@aion0/forge 0.10.50 → 0.10.53

package/RELEASE_NOTES.md

@@ -1,8 +1,8 @@
-# Forge v0.10.50
+# Forge v0.10.53
 
 Released: 2026-06-09
 
-## Changes since v0.10.49
+## Changes since v0.10.52
 
 
-**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.10.49...v0.10.50
+**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.10.52...v0.10.53

package/app/api/cache/route.ts

@@ -0,0 +1,83 @@
+/**
+ * GET  /api/cache    → list cached cloned-project dirs + total size.
+ * DELETE /api/cache  → wipe the whole cloned-projects cache.
+ * DELETE /api/cache?name=<entry>  → wipe a single entry.
+ *
+ * Backs the "Cache" item in the user dropdown. Same data the CLI's
+ * `forge clean cache` shows, surfaced in the UI for users who don't
+ * touch the terminal.
+ */
+
+import { NextResponse } from 'next/server';
+import { existsSync, readdirSync, rmSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { getDataDir } from '@/lib/dirs';
+
+function dirSizeBytes(p: string): number {
+  let total = 0;
+  try {
+    for (const ent of readdirSync(p, { withFileTypes: true })) {
+      const child = join(p, ent.name);
+      try {
+        if (ent.isDirectory()) total += dirSizeBytes(child);
+        else total += statSync(child).size;
+      } catch { /* skip unreadable */ }
+    }
+  } catch { /* skip unreadable */ }
+  return total;
+}
+
+function listCache(): { entries: { name: string; bytes: number }[]; total_bytes: number; root: string } {
+  const root = join(getDataDir(), 'cloned-projects');
+  if (!existsSync(root)) return { entries: [], total_bytes: 0, root };
+  const entries: { name: string; bytes: number }[] = [];
+  for (const ent of readdirSync(root, { withFileTypes: true })) {
+    if (!ent.isDirectory()) continue;
+    entries.push({ name: ent.name, bytes: dirSizeBytes(join(root, ent.name)) });
+  }
+  entries.sort((a, b) => b.bytes - a.bytes);
+  return { entries, total_bytes: entries.reduce((s, e) => s + e.bytes, 0), root };
+}
+
+export async function GET() {
+  return NextResponse.json(listCache());
+}
+
+export async function DELETE(req: Request) {
+  const url = new URL(req.url);
+  const name = url.searchParams.get('name');
+  const root = join(getDataDir(), 'cloned-projects');
+  if (!existsSync(root)) {
+    return NextResponse.json({ ok: true, deleted: 0, freed_bytes: 0 });
+  }
+  // Reject anything that escapes the cache root or contains separators —
+  // we accept ONLY a direct subdirectory name (e.g. "fortinet-fortinac-dev").
+  if (name && (name.includes('/') || name.includes('\\') || name.includes('..'))) {
+    return NextResponse.json({ ok: false, error: 'invalid name' }, { status: 400 });
+  }
+
+  const before = listCache();
+  if (name) {
+    const target = join(root, name);
+    if (!existsSync(target)) {
+      return NextResponse.json({ ok: false, error: 'not found' }, { status: 404 });
+    }
+    const hit = before.entries.find((e) => e.name === name);
+    try {
+      rmSync(target, { recursive: true, force: true });
+    } catch (e) {
+      return NextResponse.json({ ok: false, error: (e as Error).message }, { status: 500 });
+    }
+    return NextResponse.json({ ok: true, deleted: 1, freed_bytes: hit?.bytes || 0 });
+  }
+
+  // Wipe all
+  let deleted = 0;
+  for (const e of before.entries) {
+    try {
+      rmSync(join(root, e.name), { recursive: true, force: true });
+      deleted++;
+    } catch { /* skip individual failures, report partial */ }
+  }
+  return NextResponse.json({ ok: true, deleted, freed_bytes: before.total_bytes });
+}

package/app/scratch/[...path]/page.tsx

@@ -0,0 +1,24 @@
+/**
+ * /scratch/<path...> — in-browser viewer for files under <dataDir>/scratch/.
+ *
+ * Why this page exists: the raw `/api/scratch/<path>` route returns the
+ * file with its proper MIME, which works for images / pdf but is poor UX
+ * for markdown — browsers either show raw text or trigger a download
+ * (depending on the browser's text/markdown handling).
+ *
+ * This wrapper renders .md through MarkdownContent (same renderer as
+ * chat), and falls back to a plain <pre> for other text formats. It also
+ * exposes a one-click download link for any file type.
+ */
+
+import ScratchViewer from '@/components/ScratchViewer';
+
+export default async function ScratchPage({
+  params,
+}: {
+  params: Promise<{ path: string[] }>;
+}) {
+  const { path } = await params;
+  const joined = (path || []).map(encodeURIComponent).join('/');
+  return <ScratchViewer path={joined} />;
+}

