@aion0/forge 0.5.42 → 0.5.44

package/RELEASE_NOTES.md

@@ -1,8 +1,20 @@
-# Forge v0.5.42
+# Forge v0.5.44
 
-Released: 2026-04-23
+Released: 2026-04-26
 
-## Changes since v0.5.41
+## Changes since v0.5.43
 
+### Features
+- feat: IntelliJ plugin — Forge tool window + agent terminal launcher
+- feat: vscode extension scaffold — workspace/terminal/task views + native session picker
 
-**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.5.41...v0.5.42
+### Documentation
+- docs: add 13-ide-plugins.md covering VSCode + IntelliJ plugins
+- feat(vscode-ext): connections, pipelines, docs, deep-link to web UI
+
+### Other
+- feat(vscode-ext): connections, pipelines, docs, deep-link to web UI
+- feat(vscode-ext): workspace bootstrap, daemon control, smith click + actions
+
+
+**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.5.43...v0.5.44

package/components/Dashboard.tsx

@@ -98,6 +98,20 @@ function FloatingBrowser({ onClose }: { onClose: () => void }) {
 
 export default function Dashboard({ user }: { user: any }) {
   const [viewMode, setViewMode] = useState<'tasks' | 'sessions' | 'terminal' | 'docs' | 'projects' | 'pipelines' | 'workspace' | 'skills' | 'logs' | 'usage'>('terminal');
+
+  // Honour `?view=<mode>` from the URL so external links (eg the VSCode
+  // extension) can deep-link straight into a section. Only views that have a
+  // top-level render branch are accepted. `workspace` and `sessions` live
+  // inside ProjectDetail, so they alias to `projects` (where you pick the
+  // project that contains the workspace/session).
+  useEffect(() => {
+    const raw = new URLSearchParams(window.location.search).get('view');
+    if (!raw) return;
+    const aliases: Record<string, string> = { workspace: 'projects', sessions: 'projects' };
+    const v = aliases[raw] || raw;
+    const valid = ['tasks', 'terminal', 'docs', 'projects', 'pipelines', 'skills', 'logs', 'usage'];
+    if (valid.includes(v)) setViewMode(v as any);
+  }, []);
   // workspaceProject state kept for forge:open-terminal event compatibility
   const [workspaceProject, setWorkspaceProject] = useState<{ name: string; path: string } | null>(null);
   const [browserMode, setBrowserMode] = useState<'none' | 'float' | 'right' | 'left'>('none');
@@ -148,6 +162,11 @@ export default function Dashboard({ user }: { user: any }) {
   }, []);
   useEffect(() => { refreshDisplayName(); }, [refreshDisplayName]);
 
+  // Reflect the current user's name in the browser tab title
+  useEffect(() => {
+    document.title = displayName && displayName !== 'Forge' ? `Forge — ${displayName}` : 'Forge';
+  }, [displayName]);
+
   // Listen for open-terminal events from ProjectManager
   useEffect(() => {
     const handler = (e: Event) => {
@@ -278,7 +297,9 @@ export default function Dashboard({ user }: { user: any }) {
       <header className="h-12 border-b-2 border-[var(--border)] flex items-center justify-between px-4 shrink-0 bg-[var(--bg-secondary)]">
         <div className="flex items-center gap-4">
           <img src="/icon.png" alt="Forge" width={28} height={28} className="rounded" />
-          <span className="text-sm font-bold text-[var(--accent)]">Forge</span>
+          <span className="text-sm font-bold text-[var(--accent)]">
+            Forge{displayName && displayName !== 'Forge' ? ` · ${displayName}` : ''}
+          </span>
           {versionInfo && (
             <span className="flex items-center gap-1.5">
               <span className="text-[10px] text-[var(--text-secondary)]">v{versionInfo.current}</span>

package/components/WorkspaceView.tsx

@@ -34,6 +34,7 @@ interface AgentConfig {
 interface AgentState {
   smithStatus: 'down' | 'starting' | 'active';
   taskStatus: 'idle' | 'running' | 'done' | 'failed';
+  paused?: boolean;
   currentStep?: number;
   tmuxSession?: string;
   artifacts: { type: string; path?: string; summary?: string }[];
@@ -2794,6 +2795,7 @@ interface AgentNodeData {
   workspaceId: string | null;
   onRun: () => void;
   onPause: () => void;
+  onResume: () => void;
   onStop: () => void;
   onRetry: () => void;
   onEdit: () => void;
@@ -3307,7 +3309,7 @@ function WorkerMascot({ taskStatus, smithStatus, seed, accentColor, theme }: { t
 }
 
