@aion0/forge 0.10.77 → 0.10.79

package/lib/projects.ts

@@ -400,11 +400,21 @@ export function resolveOrCloneProject(name: string | undefined): ResolveResult {
       const projects = scanProjects();
       const want = normalizeRepoPath(targetPath) || targetPath.toLowerCase().replace(/^\/+|\/+$/g, '');
       const wantBase = want.split('/').pop()!;
-      const byRepo = projects.filter((p) => p.repo && p.repo === want);
-      if (byRepo.length === 1) return { project: byRepo[0], source: 'existing' };
-      const byRepoBase = projects.filter((p) => p.repo && p.repo.split('/').pop() === wantBase);
-      if (byRepoBase.length === 1) return { project: byRepoBase[0], source: 'existing' };
-
+      // Prefer ANY local checkout — pipelines run in a worktree, so picking
+      // either of several same-repo checkouts (e.g. FortiNAC vs FortiNAC-v3,
+      // both origin fortinac/fortinac) is safe and never touches the user's
+      // branch. Order: exact origin path → origin basename → project name.
+      // Taking the first match (not requiring a unique one) is what keeps a
+      // clone — which fails when the GitLab host is behind a VPN the server
+      // can't reach — from being attempted at all when a local copy exists.
+      const localHit =
+        projects.find((p) => p.repo && p.repo === want) ||
+        projects.find((p) => p.repo && p.repo.split('/').pop() === wantBase) ||
+        projects.find((p) => p.name.toLowerCase() === wantBase.toLowerCase());
+      if (localHit) return { project: localHit, source: 'existing' };
+
+      // No local checkout at all — clone (may fail if host unreachable, then
+      // scratch below).
       const cloned = tryGitlabClone(targetPath);
       if (cloned) return { project: cloned, source: 'gitlab-cloned', clone_url: `${gl.base_url}/${targetPath.replace(/^\/+|\/+$/g, '')}.git` };
     }

package/lib/session-utils.ts

@@ -51,3 +51,22 @@ export async function getMcpFlag(projectPath: string): Promise<string> {
   return ` --mcp-config "${projectPath}/.forge/mcp.json"`;
 }
 
+
+/**
+ * tmux env injection — keep secret env (API keys) out of pane echo + shell
+ * history. The server stores values via `tmux set-environment` (the `setenv` WS
+ * message); this prefix pulls them back at launch time so only var NAMES appear
+ * in the typed command, never the values.
+ *
+ * Uses a single `eval "$(tmux show-environment -s | grep …)"` instead of one
+ * `export K="$(tmux show-environment K | sed …)"` per var — the latter form
+ * grows O(N) in length and hits tmux send-keys buffer limits with many vars.
+ * `tmux show-environment -s` outputs `KEY="val"; export KEY;` per line, so
+ * grepping `^(K1|K2)=` and eval-ing the matches is both short and safe.
+ */
+export function tmuxEnvPrefix(keys: string[]): string {
+  const valid = keys.filter((k) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(k));
+  if (!valid.length) return '';
+  const pattern = `^(${valid.join('|')})=`;
+  return `eval "$(tmux show-environment -s 2>/dev/null | grep -E '${pattern}')" && `;
+}

package/lib/telegram-bot.ts

@@ -32,7 +32,11 @@ const chatNumberedTasks = new Map<number, Map<number, string>>();
 const chatNumberedSessions = new Map<number, Map<number, { projectName: string; sessionId: string }>>();
 const chatNumberedProjects = new Map<number, Map<number, string>>();
 // Track what the last numbered list was for
-const chatListMode = new Map<number, 'tasks' | 'projects' | 'sessions' | 'task-create' | 'peek' | 'inject-pick' | 'inject-typing'>();
+const chatListMode = new Map<number, 'tasks' | 'projects' | 'sessions' | 'task-create' | 'peek' | 'inject-pick' | 'inject-typing' | 'chat-pick'>();
+// Chat mode: once entered (/chat → pick session), every non-command message
+// goes to the Forge chat agent — same as the local /chat — until /endchat.
+const chatActiveMode = new Set<number>();                                   // chatIds currently in chat mode
+const chatNumberedChatSessions = new Map<number, Map<number, string>>();    // num → chat session id (0 = new)
 // Inject mode state — picked tmux session per chat
 const chatNumberedTmux = new Map<number, Map<number, string>>(); // num → tmux session name
 const chatInjectTarget = new Map<number, string>(); // chatId → tmux session name (currently selected)
@@ -147,11 +151,27 @@ async function handleMessage(msg: any) {
     return;
   }
 