package/cli/clean.ts

@@ -0,0 +1,140 @@
+/**
+ * `forge clean` — wipe Forge's on-disk caches.
+ *
+ * Today: just `forge clean cache` which removes auto-cloned gitlab
+ * repos under `<dataDir>/cloned-projects/`. Pipelines that need them
+ * re-clone on the next dispatch (one-shot slowdown, no broken state).
+ *
+ * Add more cache targets here as they appear — keep one obvious entry
+ * point so users don't have to learn N subcommands.
+ */
+
+import { existsSync, readdirSync, rmSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+
+function dataDir(): string {
+  return process.env.FORGE_DATA_DIR || join(homedir(), '.forge', 'data');
+}
+
+function dirSizeBytes(p: string): number {
+  let total = 0;
+  try {
+    for (const ent of readdirSync(p, { withFileTypes: true })) {
+      const child = join(p, ent.name);
+      try {
+        if (ent.isDirectory()) total += dirSizeBytes(child);
+        else total += statSync(child).size;
+      } catch { /* skip unreadable */ }
+    }
+  } catch { /* skip unreadable */ }
+  return total;
+}
+
+function humanBytes(n: number): string {
+  if (n < 1024) return `${n} B`;
+  if (n < 1024 ** 2) return `${(n / 1024).toFixed(1)} KB`;
+  if (n < 1024 ** 3) return `${(n / 1024 ** 2).toFixed(1)} MB`;
+  return `${(n / 1024 ** 3).toFixed(1)} GB`;
+}
+
+function printHelp(): void {
+  console.log(`
+forge clean — wipe Forge caches.
+
+Subcommands:
+  forge clean cache               List cached items + sizes (dry-run).
+  forge clean cache --yes         Actually delete everything.
+  forge clean cache <name> --yes  Delete one entry (e.g. fortinet-fortinac-dev).
+
+Targets cleaned:
+  • <dataDir>/cloned-projects/    Auto-cloned gitlab repos (gitlab fallback).
+`);
+}
+
+async function cmdCache(args: string[]): Promise<void> {
+  const root = join(dataDir(), 'cloned-projects');
+  const yes = args.includes('--yes') || args.includes('-y');
+  const target = args.find((a) => !a.startsWith('-'));
+
+  if (!existsSync(root)) {
+    console.log(`Nothing to clean. ${root} does not exist.`);
+    return;
+  }
+
+  const entries: { name: string; path: string; size: number }[] = [];
+  for (const ent of readdirSync(root, { withFileTypes: true })) {
+    if (!ent.isDirectory()) continue;
+    const p = join(root, ent.name);
+    entries.push({ name: ent.name, path: p, size: dirSizeBytes(p) });
+  }
+  entries.sort((a, b) => b.size - a.size);
+
+  if (entries.length === 0) {
+    console.log(`Nothing to clean. ${root} is empty.`);
+    return;
+  }
+
+  const totalBytes = entries.reduce((s, e) => s + e.size, 0);
+
+  // Single-target mode
+  if (target) {
+    const hit = entries.find((e) => e.name === target);
+    if (!hit) {
+      console.error(`Not found: ${target}`);
+      console.error(`Available: ${entries.map(e => e.name).join(', ')}`);
+      process.exit(1);
+    }
+    console.log(`${hit.name}  ${humanBytes(hit.size)}  ${hit.path}`);
+    if (!yes) {
+      console.log('\nDry-run. Add --yes to actually delete.');
+      return;
+    }
+    try {
+      rmSync(hit.path, { recursive: true, force: true });
+      console.log(`✓ Deleted ${hit.name}`);
+    } catch (e) {
+      console.error(`Failed: ${(e as Error).message}`);
+      process.exit(1);
+    }
+    return;
+  }
+
+  // List / wipe-all mode
+  console.log(`Cached repos under ${root}:\n`);
+  for (const e of entries) {
+    console.log(`  ${e.name.padEnd(40)} ${humanBytes(e.size).padStart(10)}`);
+  }
+  console.log(`\nTotal: ${entries.length} entries, ${humanBytes(totalBytes)}`);
+
+  if (!yes) {
+    console.log('\nDry-run. Add --yes to delete everything.');
+    return;
+  }
+
+  let deleted = 0;
+  for (const e of entries) {
+    try {
+      rmSync(e.path, { recursive: true, force: true });
+      deleted++;
+    } catch (err) {
+      console.error(`Failed ${e.name}: ${(err as Error).message}`);
+    }
+  }
+  console.log(`\n✓ Deleted ${deleted} entries (${humanBytes(totalBytes)} freed).`);
+}
+
+export async function cleanCommand(args: string[]): Promise<void> {
+  const sub = args[0] || '';
+  switch (sub) {
+    case 'cache':
+      await cmdCache(args.slice(1));
+      break;
+    case '--help':
+    case '-h':
+    case '':
+    default:
+      printHelp();
+      break;
+  }
+}

package/cli/mw.mjs

@@ -758,15 +758,15 @@ function migrateDataDir() {
   migrated = true;
   if (process.env.FORGE_DATA_DIR) return;
   const configDir = getConfigDir();
-  const dataDir2 = join3(configDir, "data");
+  const dataDir3 = join3(configDir, "data");
   const oldSettings = join3(configDir, "settings.yaml");
-  const newSettings = join3(dataDir2, "settings.yaml");
+  const newSettings = join3(dataDir3, "settings.yaml");
   if (!existsSync3(oldSettings) || existsSync3(newSettings)) return;
   console.log("[forge] Migrating data from ~/.forge/ to ~/.forge/data/...");
-  if (!existsSync3(dataDir2)) mkdirSync2(dataDir2, { recursive: true });
+  if (!existsSync3(dataDir3)) mkdirSync2(dataDir3, { recursive: true });
   for (const file2 of MIGRATE_FILES) {
     const src = join3(configDir, file2);
-    const dest = join3(dataDir2, file2);
+    const dest = join3(dataDir3, file2);
     if (existsSync3(src) && !existsSync3(dest)) {
       try {
         copyFileSync(src, dest);
@@ -776,7 +776,7 @@ function migrateDataDir() {
     }
   }
   const oldDb = join3(configDir, "data.db");
-  const newDb = join3(dataDir2, "workflow.db");
+  const newDb = join3(dataDir3, "workflow.db");
   if (existsSync3(oldDb) && !existsSync3(newDb)) {
     try {
       copyFileSync(oldDb, newDb);
@@ -786,7 +786,7 @@ function migrateDataDir() {
   }
   for (const dir of MIGRATE_DIRS) {
     const src = join3(configDir, dir);
-    const dest = join3(dataDir2, dir);
+    const dest = join3(dataDir3, dir);
     if (existsSync3(src) && !existsSync3(dest)) {
       try {
         renameSync(src, dest);
@@ -1221,6 +1221,135 @@ var init_key = __esm({
   }
 });
 
