@aion0/forge 0.10.89 → 0.11.0

package/lib/kanban/seed.ts

@@ -0,0 +1,43 @@
+/**
+ * Seed kanban cards from connector-declared defaults. Each installed + enabled
+ * connector whose definition carries a `kanban` block (and isn't opted out via
+ * enabled:false) contributes its declared cards. Idempotent: a card is keyed by
+ * `<connectorId>#<index>` (seed_key) so re-seeding never duplicates, and a card
+ * the user later deleted stays deleted (its seed_key already exists only if the
+ * row exists — deleted rows are re-seeded; that's acceptable for a "restore
+ * defaults" action). The cards are DECLARATIVE — Forge core hardcodes nothing.
+ */
+
+import { listInstalledConnectors } from '../connectors/registry';
+import { createCard, existingSeedKeys } from './store';
+import type { KanbanCard, WithKanban } from './types';
+
+export function seedKanbanFromConnectors(): { created: KanbanCard[] } {
+  const have = existingSeedKeys();
+  const created: KanbanCard[] = [];
+
+  for (const inst of listInstalledConnectors()) {
+    if (!inst.enabled) continue;
+    // Read the kanban block structurally — the connector loader never parses it,
+    // so the core connector types stay free of any kanban coupling.
+    const def = inst.definition as unknown as WithKanban;
+    const kb = def.kanban;
+    if (!kb || kb.enabled === false) continue;
+    const cards = kb.cards || [];
+    cards.forEach((decl, i) => {
+      if (!decl?.prompt || !decl?.title) return;
+      const seedKey = `${def.id}#${i}`;
+      if (have.has(seedKey)) return;
+      created.push(createCard({
+        connectorId: def.id,
+        title: decl.title,
+        prompt: decl.prompt,
+        icon: decl.icon ?? def.icon ?? null,
+        periodSec: typeof decl.period_sec === 'number' && decl.period_sec > 0 ? decl.period_sec : undefined,
+        execMode: decl.mode === 'task' ? 'task' : 'inline',
+        seedKey,
+      }));
+    });
+  }
+  return { created };
+}

