@aion0/forge 0.10.86 → 0.10.88

package/RELEASE_NOTES.md

@@ -1,11 +1,8 @@
-# Forge v0.10.86
+# Forge v0.10.88
 
-Released: 2026-06-16
+Released: 2026-06-17
 
-## Changes since v0.10.85
+## Changes since v0.10.87
 
-### Other
-- fix(schedules): pause/resume + extractor openai support
 
-
-**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.10.85...v0.10.86
+**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.10.87...v0.10.88

package/app/api/connectors/import-config-template/route.ts

@@ -219,6 +219,8 @@ async function apply(template: any, values: Record<string, string>): Promise<{
   fields_preserved: Array<{ connector: string; field: string; reason: string }>;
   fields_left_empty: Array<{ connector: string; field: string }>;
   agents_applied?: string[];
+  skills_installed?: string[];
+  skills_failed?: Array<{ name: string; error: string }>;
 }> {
   // Auto-inject user identity from settings so connectors (e.g. tp.username)
   // can use {user_name} / {user_email} without prompting the user again.
@@ -359,6 +361,30 @@ async function apply(template: any, values: Record<string, string>): Promise<{
     }
   }
 
+  // ─── _skills block — auto-install marketplace skills to global ─────
+  //
+  // Template declares `"_skills": ["prelude", ...]`. On apply we sync the
+  // marketplace registry once, then installGlobal each — so e.g. the fortinet
+  // template pulls prelude into ~/.claude/skills/ at setup time. installGlobal
+  // always resolves the registry's latest version, so "0.2.0 and later" tracks
+  // automatically. Failures are collected, never abort the rest of the apply.
+  const skillsInstalled: string[] = [];
+  const skillsFailed: Array<{ name: string; error: string }> = [];
+  const skillsList = Array.isArray((template as any)._skills) ? (template as any)._skills : [];
+  if (skillsList.length > 0) {
+    const { syncSkills, installGlobal } = await import('@/lib/skills');
+    // syncSkills populates the local skills DB that installGlobal reads from.
+    // If it fails (offline), installGlobal will likely fail too (it downloads
+    // files from GitHub) — that surfaces per-skill in skills_failed, never aborts.
+    try { await syncSkills(); } catch { /* non-fatal — per-skill install still attempted */ }
+    for (const raw of skillsList) {
+      const name = typeof raw === 'string' ? raw.trim() : '';
+      if (!name) continue;
+      try { await installGlobal(name); skillsInstalled.push(name); }
+      catch (e: any) { skillsFailed.push({ name, error: e?.message || String(e) }); }
+    }
+  }
+
   return {
     applied,
     installed_from_registry: installedFromRegistry,
@@ -367,6 +393,8 @@ async function apply(template: any, values: Record<string, string>): Promise<{
     fields_preserved: preserved,
     fields_left_empty: leftEmpty,
     agents_applied: agentsApplied,
+    skills_installed: skillsInstalled,
+    skills_failed: skillsFailed,
   };
 }
 

package/bin/forge-server.mjs

@@ -28,6 +28,17 @@ import { homedir } from 'node:os';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const ROOT = join(__dirname, '..');
 
+// Pre-install EnvHttpProxyAgent before any dynamic import('undici') can
+// clobber Node's NODE_USE_ENV_PROXY agent (see lib/proxy-setup.ts).
+// No-op off-corp (no proxy env), so non-docker deployments are unchanged.
+if (process.env.HTTPS_PROXY || process.env.HTTP_PROXY ||
+    process.env.https_proxy || process.env.http_proxy) {
+  try {
+    const { setGlobalDispatcher, EnvHttpProxyAgent } = await import('undici');
+    setGlobalDispatcher(new EnvHttpProxyAgent());
+  } catch { /* undici unavailable — leave Node's default dispatcher */ }
+}
+
 /** Build Next.js — install devDependencies first if missing */
 function buildNext() {
   // Check if devDependencies are installed (e.g. @tailwindcss/postcss)

package/components/SkillsPanel.tsx

@@ -26,6 +26,8 @@ interface Skill {
   installedProjects: string[];
   deletedRemotely: boolean;
   source?: 'registry' | 'local';
+  sourceId?: string;
+  isEnterprise?: boolean;
 }
 
 interface ProjectInfo {
@@ -584,6 +586,15 @@ export default function SkillsPanel({ projectFilter }: { projectFilter?: string
                 >
                   <div className="flex items-center gap-2">
                     <span className="text-[11px] font-semibold text-[var(--text-primary)] truncate flex-1">{skill.displayName}</span>
+                    {/* Source badge: enterprise skills (synced from an enterprise
+                        repo, winning over a same-name public skill) get a 🔒 chip
+                        with the tenant id; public skills stay unmarked. */}
+                    {skill.isEnterprise && (
+                      <span
+                        className="text-[8px] px-1 rounded font-medium bg-amber-500/20 text-amber-500 shrink-0"
+                        title={`Enterprise source: ${skill.sourceId?.replace(/^enterprise-/, '') || ''}`}
+                      >🔒 {skill.sourceId?.replace(/^enterprise-/, '') || 'enterprise'}</span>
+                    )}
                     <span className="text-[8px] text-[var(--text-secondary)] font-mono shrink-0">v{skill.version}</span>
                     {skill.rating > 0 && (
                       <span className="text-[8px] text-[var(--yellow)] shrink-0" title={`Rating: ${skill.rating}/5`}>