+// cli/clean.ts
+var clean_exports = {};
+__export(clean_exports, {
+  cleanCommand: () => cleanCommand
+});
+import { existsSync as existsSync7, readdirSync as readdirSync2, rmSync as rmSync3, statSync as statSync3 } from "node:fs";
+import { join as join8 } from "node:path";
+import { homedir as homedir6 } from "node:os";
+function dataDir2() {
+  return process.env.FORGE_DATA_DIR || join8(homedir6(), ".forge", "data");
+}
+function dirSizeBytes2(p) {
+  let total = 0;
+  try {
+    for (const ent of readdirSync2(p, { withFileTypes: true })) {
+      const child = join8(p, ent.name);
+      try {
+        if (ent.isDirectory()) total += dirSizeBytes2(child);
+        else total += statSync3(child).size;
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return total;
+}
+function humanBytes(n) {
+  if (n < 1024) return `${n} B`;
+  if (n < 1024 ** 2) return `${(n / 1024).toFixed(1)} KB`;
+  if (n < 1024 ** 3) return `${(n / 1024 ** 2).toFixed(1)} MB`;
+  return `${(n / 1024 ** 3).toFixed(1)} GB`;
+}
+function printHelp4() {
+  console.log(`
+forge clean \u2014 wipe Forge caches.
+
+Subcommands:
+  forge clean cache               List cached items + sizes (dry-run).
+  forge clean cache --yes         Actually delete everything.
+  forge clean cache <name> --yes  Delete one entry (e.g. fortinet-fortinac-dev).
+
+Targets cleaned:
+  \u2022 <dataDir>/cloned-projects/    Auto-cloned gitlab repos (gitlab fallback).
+`);
+}
+async function cmdCache(args2) {
+  const root = join8(dataDir2(), "cloned-projects");
+  const yes = args2.includes("--yes") || args2.includes("-y");
+  const target = args2.find((a) => !a.startsWith("-"));
+  if (!existsSync7(root)) {
+    console.log(`Nothing to clean. ${root} does not exist.`);
+    return;
+  }
+  const entries = [];
+  for (const ent of readdirSync2(root, { withFileTypes: true })) {
+    if (!ent.isDirectory()) continue;
+    const p = join8(root, ent.name);
+    entries.push({ name: ent.name, path: p, size: dirSizeBytes2(p) });
+  }
+  entries.sort((a, b) => b.size - a.size);
+  if (entries.length === 0) {
+    console.log(`Nothing to clean. ${root} is empty.`);
+    return;
+  }
+  const totalBytes = entries.reduce((s, e) => s + e.size, 0);
+  if (target) {
+    const hit = entries.find((e) => e.name === target);
+    if (!hit) {
+      console.error(`Not found: ${target}`);
+      console.error(`Available: ${entries.map((e) => e.name).join(", ")}`);
+      process.exit(1);
+    }
+    console.log(`${hit.name}  ${humanBytes(hit.size)}  ${hit.path}`);
+    if (!yes) {
+      console.log("\nDry-run. Add --yes to actually delete.");
+      return;
+    }
+    try {
+      rmSync3(hit.path, { recursive: true, force: true });
+      console.log(`\u2713 Deleted ${hit.name}`);
+    } catch (e) {
+      console.error(`Failed: ${e.message}`);
+      process.exit(1);
+    }
+    return;
+  }
+  console.log(`Cached repos under ${root}:
+`);
+  for (const e of entries) {
+    console.log(`  ${e.name.padEnd(40)} ${humanBytes(e.size).padStart(10)}`);
+  }
+  console.log(`
+Total: ${entries.length} entries, ${humanBytes(totalBytes)}`);
+  if (!yes) {
+    console.log("\nDry-run. Add --yes to delete everything.");
+    return;
+  }
+  let deleted = 0;
+  for (const e of entries) {
+    try {
+      rmSync3(e.path, { recursive: true, force: true });
+      deleted++;
+    } catch (err) {
+      console.error(`Failed ${e.name}: ${err.message}`);
+    }
+  }
+  console.log(`
+\u2713 Deleted ${deleted} entries (${humanBytes(totalBytes)} freed).`);
+}
+async function cleanCommand(args2) {
+  const sub = args2[0] || "";
+  switch (sub) {
+    case "cache":
+      await cmdCache(args2.slice(1));
+      break;
+    case "--help":
+    case "-h":
+    case "":
+    default:
+      printHelp4();
+      break;
+  }
+}
+var init_clean = __esm({
+  "cli/clean.ts"() {
+    "use strict";
+  }
+});
+
 // cli/mw.ts
 var _cliPort = process.argv.find((a, i) => i > 0 && process.argv[i - 1] === "--port");
 var BASE2 = process.env.MW_URL || `http://localhost:${_cliPort || "3000"}`;
@@ -1228,9 +1357,9 @@ var [, , cmd, ...args] = process.argv;
 async function checkForUpdate() {
   try {
     const { readFileSync: readFileSync5 } = await import("node:fs");
-    const { join: join8, dirname } = await import("node:path");
+    const { join: join9, dirname } = await import("node:path");
     const { fileURLToPath } = await import("node:url");
-    const pkg = JSON.parse(readFileSync5(join8(dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync5(join9(dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf-8"));
     const current = pkg.version;
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 3e3);
@@ -1265,10 +1394,10 @@ async function api3(path, opts) {
 async function main() {
   if (cmd === "--version" || cmd === "-v") {
     const { readFileSync: readFileSync5 } = await import("node:fs");
-    const { join: join8, dirname } = await import("node:path");
+    const { join: join9, dirname } = await import("node:path");
     const { fileURLToPath } = await import("node:url");
     try {
-      const pkg = JSON.parse(readFileSync5(join8(dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf-8"));
+      const pkg = JSON.parse(readFileSync5(join9(dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf-8"));
       console.log(`@aion0/forge v${pkg.version}`);
     } catch {
       console.log("forge (version unknown)");
@@ -1277,18 +1406,18 @@ async function main() {
   }
   if (cmd === "--reset-password") {
     const { spawnSync: spawnSync3 } = await import("node:child_process");
-    const { join: join8, dirname } = await import("node:path");
