@aion0/forge 0.5.26 → 0.5.27

package/.forge/worktrees/pipeline-4dd8dc2d/CLAUDE.md

@@ -0,0 +1,86 @@
+## Project: Forge (@aion0/forge)
+
+### Scripts
+```bash
+# ── Start ──
+./start.sh              # production (kill old processes → build → start)
+./start.sh dev           # development (hot-reload)
+forge server start              # production via npm link/install
+forge server start --dev        # dev mode
+forge server start              # background by default, logs to ~/.forge/forge.log
+forge server start --foreground # foreground mode
+forge server stop               # stop default instance (port 8403)
+forge server stop --port 4000 --dir ~/.forge-staging  # stop specific instance
+forge server restart            # stop + start (safe for remote)
+forge server rebuild            # force rebuild
+forge server start --port 4000 --terminal-port 4001 --dir ~/.forge-staging
+forge server start --reset-terminal  # kill terminal server (loses tmux attach)
+forge --version                 # show version
+
+# ── Test ──
+./dev-test.sh            # test instance (port 4000, data ~/.forge-test)
+
+# ── Install ──
+./install.sh             # install from npm
+./install.sh --local     # install from local source (npm link + build)
+
+# ── Publish ──
+./publish.sh             # bump patch version, commit, tag
+./publish.sh minor       # bump minor
+./publish.sh 1.0.0       # explicit version
+npm login && npm publish --access public --otp=<code>
+
+# ── Monitor ──
+./check-forge-status.sh  # show process status + tmux sessions
+
+# ── CLI ──
+forge                    # help
+forge --version          # show version
+forge tcode              # show tunnel URL + session code
+forge tasks              # list tasks
+forge task <project> "prompt"  # submit task
+forge watch <id>         # live stream task output
+```
+
+### Key Paths
+- Data: `~/.forge/` (settings, db, password, terminal-state, flows, bin)
+- npm package: `@aion0/forge`
+- GitHub: `github.com/aiwatching/forge`
+
+### Help Docs Rule
+When adding or changing a feature, check if `lib/help-docs/` needs updating. Each file covers one module:
+- `00-overview.md` — install, start, data paths
+- `01-settings.md` — all settings fields
+- `02-telegram.md` — bot setup and commands
+- `03-tunnel.md` — remote access
+- `04-tasks.md` — background tasks
+- `05-pipelines.md` — DAG workflows
+- `06-skills.md` — marketplace
+- `07-projects.md` — project management
+- `08-rules.md` — CLAUDE.md templates
+- `09-issue-autofix.md` — GitHub issue scanner
+- `10-troubleshooting.md` — common issues
+If a feature change affects user-facing behavior, update the corresponding help doc in the same commit.
+
+### Architecture
+- `forge-server.mjs` starts: Next.js + terminal-standalone + telegram-standalone
+- `pnpm dev` / `start.sh dev` starts: Next.js (init.ts spawns terminal + telegram)
+- `FORGE_EXTERNAL_SERVICES=1` → init.ts skips spawning (forge-server manages them)
+
+## Obsidian Vault
+Location: /Users/zliu/MyDocuments/obsidian-project/Projects/Bastion
+When I ask about my notes, use bash to search and read files from this directory.
+Example: find /Users/zliu/MyDocuments/obsidian-project -name "*.md" | head -20
+
+<!-- forge:template:obsidian-vault -->
+## Obsidian Vault
+When I ask about my notes, use bash to search and read files from the vault directory.
+Example: find <vault_path> -name "*.md" | head -20
+<!-- /forge:template:obsidian-vault -->
+
+
+<!-- FORGE:BEGIN -->
+## Forge Workspace Integration
+When you finish processing a task or message from Forge, end your final response with the marker: [FORGE_DONE]
+This helps Forge detect task completion. Do not include this marker if you are still working.
+<!-- FORGE:END -->