package/instrumentation.ts

@@ -2,6 +2,8 @@
  * Next.js instrumentation — runs once when the server starts.
  * Loads .env.local and prints login password.
  */
+import './lib/proxy-setup';   // MUST be first — see proxy-setup.ts header.
+
 export async function register() {
   // Only run on server, not Edge
   if (process.env.NEXT_RUNTIME === 'nodejs') {

package/lib/browser-bridge-standalone.ts

@@ -39,6 +39,7 @@
  * Usage: npx tsx lib/browser-bridge-standalone.ts [--forge-port=8403]
  */
 
+import './proxy-setup';   // MUST be first — see proxy-setup.ts header.
 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';
 import { WebSocket, WebSocketServer } from 'ws';
 import { randomUUID, createHash } from 'node:crypto';

package/lib/chat/protocols/http.ts

@@ -241,8 +241,14 @@ async function exchangeBearerToken(
   const exchangeFetchInit = { method: auth.exchange_method || 'POST', headers, body };
   let res: Response;
   if (verifyTls === false) {
-    const { fetch: undiciFetch, Agent } = await import('undici');
-    const dispatcher = new Agent({ connect: { rejectUnauthorized: false } });
+    // Per-call dispatcher bypasses the global proxy agent — route via
+    // ProxyAgent when a proxy is set (corp), else plain Agent (direct).
+    const { fetch: undiciFetch, Agent, ProxyAgent } = await import('undici');
+    const proxyUrl = process.env.HTTPS_PROXY || process.env.https_proxy ||
+                     process.env.HTTP_PROXY || process.env.http_proxy;
+    const dispatcher = proxyUrl
+      ? new ProxyAgent({ uri: proxyUrl, requestTls: { rejectUnauthorized: false } })
+      : new Agent({ connect: { rejectUnauthorized: false } });
     res = await undiciFetch(exchangeUrl, { ...exchangeFetchInit, dispatcher }) as unknown as Response;
   } else {
     res = await fetch(exchangeUrl, exchangeFetchInit);
@@ -488,8 +494,14 @@ export async function runHttp({ tool, settings, args, connectorAuth, noTruncatio
       // fetch are version-matched; passing an external undici Agent
       // into Node's bundled global fetch fails with UND_ERR_INVALID_ARG
       // because Node 22 ships an older undici than the installed one.
-      const { fetch: undiciFetch, Agent } = await import('undici');
-      const dispatcher = new Agent({ connect: { rejectUnauthorized: false } });
+      // Per-call dispatcher bypasses the global proxy agent — route via
+      // ProxyAgent when a proxy is set (corp), else plain Agent (direct).
+      const { fetch: undiciFetch, Agent, ProxyAgent } = await import('undici');
+      const proxyUrl = process.env.HTTPS_PROXY || process.env.https_proxy ||
+                       process.env.HTTP_PROXY || process.env.http_proxy;
+      const dispatcher = proxyUrl
+        ? new ProxyAgent({ uri: proxyUrl, requestTls: { rejectUnauthorized: false } })
+        : new Agent({ connect: { rejectUnauthorized: false } });
       res = await undiciFetch(url, { method, headers, body, signal: controller.signal, dispatcher }) as unknown as Response;
     } else {
       res = await fetch(url, { method, headers, body, signal: controller.signal });

package/lib/chat-standalone.ts

@@ -30,6 +30,7 @@
  *   keep their existing WS path; HTTP-only surfaces use SSE.
  */
 
+import './proxy-setup';   // MUST be first — see proxy-setup.ts header.
 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';
 import {
   createSession, getSession, listSessions, updateSession, deleteSession, listMessages,

package/lib/connectors/test-runner.ts

@@ -134,8 +134,14 @@ async function runHttpProbe(
     // NAC, ESXi …) need undici with rejectUnauthorized:false, same as http.ts.
     const fetchInit = { method, headers, body, signal: ctrl.signal };
     if (def.http?.verify_tls === false) {
-      const { fetch: undiciFetch, Agent } = await import('undici');
-      const dispatcher = new Agent({ connect: { rejectUnauthorized: false } });
+      // A per-call dispatcher bypasses the global proxy agent, so when a proxy
+      // is set (corp) route through ProxyAgent; else plain Agent (direct).
+      const { fetch: undiciFetch, Agent, ProxyAgent } = await import('undici');
+      const proxyUrl = process.env.HTTPS_PROXY || process.env.https_proxy ||
+                       process.env.HTTP_PROXY || process.env.http_proxy;
+      const dispatcher = proxyUrl
+        ? new ProxyAgent({ uri: proxyUrl, requestTls: { rejectUnauthorized: false } })
+        : new Agent({ connect: { rejectUnauthorized: false } });
       res = await undiciFetch(url, { ...fetchInit, dispatcher } as any) as unknown as Response;
     } else {
       res = await fetch(url, fetchInit);