+  // Chat mode: every non-command message (including bare numbers) goes to the
+  // chat agent until /endchat. Must run BEFORE numbered selection so digits are
+  // treated as chat content, not list picks. Commands fall through.
+  if (chatActiveMode.has(chatId) && !text.startsWith('/')) {
+    await handleChat(chatId, text);
+    return;
+  }
+
   // Quick number selection (1-10) → context-dependent
   if (/^\d{1,2}$/.test(text)) {
     const num = parseInt(text);
     const mode = chatListMode.get(chatId);
 
+    if (mode === 'chat-pick') {
+      const sessMap = chatNumberedChatSessions.get(chatId);
+      if (num === 0 || sessMap?.has(num)) {
+        await pickChatSession(chatId, num);
+        return;
+      }
+    }
+
     if (mode === 'task-create') {
       const projMap = chatNumberedProjects.get(chatId);
       if (projMap?.has(num)) {
@@ -298,17 +318,10 @@ async function handleMessage(msg: any) {
       }
       case '/chat':
       case '/c':
-        if (args.length === 0) {
-          await send(chatId, 'Usage: /chat <message>\n/chat_new to start a fresh session\n/chat_session to show the active session id');
-        } else {
-          await handleChat(chatId, args.join(' '));
-        }
-        break;
-      case '/chat_new':
-        await handleChatReset(chatId);
+        await enterChatMode(chatId);
         break;
-      case '/chat_session':
-        await handleChatStatus(chatId);
+      case '/endchat':
+        await exitChatMode(chatId);
         break;
       case '/tunnel':
         await handleTunnelStatus(chatId);
@@ -368,9 +381,8 @@ async function sendHelp(chatId: number) {
     `🔧 /cancel <id>  /retry <id>\n` +
     `/projects — list projects\n` +
     `🤖 /agents — list available agents\n\n` +
-    `💬 /chat <msg> — chat with Forge agent\n` +
-    `/chat_new — start a fresh chat session\n` +
-    `/chat_session — show active session id\n\n` +
+    `💬 /chat — enter chat mode (pick/new session)\n` +
+    `/endchat — leave chat mode\n\n` +
     `🌐 /tunnel — status\n` +
     `/tunnel_start / /tunnel_stop\n` +
     `/tunnel_code <admin_pw> — get session code\n\n` +
@@ -396,20 +408,56 @@ async function handleChat(chatId: number, userText: string) {
   }
 }
 
-async function handleChatReset(chatId: number) {
-  const { clearTelegramSession } = require('./chat/telegram-bridge') as typeof import('./chat/telegram-bridge');
-  clearTelegramSession(chatId);
-  await send(chatId, '✓ Chat session cleared. The next /chat starts fresh.');
+// Enter chat mode: show a numbered session picker (0 = new). Once the user
+// picks, every plain message goes to the chat agent until /endchat.
+async function enterChatMode(chatId: number) {
+  // Leave any active chat first so digits in the picker are read as choices,
+  // not chat content.
+  chatActiveMode.delete(chatId);
+  try {
+    const { listChatSessions } = require('./chat/telegram-bridge') as typeof import('./chat/telegram-bridge');
+    const sessions = await listChatSessions(15);
+    const numMap = new Map<number, string>();
+    const lines = ['💬 Chat mode — pick a session:', '', '0. ➕ New session'];
+    sessions.forEach((s, i) => {
+      const n = i + 1;
+      numMap.set(n, s.id);
+      const title = (s.title || s.id.slice(0, 8)).slice(0, 40);
+      lines.push(`${n}. ${title}`);
+    });
+    chatNumberedChatSessions.set(chatId, numMap);
+    chatListMode.set(chatId, 'chat-pick');
+    lines.push('', 'Reply with a number. /endchat to cancel.');
+    await send(chatId, lines.join('\n'));
+  } catch (err) {
+    await send(chatId, `✗ chat error: ${(err as Error).message}`);
+  }
 }
 