 function AgentFlowNode({ data }: NodeProps<Node<AgentNodeData>>) {
-  const { config, state, colorIdx, previewLines, projectPath, workspaceId, onRun, onPause, onStop, onRetry, onEdit, onRemove, onMessage, onApprove, onShowLog, onShowMemory, onShowInbox, onOpenTerminal, onSwitchSession, onSaveAsTemplate, mascotTheme, bellOn = false, onToggleBell, inboxPending = 0, inboxFailed = 0 } = data;
+  const { config, state, colorIdx, previewLines, projectPath, workspaceId, onRun, onPause, onResume, onStop, onRetry, onEdit, onRemove, onMessage, onApprove, onShowLog, onShowMemory, onShowInbox, onOpenTerminal, onSwitchSession, onSaveAsTemplate, mascotTheme, bellOn = false, onToggleBell, inboxPending = 0, inboxFailed = 0 } = data;
   const c = COLORS[colorIdx % COLORS.length];
   const smithStatus = state?.smithStatus || 'down';
   const taskStatus = state?.taskStatus || 'idle';
@@ -3426,10 +3428,20 @@ function AgentFlowNode({ data }: NodeProps<Node<AgentNodeData>>) {
           </>
         )}
         {/* Message button — send instructions to agent */}
-        {smithStatus === 'active' && taskStatus !== 'running' && (
+        {smithStatus === 'active' && taskStatus !== 'running' && !state?.paused && (
           <button onPointerDown={e => e.stopPropagation()} onClick={e => { e.stopPropagation(); onMessage(); }}
             className="text-[9px] px-1.5 py-0.5 rounded bg-blue-600/20 text-blue-400 hover:bg-blue-600/30">💬 Message</button>
         )}
+        {/* Pause / Resume — icon-only so it doesn't widen the card */}
+        {smithStatus !== 'down' && config.type !== 'input' && (
+          <button onPointerDown={e => e.stopPropagation()}
+            onClick={e => { e.stopPropagation(); state?.paused ? onResume() : onPause(); }}
+            className={`text-[9px] px-1 ${state?.paused ? 'text-orange-400 hover:text-orange-300' : 'text-gray-600 hover:text-orange-400'}`}
+            title={state?.paused
+              ? 'Paused — click to resume bus pickups and watch alerts'
+              : 'Pause — drop new bus messages and watch alerts as failed (in-flight task continues)'}
+          >{state?.paused ? '▶' : '⏸'}</button>
+        )}
         <div className="flex-1" />
         <span className="flex items-center">
             <button onPointerDown={e => e.stopPropagation()}
@@ -3733,6 +3745,7 @@ function WorkspaceViewInner({ projectPath, projectName, onClose }: {
               wsApi(workspaceId!, 'run', { agentId: agent.id });
             },
             onPause: () => wsApi(workspaceId!, 'pause', { agentId: agent.id }),
+            onResume: () => wsApi(workspaceId!, 'resume', { agentId: agent.id }),
             onStop: () => wsApi(workspaceId!, 'stop', { agentId: agent.id }),
             mascotTheme,
             bellOn: bellAgents.has(agent.id),

