@aion0/forge 0.5.24 → 0.5.26

package/.forge/worktrees/pipeline-e97c13c7/lib/logger.ts

@@ -0,0 +1,79 @@
+/**
+ * Logger — adds timestamps + writes to forge.log file.
+ * Call `initLogger()` once at startup.
+ * Works in both dev mode (terminal + file) and production (file via redirect).
+ */
+
+import { appendFileSync, mkdirSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+
+// Use globalThis to prevent double-init across forge-server.mjs and init.ts
+const loggerKey = Symbol.for('forge-logger-init');
+
+export function initLogger() {
+  if ((globalThis as any)[loggerKey]) return;
+  (globalThis as any)[loggerKey] = true;
+
+  // Determine log file path
+  // In production mode (FORGE_EXTERNAL_SERVICES=1), stdout is already redirected to forge.log
+  // by forge-server.mjs, so we only need to write to file in dev mode
+  const isProduction = process.env.FORGE_EXTERNAL_SERVICES === '1';
+  let logFile: string | null = null;
+  if (!isProduction) {
+    try {
+      const { getDataDir } = require('./dirs');
+      const dataDir = getDataDir();
+      if (!existsSync(dataDir)) mkdirSync(dataDir, { recursive: true });
+      logFile = join(dataDir, 'forge.log');
+    } catch {}
+  }
+
+  const origLog = console.log;
+  const origError = console.error;
+  const origWarn = console.warn;
+
+  const ts = () => new Date().toISOString().replace('T', ' ').slice(0, 19);
+
+  const writeToFile = (line: string) => {
+    if (!logFile) return;
+    try { appendFileSync(logFile, line + '\n'); } catch {}
+  };
+
+  const SENSITIVE_PATTERNS = [
+    /(\d{8,})/g,                                    // session codes (8+ digits)
+    /(bot\d+:[A-Za-z0-9_-]{30,})/gi,               // telegram bot tokens
+    /(enc:[A-Za-z0-9+/=.]+)/g,                      // encrypted values
+    /(sk-ant-[A-Za-z0-9_-]+)/g,                     // anthropic API keys
+    /(sk-[A-Za-z0-9]{20,})/g,                       // openai API keys
+  ];
+
+  const sanitize = (str: string): string => {
+    let result = str;
+    for (const pattern of SENSITIVE_PATTERNS) {
+      result = result.replace(pattern, (match) => match.slice(0, 4) + '****');
+    }
+    return result;
+  };
+
+  const format = (...args: any[]): string => {
+    return args.map(a => typeof a === 'string' ? a : JSON.stringify(a)).join(' ');
+  };
+
+  console.log = (...args: any[]) => {
+    const line = `[${ts()}] ${format(...args)}`;
+    origLog(line);
+    writeToFile(sanitize(line));
+  };
+
+  console.error = (...args: any[]) => {
+    const line = `[${ts()}] [ERROR] ${format(...args)}`;
+    origError(line);
+    writeToFile(sanitize(line));
+  };
+
+  console.warn = (...args: any[]) => {
+    const line = `[${ts()}] [WARN] ${format(...args)}`;
+    origWarn(line);
+    writeToFile(sanitize(line));
+  };
+}