+    const { join: join9, dirname } = await import("node:path");
     const { fileURLToPath } = await import("node:url");
-    const serverScript = join8(dirname(fileURLToPath(import.meta.url)), "..", "bin", "forge-server.mjs");
+    const serverScript = join9(dirname(fileURLToPath(import.meta.url)), "..", "bin", "forge-server.mjs");
     const passthru = process.argv.slice(3);
     spawnSync3("node", [serverScript, "--reset-password", ...passthru], { stdio: "inherit" });
     process.exit(0);
   }
   if (cmd === "--add-enterprise-key") {
     const { spawnSync: spawnSync3 } = await import("node:child_process");
-    const { join: join8, dirname } = await import("node:path");
+    const { join: join9, dirname } = await import("node:path");
     const { fileURLToPath } = await import("node:url");
-    const serverScript = join8(dirname(fileURLToPath(import.meta.url)), "..", "bin", "forge-server.mjs");
+    const serverScript = join9(dirname(fileURLToPath(import.meta.url)), "..", "bin", "forge-server.mjs");
     const r = spawnSync3("node", [serverScript, "--add-enterprise-key", ...args], { stdio: "inherit" });
     process.exit(r.status ?? 1);
   }
@@ -1326,6 +1455,11 @@ async function main() {
       await keyCommand2(args);
       break;
     }
+    case "clean": {
+      const { cleanCommand: cleanCommand2 } = await Promise.resolve().then(() => (init_clean(), clean_exports));
+      await cleanCommand2(args);
+      break;
+    }
     case "task":
     case "t": {
       const newSession = args.includes("--new");
@@ -1606,13 +1740,13 @@ Resume in CLI:`);
     }
     case "tunnel_code":
     case "tcode": {
-      const { readFileSync: readFileSync5, existsSync: existsSync7 } = await import("node:fs");
-      const { join: join8 } = await import("node:path");
+      const { readFileSync: readFileSync5, existsSync: existsSync8 } = await import("node:fs");
+      const { join: join9 } = await import("node:path");
       const { getDataDir: _gdd } = await Promise.resolve().then(() => (init_dirs(), dirs_exports));
-      const dataDir2 = _gdd();
-      const codeFile = join8(dataDir2, "session-code.json");
+      const dataDir3 = _gdd();
+      const codeFile = join9(dataDir3, "session-code.json");
       try {
-        if (existsSync7(codeFile)) {
+        if (existsSync8(codeFile)) {
           const data = JSON.parse(readFileSync5(codeFile, "utf-8"));
           if (data.code) {
             console.log(`Session code: ${data.code}`);
@@ -1625,7 +1759,7 @@ Resume in CLI:`);
       } catch {
       }
       try {
-        const tunnelState = JSON.parse(readFileSync5(join8(dataDir2, "tunnel-state.json"), "utf-8"));
+        const tunnelState = JSON.parse(readFileSync5(join9(dataDir3, "tunnel-state.json"), "utf-8"));
         if (tunnelState.url) console.log(`Tunnel URL: ${tunnelState.url}`);
       } catch {
       }
@@ -1672,9 +1806,9 @@ ${projects.length} projects`);
     }
     case "server": {
       const { execSync: execSync2 } = await import("node:child_process");
-      const { join: join8, dirname } = await import("node:path");
+      const { join: join9, dirname } = await import("node:path");
       const { fileURLToPath } = await import("node:url");
-      const serverScript = join8(dirname(fileURLToPath(import.meta.url)), "..", "bin", "forge-server.mjs");
+      const serverScript = join9(dirname(fileURLToPath(import.meta.url)), "..", "bin", "forge-server.mjs");
       const sub = args[0] || "start";
       const serverArgs = args.slice(1);
       const flagMap = {
@@ -1747,31 +1881,31 @@ ${task.gitDiff.slice(0, 2e3)}`);
     case "upgrade": {
       const { execSync: execSync2 } = await import("node:child_process");
       const { lstatSync } = await import("node:fs");
-      const { join: join8, dirname } = await import("node:path");
+      const { join: join9, dirname } = await import("node:path");
       const { fileURLToPath } = await import("node:url");
       const cliDir = dirname(fileURLToPath(import.meta.url));
       let isLinked = false;
       try {
-        isLinked = lstatSync(join8(cliDir, "..")).isSymbolicLink();
+        isLinked = lstatSync(join9(cliDir, "..")).isSymbolicLink();
       } catch {
       }
       if (isLinked) {
         console.log("[forge] Installed via npm link (local source)");
         console.log("[forge] Pull latest and rebuild:");
-        console.log("  cd " + join8(cliDir, ".."));
+        console.log("  cd " + join9(cliDir, ".."));
         console.log("  git pull && pnpm install && pnpm build");
       } else {
         console.log("[forge] Upgrading from npm...");
         try {
-          const { homedir: homedir6 } = await import("node:os");
+          const { homedir: homedir7 } = await import("node:os");
           execSync2("npm install -g @aion0/forge@latest --prefer-online", {
             stdio: "inherit",
-            cwd: homedir6()
+            cwd: homedir7()
           });
           try {
             const { readFileSync: readFileSync5 } = await import("node:fs");
-            const globalRoot = execSync2("npm root -g", { encoding: "utf-8", cwd: homedir6() }).trim();
-            const pkg = JSON.parse(readFileSync5(join8(globalRoot, "@aion0", "forge", "package.json"), "utf-8"));
+            const globalRoot = execSync2("npm root -g", { encoding: "utf-8", cwd: homedir7() }).trim();
+            const pkg = JSON.parse(readFileSync5(join9(globalRoot, "@aion0", "forge", "package.json"), "utf-8"));
             console.log(`[forge] Upgraded to v${pkg.version}. Run: forge server restart`);
           } catch {
             console.log("[forge] Upgraded. Run: forge server restart");