package/intellij-plugin/README.md

@@ -0,0 +1,53 @@
+# Forge IntelliJ Plugin
+
+Native IntelliJ IDEA / JetBrains IDE integration for [Forge](https://github.com/aiwatching/forge).
+Mirrors (in progress) the feature set of the VSCode extension.
+
+## Status — v0.1.0 (scaffold)
+
+- [x] Project structure (Gradle Kotlin DSL + IntelliJ Platform Plugin v1.17 + Kotlin 1.9)
+- [x] `plugin.xml` — registers tool window, settings page, status bar widget, actions
+- [x] Multi-connection support — persisted to `forge.xml` application state
+- [x] Auth via PasswordSafe (per-connection token)
+- [x] HTTP client (`java.net.http.HttpClient` + Gson)
+- [x] Status bar widget — shows connection name + connectivity, click switches
+- [x] Settings UI — edit connections, pick active
+- [x] Login / Logout / Switch Connection / Open Web UI actions
+
+## Coming next
+
+- [ ] Tool window tabs:
+  - [ ] Workspaces — projects, smiths, daemon control, Inbox/Log expansion
+  - [ ] Terminals — list active forge tmux sessions, attach
+  - [ ] Pipelines — project-bound bindings, recent runs, node detail markdown
+  - [ ] Docs — file tree (local file:// or remote forge-docs:// VFS)
+- [ ] Smith terminal attach (custom JediTerm session over forge WebSocket)
+- [ ] Pipeline node result viewer
+- [ ] Workspace bootstrap from current project root
+- [ ] Send selection to forge terminal
+
+## Build
+
+```bash
+cd intellij-plugin
+./gradlew buildPlugin           # produces build/distributions/forge-intellij-0.1.0.zip
+./gradlew runIde                # launches a sandbox IntelliJ with the plugin loaded
+```
+
+## Install locally
+
+After `buildPlugin`:
+1. JetBrains IDE → Settings → Plugins → ⚙ → "Install Plugin from Disk…"
+2. Pick `build/distributions/forge-intellij-0.1.0.zip`
+3. Restart IDE
+4. View → Tool Windows → Forge
+
+Then **Tools → Forge: Login** to authenticate against the active connection.
+
+## Settings
+
+Settings → Tools → Forge:
+- Connections table (add / edit / remove)
+- Active connection name
+
+Tokens are stored separately in IntelliJ's PasswordSafe — clear via **Tools → Forge: Logout**.

package/intellij-plugin/build.gradle.kts

@@ -0,0 +1,60 @@
+plugins {
+    id("org.jetbrains.kotlin.jvm") version "2.0.21"
+    id("org.jetbrains.intellij.platform") version "2.15.0"
+}
+
+group = "com.aion0.forge"
+version = "0.1.19"
+
+repositories {
+    mavenCentral()
+    intellijPlatform {
+        defaultRepositories()
+    }
+}
+
+dependencies {
+    intellijPlatform {
+        intellijIdeaCommunity("2024.1")
+        // Bundled terminal plugin — needed for TerminalView (smith terminal attach).
+        bundledPlugin("org.jetbrains.plugins.terminal")
+    }
+}
+
+kotlin {
+    jvmToolchain(17)
+}
+
+// Force every Kotlin compile task (and its worker JVM) to run on JDK 17
+// instead of the host JDK (25 on this machine, which crashes Kotlin's
+// internal version parser).
+val jdk17Launcher = javaToolchains.launcherFor {
+    languageVersion = JavaLanguageVersion.of(17)
+}
+tasks.withType<org.jetbrains.kotlin.gradle.tasks.KotlinCompile>().configureEach {
+    kotlinJavaToolchain.toolchain.use(jdk17Launcher)
+}
+
+intellijPlatform {
+    buildSearchableOptions = false
+
+    pluginConfiguration {
+        version = "0.1.19"
+        ideaVersion {
+            sinceBuild = "241"
+            // Don't pin untilBuild — keeps the plugin compatible with newer
+            // IDEs until the platform actually breaks something.
+            untilBuild = provider { null }
+        }
+    }
+
+    // `gradle publishPlugin` uploads to the JetBrains Marketplace.
+    // Get a permanent token at https://plugins.jetbrains.com/author/me/tokens
+    // and export it as JETBRAINS_MARKETPLACE_TOKEN before running.
+    publishing {
+        token = providers.environmentVariable("JETBRAINS_MARKETPLACE_TOKEN")
+        // Use "default" for stable releases. Switch to "beta" / "eap" for
+        // pre-releases (users opt in via the IDE plugin settings).
+        channels = listOf("default")
+    }
+}