package/.forge/worktrees/pipeline-4dd8dc2d/README.md

@@ -0,0 +1,136 @@
+<p align="center">
+  <img src="app/icon.ico" width="80" height="80" alt="Forge">
+</p>
+
+<h1 align="center">Forge</h1>
+
+<p align="center">
+  <strong>Self-hosted Vibe Coding platform for Claude Code</strong><br>
+  Browser terminal · AI tasks · Remote access · Telegram bot
+</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/@aion0/forge"><img src="https://img.shields.io/npm/v/@aion0/forge" alt="npm"></a>
+  <a href="https://github.com/aiwatching/forge/blob/main/LICENSE"><img src="https://img.shields.io/npm/l/@aion0/forge" alt="MIT"></a>
+  <a href="https://github.com/aiwatching/forge"><img src="https://img.shields.io/github/stars/aiwatching/forge?style=social" alt="stars"></a>
+</p>
+
+<p align="center">
+  <a href="https://www.youtube.com/watch?v=F3fiSiP3pZY">Watch Demo →</a>
+</p>
+
+---
+
+## Demo & Install Guide
+
+[![Forge Install Guide](https://img.youtube.com/vi/F3fiSiP3pZY/maxresdefault.jpg)](https://www.youtube.com/watch?v=F3fiSiP3pZY)
+
+## Install
+
+```bash
+npm install -g @aion0/forge
+forge server start
+```
+
+Open `http://localhost:8403`. First launch prompts you to set an admin password.
+
+**Requirements:** Node.js ≥ 20, tmux, [Claude Code CLI](https://docs.anthropic.com/en/docs/claude-code)
+
+## What is Forge?
+
+Forge turns Claude Code into a remote-accessible coding platform. Run it on your machine, access from any device.
+
+- **Vibe Code anywhere** — iPad, phone, any browser. Persistent tmux sessions survive refresh/restart
+- **Background AI tasks** — Submit prompts that run while you sleep. Live output, cost tracking
+- **Pipeline workflows** — Chain Claude Code steps in YAML (design → implement → review)
+- **Remote access** — One-click Cloudflare Tunnel, no account needed
+- **Telegram bot** — Create tasks, check status, take notes from your phone
+- **Skills marketplace** — Browse & install Claude Code slash commands
+
+No API keys required. Uses your existing Claude Code subscription. Code never leaves your machine.
+
+## Multi-Agent Workspace <sup>v0.5.0</sup>
+
+Define agent teams with roles, dependencies, and steps. Agents run as daemons and communicate via a structured message bus.
+
+```mermaid
+graph LR
+    Input["📋 Requirements"] --> PM["🎯 PM"]
+    PM --> Eng["🔨 Engineer"]
+    Eng --> QA["🧪 QA"]
+    Eng --> Rev["👁 Reviewer"]
+    QA --> Rev
+
+    style Input fill:#f0883e,stroke:#f0883e,color:#fff
+    style PM fill:#a371f7,stroke:#a371f7,color:#fff
+    style Eng fill:#58a6ff,stroke:#58a6ff,color:#fff
+    style QA fill:#3fb950,stroke:#3fb950,color:#fff
+    style Rev fill:#f778ba,stroke:#f778ba,color:#fff
+```
+
+- **Agent profiles** — Reusable configs with env vars, model overrides, custom API endpoints (Claude, Codex, Aider)
+- **Message system** — Notifications (follow DAG) + Tickets (any direction, retry limits) with causedBy tracing
+- **Manual mode** — Open a terminal on any agent, work interactively, return to auto
+- **Watch manager** — Monitor files, git, or commands. Auto-analyze or require approval on changes
+
+## Features
+
+| | |
+|---|---|
+| **Multi-Agent Workspace** | Agent teams with DAG dependencies, message bus, watch monitoring, manual/auto mode |
+| **Vibe Coding** | Browser tmux terminal, multi-tab, split panes, WebGL, Ctrl+F search |
+| **AI Tasks** | Background Claude Code execution with live streaming output |
+| **Pipelines** | YAML DAG workflows with parallel execution & visual editor |
+| **Remote Access** | Cloudflare Tunnel with 2FA (password + session code) |
+| **Docs Viewer** | Obsidian / markdown rendering with AI assistant |
+| **Projects** | File browser, git operations, code viewer with syntax highlighting, diff view |
+| **Skills** | Marketplace for skills & commands — browse, install, update, version tracking |
+| **Telegram** | Tasks, sessions, notes, tunnel control from mobile |
+| **CLI** | `forge task`, `forge watch`, `forge status`, and more |
+
+## Quick Start
+
+```bash
+forge server start              # start (background by default)
+forge server start --foreground # run in foreground
+forge server start --dev        # dev mode with hot-reload
+forge server stop               # stop
+forge server restart            # restart
+```
+
+### From source
+
+```bash
+git clone https://github.com/aiwatching/forge.git
+cd forge && pnpm install
+./start.sh          # production
+./start.sh dev      # development
+```
+
+## CLI
+
+```bash
+forge task <project> <prompt>   # submit a task
+forge tasks                     # list tasks
+forge watch <id>                # live stream output
+forge status                    # process status
+forge tcode                     # show tunnel URL + session code
+forge projects                  # list projects
+forge flows                     # list workflows
+forge run <flow>                # run a workflow
+forge --reset-password               # reset admin password
+```
+
+## Telegram Bot
+
+Create a bot via [@BotFather](https://t.me/botfather), add the token in Settings.
+
+`/task` — create task · `/tasks` — list · `/sessions` — AI summary · `/note` — quick note · `/tunnel_start` — start tunnel · `/watch` — monitor session
+
+## Data
+
+All data in `~/.forge/` — settings, database, terminal state, workflows, logs. Configurable via `--dir` flag.
+
+## License
+
+[MIT](LICENSE)