package/lib/help-docs/10-troubleshooting.md

@@ -76,6 +76,19 @@ The WebSocket dropped (system suspend, network blip). Forge auto-reconnects afte
 gh auth login
 ```
 
+### Connector Test fails with `ENETUNREACH` behind a corp proxy
+Symptom: a brand-new deployment behind a corporate proxy/ZTNA, configure a
+connector (e.g. GitLab) → **Test** → `request failed: fetch failed: connect
+ENETUNREACH <backend-ip>:443`.
+
+Forge honours `HTTPS_PROXY` / `HTTP_PROXY` / `NO_PROXY` automatically — every
+entry point pre-installs an `EnvHttpProxyAgent` before any code makes a request,
+so a proxy set in the environment is used for all connector calls (including
+`verify_tls: false` self-signed appliances like FortiNAC). Just make sure the
+proxy env vars are exported for the Forge process (in Docker, via the
+container's environment). Off-corp deployments with no proxy env are unaffected
+— requests go direct as before.
+
 ### Skills not syncing
 Click "Sync" in Skills tab. Check `skillsRepoUrl` in Settings points to valid registry.
 

package/lib/memory-standalone.ts

@@ -18,6 +18,8 @@
  * next sub-task still runs in the same cycle.
  */
 
+import './proxy-setup';   // MUST be first — see proxy-setup.ts header.
+
 const MEMORY_TICK_SEC = 120;
 
 export interface MemorySubTask {

package/lib/pipeline.ts

@@ -10,7 +10,7 @@ import { existsSync, readdirSync, readFileSync, writeFileSync, mkdirSync, statSy
 import { execSync } from 'node:child_process';
 import { join } from 'node:path';
 import YAML from 'yaml';
-import { createTask, getTask, onTaskEvent, taskModelOverrides, taskAppendSystemPromptOverrides, cancelTask } from './task-manager';
+import { createTask, getTask, onTaskEvent, taskModelOverrides, taskAppendSystemPromptOverrides, taskSkillsOverrides, cancelTask } from './task-manager';
 import { getProjectInfo, resolveOrCloneProject, resolveProjectStrict, getProjectWorktreeRoot, ensureScratchProject } from './projects';
 import { loadSettings } from './settings';
 import { getAgent, listAgents } from './agents';
@@ -182,6 +182,13 @@ export interface Workflow {
    *  Default: false (preserves the scratch fallback for connector-only / chat
    *  pipelines that don't touch a repo). */
   requires_real_project?: boolean;
+  /** Skills auto-attached to every task this workflow spawns, declared in the
+   *  workflow YAML. Merged (deduped) with any skills the dispatching
+   *  Job/Schedule/chat passes at runtime — so a pipeline can carry a default
+   *  skill (e.g. prelude) regardless of how it's triggered, including manual
+   *  Fire which passes no opts.skills. Composed into each task's
+   *  --append-system-prompt via renderSkillsAppendPrompt + auto-installed. */
+  skills?: string[];
   /** Default execution backend for every node's task. 'tmux' runs interactive
    *  claude in a per-node tmux session (subscription billing); 'headless' /
    *  omitted uses default `claude -p`. Per-node `backend:` overrides this. */
@@ -535,6 +542,9 @@ export function parseWorkflow(raw: string): Workflow {
     // would newly enable the preflight on existing fortinet pipelines, an
     // unrelated behavior change that belongs in its own commit.
     requires_real_project: parsed.requires_real_project === true,
+    skills: Array.isArray(parsed.skills)
+      ? parsed.skills.filter((s: any) => typeof s === 'string' && s.trim()).map((s: string) => s.trim())
+      : undefined,
   };
 }
 
@@ -1093,7 +1103,10 @@ export function startPipeline(
     nodes,
     nodeOrder,
     createdAt: new Date().toISOString(),
-    skills: opts.skills && opts.skills.length ? [...opts.skills] : undefined,
+    skills: (() => {
+      const merged = [...(workflow.skills || []), ...(opts.skills || [])];
+      return merged.length ? [...new Set(merged)] : undefined;
+    })(),
     // Runtime override (e.g. chat "use tmux") wins over the workflow's declared default.
     backend: opts.backend ?? workflow.backend,
     forEach: forEachState,
@@ -1274,7 +1287,10 @@ function scheduleNextConversationTurn(pipeline: Pipeline, contextForAgent: strin
   pipelineTaskIds.add(task.id);
   {
     const skillsAppend = renderSkillsAppendPrompt(pipeline.skills);
-    if (skillsAppend) taskAppendSystemPromptOverrides.set(task.id, skillsAppend);
+    if (skillsAppend) {
+      taskAppendSystemPromptOverrides.set(task.id, skillsAppend);
+      taskSkillsOverrides.set(task.id, pipeline.skills!);
+    }
   }
 
   // Add pending message