package/lib/kanban/store.ts

@@ -0,0 +1,219 @@
+/**
+ * Kanban dashboard SQLite store — table `kanban_cards`. Mirrors the
+ * lib/schedules/store.ts conventions (single workflow.db, ensureSchema guard,
+ * row mappers, ISO time). Card execution (connector-scoped LLM turn → WidgetSpec)
+ * lands in P2; this file is pure CRUD + result/status setters.
+ */
+
+import { randomUUID } from 'node:crypto';
+import { getDb } from '../../src/core/db/database';
+import { getDbPath } from '../../src/config';
+import { toIsoUTC } from '../iso-time';
+import type {
+  KanbanCard,
+  KanbanCardStatus,
+  WidgetSpec,
+  CreateKanbanCardInput,
+  UpdateKanbanCardInput,
+} from './types';
+
+function db() { return getDb(getDbPath()); }
+
+let ensured = false;
+export function ensureSchema(): void {
+  if (ensured) return;
+  db().exec(`
+    CREATE TABLE IF NOT EXISTS kanban_cards (
+      id            TEXT PRIMARY KEY,
+      connector_id  TEXT NOT NULL,
+      title         TEXT NOT NULL,
+      icon          TEXT,
+      prompt        TEXT NOT NULL,
+      period_sec    INTEGER NOT NULL DEFAULT 1800,
+      card_order    INTEGER NOT NULL DEFAULT 0,
+      enabled       INTEGER NOT NULL DEFAULT 1,
+      last_result   TEXT,
+      last_run_at   TEXT,
+      last_error    TEXT,
+      status        TEXT NOT NULL DEFAULT 'idle',
+      created_at    TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at    TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+    CREATE INDEX IF NOT EXISTS idx_kanban_order ON kanban_cards(card_order ASC);
+  `);
+  // Idempotent add: seed_key marks a card auto-created from a connector's
+  // declared default (so re-seeding doesn't duplicate). NULL = user-created.
+  try { db().exec('ALTER TABLE kanban_cards ADD COLUMN seed_key TEXT'); } catch { /* exists */ }
+  // Execution mode (inline default | task) + the task it's tied to in task mode.
+  try { db().exec("ALTER TABLE kanban_cards ADD COLUMN exec_mode TEXT NOT NULL DEFAULT 'inline'"); } catch { /* exists */ }
+  try { db().exec('ALTER TABLE kanban_cards ADD COLUMN task_id TEXT'); } catch { /* exists */ }
+  ensured = true;
+}
+
+/** seed_keys already present — lets seeding skip cards it already created. */
+export function existingSeedKeys(): Set<string> {
+  ensureSchema();
+  const rows = db().prepare(
+    "SELECT seed_key FROM kanban_cards WHERE seed_key IS NOT NULL",
+  ).all() as { seed_key: string }[];
+  return new Set(rows.map((r) => r.seed_key));
+}
+
+// ─── Row mapper ───────────────────────────────────────────
+
+function safeWidget(raw: unknown): WidgetSpec | null {
+  if (!raw || typeof raw !== 'string') return null;
+  try {
+    const v = JSON.parse(raw);
+    return v && typeof v === 'object' && Array.isArray((v as any).blocks) ? (v as WidgetSpec) : null;
+  } catch { return null; }
+}
+
+function rowToCard(r: any): KanbanCard {
+  return {
+    id: r.id,
+    connectorId: r.connector_id,
+    title: r.title,
+    icon: r.icon ?? null,
+    prompt: r.prompt,
+    periodSec: typeof r.period_sec === 'number' ? r.period_sec : 1800,
+    order: typeof r.card_order === 'number' ? r.card_order : 0,
+    enabled: !!r.enabled,
+    execMode: r.exec_mode === 'task' ? 'task' : 'inline',
+    taskId: r.task_id ?? null,
+    lastResult: safeWidget(r.last_result),
+    lastRunAt: toIsoUTC(r.last_run_at),
+    lastError: r.last_error ?? null,
+    status: (r.status as KanbanCardStatus) || 'idle',
+    createdAt: toIsoUTC(r.created_at) || r.created_at,
+    updatedAt: toIsoUTC(r.updated_at) || r.updated_at,
+  };
+}
+
+// ─── CRUD ─────────────────────────────────────────────────
+
+export function listCards(): KanbanCard[] {
+  ensureSchema();
+  const rows = db().prepare(
+    'SELECT * FROM kanban_cards ORDER BY card_order ASC, created_at ASC',
+  ).all() as any[];
+  return rows.map(rowToCard);
+}
+
+export function getCard(id: string): KanbanCard | null {
+  ensureSchema();
+  const r = db().prepare('SELECT * FROM kanban_cards WHERE id = ?').get(id) as any;
+  return r ? rowToCard(r) : null;
+}
+
+export function createCard(input: CreateKanbanCardInput): KanbanCard {
+  ensureSchema();
+  const id = `kb_${randomUUID().slice(0, 12).replace(/-/g, '')}`;
+  // Default order = append to the end.
+  const maxOrder = (db().prepare('SELECT MAX(card_order) AS m FROM kanban_cards').get() as { m: number | null }).m;