package/cli/mw.ts

@@ -140,6 +140,13 @@ async function main() {
       break;
     }
 
+    case 'clean': {
+      // Wipe Forge on-disk caches (cloned gitlab repos, etc).
+      const { cleanCommand } = await import('./clean');
+      await cleanCommand(args);
+      break;
+    }
+
     case 'task':
     case 't': {
       // Parse --new flag to force a fresh session

package/components/Dashboard.tsx

@@ -176,10 +176,52 @@ export default function Dashboard({ user }: { user: any }) {
   const [expandedNotif, setExpandedNotif] = useState<string | null>(null);
   const [showUserMenu, setShowUserMenu] = useState(false);
   const [theme, setTheme] = useState<'dark' | 'light'>('dark');
+  const [cacheInfo, setCacheInfo] = useState<{ entries: { name: string; bytes: number }[]; total_bytes: number } | null>(null);
+  const [showCacheMenu, setShowCacheMenu] = useState(false);
+  const [cacheBusy, setCacheBusy] = useState(false);
   const [displayName, setDisplayName] = useState(user?.name || 'Forge');
   const [profileDept, setProfileDept] = useState('');
   const terminalRef = useRef<WebTerminalHandle>(null);
 
+  // Cache (forge-managed cloned-projects) load + clear helpers. Used by the
+  // user-menu "Cache" entry to show on-disk size and let the user wipe it
+  // without dropping to the terminal. Lazy — only fetched on menu open.
+  const loadCacheInfo = async () => {
+    try {
+      const r = await fetch('/api/cache');
+      if (!r.ok) return;
+      const data = await r.json();
+      setCacheInfo({ entries: data.entries || [], total_bytes: data.total_bytes || 0 });
+    } catch { /* leave previous */ }
+  };
+  const humanBytes = (n: number) => {
+    if (!n) return '0 B';
+    if (n < 1024) return `${n} B`;
+    if (n < 1024 ** 2) return `${(n / 1024).toFixed(1)} KB`;
+    if (n < 1024 ** 3) return `${(n / 1024 ** 2).toFixed(1)} MB`;
+    return `${(n / 1024 ** 3).toFixed(2)} GB`;
+  };
+  const clearCache = async (name?: string) => {
+    if (cacheBusy) return;
+    const ok = confirm(name ? `Delete cached repo "${name}"?` : 'Delete ALL cached repos? They will be re-cloned on next pipeline run.');
+    if (!ok) return;
+    setCacheBusy(true);
+    try {
+      const q = name ? `?name=${encodeURIComponent(name)}` : '';
+      const r = await fetch(`/api/cache${q}`, { method: 'DELETE' });
+      const data = await r.json();
+      if (data?.ok) {
+        await loadCacheInfo();
+      } else {
+        alert(`Cache clear failed: ${data?.error || `HTTP ${r.status}`}`);
+      }
+    } catch (e) {
+      alert(`Cache clear failed: ${(e as Error).message}`);
+    } finally {
+      setCacheBusy(false);
+    }
+  };
+
   // Theme: load from localStorage + apply
   useEffect(() => {
     const saved = localStorage.getItem('forge-theme') as 'dark' | 'light' | null;
@@ -621,7 +663,14 @@ export default function Dashboard({ user }: { user: any }) {
           {/* User menu */}
           <div className="relative">
             <button
-              onClick={() => { setShowUserMenu(v => !v); setShowNotifications(false); }}
+              onClick={() => {
+                const next = !showUserMenu;
+                setShowUserMenu(next);
+                setShowNotifications(false);
+                // Lazy-load cache size whenever the menu opens — keeps
+                // the cache row's "· N MB" current without polling.
+                if (next) loadCacheInfo();
+              }}
               className="text-[var(--text-secondary)] hover:text-[var(--text-primary)] flex items-center gap-1 px-1"
             >
               <span className="flex flex-col items-end leading-tight">
@@ -734,6 +783,52 @@ export default function Dashboard({ user }: { user: any }) {
                       )}
                     </div>
                   )}
+                  {/* Cache — show on-disk size of auto-cloned gitlab repos
+                      under <dataDir>/cloned-projects/, with a click-to-clear
+                      sub-menu listing each entry. Same backend as
+                      `forge clean cache` CLI. */}
+                  <button
+                    onClick={() => setShowCacheMenu(v => !v)}
+                    className="w-full text-left text-[11px] px-3 py-1.5 text-[var(--text-secondary)] hover:text-[var(--text-primary)] hover:bg-[var(--bg-tertiary)] flex items-center gap-2"
+                  >
+                    <span className="w-3 text-center">💾</span>
+                    <span className="flex-1">Cache</span>
+                    <span className="text-[9px] text-[var(--text-secondary)]">
+                      {cacheInfo ? humanBytes(cacheInfo.total_bytes) : '…'}
+                    </span>
+                    <span className="text-[9px] text-[var(--text-secondary)]">{showCacheMenu ? '▾' : '▸'}</span>
+                  </button>
+                  {showCacheMenu && (
+                    <div className="pl-6 pr-1 py-0.5 border-l border-[var(--border)] ml-3 mb-1 max-h-48 overflow-y-auto">
+                      {!cacheInfo && (
+                        <div className="text-[10px] text-[var(--text-secondary)] py-1 px-2">Loading…</div>
+                      )}
+                      {cacheInfo && cacheInfo.entries.length === 0 && (
+                        <div className="text-[10px] text-[var(--text-secondary)] py-1 px-2">Empty.</div>
+                      )}
+                      {cacheInfo?.entries.map((e) => (
+                        <button
+                          key={e.name}
+                          disabled={cacheBusy}
+                          onClick={() => clearCache(e.name)}
+                          className="w-full text-left px-2 py-1 text-[10px] text-[var(--text-primary)] hover:bg-[var(--bg-tertiary)] flex items-center gap-2 disabled:opacity-50"
+                          title={`Click to delete ${e.name}`}
+                        >
+                          <span className="flex-1 truncate">{e.name}</span>
+                          <span className="text-[9px] text-[var(--text-secondary)] flex-shrink-0">{humanBytes(e.bytes)}</span>
+                        </button>
+                      ))}
+                      {cacheInfo && cacheInfo.entries.length > 0 && (
+                        <button
+                          disabled={cacheBusy}
+                          onClick={() => clearCache()}
+                          className="w-full text-left px-2 py-1 mt-1 text-[10px] text-red-400 hover:bg-[var(--bg-tertiary)] disabled:opacity-50 border-t border-[var(--border)]"
+                        >
+                          Clear All ({humanBytes(cacheInfo.total_bytes)})
+                        </button>
+                      )}
+                    </div>
+                  )}
                   <div className="border-t border-[var(--border)] my-1" />
                   <button
                     onClick={() => { setShowHelp(v => !v); setShowUserMenu(false); }}