package/intellij-plugin/gradle/gradle-daemon-jvm.properties

@@ -0,0 +1,12 @@
+#This file is generated by updateDaemonJvm
+toolchainUrl.FREE_BSD.AARCH64=https\://api.foojay.io/disco/v3.0/ids/40b4344c056b4284246d176d9701577f/redirect
+toolchainUrl.FREE_BSD.X86_64=https\://api.foojay.io/disco/v3.0/ids/466f185020ff3c07ab32696653613a8d/redirect
+toolchainUrl.LINUX.AARCH64=https\://api.foojay.io/disco/v3.0/ids/40b4344c056b4284246d176d9701577f/redirect
+toolchainUrl.LINUX.X86_64=https\://api.foojay.io/disco/v3.0/ids/466f185020ff3c07ab32696653613a8d/redirect
+toolchainUrl.MAC_OS.AARCH64=https\://api.foojay.io/disco/v3.0/ids/1050b2216f8beaaecc1289b17d30b586/redirect
+toolchainUrl.MAC_OS.X86_64=https\://api.foojay.io/disco/v3.0/ids/2208feeb3d4e12f412e9a450db1a842a/redirect
+toolchainUrl.UNIX.AARCH64=https\://api.foojay.io/disco/v3.0/ids/40b4344c056b4284246d176d9701577f/redirect
+toolchainUrl.UNIX.X86_64=https\://api.foojay.io/disco/v3.0/ids/466f185020ff3c07ab32696653613a8d/redirect
+toolchainUrl.WINDOWS.AARCH64=https\://api.foojay.io/disco/v3.0/ids/3676ee7aa5095d7f22645eb0f22ca159/redirect
+toolchainUrl.WINDOWS.X86_64=https\://api.foojay.io/disco/v3.0/ids/69a793dd932268c7d1ae9d8b855de8ed/redirect
+toolchainVersion=17

package/intellij-plugin/gradle.properties

@@ -0,0 +1,9 @@
+kotlin.stdlib.default.dependency=false
+org.gradle.jvmargs=-Xmx2g -XX:+UseG1GC
+org.gradle.caching=true
+org.gradle.parallel=true
+# Force Gradle itself to use the toolchain-provisioned JDK 17 instead of the
+# host JDK (which is 25 on this machine and breaks the Kotlin compiler).
+org.gradle.java.installations.auto-download=true
+# Don't let the Kotlin daemon silently fall back to the host JVM (25).
+kotlin.daemon.useFallbackStrategy=false

package/intellij-plugin/publish.sh

@@ -0,0 +1,78 @@
+#!/bin/bash
+# Publish the Forge IntelliJ plugin to the JetBrains Marketplace.
+#
+# Usage:
+#   ./publish.sh                # publish current version in build.gradle.kts
+#   ./publish.sh patch          # bump patch (0.1.19 → 0.1.20) + publish
+#   ./publish.sh minor          # bump minor (0.1.x → 0.2.0) + publish
+#   ./publish.sh major          # bump major (0.x.x → 1.0.0) + publish
+#   ./publish.sh 0.5.0          # publish exact version
+#
+# Auth: get a permanent token at https://plugins.jetbrains.com/author/me/tokens
+# and export it as JETBRAINS_MARKETPLACE_TOKEN. The first publish must go
+# through the JetBrains Marketplace upload form for moderation; subsequent
+# updates can use this script.
+#
+# Requires JDK 17 — Gradle's Kotlin compiler crashes on the host JDK 25.
+
+set -euo pipefail
+cd "$(dirname "$0")"
+
+if [[ -z "${JETBRAINS_MARKETPLACE_TOKEN:-}" ]]; then
+    echo "ERROR: set JETBRAINS_MARKETPLACE_TOKEN env var first." >&2
+    echo "  Get one at https://plugins.jetbrains.com/author/me/tokens" >&2
+    exit 1
+fi
+
+ARG="${1:-}"
+
+bump_version() {
+    local kind="$1"
+    local current
+    current=$(grep -E '^version = "' build.gradle.kts | head -1 | sed -E 's/^version = "([^"]+)".*/\1/')
+    local new
+    case "$kind" in
+        patch|minor|major)
+            local major minor patch
+            IFS='.' read -r major minor patch <<<"$current"
+            case "$kind" in
+                patch) patch=$((patch + 1)) ;;
+                minor) minor=$((minor + 1)); patch=0 ;;
+                major) major=$((major + 1)); minor=0; patch=0 ;;
+            esac
+            new="${major}.${minor}.${patch}"
+            ;;
+        *)
+            new="$kind"
+            ;;
+    esac
+    echo "→ Bumping $current → $new"
+    # Replace both `version = "..."` (top-level) and `version = "..."` (in pluginConfiguration).
+    sed -i.bak -E "s/version = \"$current\"/version = \"$new\"/g" build.gradle.kts
+    rm -f build.gradle.kts.bak
+}
+
+case "$ARG" in
+    "")
+        ;;
+    patch|minor|major)
+        bump_version "$ARG"
+        ;;
+    *)
+        if [[ "$ARG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            bump_version "$ARG"
+        else
+            echo "Unknown argument: $ARG" >&2
+            echo "Usage: $0 [patch|minor|major|x.y.z]" >&2
+            exit 1
+        fi
+        ;;
+esac
+
+VERSION=$(grep -E '^version = "' build.gradle.kts | head -1 | sed -E 's/^version = "([^"]+)".*/\1/')
+echo "→ Publishing version $VERSION to JetBrains Marketplace…"
+
+JAVA_HOME="$(/usr/libexec/java_home -v 17)" gradle publishPlugin
+
+echo "✓ Published Forge Vibe Coding v$VERSION"
+echo "→ https://plugins.jetbrains.com/author/me/plugins"