+  const order = typeof input.order === 'number' ? input.order : (maxOrder ?? -1) + 1;
+  db().prepare(`
+    INSERT INTO kanban_cards (id, connector_id, title, icon, prompt, period_sec, card_order, enabled, seed_key, exec_mode)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(
+    id,
+    input.connectorId,
+    input.title,
+    input.icon ?? null,
+    input.prompt,
+    input.periodSec ?? 1800,
+    order,
+    input.enabled === false ? 0 : 1,
+    input.seedKey ?? null,
+    input.execMode === 'task' ? 'task' : 'inline',
+  );
+  return getCard(id)!;
+}
+
+export function updateCard(id: string, patch: UpdateKanbanCardInput): boolean {
+  ensureSchema();
+  const sets: string[] = [];
+  const vals: any[] = [];
+  if (patch.title !== undefined)     { sets.push('title = ?');      vals.push(patch.title); }
+  if (patch.prompt !== undefined)    { sets.push('prompt = ?');     vals.push(patch.prompt); }
+  if (patch.icon !== undefined)      { sets.push('icon = ?');       vals.push(patch.icon ?? null); }
+  if (patch.periodSec !== undefined) { sets.push('period_sec = ?'); vals.push(patch.periodSec); }
+  if (patch.order !== undefined)     { sets.push('card_order = ?'); vals.push(patch.order); }
+  if (patch.enabled !== undefined)   { sets.push('enabled = ?');    vals.push(patch.enabled ? 1 : 0); }
+  if (patch.execMode !== undefined)  { sets.push('exec_mode = ?');  vals.push(patch.execMode === 'task' ? 'task' : 'inline'); }
+  if (sets.length === 0) return false;
+  sets.push("updated_at = datetime('now')");
+  vals.push(id);
+  return db().prepare(`UPDATE kanban_cards SET ${sets.join(', ')} WHERE id = ?`).run(...vals).changes > 0;
+}
+
+export function deleteCard(id: string): boolean {
+  ensureSchema();
+  return db().prepare('DELETE FROM kanban_cards WHERE id = ?').run(id).changes > 0;
+}
+
+/** Persist a batch of {id, order} — used by drag-to-reorder. */
+export function reorderCards(order: { id: string; order: number }[]): void {
+  ensureSchema();
+  const stmt = db().prepare("UPDATE kanban_cards SET card_order = ?, updated_at = datetime('now') WHERE id = ?");
+  const tx = db().transaction((rows: { id: string; order: number }[]) => {
+    for (const row of rows) stmt.run(row.order, row.id);
+  });
+  tx(order);
+}
+
+/** Cards due to run: enabled, not already running, and either never run or
+ *  past their period. Used by the kanban tick. */
+export function listDueCards(): KanbanCard[] {
+  ensureSchema();
+  const rows = db().prepare(`
+    SELECT * FROM kanban_cards
+     WHERE enabled = 1 AND status != 'running'
+       AND (last_run_at IS NULL
+            OR datetime(last_run_at, '+' || period_sec || ' seconds') <= datetime('now'))
+     ORDER BY (last_run_at IS NULL) DESC, last_run_at ASC
+  `).all() as any[];
+  return rows.map(rowToCard);
+}
+
+// ─── Run status / result (used by P2 executor + manual refresh) ──
+
+export function setCardRunning(id: string): void {
+  ensureSchema();
+  db().prepare("UPDATE kanban_cards SET status = 'running', updated_at = datetime('now') WHERE id = ?").run(id);
+}
+
+/** Mark a card running AND tie it to the dispatched task (task mode). */
+export function setCardTask(id: string, taskId: string): void {
+  ensureSchema();
+  db().prepare("UPDATE kanban_cards SET task_id = ?, status = 'running', updated_at = datetime('now') WHERE id = ?").run(taskId, id);
+}
+
+/** Find the card a task was dispatched for (used by the terminal listener). */
+export function getCardByTaskId(taskId: string): KanbanCard | null {
+  ensureSchema();
+  const r = db().prepare('SELECT * FROM kanban_cards WHERE task_id = ?').get(taskId) as any;
+  return r ? rowToCard(r) : null;
+}
+
+/** Store a successful run's WidgetSpec snapshot. */
+export function setCardResult(id: string, result: WidgetSpec): void {
+  ensureSchema();
+  db().prepare(`
+    UPDATE kanban_cards
+       SET last_result = ?, last_run_at = datetime('now'), last_error = NULL,
+           status = 'ok', updated_at = datetime('now')
+     WHERE id = ?
+  `).run(JSON.stringify(result), id);
+}
+
+/** Record a failed run — keep the previous snapshot (last_result) intact. */
+export function setCardError(id: string, error: string): void {
+  ensureSchema();
+  db().prepare(`
+    UPDATE kanban_cards
+       SET last_error = ?, last_run_at = datetime('now'), status = 'error',
+           updated_at = datetime('now')
+     WHERE id = ?
+  `).run(error, id);
+}

