@aion0/forge 0.6.3 → 0.8.0

package/app/api/chat-proxy/[...path]/route.ts

@@ -0,0 +1,83 @@
+/**
+ * Catch-all proxy from the Forge web app to the chat-standalone server
+ * (127.0.0.1:$CHAT_PORT, default 8408). Lets the in-app /chat page hit
+ * the same routes the browser extension uses, without exposing 8408
+ * publicly or re-implementing auth.
+ *
+ * The middleware on this server (port 8403) gates access via cookie/
+ * token; once a request reaches here it's authenticated, so we can
+ * forward to loopback without further checks.
+ *
+ * SSE pass-through: when upstream returns text/event-stream we stream
+ * the body verbatim so the /chat page gets live tokens.
+ */
+
+import { NextResponse } from 'next/server';
+
+const CHAT_BASE = `http://127.0.0.1:${process.env.CHAT_PORT || 8408}`;
+
+async function forward(
+  req: Request,
+  ctx: { params: Promise<{ path: string[] }> },
+): Promise<Response> {
+  const { path } = await ctx.params;
+  const segs = (path || []).map(encodeURIComponent).join('/');
+  const search = new URL(req.url).search;
+  const target = `${CHAT_BASE}/api/${segs}${search}`;
+
+  const headers: Record<string, string> = {};
+  const ct = req.headers.get('content-type');
+  if (ct) headers['content-type'] = ct;
+  const accept = req.headers.get('accept');
+  if (accept) headers['accept'] = accept;
+
+  const init: RequestInit = { method: req.method, headers };
+  if (req.method !== 'GET' && req.method !== 'HEAD') {
+    init.body = await req.text();
+  }
+
+  let upstream: Response;
+  try {
+    upstream = await fetch(target, init);
+  } catch (err) {
+    return NextResponse.json(
+      {
+        error: 'chat backend unreachable',
+        detail: err instanceof Error ? err.message : String(err),
+        target,
+      },
+      { status: 502 },
+    );
+  }
+
+  const upstreamCt = upstream.headers.get('content-type') || '';
+  if (upstreamCt.includes('text/event-stream')) {
+    return new Response(upstream.body, {
+      status: upstream.status,
+      headers: {
+        'content-type': 'text/event-stream',
+        'cache-control': 'no-cache, no-transform',
+        connection: 'keep-alive',
+        'x-accel-buffering': 'no',
+      },
+    });
+  }
+
+  return new Response(upstream.body, {
+    status: upstream.status,
+    headers: { 'content-type': upstreamCt || 'application/json' },
+  });
+}
+
+export async function GET(req: Request, ctx: { params: Promise<{ path: string[] }> }) {
+  return forward(req, ctx);
+}
+export async function POST(req: Request, ctx: { params: Promise<{ path: string[] }> }) {
+  return forward(req, ctx);
+}
+export async function PATCH(req: Request, ctx: { params: Promise<{ path: string[] }> }) {
+  return forward(req, ctx);
+}
+export async function DELETE(req: Request, ctx: { params: Promise<{ path: string[] }> }) {
+  return forward(req, ctx);
+}

package/app/api/connector-tool/route.ts

@@ -0,0 +1,38 @@
+/**
+ * POST /api/connector-tool
+ *
+ * Single-tool dispatch for internal callers (pipelines, jobs, CLI). Wraps
+ * lib/chat/tool-dispatcher.dispatchTool so http/shell/browser connectors
+ * are all callable through one shape:
+ *
+ *   { "plugin_id": "teams", "tool": "send_message",
+ *     "input": { "name": "Alice", "text": "MR ready: https://..." } }
+ *
+ * Returns the tool_result shape: { content: string, is_error?: boolean }.
+ *
+ * Loopback-only — middleware skips auth for this path on 127.0.0.1 /
+ * localhost; outside-host requests fall back to the normal X-Forge-Token
+ * check.
+ */
+
+import { NextResponse } from 'next/server';
+import { dispatchTool } from '@/lib/chat/tool-dispatcher';
+
+export async function POST(req: Request) {
+  let body: any = {};
+  try { body = await req.json(); } catch {}
+  const pluginId = String(body?.plugin_id || '').trim();
+  const tool = String(body?.tool || '').trim();
+  if (!pluginId || !tool) {
+    return NextResponse.json({ error: 'plugin_id and tool are required' }, { status: 400 });
+  }
+  const name = `${pluginId}.${tool}`;
+  const result = await dispatchTool({
+    id: `internal-${Date.now()}`,
+    name,
+    input: body?.input ?? {},
+  });
+  // Always 200 — the result carries is_error if the dispatched tool failed.
+  // (Network / wiring errors throw inside dispatchTool and bubble as 500.)
+  return NextResponse.json(result);
+}