package/.forge/worktrees/pipeline-e97c13c7/lib/notifications.ts

@@ -0,0 +1,75 @@
+/**
+ * In-app notification system.
+ * Stores notifications in SQLite, auto-cleans based on retention setting.
+ */
+
+import { getDb } from '@/src/core/db/database';
+import { getDbPath } from '@/src/config';
+import { loadSettings } from './settings';
+
+export interface Notification {
+  id: number;
+  type: string;     // 'task_done' | 'task_failed' | 'pipeline_done' | 'pipeline_failed' | 'tunnel' | 'system'
+  title: string;
+  body: string | null;
+  read: boolean;
+  taskId: string | null;
+  createdAt: string;
+}
+
+function db() {
+  return getDb(getDbPath());
+}
+
+/** Add a notification */
+export function addNotification(type: string, title: string, body?: string, taskId?: string) {
+  db().prepare(
+    'INSERT INTO notifications (type, title, body, task_id) VALUES (?, ?, ?, ?)'
+  ).run(type, title, body || null, taskId || null);
+}
+
+/** Get recent notifications (newest first) */
+export function getNotifications(limit = 50, offset = 0): Notification[] {
+  const rows = db().prepare(
+    'SELECT * FROM notifications ORDER BY created_at DESC LIMIT ? OFFSET ?'
+  ).all(limit, offset) as any[];
+  return rows.map(r => ({
+    id: r.id,
+    type: r.type,
+    title: r.title,
+    body: r.body,
+    read: !!r.read,
+    taskId: r.task_id,
+    createdAt: r.created_at ? (r.created_at.endsWith('Z') ? r.created_at : r.created_at.replace(' ', 'T') + 'Z') : r.created_at,
+  }));
+}
+
+/** Count unread notifications */
+export function getUnreadCount(): number {
+  const row = db().prepare('SELECT COUNT(*) as count FROM notifications WHERE read = 0').get() as any;
+  return row?.count || 0;
+}
+
+/** Mark one as read */
+export function markRead(id: number) {
+  db().prepare('UPDATE notifications SET read = 1 WHERE id = ?').run(id);
+}
+
+/** Mark all as read */
+export function markAllRead() {
+  db().prepare('UPDATE notifications SET read = 1 WHERE read = 0').run();
+}
+
+/** Delete one notification */
+export function deleteNotification(id: number) {
+  db().prepare('DELETE FROM notifications WHERE id = ?').run(id);
+}
+
+/** Clean up old notifications based on retention setting */
+export function cleanupNotifications() {
+  const settings = loadSettings();
+  const days = settings.notificationRetentionDays || 30;
+  db().prepare(
+    `DELETE FROM notifications WHERE created_at < datetime('now', '-' || ? || ' days')`
+  ).run(days);
+}

package/.forge/worktrees/pipeline-e97c13c7/lib/notify.ts

@@ -0,0 +1,108 @@
+/**
+ * Notification module — sends task updates via Telegram.
+ */
+
+import { loadSettings } from './settings';
+import { addNotification } from './notifications';
+import type { Task } from '@/src/types';
+
+export async function notifyTaskComplete(task: Task) {
+  // Skip pipeline tasks
+  let isPipeline = false;
+  try { const { pipelineTaskIds } = require('./pipeline'); isPipeline = pipelineTaskIds.has(task.id); } catch {}
+  if (isPipeline) return;
+
+  const cost = task.costUSD != null ? `$${task.costUSD.toFixed(4)}` : 'unknown';
+  const duration = task.startedAt && task.completedAt
+    ? formatDuration(new Date(task.completedAt).getTime() - new Date(task.startedAt).getTime())
+    : 'unknown';
+  const model = task.log?.find(e => e.subtype === 'init' && e.content.startsWith('Model:'))?.content.replace('Model: ', '') || 'unknown';
+
+  // In-app notification (always)
+  try {
+    addNotification(
+      'task_done',
+      `Task done: ${task.projectName}`,
+      `${task.prompt.slice(0, 100)} — ${duration}, ${cost}`,
+      task.id
+    );
+  } catch {}
+
+  const settings = loadSettings();
+  if (!settings.notifyOnComplete) return;
+
+  await sendTelegram(
+    `✅ *Task Done*\n\n` +
+    `*Project:* ${esc(task.projectName)}\n` +
+    `*Task:* ${esc(task.prompt.slice(0, 200))}\n` +
+    `*Model:* ${esc(model)}\n` +
+    `*Duration:* ${duration}\n` +
+    `*Cost:* ${cost}\n\n` +
+    `${task.resultSummary ? `*Result:*\n${esc(task.resultSummary.slice(0, 500))}` : '_No summary_'}`
+  );
+}
+
+export async function notifyTaskFailed(task: Task) {
+  // Skip pipeline tasks
+  let isPipeline = false;
+  try { const { pipelineTaskIds } = require('./pipeline'); isPipeline = pipelineTaskIds.has(task.id); } catch {}
+  if (isPipeline) return;
+
+  // In-app notification (always)
+  try {
+    addNotification(
+      'task_failed',
+      `Task failed: ${task.projectName}`,
+      task.error || task.prompt.slice(0, 100),
+      task.id
+    );
+  } catch {}
+
+  const settings = loadSettings();
+  if (!settings.notifyOnFailure) return;
+
+  await sendTelegram(
+    `❌ *Task Failed*\n\n` +
+    `*Project:* ${esc(task.projectName)}\n` +
+    `*Task:* ${esc(task.prompt.slice(0, 200))}\n` +
+    `*Error:* ${esc(task.error || 'Unknown error')}`
+  );
+}
+
+async function sendTelegram(text: string) {
+  const settings = loadSettings();
+  const { telegramBotToken, telegramChatId } = settings;
+
+  if (!telegramBotToken || !telegramChatId) return;
+
+  try {
+    const url = `https://api.telegram.org/bot${telegramBotToken}/sendMessage`;
+    const res = await fetch(url, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        chat_id: telegramChatId,
+        text,
+        parse_mode: 'Markdown',
+        disable_web_page_preview: true,
+      }),
+    });
+
+    if (!res.ok) {
+      console.error('[notify] Telegram error:', res.status, await res.text());
+    }
+  } catch (err) {
+    console.error('[notify] Telegram send failed:', err);
+  }
+}
+
+// Escape Markdown special characters
+function esc(s: string): string {
+  return s.replace(/[_*[\]()~`>#+=|{}.!-]/g, '\\$&');
+}
+
+function formatDuration(ms: number): string {
+  if (ms < 60000) return `${Math.round(ms / 1000)}s`;
+  if (ms < 3600000) return `${Math.floor(ms / 60000)}m ${Math.round((ms % 60000) / 1000)}s`;
+  return `${Math.floor(ms / 3600000)}h ${Math.floor((ms % 3600000) / 60000)}m`;
+}