-async function handleChatStatus(chatId: number) {
-  const { getTelegramSession } = require('./chat/telegram-bridge') as typeof import('./chat/telegram-bridge');
-  const id = getTelegramSession(chatId);
-  if (!id) {
-    await send(chatId, 'No active chat session. /chat <message> creates one.');
-    return;
-  }
-  await send(chatId, `Active session: ${id}\n/chat_new to start fresh`);
+// Pick a session (0 = new) → bind it and switch to chat-active mode.
+async function pickChatSession(chatId: number, num: number) {
+  const { setTelegramSession, newChatSession } = require('./chat/telegram-bridge') as typeof import('./chat/telegram-bridge');
+  let sessionId: string | null;
+  if (num === 0) {
+    sessionId = await newChatSession(`Telegram chat ${chatId}`);
+    if (!sessionId) { await send(chatId, '✗ could not create a new session'); return; }
+  } else {
+    sessionId = chatNumberedChatSessions.get(chatId)?.get(num) || null;
+    if (!sessionId) { await send(chatId, 'Invalid choice. /chat to list again.'); return; }
+  }
+  setTelegramSession(chatId, sessionId);
+  chatListMode.delete(chatId);
+  chatNumberedChatSessions.delete(chatId);
+  chatActiveMode.add(chatId);
+  await send(chatId, `✅ Chat started${num === 0 ? ' (new session)' : ''}. Send messages normally — every message goes to the Forge agent.\n\n/endchat to leave.`);
+}
+
+// Leave chat mode. Keeps the session binding so /chat can resume it later.
+async function exitChatMode(chatId: number) {
+  const wasActive = chatActiveMode.delete(chatId);
+  chatListMode.delete(chatId);
+  chatNumberedChatSessions.delete(chatId);
+  await send(chatId, wasActive ? '👋 Left chat mode.' : 'Not in chat mode.');
 }
 
 async function sendAgentList(chatId: number) {

package/lib/terminal-standalone.ts

@@ -424,6 +424,23 @@ wss.on('connection', (ws: WebSocket) => {
           break;
         }
 
+        case 'setenv': {
+          // Store secret env (API keys) into the tmux SESSION environment so the
+          // launch command can pull them via `tmux show-environment` instead of
+          // typing `export KEY=value` into the pane — keeps secrets out of the
+          // terminal echo and shell history. Values never touch the typed line.
+          const name = parsed.sessionName;
+          const env = parsed.env;
+          if (name && tmuxSessionExists(name) && env && typeof env === 'object') {
+            for (const [k, v] of Object.entries(env)) {
+              if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(k)) continue;
+              const val = `'${String(v).replace(/'/g, `'\\''`)}'`;
+              try { execSync(`${TMUX} set-environment -t "${name}" ${k} ${val}`, { timeout: 3000 }); } catch {}
+            }
+          }
+          break;
+        }
+
         case 'load-state': {
           const state = loadTerminalState();
           ws.send(JSON.stringify({ type: 'terminal-state', data: state }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aion0/forge",
-  "version": "0.10.77",
+  "version": "0.10.79",
   "description": "Unified AI workflow platform — multi-model task orchestration, persistent sessions, web terminal, remote access",
   "type": "module",
   "scripts": {