@@ -2157,6 +2173,7 @@ async function scheduleReadyNodes(pipeline: Pipeline, workflow: Workflow) {
     const skillsAppend = renderSkillsAppendPrompt(pipeline.skills);
     if (skillsAppend) {
       taskAppendSystemPromptOverrides.set(task.id, skillsAppend);
+      taskSkillsOverrides.set(task.id, pipeline.skills!);
     }
     // Pipeline tasks use the same model selection as normal tasks
     // (per-task override > agent scene model > agent default).

package/lib/proxy-setup.ts

@@ -0,0 +1,21 @@
+/**
+ * Pre-install an EnvHttpProxyAgent on undici's global dispatcher BEFORE
+ * anything dynamic-imports the npm undici (8.x).
+ *
+ * Why: Node honours NODE_USE_ENV_PROXY by putting EnvHttpProxyAgent on
+ * undici v1's dispatcher symbol. The npm undici uses v2; on load its
+ * `if (getGlobalDispatcher() === undefined) setGlobalDispatcher(new Agent())`
+ * reads v2 (undefined) and writes a plain Agent into BOTH v1 and v2,
+ * silently clobbering Node's proxy agent — after which every fetch ignores
+ * HTTPS_PROXY and direct-connects (ENETUNREACH behind corp ZTNA).
+ * Setting v2 here makes that check non-undefined, so npm undici skips it.
+ *
+ * MUST be the FIRST import in every entry point. Off-corp (no proxy env)
+ * this is a no-op, so non-docker / standalone deployments are unchanged.
+ */
+import { setGlobalDispatcher, EnvHttpProxyAgent } from 'undici';
+
+if (process.env.HTTPS_PROXY || process.env.HTTP_PROXY ||
+    process.env.https_proxy || process.env.http_proxy) {
+  setGlobalDispatcher(new EnvHttpProxyAgent());
+}

package/lib/skills.ts

@@ -9,6 +9,7 @@ import { getDb } from '../src/core/db/database';
 import { getDbPath } from '../src/config';
 import { loadSettings } from './settings';
 import { getClaudeDir } from './dirs';
+import { listSources, fetchSourceFile, type SourceMeta } from './connectors/sync';
 
 type ItemType = 'skill' | 'command';
 
@@ -30,6 +31,11 @@ interface SkillItem {
   deletedRemotely: boolean;
   /** 'registry' (synced from forge-skills) or 'local' (uploaded). */
   source: 'registry' | 'local';
+  /** Which marketplace source the registry row came from: 'public' or an
+   *  'enterprise-<tenant>' id. Lets the UI show a per-skill source badge. */
+  sourceId: string;
+  /** True when sourceId is an enterprise source (for the 🔒 badge). */
+  isEnterprise: boolean;
 }
 
 function db() {
@@ -49,6 +55,40 @@ function getRepoInfo(): { owner: string; repo: string; branch: string } {
   return { owner: 'aiwatching', repo: 'forge-skills', branch: 'main' };
 }
 
+// ─── Multi-source (#354) ──────────────────────────────────────
+//
+// Skills sync from the same source set as connectors: enterprise sources
+// (by priority) layered OVER the public marketplace. We reuse the connector
+// module's SourceMeta + fetchSourceFile (it already handles raw vs github_api
+// + private-repo PAT auth), but the PUBLIC source must point at forge-skills,
+// not forge-connectors — so we take the enterprise entries from listSources()
+// and swap in the skills public base.
+
+/** Ordered skill sources, highest priority first, public last. */
+function listSkillSources(): SourceMeta[] {
+  const enterprise = listSources().filter((s) => s.is_enterprise);
+  const publicSrc: SourceMeta = {
+    id: 'public',
+    display_name: 'Public',
+    is_enterprise: false,
+    priority: enterprise.length,
+    fetch_mode: 'raw',
+    base_url: getBaseUrl(),
+  };
+  return [...enterprise, publicSrc];
+}
+
+function sourceById(id: string): SourceMeta | undefined {
+  return listSkillSources().find((s) => s.id === id);
+}
+
+/** "owner/repo" for a source — for the source_repo DB column. */
+function sourceRepoOf(s: SourceMeta): string {
+  if (s.is_enterprise) return (s.repo_url || '').replace(/^github\.com\//, '');
+  const r = getRepoInfo();
+  return `${r.owner}/${r.repo}`;
+}
+
 function compareVersions(a: string, b: string): number {
   const pa = (a || '0.0.0').split('.').map(Number);
   const pb = (b || '0.0.0').split('.').map(Number);
@@ -64,85 +104,112 @@ function compareVersions(a: string, b: string): number {
 /** Max info.json enrichments per sync (incremental) */
 const ENRICH_BATCH_SIZE = 10;
 
+function parseRegistryItems(data: any): any[] {
+  if (data && data.version === 2) {
+    return [
+      ...(data.skills || []).map((s: any) => ({ ...s, type: s.type || 'skill' })),
+      ...(data.commands || []).map((c: any) => ({ ...c, type: c.type || 'command' })),
+    ];
+  }