package/.forge/worktrees/pipeline-e97c13c7/lib/password.ts

@@ -0,0 +1,97 @@
+/**
+ * Password management.
+ *
+ * - Admin password: set in Settings, encrypted in settings.yaml
+ *   Used for: local login, tunnel start, secret changes, Telegram commands
+ * - Session code: random 8-digit numeric, generated each time tunnel starts
+ *   Used for: remote login 2FA (admin password + session code)
+ *
+ * Local login: admin password only
+ * Remote login (tunnel): admin password + session code
+ */
+
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { randomInt } from 'node:crypto';
+import { getDataDir } from './dirs';
+
+const DATA_DIR = getDataDir();
+const SESSION_CODE_FILE = join(DATA_DIR, 'session-code.json');
+
+/** Generate a random 8-digit numeric code */
+function generateSessionCode(): string {
+  return String(randomInt(10000000, 99999999));
+}
+
+function readSessionCode(): string {
+  try {
+    if (!existsSync(SESSION_CODE_FILE)) return '';
+    const data = JSON.parse(readFileSync(SESSION_CODE_FILE, 'utf-8'));
+    return data?.code || '';
+  } catch {
+    return '';
+  }
+}
+
+function saveSessionCode(code: string) {
+  const dir = dirname(SESSION_CODE_FILE);
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  writeFileSync(SESSION_CODE_FILE, JSON.stringify({ code }), { mode: 0o600 });
+}
+
+/** Get the admin password from settings */
+export function getAdminPassword(): string {
+  try {
+    const { loadSettings } = require('./settings');
+    const settings = loadSettings();
+    return settings.telegramTunnelPassword || '';
+  } catch {
+    return '';
+  }
+}
+
+/** Get current session code (empty if none) */
+export function getSessionCode(): string {
+  return readSessionCode();
+}
+
+/** Generate new session code. Called on tunnel start. */
+export function rotateSessionCode(): string {
+  const code = generateSessionCode();
+  saveSessionCode(code);
+  console.log(`[password] New session code: ****${code.slice(-2)}`);
+  return code;
+}
+
+/**
+ * Verify login credentials.
+ * @param password - admin password
+ * @param sessionCode - session code (required for remote, empty for local)
+ * @param isRemote - true if accessing via tunnel
+ */
+export function verifyLogin(password: string, sessionCode?: string, isRemote?: boolean): boolean {
+  if (!password) return false;
+
+  const admin = getAdminPassword();
+  if (!admin) return false;
+  if (password !== admin) return false;
+
+  // Remote access requires session code as 2FA
+  if (isRemote) {
+    const currentCode = readSessionCode();
+    if (!currentCode || sessionCode !== currentCode) return false;
+  }
+
+  return true;
+}
+
+/**
+ * Verify admin password for privileged operations
+ * (tunnel start, secret changes, Telegram commands).
+ */
+export function verifyAdmin(input: string): boolean {
+  if (!input) return false;
+  const admin = getAdminPassword();
+  return admin ? input === admin : false;
+}
+