package/lib/kanban/task-executor.ts

@@ -0,0 +1,71 @@
+/**
+ * Kanban task-mode executor. For heavy / multi-step cards the inline streamLlm
+ * turn (executor.ts) chokes on big tool schemas; instead we dispatch a one-shot
+ * CLI task (the relay backend) that can work over many steps, then writes the
+ * final widget to <dataDir>/kanban/<cardId>/widget.json. The terminal listener
+ * (task-listener.ts) reads that file back into the card. Mirrors the Schedules
+ * V3 prompt-body dispatch pattern.
+ */
+
+import { createTask } from '../task-manager';
+import { ensureScratchProject, getProjectInfo, SCRATCH_PROJECT_NAME } from '../projects';
+import { WIDGET_SCHEMA_TEXT } from './executor';
+import { getCard, setCardTask, setCardError } from './store';
+import { ensureArtifactDir, clearWidgetFile, widgetFilePath } from './artifacts';
+
+/** Compose the task prompt: the card's own prompt + a fixed contract telling the
+ *  agent how to reach the connector and where to write the widget. */
+function composePrompt(connectorId: string, cardId: string, userPrompt: string): string {
+  const outFile = widgetFilePath(cardId);
+  return [
+    `You are generating a Forge home "kanban card" for the connector "${connectorId}".`,
+    '',
+    'TASK:',
+    userPrompt,
+    '',
+    'HOW TO GET DATA:',
+    `- Call connector tools with mcp__forge__call_connector, passing plugin_id="${connectorId}", tool="<toolName>", and the tool's args. The TASK above names the tools + args to use.`,
+    '- Do NOT call mcp__forge__list_connectors — its output is huge and will waste the run. You already know plugin_id; call the named tools directly.',
+    '- You may work in multiple steps and refine. Take the time to produce accurate, well-organized content.',
+    '',
+    'OUTPUT (required):',
+    `- Write the FINAL widget as a single JSON object to this exact path: ${outFile}`,
+    '- The JSON MUST match this schema (no markdown fences inside the file):',
+    WIDGET_SCHEMA_TEXT,
+    '- Keep it glanceable: short labels, group with the block types that fit the data.',
+    `- You MAY also write supplementary files into the same directory (e.g. report.md) and link to them from list/badge "href" as "/api/kanban/${cardId}/artifact/<filename>".`,
+    '- If a tool errors or returns nothing, still write a valid widget (a text block explaining the state).',
+    '',
+    `Success = ${outFile} exists and is valid JSON. Write it as your final action.`,
+  ].join('\n');
+}
+
+/** Dispatch a task-mode run. Returns the task id, or sets card error + returns
+ *  null on dispatch failure. Never throws. */
+export function runKanbanCardViaTask(cardId: string): string | null {
+  const card = getCard(cardId);
+  if (!card) return null;
+
+  try {
+    ensureScratchProject();
+    const project = getProjectInfo(SCRATCH_PROJECT_NAME);
+    if (!project) { setCardError(cardId, 'scratch project unavailable'); return null; }
+
+    ensureArtifactDir(cardId);
+    clearWidgetFile(cardId); // never read a stale widget from a prior run
+
+    const task = createTask({
+      projectName: project.name,
+      projectPath: project.path,
+      prompt: composePrompt(card.connectorId, cardId, card.prompt),
+      conversationId: '',           // one-shot, fresh conversation
+      // agent omitted → default CLI agent (the working relay backend)
+    });
+
+    setCardTask(cardId, task.id);
+    return task.id;
+  } catch (e) {
+    setCardError(cardId, `task dispatch failed: ${(e as Error).message}`);
+    return null;
+  }
+}