+  return (data?.skills || []).map((s: any) => ({ ...s, type: s.type || 'skill' }));
+}
+
 export async function syncSkills(): Promise<{ synced: number; enriched: number; total?: number; remaining?: number; error?: string }> {
   console.log('[skills] Syncing from registry...');
   const baseUrl = getBaseUrl();
+  const cacheBust = `_t=${Date.now()}`;
 
   try {
-    // Step 1: Fetch registry.json (always fresh)
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 10000);
-    const cacheBust = `_t=${Date.now()}`;
-    const res = await fetch(`${baseUrl}/registry.json?${cacheBust}`, {
-      signal: controller.signal,
-      headers: { 'Accept': 'application/json', 'Cache-Control': 'no-cache' },
-    });
-    clearTimeout(timeout);
-
-    if (!res.ok) return { synced: 0, enriched: 0, error: `Registry fetch failed: ${res.status}` };
+    // Step 1+2: fetch + upsert from EVERY source. Process lowest-priority
+    // first (public), then enterprise — so an enterprise skill of the same
+    // name overwrites the public one on INSERT OR REPLACE (enterprise wins,
+    // matching connector/pipeline precedence). Each row records which source
+    // it came from so installGlobal knows where (and with what auth) to pull.
+    const ordered = [...listSkillSources()].reverse(); // public → … → highest enterprise
 
-    const data = await res.json();
-
-    // Parse registry items (v1 + v2 support)
-    let rawItems: any[] = [];
-    if (data.version === 2) {
-      rawItems = [
-        ...(data.skills || []).map((s: any) => ({ ...s, type: s.type || 'skill' })),
-        ...(data.commands || []).map((c: any) => ({ ...c, type: c.type || 'command' })),
-      ];
-    } else {
-      rawItems = (data.skills || []).map((s: any) => ({ ...s, type: s.type || 'command' }));
-    }
-
-    // Step 2: Upsert all items from registry.json directly (fast, no extra fetch)
     const upsertStmt = db().prepare(`
-      INSERT OR REPLACE INTO skills (name, type, display_name, description, author, version, tags, score, rating, source_url, archive, synced_at,
+      INSERT OR REPLACE INTO skills (name, type, display_name, description, author, version, tags, score, rating, source_url, archive,
+        source_id, source_repo, source_branch, synced_at,
         installed_global, installed_projects, installed_version)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
+        ?, ?, ?,
         COALESCE((SELECT synced_at FROM skills WHERE name = ?), datetime('now')),
         COALESCE((SELECT installed_global FROM skills WHERE name = ?), 0),
         COALESCE((SELECT installed_projects FROM skills WHERE name = ?), '[]'),
         COALESCE((SELECT installed_version FROM skills WHERE name = ?), ''))
     `);
 
-    const tx = db().transaction(() => {
-      for (const s of rawItems) {
-        upsertStmt.run(
-          s.name || '', s.type || 'skill',
-          s.display_name || '', s.description || '',
-          (s.author?.name || s.author || '').toString(), s.version || '',
-          JSON.stringify(s.tags || []),
-          s.score ?? 0, s.rating ?? 0, s.source?.url || s.source_url || '',
-          '', // archive
-          s.name || '', s.name || '', s.name || '', s.name || ''
-        );
+    const registryNames = new Set<string>();
+    const sourceErrors: string[] = [];
+    let syncedTotal = 0;
+    let anyOk = false;
+
+    for (const source of ordered) {
+      let items: any[];
+      try {
+        // fetchSourceFile busts cache internally (raw appends ?_t, github_api
+        // appends &_t) — pass the bare path so we don't double the query string.
+        const text = await fetchSourceFile(source, 'registry.json');
+        items = parseRegistryItems(JSON.parse(text));
+      } catch (e) {
+        // One source down (offline / PAT issue) must not wipe the others.
+        sourceErrors.push(`${source.id}: ${e instanceof Error ? e.message : String(e)}`);
+        continue;
       }
-    });
-    tx();
-
-    // Step 3: Handle items no longer in registry
-    // Skip 'local'-source rows entirely — they were uploaded by the
-    // user via /api/skills/install-local and have no upstream
-    // counterpart, so absence from registry.json is expected.
-    const registryNames = new Set(rawItems.map((s: any) => s.name));
-    const dbItems = db().prepare('SELECT name, installed_global, installed_projects, source FROM skills').all() as any[];
-    for (const row of dbItems) {
-      if (row.source === 'local') continue;
-      if (!registryNames.has(row.name)) {
