@aion0/forge 0.10.70 → 0.10.72

package/RELEASE_NOTES.md

@@ -1,23 +1,8 @@
-# Forge v0.10.70
+# Forge v0.10.72
 
 Released: 2026-06-11
 
-## Changes since v0.10.69
+## Changes since v0.10.71
 
-### Other
-- revert: remove CLI quick-setup wizard + AUTH_SECRET persist (keep BRIDGE/CHAT port fixes)
-- feat(setup): ask for department in enterprise wizard
-- fix(auth): persist AUTH_SECRET so sessions survive refresh/restart
-- fix(server): per-instance CHAT_PORT (webPort+5) — fixes 2nd-instance settings/sync
-- feat(server): minimal first-run quick setup (public/enterprise)
-- revert: remove first-run wizard + AUTH_SECRET persist + onboarding tweaks
-- fix(setup): skip first-run wizard when instance already configured
-- fix(setup): normalize half-typed email against tenant domain
-- fix(auth): persist AUTH_SECRET so sessions survive refresh/restart
-- fix(onboarding): show banner only, don't auto-open the modal each load
-- fix(server): per-instance BRIDGE_PORT (webPort+4) + wizard sets onboardingCompleted
-- feat(server): first-run public/enterprise quick-setup wizard
-- fix(pipeline): run finalizePipeline on git-preflight abort
 
-
-**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.10.69...v0.10.70
+**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.10.71...v0.10.72

package/bin/forge-server.mjs

@@ -262,6 +262,25 @@ process.env.BRIDGE_PORT = String(bridgePort);
 process.env.CHAT_PORT = String(chatPort);
 process.env.FORGE_DATA_DIR = DATA_DIR;
 
+// Persist AUTH_SECRET so every next-server worker uses the same key.
+// lib/auth.ts generates a random one per process when unset, and Next prod
+// mode spawns multiple workers — without a stable secret, a cookie signed
+// by worker A is rejected by worker B, so the user randomly gets bounced
+// to /login every few requests. Forge-server.mjs is the only common parent
+// of all workers; lib/auth.ts is intentionally untouched.
+if (!process.env.AUTH_SECRET) {
+  const SECRET_FILE = join(DATA_DIR, '.auth-secret');
+  let secret = '';
+  try { if (existsSync(SECRET_FILE)) secret = readFileSync(SECRET_FILE, 'utf-8').trim(); } catch {}
+  if (!secret) {
+    const { randomBytes } = await import('node:crypto');
+    secret = randomBytes(32).toString('hex');
+    if (!existsSync(DATA_DIR)) mkdirSync(DATA_DIR, { recursive: true });
+    writeFileSync(SECRET_FILE, secret, { mode: 0o600 });
+  }
+  process.env.AUTH_SECRET = secret;
+}
+
 // ── Password setup (first run or --reset-password) ──
 // Skipped in --add-enterprise-key persist-and-exit mode: registering a
 // key from install.sh must not block on an interactive prompt.

package/lib/projects.ts

@@ -386,15 +386,25 @@ export function resolveOrCloneProject(name: string | undefined): ResolveResult {
   //   2. `name` is empty / unknown — pull the gitlab connector's
   //      `default_project_path` (e.g. "fortinet/fortinac-dev") and use
   //      it as the fallback repo.
-  // Either way we clone into <dataDir>/cloned-projects/ and reuse on
-  // subsequent runs. The previous behaviour silently dropped to scratch
-  // and code-fix pipelines exploded with "fatal: not a git repository".
+  // Before cloning, scan local projectRoots for a checkout whose git
+  // origin already matches — saves a redundant clone and also covers the
+  // "server just booted, registry/settings cache not warm yet" window
+  // where the user's real local FortiNAC was missed by the name-based
+  // lookups above.
   const gl = readGitlabConnector();
   if (gl) {
     const targetPath = trimmed && trimmed.includes('/')
       ? trimmed
       : (gl.default_project_path || '').trim();
     if (targetPath) {
+      const projects = scanProjects();
+      const want = normalizeRepoPath(targetPath) || targetPath.toLowerCase().replace(/^\/+|\/+$/g, '');
+      const wantBase = want.split('/').pop()!;
+      const byRepo = projects.filter((p) => p.repo && p.repo === want);
+      if (byRepo.length === 1) return { project: byRepo[0], source: 'existing' };
+      const byRepoBase = projects.filter((p) => p.repo && p.repo.split('/').pop() === wantBase);
+      if (byRepoBase.length === 1) return { project: byRepoBase[0], source: 'existing' };
+
       const cloned = tryGitlabClone(targetPath);
       if (cloned) return { project: cloned, source: 'gitlab-cloned', clone_url: `${gl.base_url}/${targetPath.replace(/^\/+|\/+$/g, '')}.git` };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aion0/forge",
-  "version": "0.10.70",
+  "version": "0.10.72",
   "description": "Unified AI workflow platform — multi-model task orchestration, persistent sessions, web terminal, remote access",
   "type": "module",
   "scripts": {