@aion0/forge 0.10.82 → 0.10.84

package/RELEASE_NOTES.md

@@ -1,8 +1,11 @@
-# Forge v0.10.82
+# Forge v0.10.84
 
 Released: 2026-06-15
 
-## Changes since v0.10.81
+## Changes since v0.10.83
 
+### Other
+- fix(auth): logout redirects to current origin, not localhost:8403
 
-**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.10.81...v0.10.82
+
+**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.10.83...v0.10.84

package/app/api/settings/route.ts

@@ -1,11 +1,20 @@
 import { NextResponse } from 'next/server';
+import { existsSync } from 'node:fs';
 import { loadSettings, loadSettingsMasked, saveSettings, type Settings } from '@/lib/settings';
 import { restartTelegramBot } from '@/lib/init';
 import { SECRET_FIELDS } from '@/lib/crypto';
 import { verifyAdmin } from '@/lib/password';
 
+// Container deployments manage the admin password out-of-band (control plane /
+// `make change-password`), which also re-pairs the browser-extension bridge
+// token. Same detection signal as app/api/onboarding/route.ts.
+function inContainer(): boolean {
+  if (process.env.FORGE_CONTAINER === '1') return true;
+  try { return existsSync('/.dockerenv'); } catch { return false; }
+}
+
 export async function GET() {
-  return NextResponse.json(loadSettingsMasked());
+  return NextResponse.json({ ...loadSettingsMasked(), _inContainer: inContainer() });
 }
 
 export async function PUT(req: Request) {
@@ -34,6 +43,21 @@ export async function PUT(req: Request) {
       && !existingSettings.telegramTunnelPassword
       && !!newValue;
 
+    // In container mode the admin password is managed out-of-band (the
+    // platform rotation also re-pairs the browser extension's bridge token).
+    // Changing it here would desync that token and break the agent's browser,
+    // with no UI re-pair path. Block rotations — but still allow the very first
+    // set (isFirstAdminSet), which happens before any extension pairing.
+    if (field === 'telegramTunnelPassword' && !isFirstAdminSet && inContainer()) {
+      return NextResponse.json({
+        ok: false,
+        error:
+          'Password is managed by the platform in container mode. Change it from ' +
+          'the admin console / self-service portal (it also re-pairs the browser ' +
+          'extension), or on the host run: make change-password U=<user>.',
+      }, { status: 403 });
+    }
+
     if (!isFirstAdminSet && !verifyAdmin(adminPassword)) {
       return NextResponse.json({ ok: false, error: 'Wrong password' }, { status: 403 });
     }

package/components/Dashboard.tsx

@@ -916,7 +916,14 @@ export default function Dashboard({ user }: { user: any }) {
                     <span className="w-3 text-center">?</span><span>Help</span>
                   </button>
                   <button
-                    onClick={() => signOut({ callbackUrl: '/login' })}
+                    onClick={async () => {
+                      // Redirect client-side so logout stays on the CURRENT origin
+                      // (tunnel host / LAN IP / custom port). next-auth's own
+                      // callbackUrl uses the server baseUrl, which is localhost:8403
+                      // when cloudflared rewrites the Host header.
+                      await signOut({ redirect: false });
+                      window.location.href = '/login';
+                    }}
                     className="w-full text-left text-[11px] px-3 py-1.5 text-[var(--text-secondary)] hover:text-[var(--red)] hover:bg-[var(--bg-tertiary)] flex items-center gap-2"
                   >
                     <span className="w-3 text-center">⏻</span><span>Logout</span>

package/components/SettingsModal.tsx

@@ -367,6 +367,9 @@ export default function SettingsModal({ onClose }: { onClose: () => void }) {
     maxConcurrentPipelines: 5,
   });
   const [secretStatus, setSecretStatus] = useState<Record<string, boolean>>({});
+  // Container deployments manage the admin password out-of-band (it also
+  // re-pairs the browser extension); UI change is disabled when set.
+  const [inContainer, setInContainer] = useState(false);
   const [newRoot, setNewRoot] = useState('');
   const [newDocRoot, setNewDocRoot] = useState('');
   const [pickerFor, setPickerFor] = useState<null | 'project' | 'doc'>(null);
@@ -390,7 +393,9 @@ export default function SettingsModal({ onClose }: { onClose: () => void }) {
   const fetchSettings = useCallback(() => {
     fetch('/api/settings').then(r => r.json()).then((data: Settings) => {
       const status = data._secretStatus || {};
+      setInContainer(!!(data as any)._inContainer);
       delete data._secretStatus;
+      delete (data as any)._inContainer;
       setSettings(data);
       origSettingsRef.current = JSON.stringify(data);
       setSecretStatus(status);
@@ -983,14 +988,30 @@ export default function SettingsModal({ onClose }: { onClose: () => void }) {
           <p className="text-[10px] text-[var(--text-secondary)]">
             Used for local login, tunnel start, secret changes, and Telegram commands. Remote login requires admin password + session code (generated on tunnel start).
           </p>
-          <SecretField
-            label="Admin Password"
-            isSet={!!secretStatus.telegramTunnelPassword}
-            onEdit={() => setEditingSecret({ field: 'telegramTunnelPassword', label: 'Admin Password' })}
-          />
-          <p className="text-[9px] text-[var(--text-secondary)]">
-            Forgot? Run: <code className="text-[var(--accent)]">forge --reset-password</code>
-          </p>
+          {inContainer && secretStatus.telegramTunnelPassword ? (
+            <>
+              <div className="flex items-center justify-between gap-2 px-2 py-1.5 bg-[var(--bg-tertiary)] border border-[var(--border)] rounded">
+                <span className="text-xs font-mono text-[var(--text-secondary)]">••••••••</span>
+                <span className="text-[9px] text-[var(--text-secondary)] italic">Managed by platform</span>
+              </div>
+              <p className="text-[9px] text-[var(--text-secondary)]">
+                Password is managed by the platform. Change it from the admin console
+                or your self-service portal — it also re-pairs the browser extension.
+                (Host CLI: <code className="text-[var(--accent)]">make change-password U=&lt;user&gt;</code>.)
+              </p>
+            </>
+          ) : (
+            <>
+              <SecretField
+                label="Admin Password"
+                isSet={!!secretStatus.telegramTunnelPassword}
+                onEdit={() => setEditingSecret({ field: 'telegramTunnelPassword', label: 'Admin Password' })}
+              />
+              <p className="text-[9px] text-[var(--text-secondary)]">
+                Forgot? Run: <code className="text-[var(--accent)]">forge --reset-password</code>
+              </p>
+            </>
+          )}
         </div>
 
         {/* API Key */}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aion0/forge",
-  "version": "0.10.82",
+  "version": "0.10.84",
   "description": "Unified AI workflow platform — multi-model task orchestration, persistent sessions, web terminal, remote access",
   "type": "module",
   "scripts": {