-        const hasLocal = !!row.installed_global || JSON.parse(row.installed_projects || '[]').length > 0;
-        if (hasLocal) {
-          db().prepare('UPDATE skills SET deleted_remotely = 1 WHERE name = ?').run(row.name);
-        } else {
-          db().prepare('DELETE FROM skills WHERE name = ?').run(row.name);
+      anyOk = true;
+      const repo = sourceRepoOf(source);
+      const branch = source.is_enterprise ? 'main' : getRepoInfo().branch;
+      const tx = db().transaction(() => {
+        for (const s of items) {
+          if (!s.name) continue;
+          upsertStmt.run(
+            s.name, s.type || 'skill',
+            s.display_name || '', s.description || '',
+            (s.author?.name || s.author || '').toString(), s.version || '',
+            JSON.stringify(s.tags || []),
+            s.score ?? 0, s.rating ?? 0, s.source?.url || s.source_url || '',
+            '', // archive
+            source.id, repo, branch,
+            s.name, s.name, s.name, s.name
+          );
+          registryNames.add(s.name);
+        }
+      });
+      tx();
+      syncedTotal += items.length;
+    }
+
+    if (!anyOk) {
+      // Every source failed (typically offline) — leave the DB untouched.
+      return { synced: 0, enriched: 0, error: sourceErrors.join('; ') || 'all sources unreachable' };
+    }
+
+    // Step 3: prune items no longer in ANY registry — but ONLY when every
+    // source synced cleanly. If an enterprise source was transiently down,
+    // skipping this avoids wrongly deleting its (still-valid) skills.
+    // 'local'-source rows are never pruned (user uploads, no upstream).
+    if (sourceErrors.length === 0) {
+      const dbItems = db().prepare('SELECT name, installed_global, installed_projects, source FROM skills').all() as any[];
+      for (const row of dbItems) {
+        if (row.source === 'local') continue;
+        if (!registryNames.has(row.name)) {
+          const hasLocal = !!row.installed_global || JSON.parse(row.installed_projects || '[]').length > 0;
+          if (hasLocal) {
+            db().prepare('UPDATE skills SET deleted_remotely = 1 WHERE name = ?').run(row.name);
+          } else {
+            db().prepare('DELETE FROM skills WHERE name = ?').run(row.name);
+          }
         }
       }
     }
 
-    // Step 4: Incremental enrichment — fetch info.json for oldest-synced items
-    // Pick items whose synced_at is oldest (or version changed since last enrich)
+    // Step 4: Incremental enrichment from info.json — PUBLIC source only.
+    // Enterprise registry.json entries are authored in full (version, tags,
+    // description), so they need no enrichment; and their info.json lives in a
+    // private repo that the plain fetch() below can't read anyway.
     const staleItems = db().prepare(`
       SELECT name, type, version FROM skills
-      WHERE deleted_remotely = 0
+      WHERE deleted_remotely = 0 AND source_id = 'public'
       ORDER BY synced_at ASC
       LIMIT ?
     `).all(ENRICH_BATCH_SIZE) as any[];
@@ -190,8 +257,16 @@ export async function syncSkills(): Promise<{ synced: number; enriched: number;
 
     const totalCount = (db().prepare('SELECT count(*) as c FROM skills WHERE deleted_remotely = 0').get() as any).c;
     const remaining = totalCount - ENRICH_BATCH_SIZE; // approximate items not yet enriched this round
-    console.log(`[skills] Synced ${rawItems.length} items, enriched ${enriched}/${staleItems.length} from info.json`);
-    return { synced: rawItems.length, enriched, total: totalCount, remaining: Math.max(0, remaining) };
+    console.log(`[skills] Synced ${syncedTotal} items across ${ordered.length} source(s), enriched ${enriched}/${staleItems.length} from info.json`);
+    return {
+      synced: syncedTotal,
+      enriched,
+      total: totalCount,
+      remaining: Math.max(0, remaining),
+      // Surface a partial-failure note (e.g. one enterprise source down) while
+      // still reporting success for the sources that did sync.
+      error: sourceErrors.length ? `partial: ${sourceErrors.join('; ')}` : undefined,
+    };
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
     // Corp networks routinely can't reach GitHub raw — this is expected
@@ -226,6 +301,8 @@ export function listSkills(): SkillItem[] {
       hasUpdate: isInstalled && !!registryVersion && !!installedVersion && compareVersions(registryVersion, installedVersion) > 0,
       deletedRemotely: !!r.deleted_remotely,