package/lib/kanban/task-listener.ts

@@ -0,0 +1,63 @@
+/**
+ * Settles task-mode kanban cards. Two paths, same logic:
+ *  - event: a global task listener fires on terminal status.
+ *  - reconcile: the tick / API sweep catches cards stuck 'running' whose task
+ *    already reached terminal (missed events from races / multi-worker / restart).
+ *
+ * The widget FILE wins over the task's exit code: the CLI often writes a valid
+ * widget.json and then exits non-zero ("Process exited with code 1") — that is
+ * still a success. Mirrors Schedules V3's settle + zombie reconciliation.
+ */
+
+import { onTaskEvent, getTask } from '../task-manager';
+import { getCardByTaskId, setCardResult, setCardError } from './store';
+import { readWidgetFile } from './artifacts';
+import { parseWidget } from './executor';
+import type { KanbanCard } from './types';
+
+const TERMINAL = new Set(['done', 'failed', 'cancelled', 'error']);
+let installed = false;
+
+export function installKanbanTaskListener(): void {
+  if (installed) return;
+  installed = true;
+  onTaskEvent((taskId, event, data) => {
+    if (event !== 'status' || !TERMINAL.has(String(data))) return;
+    try { settleKanbanTask(taskId); } catch (e) {
+      console.error(`[kanban] settle task ${taskId} failed: ${(e as Error).message}`);
+    }
+  });
+}
+
+/** Settle one card from its (terminal) task. File wins over exit code. */
+export function settleKanbanTask(taskId: string): void {
+  const card = getCardByTaskId(taskId);
+  if (!card) return; // not a kanban task
+
+  const fromFile = readWidgetFile(card.id);
+  if (fromFile) { setCardResult(card.id, fromFile); return; }
+
+  const t = getTask(taskId);
+  const fromSummary = t?.resultSummary ? parseWidget(t.resultSummary) : null;
+  if (fromSummary) { setCardResult(card.id, fromSummary); return; }
+
+  setCardError(card.id, t?.error || 'task finished but wrote no widget.json');
+}
+
+/** Backstop for missed terminal events: settle any task-mode card stuck in
+ *  'running' whose task is already terminal (or whose task row is gone). */
+export function reconcileRunningKanbanTaskCards(cards: KanbanCard[]): void {
+  for (const c of cards) {
+    if (c.execMode !== 'task' || c.status !== 'running' || !c.taskId) continue;
+    const t = getTask(c.taskId);
+    if (!t) {
+      // Task row vanished but a widget may still be on disk — prefer it.
+      const w = readWidgetFile(c.id);
+      if (w) setCardResult(c.id, w); else setCardError(c.id, 'task row gone');
+      continue;
+    }
+    if (TERMINAL.has(String(t.status))) {
+      try { settleKanbanTask(c.taskId); } catch { /* keep going */ }
+    }
+  }
+}

package/lib/kanban/tick.ts

@@ -0,0 +1,41 @@
+/**
+ * Kanban tick — find due cards and run them. Driven by the same loop that
+ * ticks schedules (period reuse, per-card cadence). Inline cards run in-process
+ * (sequential, a single in-flight guard prevents overlap); task-mode cards are
+ * dispatched as one-shot tasks (fire-and-forget — the task listener settles
+ * them) with a small per-tick cap so the board can't flood the task queue.
+ */
+
+import { listCards, listDueCards } from './store';
+import { runKanbanCard } from './executor';
+import { runKanbanCardViaTask } from './task-executor';
+import { installKanbanTaskListener, reconcileRunningKanbanTaskCards } from './task-listener';
+
+let running = false;
+const MAX_TASK_DISPATCH_PER_TICK = 2;
+
+export async function kanbanTick(): Promise<void> {
+  if (running) return;
+  running = true;
+  installKanbanTaskListener(); // idempotent; ensures task cards get settled
+  reconcileRunningKanbanTaskCards(listCards()); // backstop for missed events
+  try {
+    const due = listDueCards();
+    let taskDispatched = 0;
+    for (const card of due) {
+      try {
+        if (card.execMode === 'task') {
+          if (taskDispatched >= MAX_TASK_DISPATCH_PER_TICK) continue; // next tick
+          runKanbanCardViaTask(card.id); // async; listener settles on terminal
+          taskDispatched++;
+        } else {
+          await runKanbanCard(card.id);
+        }
+      } catch (e) {
+        console.warn(`[kanban] card ${card.id} (${card.connectorId}) failed: ${(e as Error).message}`);
+      }
+    }
+  } finally {
+    running = false;
+  }
+}