package/intellij-plugin/settings.gradle.kts

@@ -0,0 +1,7 @@
+// Foojay resolver auto-downloads JDK 17 if the host doesn't have one,
+// so users don't need to install Java separately.
+plugins {
+    id("org.gradle.toolchains.foojay-resolver-convention") version "1.0.0"
+}
+
+rootProject.name = "forge-intellij"

package/intellij-plugin/src/main/kotlin/com/aion0/forge/action/LoginAction.kt

@@ -0,0 +1,49 @@
+package com.aion0.forge.action
+
+import com.aion0.forge.api.ForgeClient
+import com.aion0.forge.connection.ConnectionManager
+import com.intellij.notification.NotificationGroupManager
+import com.intellij.notification.NotificationType
+import com.intellij.openapi.actionSystem.AnAction
+import com.intellij.openapi.actionSystem.AnActionEvent
+import com.intellij.openapi.application.ApplicationManager
+import com.intellij.openapi.progress.ProgressIndicator
+import com.intellij.openapi.progress.Task
+import com.intellij.openapi.ui.Messages
+
+class LoginAction : AnAction() {
+    override fun actionPerformed(e: AnActionEvent) {
+        val project = e.project
+        val active = ConnectionManager.get().active()
+        val pw = Messages.showPasswordDialog(
+            project,
+            "Admin password for ${active.name} (${active.serverUrl})",
+            "Forge Login",
+            null,
+        ) ?: return
+
+        ProgressManager().queue(project, "Forge: signing in") {
+            val res = ForgeClient.get().login(pw)
+            ApplicationManager.getApplication().invokeLater {
+                val group = NotificationGroupManager.getInstance().getNotificationGroup("Forge")
+                if (res.ok) {
+                    group.createNotification("Forge: logged in to ${active.name}", NotificationType.INFORMATION)
+                        .notify(project)
+                } else {
+                    group.createNotification("Forge login failed: ${res.error}", NotificationType.ERROR)
+                        .notify(project)
+                }
+            }
+        }
+    }
+}
+
+private class ProgressManager {
+    fun queue(project: com.intellij.openapi.project.Project?, title: String, work: () -> Unit) {
+        com.intellij.openapi.progress.ProgressManager.getInstance().run(
+            object : Task.Backgroundable(project, title, false) {
+                override fun run(indicator: ProgressIndicator) { work() }
+            },
+        )
+    }
+}

package/intellij-plugin/src/main/kotlin/com/aion0/forge/action/LogoutAction.kt

@@ -0,0 +1,18 @@
+package com.aion0.forge.action
+
+import com.aion0.forge.api.ForgeClient
+import com.aion0.forge.connection.ConnectionManager
+import com.intellij.notification.NotificationGroupManager
+import com.intellij.notification.NotificationType
+import com.intellij.openapi.actionSystem.AnAction
+import com.intellij.openapi.actionSystem.AnActionEvent
+
+class LogoutAction : AnAction() {
+    override fun actionPerformed(e: AnActionEvent) {
+        val active = ConnectionManager.get().active()
+        ForgeClient.get().logout()
+        NotificationGroupManager.getInstance().getNotificationGroup("Forge")
+            .createNotification("Forge: logged out of ${active.name}", NotificationType.INFORMATION)
+            .notify(e.project)
+    }
+}

package/intellij-plugin/src/main/kotlin/com/aion0/forge/action/OpenWebUIAction.kt