package/.forge/worktrees/pipeline-4dd8dc2d/RELEASE_NOTES.md

@@ -0,0 +1,36 @@
+# Forge v0.5.26
+
+Released: 2026-04-06
+
+## Changes since v0.5.25
+
+### Features
+- feat: add review-mr as builtin pipeline
+- feat: all pipeline steps use worktree, no shell mode exception
+- feat: pipeline steps auto-use git worktree for isolated execution
+
+### Bug Fixes
+- fix: pipeline tasks use same model as normal tasks, no pipelineModel override
+- fix: task model selection — treat 'default' as fall-through
+- fix: ignore stdin + parse worktree field in pipeline nodes
+- fix: spawn claude without shell, resolve path via which
+- fix: remove shell: '/bin/zsh' from claude spawn to prevent arg interpretation
+- fix: all pipeline steps use worktree, shell gets env vars
+- fix: all pipeline steps use worktree, shell gets env vars
+- fix: shell/plugin pipeline steps skip worktree, run in project dir
+- fix: only auto-worktree for agent/prompt mode, not shell steps
+- fix: resolve rebase conflicts and fix anti-loop guard in messaging
+
+### Documentation
+- docs: update pipeline help with worktree env vars for shell steps
+
+### Other
+- try some fixes 2
+- try some fixes
+- daemon is exclusive writer of state.json
+- skip auth in dev mode
+- fix terminal copy/paste and selection
+- add noreply and inbox to workspace messaging
+
+
+**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.5.25...v0.5.26

package/.forge/worktrees/pipeline-4dd8dc2d/app/api/agents/route.ts

@@ -0,0 +1,17 @@
+import { NextResponse } from 'next/server';
+import { listAgents, getDefaultAgentId, resolveTerminalLaunch } from '@/lib/agents';
+
+export async function GET(req: Request) {
+  const url = new URL(req.url);
+  const resolve = url.searchParams.get('resolve');
+
+  // GET /api/agents?resolve=claude → resolve terminal launch info for an agent
+  if (resolve) {
+    const info = resolveTerminalLaunch(resolve);
+    return NextResponse.json(info);
+  }
+
+  const agents = listAgents();
+  const defaultAgent = getDefaultAgentId();
+  return NextResponse.json({ agents, defaultAgent });
+}