package/lib/kanban/types.ts

@@ -0,0 +1,104 @@
+/**
+ * Kanban dashboard — types. A card = one connector + a prompt + a period.
+ * The card's prompt runs (connector-scoped LLM turn) and must return a
+ * WidgetSpec, which a generic renderer draws. See
+ * obsidian forge/forge-kanban-dashboard-design.md.
+ */
+
+export type WidgetColor =
+  | 'gray' | 'red' | 'amber' | 'yellow' | 'green' | 'emerald' | 'blue' | 'violet';
+
+/** The constrained block vocabulary the card LLM may emit. The renderer maps
+ *  each to a component; unknown types degrade to 'text' so it never crashes.
+ *  Deliberately NOT free HTML — keeps it XSS/injection-safe and visually
+ *  consistent. Extend the union (+ renderer) to add new block kinds. */
+export type WidgetBlock =
+  | { type: 'metric_row'; items: { label: string; value: string | number; color?: WidgetColor }[] }
+  | { type: 'list'; items: { text: string; badge?: string; badgeColor?: WidgetColor; sub?: string; href?: string; avatar?: string }[] }
+  | { type: 'stat'; value: string | number; label: string; delta?: string; deltaColor?: WidgetColor }
+  | { type: 'progress'; label: string; value: number; max: number; color?: WidgetColor }
+  | { type: 'table'; columns: string[]; rows: string[][] }
+  | { type: 'badges'; items: { text: string; color?: WidgetColor }[] }
+  | { type: 'callout'; text: string; color?: WidgetColor; icon?: string }
+  | { type: 'text'; markdown: string };
+
+export interface WidgetSpec {
+  accent?: WidgetColor;
+  blocks: WidgetBlock[];
+  footer?: string;
+}
+
+export type KanbanCardStatus = 'idle' | 'running' | 'ok' | 'error';
+
+/** How a card's prompt is executed:
+ *  - inline: fast headless streamLlm turn (API profile) — simple cards.
+ *  - task:   dispatched as a one-shot CLI task (relay backend) that can do
+ *            multi-step work + write the widget to a file. Heavy cards. */
+export type KanbanExecMode = 'inline' | 'task';
+
+export interface KanbanCard {
+  id: string;
+  connectorId: string;        // card runs scoped to THIS connector's tools
+  title: string;
+  icon?: string | null;       // emoji
+  prompt: string;             // what to pull + how to summarize
+  periodSec: number;          // refresh cadence (per card)
+  order: number;              // drag-to-reorder
+  enabled: boolean;
+  execMode: KanbanExecMode;   // inline (default) | task
+  taskId?: string | null;     // current/last dispatched task (task mode)
+  lastResult?: WidgetSpec | null;
+  lastRunAt?: string | null;
+  lastError?: string | null;
+  status: KanbanCardStatus;
+  createdAt: string;
+  updatedAt: string;
+  /** Derived (not stored): the connector's website / base_url, attached by the
+   *  API so the card can link out. */
+  connectorUrl?: string | null;
+}
+
+export interface CreateKanbanCardInput {
+  connectorId: string;
+  title: string;
+  prompt: string;
+  icon?: string | null;
+  periodSec?: number;         // default 1800
+  order?: number;
+  enabled?: boolean;
+  execMode?: KanbanExecMode;  // default 'inline'
+  seedKey?: string;           // set when auto-created from a connector default
+}
+
+export interface UpdateKanbanCardInput {
+  title?: string;
+  prompt?: string;
+  icon?: string | null;
+  periodSec?: number;
+  order?: number;
+  enabled?: boolean;
+  execMode?: KanbanExecMode;
+}
+
+// ─── Connector-declared kanban defaults ───────────────────
+// These live HERE (not in lib/connectors/types.ts) on purpose: the core
+// connector subsystem stays untouched, so old connectors load exactly as
+// before. seed.ts reads `definition.kanban` via a structural cast — a manifest
+// `kanban:` block is plain pass-through YAML the connector loader never parses.
+
+export interface ConnectorKanban {
+  enabled?: boolean;          // default: true when `cards` is non-empty
+  cards?: KanbanCardDecl[];
+}
+
+export interface KanbanCardDecl {
+  title: string;
+  icon?: string;
+  prompt: string;
+  period_sec?: number;        // refresh cadence; default 1800
+  mode?: KanbanExecMode;      // 'task' for heavy multi-step cards; default inline
+}
+
+/** A connector definition that may carry kanban defaults — used by seed.ts to
+ *  read the field without coupling lib/connectors/types.ts to kanban. */
+export type WithKanban = { id: string; icon?: string | null; kanban?: ConnectorKanban };