@@ -0,0 +1,13 @@
+package com.aion0.forge.action
+
+import com.aion0.forge.connection.ConnectionManager
+import com.intellij.ide.BrowserUtil
+import com.intellij.openapi.actionSystem.AnAction
+import com.intellij.openapi.actionSystem.AnActionEvent
+
+class OpenWebUIAction : AnAction() {
+    override fun actionPerformed(e: AnActionEvent) {
+        val url = ConnectionManager.get().active().serverUrl
+        BrowserUtil.browse(url)
+    }
+}

package/intellij-plugin/src/main/kotlin/com/aion0/forge/action/SwitchConnectionAction.kt

@@ -0,0 +1,26 @@
+package com.aion0.forge.action
+
+import com.aion0.forge.connection.ConnectionManager
+import com.intellij.openapi.actionSystem.AnAction
+import com.intellij.openapi.actionSystem.AnActionEvent
+import com.intellij.openapi.ui.popup.JBPopupFactory
+import com.intellij.openapi.ui.popup.PopupStep
+import com.intellij.openapi.ui.popup.util.BaseListPopupStep
+
+class SwitchConnectionAction : AnAction() {
+    override fun actionPerformed(e: AnActionEvent) {
+        val mgr = ConnectionManager.get()
+        val items = mgr.list().map { it.name }
+        if (items.isEmpty()) return
+        val active = mgr.active().name
+        val popup = JBPopupFactory.getInstance()
+            .createListPopup(object : BaseListPopupStep<String>("Switch Forge Connection", items) {
+                override fun getDefaultOptionIndex(): Int = items.indexOf(active).coerceAtLeast(0)
+                override fun onChosen(selectedValue: String, finalChoice: Boolean): PopupStep<*>? {
+                    mgr.setActive(selectedValue)
+                    return PopupStep.FINAL_CHOICE
+                }
+            })
+        popup.showInBestPositionFor(e.dataContext)
+    }
+}