package/.forge/worktrees/pipeline-4dd8dc2d/app/api/auth/[...nextauth]/route.ts

@@ -0,0 +1,3 @@
+import { handlers } from '@/lib/auth';
+
+export const { GET, POST } = handlers;

package/.forge/worktrees/pipeline-4dd8dc2d/app/api/auth/verify/route.ts

@@ -0,0 +1,46 @@
+import { NextResponse } from 'next/server';
+import { randomUUID } from 'node:crypto';
+
+// In-memory valid tokens — shared across API routes in the same process
+const tokenKey = Symbol.for('forge-api-tokens');
+const g = globalThis as any;
+if (!g[tokenKey]) g[tokenKey] = new Set<string>();
+export const validTokens: Set<string> = g[tokenKey];
+
+/** Verify a token is valid (for use in other API routes) */
+export function isValidToken(req: Request): boolean {
+  // Check header
+  const headerToken = new Headers(req.headers).get('x-forge-token');
+  if (headerToken && validTokens.has(headerToken)) return true;
+  // Check cookie
+  const cookieHeader = new Headers(req.headers).get('cookie') || '';
+  const match = cookieHeader.match(/forge-api-token=([^;]+)/);
+  if (match && validTokens.has(match[1])) return true;
+  return false;
+}
+
+export async function POST(req: Request) {
+  const body = await req.json();
+  const { password } = body;
+
+  if (!password) {
+    return NextResponse.json({ error: 'password required' }, { status: 400 });
+  }
+
+  const { verifyAdmin } = await import('@/lib/password');
+  if (!verifyAdmin(password)) {
+    return NextResponse.json({ error: 'invalid password' }, { status: 401 });
+  }
+
+  const token = randomUUID();
+  validTokens.add(token);
+
+  const res = NextResponse.json({ ok: true, token });
+  res.cookies.set('forge-api-token', token, {
+    httpOnly: true,
+    sameSite: 'lax',
+    maxAge: 86400,
+    path: '/',
+  });
+  return res;
+}

package/.forge/worktrees/pipeline-4dd8dc2d/app/api/claude/[id]/route.ts

@@ -0,0 +1,31 @@
+import { NextResponse } from 'next/server';
+import { getProcess, sendToClaudeSession, killProcess } from '@/lib/claude-process';
+
+// Get session info
+export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  const proc = getProcess(id);
+  if (!proc) return NextResponse.json({ error: 'Not found' }, { status: 404 });
+  return NextResponse.json(proc);
+}
+
+// Send a message to the Claude session
+export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  const body = await req.json();
+
+  if (body.type === 'message') {
+    const ok = sendToClaudeSession(id, body.content, body.conversationId);
+    if (!ok) {
+      return NextResponse.json({ error: 'Session not found or already running' }, { status: 400 });
+    }
+    return NextResponse.json({ ok: true });
+  }
+
+  if (body.type === 'kill') {
+    killProcess(id);
+    return NextResponse.json({ ok: true });
+  }
+
+  return NextResponse.json({ error: 'Unknown type' }, { status: 400 });
+}