       source: r.source === 'local' ? 'local' : 'registry',
+      sourceId: r.source_id || 'public',
+      isEnterprise: typeof r.source_id === 'string' && r.source_id.startsWith('enterprise-'),
     };
   });
 }
@@ -269,6 +346,59 @@ async function downloadFile(url: string): Promise<string> {
   return res.text();
 }
 
+/** Recursively list a directory in a private enterprise repo via the GitHub
+ *  contents API (PAT-authenticated). Returns repo-relative file paths. */
+async function listEnterpriseDir(source: SourceMeta, dirPath: string): Promise<string[]> {
+  const repo = (source.repo_url || '').replace(/^github\.com\//, '');
+  const out: string[] = [];
+  async function recurse(path: string): Promise<void> {
+    const url = `https://api.github.com/repos/${repo}/contents/${path}?ref=main`;
+    const res = await fetch(url, {
+      headers: {
+        Authorization: `Bearer ${source.github_pat}`,
+        Accept: 'application/vnd.github.v3+json',
+        'User-Agent': 'forge-skills-sync/1.0',
+      },
+    });
+    if (!res.ok) return;
+    const items = await res.json();
+    if (!Array.isArray(items)) return;
+    for (const it of items) {
+      if (it.type === 'file') out.push(it.path);
+      else if (it.type === 'dir') await recurse(it.path);
+    }
+  }
+  await recurse(dirPath);
+  return out;
+}
+
+/** Source-aware fetch of all files for a skill/command. Public skills use the
+ *  unauthenticated GitHub contents API; enterprise skills list + download via
+ *  the recorded source's PAT (private repos). Returns local-relative paths. */
+async function fetchSkillFiles(name: string, type: ItemType, sourceId: string): Promise<{ path: string; content: string }[]> {
+  const source = sourceById(sourceId);
+  // Public (or a source no longer configured) → legacy unauthenticated path.
+  if (!source || !source.is_enterprise) {
+    const files = await listRepoFiles(name, type);
+    const out: { path: string; content: string }[] = [];
+    for (const f of files) out.push({ path: f.path, content: await downloadFile(f.download_url) });
+    return out;
+  }
+  // Enterprise → private repo: list with PAT, fetch each via fetchSourceFile.
+  const dirs = type === 'skill' ? ['skills', 'commands'] : ['commands', 'skills'];
+  for (const dir of dirs) {
+    const repoPaths = await listEnterpriseDir(source, `${dir}/${name}`);
+    if (repoPaths.length === 0) continue;
+    const stripRe = new RegExp(`^${dir}/${name}/`);
+    const out: { path: string; content: string }[] = [];
+    for (const p of repoPaths) {
+      out.push({ path: p.replace(stripRe, ''), content: await fetchSourceFile(source, p) });
+    }
+    return out;
+  }
+  return [];
+}
+
 // ─── Install ─────────────────────────────────────────────────
 
 function getClaudeHome(): string {
@@ -290,15 +420,14 @@ export async function installGlobal(name: string): Promise<void> {
   const subdir = type === 'skill' ? 'skills' : 'commands';
   const targetDir = join(claudeHome, subdir, name);
 
-  const files = await listRepoFiles(name, type);
+  const files = await fetchSkillFiles(name, type, skill.source_id || 'public');
   if (files.length === 0) throw new Error(`No files found for ${name}`);
 
   mkdirSync(targetDir, { recursive: true });
   for (const f of files) {
-    const content = await downloadFile(f.download_url);
     const targetPath = join(targetDir, f.path);
     mkdirSync(dirname(targetPath), { recursive: true });
-    writeFileSync(targetPath, content);
+    writeFileSync(targetPath, f.content);
   }
 
   // Update installed state
@@ -333,15 +462,14 @@ export async function installProject(name: string, projectPath: string): Promise
   const subdir = type === 'skill' ? 'skills' : 'commands';
   const targetDir = join(projectPath, '.claude', subdir, name);
 
-  const files = await listRepoFiles(name, type);
+  const files = await fetchSkillFiles(name, type, skill.source_id || 'public');
   if (files.length === 0) throw new Error(`No files found for ${name}`);
 
   mkdirSync(targetDir, { recursive: true });
   for (const f of files) {
-    const content = await downloadFile(f.download_url);
     const targetPath = join(targetDir, f.path);
     mkdirSync(dirname(targetPath), { recursive: true });
-    writeFileSync(targetPath, content);
+    writeFileSync(targetPath, f.content);
   }
 
   // Update installed state

package/lib/task-manager.ts

@@ -69,6 +69,19 @@ export const taskModelOverrides = new Map<string, string>();