package/intellij-plugin/src/main/kotlin/com/aion0/forge/api/ForgeClient.kt

@@ -0,0 +1,115 @@
+package com.aion0.forge.api
+
+import com.aion0.forge.auth.Auth
+import com.aion0.forge.connection.ConnectionManager
+import com.google.gson.Gson
+import com.google.gson.JsonElement
+import com.intellij.openapi.application.ApplicationManager
+import com.intellij.openapi.components.Service
+import java.net.URI
+import java.net.http.HttpClient
+import java.net.http.HttpRequest
+import java.net.http.HttpResponse
+import java.time.Duration
+
+data class ApiResult(
+    val ok: Boolean,
+    val status: Int,
+    val data: JsonElement? = null,
+    val error: String? = null,
+)
+
+/** Lightweight HTTP wrapper around forge's REST API. Uses java.net.http for
+ *  zero extra deps; Gson is bundled in the IntelliJ Platform. */
+@Service
+class ForgeClient {
+    private val http: HttpClient = HttpClient.newBuilder()
+        .connectTimeout(Duration.ofSeconds(5))
+        // Force HTTP/1.1. forge's Next.js server doesn't always handle the
+        // HTTP/2 upgrade probe cleanly, which manifests as
+        // "http/1.1 header parser received no byte".
+        .version(HttpClient.Version.HTTP_1_1)
+        .build()
+    private val gson = Gson()
+
+    fun activeName(): String = ConnectionManager.get().active().name
+    fun baseUrl(): String = ConnectionManager.get().active().serverUrl
+    fun terminalUrl(): String = ConnectionManager.get().active().terminalUrl
+
+    /** Verify password against the active connection's `/api/auth/verify`.
+     *  On success, persists the returned token in PasswordSafe. */
+    fun login(password: String): ApiResult {
+        val body = gson.toJson(mapOf("password" to password))
+        val req = HttpRequest.newBuilder(URI.create("${baseUrl()}/api/auth/verify"))
+            .header("Content-Type", "application/json")
+            .timeout(Duration.ofSeconds(10))
+            .POST(HttpRequest.BodyPublishers.ofString(body))
+            .build()
+        return runCatching {
+            val res = http.send(req, HttpResponse.BodyHandlers.ofString())
+            val parsed = res.body().takeIf { it.isNotEmpty() }?.let { gson.fromJson(it, JsonElement::class.java) }
+            if (res.statusCode() in 200..299 && parsed?.asJsonObject?.get("token") != null) {
+                val token = parsed.asJsonObject.get("token").asString
+                Auth.get().setToken(activeName(), token)
+                ApiResult(true, res.statusCode(), parsed)
+            } else {
+                val err = parsed?.asJsonObject?.get("error")?.asString ?: "HTTP ${res.statusCode()}"
+                ApiResult(false, res.statusCode(), parsed, err)
+            }
+        }.getOrElse { ApiResult(false, 0, error = it.message ?: "network error") }
+    }
+
+    fun logout() {
+        Auth.get().clearToken(activeName())
+    }
+
+    /** Quick liveness probe — does NOT require auth. */
+    fun ping(): Boolean = runCatching {
+        val req = HttpRequest.newBuilder(URI.create("${baseUrl()}/api/version"))
+            .timeout(Duration.ofSeconds(2))
+            .GET().build()
+        http.send(req, HttpResponse.BodyHandlers.discarding()).statusCode() in 200..299
+    }.getOrDefault(false)
+
+    /** Generic request — returns `ApiResult` with parsed JSON body. */
+    fun request(path: String, method: String = "GET", body: Any? = null): ApiResult {
+        val url = "${baseUrl()}$path"
+        return runCatching {
+            val token = Auth.get().getToken(activeName())
+            val builder = HttpRequest.newBuilder(URI.create(url))
+                .header("Content-Type", "application/json")
+                .header("Accept", "application/json")
+                .timeout(Duration.ofSeconds(15))
+            if (token != null) builder.header("X-Forge-Token", token)
+            when (method.uppercase()) {
+                "GET"    -> builder.GET()
+                "DELETE" -> builder.DELETE()
+                "POST"   -> builder.POST(jsonBody(body))
+                "PUT"    -> builder.PUT(jsonBody(body))
+                else     -> builder.method(method, jsonBody(body))
+            }
+            val res = http.send(builder.build(), HttpResponse.BodyHandlers.ofString())
+            val text = res.body()
+            val data = if (text.isNullOrBlank()) null
+                       else runCatching { gson.fromJson(text, JsonElement::class.java) }.getOrNull()
+            if (res.statusCode() in 200..299) {
+                ApiResult(true, res.statusCode(), data)
+            } else {
+                val err = data?.asJsonObject?.get("error")?.asString ?: "HTTP ${res.statusCode()}"
+                ApiResult(false, res.statusCode(), data, "$err  ($method $url)")
+            }
+        }.getOrElse {
+            ApiResult(false, 0, error = "${it.javaClass.simpleName}: ${it.message ?: "network error"}  ($method $url)")
+        }
+    }
+
+    private fun jsonBody(body: Any?): HttpRequest.BodyPublisher =
+        if (body == null) HttpRequest.BodyPublishers.noBody()
+        else HttpRequest.BodyPublishers.ofString(gson.toJson(body))
+
+    companion object {
+        @JvmStatic
+        fun get(): ForgeClient =
+            ApplicationManager.getApplication().getService(ForgeClient::class.java)
+    }
+}

package/intellij-plugin/src/main/kotlin/com/aion0/forge/auth/Auth.kt

@@ -0,0 +1,31 @@
+package com.aion0.forge.auth
+
+import com.intellij.credentialStore.CredentialAttributes
+import com.intellij.credentialStore.Credentials
+import com.intellij.ide.passwordSafe.PasswordSafe
+import com.intellij.openapi.application.ApplicationManager
+import com.intellij.openapi.components.Service
+
+/** Per-connection token storage backed by IntelliJ's PasswordSafe (system
+ *  keychain on macOS, KWallet/libsecret on Linux, Windows Credential Manager
+ *  on Windows). Key shape: `forge.token.<connectionName>`. */
+@Service
+class Auth {
+    fun getToken(connectionName: String): String? =
+        PasswordSafe.instance.getPassword(attrs(connectionName))
+
+    fun setToken(connectionName: String, token: String) {
+        PasswordSafe.instance.set(attrs(connectionName), Credentials("forge", token))
+    }
+
+    fun clearToken(connectionName: String) {
+        PasswordSafe.instance.set(attrs(connectionName), null)
+    }
+
+    private fun attrs(name: String) = CredentialAttributes("forge.token.$name", "forge")
+
+    companion object {
+        @JvmStatic
+        fun get(): Auth = ApplicationManager.getApplication().getService(Auth::class.java)
+    }
+}