package/components/ScratchViewer.tsx

@@ -0,0 +1,141 @@
+'use client';
+
+import { useEffect, useState } from 'react';
+import MarkdownContent from './MarkdownContent';
+
+const TEXT_LIKE = new Set(['md', 'txt', 'log', 'json', 'yaml', 'yml', 'csv', 'html']);
+const IMAGE_LIKE = new Set(['png', 'jpg', 'jpeg', 'gif', 'svg']);
+const EMBED_LIKE = new Set(['pdf']);
+
+/** Cap inline text rendering. Anything larger falls back to a download
+ *  prompt — react-markdown on multi-MB strings locks the tab. */
+const MAX_INLINE_BYTES = 2 * 1024 * 1024;
+
+function extOf(p: string): string {
+  const m = p.match(/\.([^./]+)$/);
+  return m ? m[1].toLowerCase() : '';
+}
+
+export default function ScratchViewer({ path }: { path: string }) {
+  const decoded = (() => {
+    try {
+      return decodeURIComponent(path);
+    } catch {
+      return path;
+    }
+  })();
+  const ext = extOf(decoded);
+  const rawUrl = `/api/scratch/${path}`;
+  const downloadUrl = `${rawUrl}?download=1`;
+
+  const [text, setText] = useState<string | null>(null);
+  const [err, setErr] = useState<string>('');
+  const [tooLarge, setTooLarge] = useState(false);
+
+  useEffect(() => {
+    if (!TEXT_LIKE.has(ext)) return;
+    let cancelled = false;
+    (async () => {
+      try {
+        const r = await fetch(rawUrl);
+        if (!r.ok) {
+          if (!cancelled) setErr(`${r.status} ${r.statusText}`);
+          return;
+        }
+        const len = Number(r.headers.get('content-length') || '0');
+        if (len > MAX_INLINE_BYTES) {
+          if (!cancelled) setTooLarge(true);
+          return;
+        }
+        const body = await r.text();
+        if (cancelled) return;
+        if (body.length > MAX_INLINE_BYTES) {
+          setTooLarge(true);
+          return;
+        }
+        setText(body);
+      } catch (e) {
+        if (!cancelled) setErr((e as Error).message);
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [rawUrl, ext]);
+
+  return (
+    <div className="min-h-screen bg-[var(--bg-primary)] text-[var(--text-primary)]">
+      <header className="sticky top-0 z-10 flex items-center justify-between gap-2 px-4 py-2 border-b border-[var(--border)] bg-[var(--bg-secondary)]">
+        <div className="flex items-center gap-2 min-w-0">
+          <span className="text-[10px] uppercase tracking-wide text-[var(--text-secondary)]">scratch</span>
+          <span className="text-xs font-mono truncate" title={decoded}>
+            {decoded}
+          </span>
+        </div>
+        <div className="flex items-center gap-2 flex-shrink-0">
+          <a
+            href={rawUrl}
+            className="text-xs px-2 py-1 rounded border border-[var(--border)] hover:bg-[var(--bg-tertiary)]"
+            target="_blank"
+            rel="noopener"
+          >
+            Open raw
+          </a>
+          <a
+            href={downloadUrl}
+            className="text-xs px-2 py-1 rounded bg-[var(--accent)] text-white hover:opacity-90"
+          >
+            Download
+          </a>
+        </div>
+      </header>
+
+      <main className="px-4 py-3 max-w-4xl mx-auto">
+        {err && (
+          <div className="text-xs text-red-400 border border-red-400/40 rounded p-2 bg-red-400/5">
+            Failed to load: {err}
+          </div>
+        )}
+
+        {tooLarge && (
+          <div className="text-xs text-[var(--text-secondary)] border border-[var(--border)] rounded p-3">
+            File is larger than {Math.round(MAX_INLINE_BYTES / 1024 / 1024)} MB — inline preview skipped. Use Download or Open raw.
+          </div>
+        )}
+
+        {!err && !tooLarge && IMAGE_LIKE.has(ext) && (
+          <img src={rawUrl} alt={decoded} className="max-w-full rounded border border-[var(--border)]" />
+        )}
+
+        {!err && !tooLarge && EMBED_LIKE.has(ext) && (
+          <embed src={rawUrl} type="application/pdf" className="w-full h-[calc(100vh-60px)]" />
+        )}
+
+        {!err && !tooLarge && TEXT_LIKE.has(ext) && text != null && (
+          ext === 'md' ? (
+            <MarkdownContent content={text} />
+          ) : ext === 'html' ? (
+            // Wrap in iframe srcdoc so any embedded scripts can't reach Forge's
+            // origin or steal session cookies. sandbox blocks everything.
+            <iframe
+              srcDoc={text}
+              sandbox=""
+              className="w-full h-[calc(100vh-60px)] bg-white rounded border border-[var(--border)]"
+              title={decoded}
+            />
+          ) : (
+            <pre className="text-[12px] font-mono text-[var(--text-primary)] bg-[var(--bg-tertiary)] border border-[var(--border)] rounded p-3 overflow-auto whitespace-pre-wrap break-words" style={{ fontFamily: 'Menlo, Monaco, "Courier New", monospace' }}>
+              {text}
+            </pre>
+          )
+        )}
+
+        {!err && !tooLarge && !TEXT_LIKE.has(ext) && !IMAGE_LIKE.has(ext) && !EMBED_LIKE.has(ext) && (
+          <div className="text-xs text-[var(--text-secondary)] border border-[var(--border)] rounded p-3">
+            No inline preview for <code className="font-mono">.{ext || '?'}</code> files. Use Download.
+          </div>
+        )}
+      </main>
+    </div>
+  );
+}