  */
 export const taskAppendSystemPromptOverrides = new Map<string, string>();
 
+/**
+ * Skill names attached to a task (parallel to the append-system-prompt
+ * override above). Purely for observability — surfaced in the task's
+ * init log so a pipeline run shows which skills it loaded.
+ */
+export const taskSkillsOverrides = new Map<string, string[]>();
+
+/** ` | Skills: a, b` for the init log, or '' when none attached. */
+function skillsLogSuffix(taskId: string): string {
+  const s = taskSkillsOverrides.get(taskId);
+  return s && s.length ? ` | Skills: ${s.join(', ')}` : '';
+}
+
 // ─── CRUD ────────────────────────────────────────────────────
 
 export function createTask(opts: {
@@ -538,7 +551,7 @@ function executeTmuxBackendTask(task: Task): Promise<void> {
 
   updateTaskStatus(task.id, 'running');
   db().prepare('UPDATE tasks SET started_at = datetime(\'now\') WHERE id = ?').run(task.id);
-  appendLog(task.id, { type: 'system', subtype: 'init', content: `Agent: ${(task as any).agent || 'claude'} | Backend: tmux`, timestamp: new Date().toISOString() });
+  appendLog(task.id, { type: 'system', subtype: 'init', content: `Agent: ${(task as any).agent || 'claude'} | Backend: tmux${skillsLogSuffix(task.id)}`, timestamp: new Date().toISOString() });
 
   return executeTmuxTask(task, {
     appendLog: (entry) => appendLog(task.id, entry),
@@ -670,7 +683,7 @@ function executeTask(task: Task): Promise<void> {
     console.log(`[task] ${task.projectName} [${agentName}${supportsModel && model ? '/' + model : ''}]: "${task.prompt.slice(0, 60)}..."`);
 
     // Log agent info as first entry
-    appendLog(task.id, { type: 'system', subtype: 'init', content: `Agent: ${agentName}${supportsModel && model && model !== 'default' ? ` | Model: ${model}` : ''}`, timestamp: new Date().toISOString() });
+    appendLog(task.id, { type: 'system', subtype: 'init', content: `Agent: ${agentName}${supportsModel && model && model !== 'default' ? ` | Model: ${model}` : ''}${skillsLogSuffix(task.id)}`, timestamp: new Date().toISOString() });
 
     const needsTTY = adapter.config.capabilities?.requiresTTY;
     let child: any;

package/lib/telegram-standalone.ts

@@ -4,6 +4,7 @@
  * Runs as a single process — no duplication from Next.js workers.
  */
 
+import './proxy-setup';   // MUST be first — see proxy-setup.ts header.
 import { loadSettings } from './settings';
 
 const settings = loadSettings();

package/lib/terminal-standalone.ts

@@ -24,6 +24,7 @@
  * Usage: npx tsx lib/terminal-standalone.ts
  */
 
+import './proxy-setup';   // MUST be first — see proxy-setup.ts header.
 import { WebSocketServer, WebSocket } from 'ws';
 import * as pty from 'node-pty';
 import { execSync } from 'node:child_process';

package/lib/workspace-standalone.ts

@@ -12,6 +12,7 @@
  *   FORGE_DATA_DIR  — data directory
  */
 
+import './proxy-setup';   // MUST be first — see proxy-setup.ts header.
 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';
 import { readdirSync, statSync } from 'node:fs';
 import { join, resolve } from 'node:path';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aion0/forge",
-  "version": "0.10.86",
+  "version": "0.10.88",
   "description": "Unified AI workflow platform — multi-model task orchestration, persistent sessions, web terminal, remote access",
   "type": "module",
   "scripts": {

package/src/core/db/database.ts

@@ -246,6 +246,13 @@ function initSchema(db: Database.Database) {
   // Local skills are kept across syncs (they're not in the remote registry,
   // so the deleted_remotely housekeeping would otherwise wipe them).
   migrate("ALTER TABLE skills ADD COLUMN source TEXT NOT NULL DEFAULT 'registry'");
+  // Multi-source skill sync (#354): which marketplace source a registry skill
+  // came from, so installGlobal knows where (and with what auth) to fetch its
+  // files. 'public' = the public forge-skills repo; otherwise an enterprise
+  // tenant_id. source_repo is "owner/repo", source_branch the ref.
+  migrate("ALTER TABLE skills ADD COLUMN source_id TEXT NOT NULL DEFAULT 'public'");
+  migrate("ALTER TABLE skills ADD COLUMN source_repo TEXT NOT NULL DEFAULT ''");
+  migrate("ALTER TABLE skills ADD COLUMN source_branch TEXT NOT NULL DEFAULT 'main'");
   migrate('ALTER TABLE project_pipelines ADD COLUMN last_run_at TEXT');
   migrate('ALTER TABLE pipeline_runs ADD COLUMN dedup_key TEXT');
   migrate("ALTER TABLE tasks ADD COLUMN agent TEXT DEFAULT 'claude'");