@aion0/forge 0.10.48 → 0.10.49

package/RELEASE_NOTES.md

@@ -1,12 +1,11 @@
-# Forge v0.10.48
+# Forge v0.10.49
 
-Released: 2026-06-08
+Released: 2026-06-09
 
-## Changes since v0.10.47
+## Changes since v0.10.48
 
 ### Other
-- fix(proxy): drop runtime:'nodejs' — Next.js 16 errors on it
-- Implement an MCP layer for forge management (#34)
+- fix(idp-login): pick a failing SP as the SAML trigger, not the first one
 
 
-**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.10.47...v0.10.48
+**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.10.48...v0.10.49

package/lib/auth/idp-login.ts

@@ -103,14 +103,36 @@ function readIdpBlocks(): IdpTemplateBlock[] {
   return tryRead() || [];
 }
 
-/** First installed SP from saml_sps wins as trigger. */
+/** Pick the SP whose tab we'll open to trigger the SAML flow.
+ *
+ *  Preference order:
+ *   1. A SP whose login-status cache currently shows ✗ — opening it forces
+ *      a SAML redirect to the IdP, which is exactly what we want when the
+ *      IdP cookie has expired even though some sibling SPs still have a
+ *      valid session cookie (Mantis can be ✓ while pmdb/tp are ✗ because
+ *      per-SP cookies are independent of the IdP SSO state).
+ *   2. Otherwise first installed SP with a base_url (legacy fallback).
+ *
+ *  Without (1) the IdP login flow would open Mantis (first in saml_sps),
+ *  see the cookie still good, declare "no form needed", and exit — leaving
+ *  the broken siblings unrefreshed.
+ */
 function pickTriggerUrl(saml_sps: string[]): string | null {
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const { getCachedResult } = require('./login-status') as typeof import('./login-status');
+  let fallback: string | null = null;
   for (const id of saml_sps) {
     const c = getInstalledConnector(id);
     const url = (c?.config as { base_url?: string } | undefined)?.base_url;
-    if (url) return url.replace(/\/+$/, '/');
+    if (!url) continue;
+    const normalized = url.replace(/\/+$/, '/');
+    fallback ||= normalized;
+    const cached = getCachedResult(`connector:${id}`);
+    if (cached && cached.ok === false) {
+      return normalized;
+    }
   }
-  return null;
+  return fallback;
 }
 
 async function runOneIdp(block: IdpTemplateBlock, req: IdpLoginRequest): Promise<IdpLoginEntry> {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aion0/forge",
-  "version": "0.10.48",
+  "version": "0.10.49",
   "description": "Unified AI workflow platform — multi-model task orchestration, persistent sessions, web terminal, remote access",
   "type": "module",
   "scripts": {