package/lib/chat/link-patterns.ts

@@ -83,13 +83,13 @@ export const LINK_PATTERNS: LinkPattern[] = [
   },
   // Forge scratch-dir files. LLMs frequently emit paths like
   // `scratch/foo.md` when they write reports during chat-launched tasks.
-  // Turn them into clickable links served by /api/scratch/<path>.
-  // Match path segments + filename with extension; bound to a known set
-  // of extensions to avoid linkifying noise like `scratch/notes`.
+  // Link to the in-browser viewer at /scratch/<path> (page renders .md
+  // through the chat markdown component + download button); the viewer
+  // itself fetches /api/scratch/<path> for raw bytes.
   {
     id: 'scratch-file',
     regex: /\bscratch\/([\w\-./]+?\.(?:md|txt|json|yaml|yml|csv|log|html|pdf|png|jpg|jpeg|gif|svg))\b/gi,
-    url: '/api/scratch/{1}',
+    url: '/scratch/{1}',
     label: 'scratch/{1}',
   },
 ];

package/lib/pipeline.ts

@@ -1792,7 +1792,13 @@ async function scheduleReadyNodes(pipeline: Pipeline, workflow: Workflow) {
     // declared, skip the auto-worktree creation entirely — otherwise we
     // produce dead `.forge/worktrees/pipeline-<id>` directories that
     // nothing ever uses but pile up on disk per pipeline run.
-    const useWorktree = nodeDef.worktree !== false && !nodeDef.workdir;
+    //
+    // Also skip on non-git projects (scratch, or any user project where
+    // `.git` is missing). Pipelines without a project bound default to
+    // the scratch project, which has hasGit:false — without this guard
+    // the worktree branch fired `git branch` / `git worktree add` on a
+    // non-repo and surfaced "fatal: not a git repository" in the run log.
+    const useWorktree = nodeDef.worktree !== false && !nodeDef.workdir && projectInfo.hasGit;
     const branchName = nodeDef.branch ? resolveTemplate(nodeDef.branch, ctx) : `pipeline/${pipeline.id.slice(0, 8)}`;
     if (useWorktree) try {
       const wtRoot = getProjectWorktreeRoot(projectInfo);

package/lib/projects.ts

@@ -1,4 +1,5 @@
 import { readdirSync, existsSync, statSync, readFileSync, mkdirSync, writeFileSync } from 'node:fs';
+import { execSync } from 'node:child_process';
 import { join, resolve, isAbsolute, parse } from 'node:path';
 import { homedir } from 'node:os';
 import { loadSettings, saveSettings } from './settings';
@@ -178,7 +179,7 @@ export function getProjectInfo(name: string): LocalProject | null {
  */
 export interface ResolveResult {
   project: LocalProject;
-  source: 'existing' | 'cloned' | 'scratch';
+  source: 'existing' | 'cloned' | 'gitlab-cloned' | 'scratch';
   clone_url?: string;
 }
 
@@ -206,6 +207,95 @@ export function getDefaultCloneRoot(): string {
   return join(getDataDir(), 'scratch');
 }
 