package/.forge/worktrees/pipeline-4dd8dc2d/app/api/claude/[id]/stream/route.ts

@@ -0,0 +1,63 @@
+import { attachToProcess } from '@/lib/claude-process';
+
+export const dynamic = 'force-dynamic';
+export const runtime = 'nodejs';
+
+// SSE stream of Claude Code structured messages
+export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+
+  const encoder = new TextEncoder();
+  let unsubscribe: (() => void) | null = null;
+  let heartbeat: ReturnType<typeof setInterval> | null = null;
+  let closed = false;
+
+  const stream = new ReadableStream({
+    start(controller) {
+      // Heartbeat every 15s to keep connection alive
+      heartbeat = setInterval(() => {
+        if (!closed) {
+          try {
+            controller.enqueue(encoder.encode(': heartbeat\n\n'));
+          } catch {
+            // Controller closed
+            cleanup();
+          }
+        }
+      }, 15000);
+
+      unsubscribe = attachToProcess(id, (msg) => {
+        if (closed) return;
+        try {
+          controller.enqueue(encoder.encode(`data: ${JSON.stringify(msg)}\n\n`));
+        } catch {
+          cleanup();
+        }
+      });
+
+      if (!unsubscribe) {
+        controller.enqueue(encoder.encode(`data: ${JSON.stringify({ type: 'system', subtype: 'error', content: 'Session not found' })}\n\n`));
+        cleanup();
+        controller.close();
+      }
+    },
+    cancel() {
+      cleanup();
+    },
+  });
+
+  function cleanup() {
+    closed = true;
+    if (heartbeat) { clearInterval(heartbeat); heartbeat = null; }
+    if (unsubscribe) { unsubscribe(); unsubscribe = null; }
+  }
+
+  return new Response(stream, {
+    headers: {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache, no-transform',
+      Connection: 'keep-alive',
+      'X-Accel-Buffering': 'no',
+    },
+  });
+}

package/.forge/worktrees/pipeline-4dd8dc2d/app/api/claude/route.ts

@@ -0,0 +1,28 @@
+import { NextResponse } from 'next/server';
+import { createClaudeSession, listProcesses, deleteSession } from '@/lib/claude-process';
+import { getProjectInfo } from '@/lib/projects';
+
+// List all Claude Code sessions
+export async function GET() {
+  return NextResponse.json(listProcesses());
+}
+
+// Create a new Claude Code session for a project
+export async function POST(req: Request) {
+  const { projectName } = await req.json();
+
+  const project = getProjectInfo(projectName);
+  if (!project) {
+    return NextResponse.json({ error: `Project not found: ${projectName}` }, { status: 404 });
+  }
+
+  const session = createClaudeSession(project.name, project.path);
+  return NextResponse.json(session);
+}
+
+// Delete a session
+export async function DELETE(req: Request) {
+  const { id } = await req.json();
+  deleteSession(id);
+  return NextResponse.json({ ok: true });
+}

package/.forge/worktrees/pipeline-4dd8dc2d/app/api/claude-sessions/[projectName]/entries/route.ts

@@ -0,0 +1,23 @@
+import { NextResponse } from 'next/server';
+import { getSessionFilePath, readSessionEntries } from '@/lib/claude-sessions';
+import { statSync } from 'node:fs';
+
+export async function GET(req: Request, { params }: { params: Promise<{ projectName: string }> }) {
+  const { projectName } = await params;
+  const url = new URL(req.url);
+  const sessionId = url.searchParams.get('sessionId');
+
+  if (!sessionId) {
+    return NextResponse.json({ error: 'sessionId required' }, { status: 400 });
+  }
+
+  const filePath = getSessionFilePath(decodeURIComponent(projectName), sessionId);
+  if (!filePath) {
+    return NextResponse.json({ entries: [], count: 0, fileSize: 0 });
+  }
+
+  const entries = readSessionEntries(filePath);
+  let fileSize = 0;
+  try { fileSize = statSync(filePath).size; } catch {}
+  return NextResponse.json({ entries, count: entries.length, fileSize });
+}

package/.forge/worktrees/pipeline-4dd8dc2d/app/api/claude-sessions/[projectName]/live/route.ts