package/lib/schedules/scheduler.ts

@@ -83,6 +83,12 @@ async function tick(): Promise<void> {
       console.error(`[schedules-scheduler] execute ${s.id} crashed`, err);
     });
   }
+
+  // Kanban cards reuse this same tick (per-card period). Lazy-imported so the
+  // scheduler module doesn't statically pull in the chat agent-loop graph.
+  void import('../kanban/tick')
+    .then(({ kanbanTick }) => kanbanTick())
+    .catch((e) => console.warn(`[kanban] tick failed: ${(e as Error).message}`));
 }
 
 function toSqlIso(d: Date): string {

package/lib/task-manager.ts

@@ -5,7 +5,9 @@
 
 import { randomUUID } from 'node:crypto';
 import { spawn, execSync } from 'node:child_process';
-import { realpathSync } from 'node:fs';
+import { realpathSync, existsSync } from 'node:fs';
+import { join as pathJoin } from 'node:path';
+import { getConfigDir } from './dirs';
 import * as pty from 'node-pty';
 import { getDb } from '../src/core/db/database';
 import { getDbPath } from '../src/config';
@@ -676,6 +678,14 @@ function executeTask(task: Task): Promise<void> {
     const env = { ...process.env, ...connectorEnv(), ...(spawnOpts.env || {}) };
     delete env.CLAUDECODE;
 
+    // Corporate SSL: if the server was launched without NODE_EXTRA_CA_CERTS but
+    // a CA bundle exists at <configDir>/corporate-ca.pem, wire it through so the
+    // spawned CLI doesn't die with "SSL certificate verification failed".
+    if (!env.NODE_EXTRA_CA_CERTS) {
+      const corpCa = pathJoin(getConfigDir(), 'corporate-ca.pem');
+      if (existsSync(corpCa)) env.NODE_EXTRA_CA_CERTS = corpCa;
+    }
+
     updateTaskStatus(task.id, 'running');
     db().prepare('UPDATE tasks SET started_at = datetime(\'now\') WHERE id = ?').run(task.id);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aion0/forge",
-  "version": "0.10.89",
+  "version": "0.11.0",
   "description": "Unified AI workflow platform — multi-model task orchestration, persistent sessions, web terminal, remote access",
   "type": "module",
   "engines": {
@@ -50,7 +50,7 @@
     "better-sqlite3": "^12.6.2",
     "cron-parser": "^5.5.0",
     "esbuild": "^0.27.3",
-    "next": "^16.2.1",
+    "next": "^16.2.9",
     "next-auth": "5.0.0-beta.30",
     "node-pty": "1.0.0",
     "nodemailer": "^6.10.1",

package/publish.sh

@@ -55,7 +55,7 @@ echo ""
 # checked separately, so they're excluded.
 echo "Verifying clean build before publish ..."
 rm -rf .next
-npx next build --webpack
+npx next build
 TSC_ERRORS=$(npx tsc --noEmit 2>&1 | grep "error TS" | grep -v "__tests__" || true)
 if [ -n "$TSC_ERRORS" ]; then
   echo "$TSC_ERRORS"