+/** Read the gitlab connector config without pulling in the connectors
+ *  module statically — projects.ts is imported very early by init/dirs;
+ *  going through a dynamic require keeps the dependency graph one-way.
+ *  Returns null when the connector isn't installed/configured. */
+function readGitlabConnector(): { base_url: string; token: string; default_project_path?: string } | null {
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { getInstalledConnector } = require('./connectors/registry') as typeof import('./connectors/registry');
+    const inst = getInstalledConnector('gitlab');
+    if (!inst) return null;
+    const cfg = (inst.config || {}) as { base_url?: string; token?: string; default_project_path?: string };
+    if (!cfg.base_url || !cfg.token) return null;
+    return {
+      base_url: String(cfg.base_url).replace(/\/+$/, ''),
+      token: String(cfg.token),
+      default_project_path: cfg.default_project_path,
+    };
+  } catch { return null; }
+}
+
+/** Per-process freshness cache for cloned repos. Within this window the
+ *  same repo path skips the `git fetch` step and reuses the on-disk
+ *  state. Pipelines call resolveOrCloneProject once per node per
+ *  for_each iteration — without this, a 5-node × 10-item run does 50
+ *  fetches (~50s of network) before any real work starts. */
+const CLONE_FRESH_WINDOW_MS = 5 * 60 * 1000;
+const _cloneFreshAt = new Map<string, number>();
+
+/** Try to clone (or fast-update) a gitlab project into a Forge-managed
+ *  cache dir. Returns the cached LocalProject on success, null when the
+ *  connector isn't configured or git fails. Used by resolveOrCloneProject
+ *  when no real local project matches the requested name.
+ *
+ *  Cache layout: <dataDir>/cloned-projects/<owner>-<repo>/
+ *  Within the per-process freshness window: skip network entirely.
+ *  Past it (or on first call): `git fetch` to refresh refs. */
+function tryGitlabClone(repoPath: string): LocalProject | null {
+  const gl = readGitlabConnector();
+  if (!gl) return null;
+  const path = repoPath.replace(/^\/+|\/+$/g, '');
+  if (!path || !path.includes('/')) return null;  // not a repo path shape
+  const safe = path.replace(/[^A-Za-z0-9._-]+/g, '-');
+  const cacheRoot = join(getDataDir(), 'cloned-projects');
+  const target = join(cacheRoot, safe);
+  try { mkdirSync(cacheRoot, { recursive: true }); } catch {}
+
+  // Inject PAT into URL. gitlab accepts `oauth2:<token>` basic auth on
+  // HTTPS. URL-encode the token in case it contains '@' or '/'.
+  const cloneUrl = `${gl.base_url}/${path}.git`;
+  const authedUrl = cloneUrl.replace(/^(https?:\/\/)/, `$1oauth2:${encodeURIComponent(gl.token)}@`);
+
+  const alreadyCloned = existsSync(join(target, '.git'));
+  const lastFreshAt = _cloneFreshAt.get(target) || 0;
+  const stillFresh = alreadyCloned && (Date.now() - lastFreshAt) < CLONE_FRESH_WINDOW_MS;
+
+  try {
+    if (!alreadyCloned) {
+      execSync(`git clone --quiet "${authedUrl}" "${target}"`, { stdio: 'pipe', timeout: 120000 });
+      _cloneFreshAt.set(target, Date.now());
+    } else if (!stillFresh) {
+      // Best-effort refresh; failures (offline, network, auth drift) are
+      // non-fatal — fall back to whatever's cached. Pipelines see stale
+      // code, not "fatal: not a git repo".
+      try {
+        execSync(`git -C "${target}" remote set-url origin "${authedUrl}"`, { stdio: 'pipe', timeout: 5000 });
+        execSync(`git -C "${target}" fetch --quiet origin`, { stdio: 'pipe', timeout: 30000 });
+      } catch { /* keep cached state */ }
+      _cloneFreshAt.set(target, Date.now());
+    }
+    // else: within freshness window — skip network entirely
+  } catch (e) {
+    console.warn(`[projects] gitlab clone of ${path} failed:`, (e as Error).message);
+    return null;
+  }
+
+  let mtime: string;
+  try { mtime = statSync(target).mtime.toISOString(); }
+  catch { mtime = new Date().toISOString(); }
+  return {
+    name: path,
+    path: target,
+    root: cacheRoot,
+    hasGit: existsSync(join(target, '.git')),
+    hasClaudeMd: existsSync(join(target, 'CLAUDE.md')),
+    language: null,
+    lastModified: mtime,
+  };
+}
+
 export function resolveOrCloneProject(name: string | undefined): ResolveResult {
   const trimmed = (name || '').trim();
   if (trimmed) {
@@ -213,14 +303,33 @@ export function resolveOrCloneProject(name: string | undefined): ResolveResult {
     if (hit) return { project: hit, source: 'existing' };
   }
 
-  // Default to scratch when the name doesn't match a real project root. The
-  // earlier behavior was to auto-clone from gitlab.default_project_path — but
-  // that ran a `git clone` in-band (slow, surprising, leaves dirs scattered
-  // under ~/IdeaProjects). Pipelines now always run inside Forge-managed
-  // `<dataDir>/scratch/worktrees/pipeline-<id>/` unless the user has
-  // explicitly added the named project under Settings → Project roots.
-  // Explicit clone is still available via `POST /api/projects/clone` for
-  // users who want it.
+  // Fallback to gitlab connector when no local match. Two cases worth
+  // honouring:
+  //   1. `name` itself looks like a gitlab repo path (e.g. "team/repo")
+  //      — caller meant that path literally.
+  //   2. `name` is empty / unknown — pull the gitlab connector's
+  //      `default_project_path` (e.g. "fortinet/fortinac-dev") and use
+  //      it as the fallback repo.
+  // Either way we clone into <dataDir>/cloned-projects/ and reuse on
+  // subsequent runs. The previous behaviour silently dropped to scratch
+  // and code-fix pipelines exploded with "fatal: not a git repository".
+  const gl = readGitlabConnector();
+  if (gl) {
+    const targetPath = trimmed && trimmed.includes('/')
+      ? trimmed
+      : (gl.default_project_path || '').trim();
+    if (targetPath) {
+      const cloned = tryGitlabClone(targetPath);
+      if (cloned) return { project: cloned, source: 'gitlab-cloned', clone_url: `${gl.base_url}/${targetPath.replace(/^\/+|\/+$/g, '')}.git` };
+    }
+  }
+
+  // Last resort: scratch project. Most non-code pipelines (chat
+  // dispatch, mantis-only, notifications) are fine here. Code-fix
+  // pipelines that try to run git will surface their own errors —
+  // pipeline.ts:1795 already skips framework auto-worktree, so the
+  // noise is limited to the pipeline's own shell nodes (which need
+  // a real project to make sense).
   return { project: scratchProject(), source: 'scratch' };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aion0/forge",
-  "version": "0.10.50",
+  "version": "0.10.53",
   "description": "Unified AI workflow platform — multi-model task orchestration, persistent sessions, web terminal, remote access",
   "type": "module",
   "scripts": {