@@ -0,0 +1,72 @@
+import { getSessionFilePath, readSessionEntries, tailSessionFile } from '@/lib/claude-sessions';
+
+export const dynamic = 'force-dynamic';
+export const runtime = 'nodejs';
+
+export async function GET(req: Request, { params }: { params: Promise<{ projectName: string }> }) {
+  const { projectName } = await params;
+  const url = new URL(req.url);
+  const sessionId = url.searchParams.get('sessionId');
+
+  if (!sessionId) {
+    return new Response('sessionId parameter required', { status: 400 });
+  }
+
+  const filePath = getSessionFilePath(decodeURIComponent(projectName), sessionId);
+  if (!filePath) {
+    return new Response('Session file not found', { status: 404 });
+  }
+
+  const encoder = new TextEncoder();
+  let cleanup: (() => void) | null = null;
+  let heartbeat: ReturnType<typeof setInterval> | null = null;
+  let closed = false;
+
+  const stream = new ReadableStream({
+    start(controller) {
+      // Send all existing entries
+      const existing = readSessionEntries(filePath);
+      controller.enqueue(encoder.encode(`data: ${JSON.stringify({ type: 'init', entries: existing })}\n\n`));
+
+      // Heartbeat
+      heartbeat = setInterval(() => {
+        if (!closed) {
+          try { controller.enqueue(encoder.encode(': heartbeat\n\n')); } catch { doCleanup(); }
+        }
+      }, 15000);
+
+      // Tail for new entries
+      cleanup = tailSessionFile(
+        filePath,
+        (entries) => {
+          if (closed) return;
+          try {
+            controller.enqueue(encoder.encode(`data: ${JSON.stringify({ type: 'update', entries })}\n\n`));
+          } catch { doCleanup(); }
+        },
+        () => {
+          doCleanup();
+          try { controller.close(); } catch {}
+        },
+      );
+    },
+    cancel() {
+      doCleanup();
+    },
+  });
+
+  function doCleanup() {
+    closed = true;
+    if (heartbeat) { clearInterval(heartbeat); heartbeat = null; }
+    if (cleanup) { cleanup(); cleanup = null; }
+  }
+
+  return new Response(stream, {
+    headers: {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache, no-transform',
+      Connection: 'keep-alive',
+      'X-Accel-Buffering': 'no',
+    },
+  });
+}

package/.forge/worktrees/pipeline-4dd8dc2d/app/api/claude-sessions/[projectName]/route.ts

@@ -0,0 +1,37 @@
+import { NextResponse } from 'next/server';
+import { listClaudeSessions, deleteSession } from '@/lib/claude-sessions';
+import { getDb } from '@/src/core/db/database';
+import { getDbPath } from '@/src/config';
+
+export async function GET(_req: Request, { params }: { params: Promise<{ projectName: string }> }) {
+  const { projectName } = await params;
+  const sessions = listClaudeSessions(decodeURIComponent(projectName));
+  return NextResponse.json(sessions);
+}
+
+export async function DELETE(req: Request, { params }: { params: Promise<{ projectName: string }> }) {
+  const { projectName } = await params;
+  const project = decodeURIComponent(projectName);
+  const body = await req.json();
+
+  // Support both single sessionId and batch sessionIds
+  const ids: string[] = body.sessionIds || (body.sessionId ? [body.sessionId] : []);
+
+  if (ids.length === 0) {
+    return NextResponse.json({ error: 'sessionId or sessionIds required' }, { status: 400 });
+  }
+
+  const db = getDb(getDbPath());
+  let deletedCount = 0;
+
+  for (const id of ids) {
+    if (deleteSession(project, id)) {
+      deletedCount++;
+    }
+    try {
+      db.prepare('DELETE FROM cached_sessions WHERE project_name = ? AND session_id = ?').run(project, id);
+    } catch {}
+  }
+
+  return NextResponse.json({ ok: true, deleted: deletedCount });
+}

package/.forge/worktrees/pipeline-4dd8dc2d/app/api/claude-sessions/sync/route.ts

@@ -0,0 +1,17 @@
+import { NextResponse } from 'next/server';
+import { ensureInitialized } from '@/lib/init';
+import { syncSessionsToDb, getAllCachedSessions } from '@/lib/session-watcher';
+
+export async function GET() {
+  ensureInitialized();
+  const all = getAllCachedSessions();
+  return NextResponse.json(all);
+}
+
+export async function POST(req: Request) {
+  ensureInitialized();
+  const body = await req.json().catch(() => ({}));
+  const count = syncSessionsToDb(body.projectName);
+  const all = getAllCachedSessions();
+  return NextResponse.json({ synced: count, sessions: all });
+}