package/app/api/connectors/[id]/settings/route.ts

@@ -0,0 +1,112 @@
+/**
+ * Per-user settings for a connector plugin.
+ *
+ * Browser-side connectors don't have a Forge-side executor, so "install" is
+ * really just "save your host URL + preferences". We map connector `settings`
+ * onto the existing plugin config storage to avoid a second store.
+ */
+
+import { NextResponse } from 'next/server';
+import {
+  getPlugin,
+  getInstalledPlugin,
+  installPlugin,
+  updatePluginConfig,
+  getConnectorsForPlugin,
+} from '@/lib/plugins/registry';
+import type { PluginFieldSchema } from '@/lib/plugins/types';
+
+function settingsSchemaFor(id: string): Record<string, PluginFieldSchema> {
+  const def = getPlugin(id);
+  if (!def) return {};
+  // For 1:N suites, merge settings across all entries (caller can scope by entry id).
+  const merged: Record<string, PluginFieldSchema> = {};
+  for (const c of getConnectorsForPlugin(def)) {
+    if (c.settings) Object.assign(merged, c.settings);
+  }
+  return merged;
+}
+
+function defaultsFor(id: string): Record<string, any> {
+  const schema = settingsSchemaFor(id);
+  const out: Record<string, any> = {};
+  for (const [k, v] of Object.entries(schema)) {
+    if (v.default !== undefined) out[k] = v.default;
+  }
+  return out;
+}
+
+const SECRET_MASK = '••••••••';
+
+function isSecretField(schema: PluginFieldSchema | undefined): boolean {
+  if (!schema) return false;
+  return schema.type === 'secret' || (schema.type as string) === 'password';
+}
+
+function maskSecrets(settings: Record<string, any>, schema: Record<string, PluginFieldSchema>): Record<string, any> {
+  const out: Record<string, any> = { ...settings };
+  for (const [k, v] of Object.entries(schema)) {
+    if (isSecretField(v) && typeof out[k] === 'string' && out[k]) {
+      out[k] = SECRET_MASK;
+    }
+  }
+  return out;
+}
+
+function restoreSecrets(
+  incoming: Record<string, any>,
+  existing: Record<string, any>,
+  schema: Record<string, PluginFieldSchema>,
+): Record<string, any> {
+  const out: Record<string, any> = { ...incoming };
+  for (const [k, v] of Object.entries(schema)) {
+    if (isSecretField(v) && out[k] === SECRET_MASK) {
+      if (typeof existing[k] === 'string') out[k] = existing[k];
+      else delete out[k];
+    }
+  }
+  return out;
+}
+
+export async function GET(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  const def = getPlugin(id);
+  if (!def || def.category !== 'connector') {
+    return NextResponse.json({ error: 'connector not found' }, { status: 404 });
+  }
+  const inst = getInstalledPlugin(id);
+  const stored = inst?.config || {};
+  const schema = settingsSchemaFor(id);
+  const merged = { ...defaultsFor(id), ...stored };
+  return NextResponse.json({
+    settings: maskSecrets(merged, schema),
+    schema,
+    installed: !!inst,
+  });
+}
+
+export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  const def = getPlugin(id);
+  if (!def || def.category !== 'connector') {
+    return NextResponse.json({ error: 'connector not found' }, { status: 404 });
+  }
+
+  const body = await req.json().catch(() => ({}));
+  const settings = body?.settings ?? body;
+  if (typeof settings !== 'object' || settings === null) {
+    return NextResponse.json({ error: 'settings must be an object' }, { status: 400 });
+  }
+
+  const existing = getInstalledPlugin(id);
+  const schema = settingsSchemaFor(id);
+  const merged = restoreSecrets(settings, existing?.config || {}, schema);
+  const ok = existing
+    ? updatePluginConfig(id, merged)
+    : installPlugin(id, merged);
+
+  if (!ok) {
+    return NextResponse.json({ error: 'failed to persist settings' }, { status: 500 });
+  }
+  return NextResponse.json({ ok: true, settings: maskSecrets(merged, schema) });
+}

package/app/api/connectors/route.ts

@@ -0,0 +1,108 @@
+/**
+ * Connectors API — discovery surface for the Forge browser extension.
+ *
+ * The extension hits this endpoint to learn what connector plugins are
+ * installed and what tools they advertise. The new declarative-script
+ * design (see docs/Connector-DeclarativeExtract-Spec.md) means each tool
+ * carries its own `page` (where to navigate) and `script` (function body
+ * to run in the user's tab). Forge expands {base_url} / {settings.*}
+ * tokens here using the user's saved settings; {args.*} is left literal
+ * for the extension's runner to expand at execution time.
+ */
+
+import { NextResponse } from 'next/server';
+import {
+  listPlugins,
+  getPlugin,
+  getInstalledPlugin,
+  getConnectorsForPlugin,
+} from '@/lib/plugins/registry';
+import { expandSettingsTokens } from '@/lib/plugins/templates';
+import type { Connector, ConnectorTool, PluginDefinition } from '@/lib/plugins/types';
+
+// Auth is handled by middleware (session cookie OR X-Forge-Token).
+
+function expandTool(tool: ConnectorTool, settings: Record<string, any> | undefined): ConnectorTool {
+  if (!tool.page && !tool.script) return tool;
+  const page = tool.page
+    ? {
+        url: expandSettingsTokens(tool.page.url, settings),
+        ...(tool.page.on_target
+          ? { on_target: expandSettingsTokens(tool.page.on_target, settings) }
+          : {}),
+      }
+    : undefined;
+  return { ...tool, ...(page ? { page } : {}) };
+}
+
+function expandConnector(entry: Connector, settings: Record<string, any> | undefined): Connector {
+  const out: Connector = {
+    ...entry,
+    tools: Object.fromEntries(
+      Object.entries(entry.tools).map(([name, t]) => [name, expandTool(t, settings)]),
+    ),
+  };
+  if (entry.host_match) out.host_match = expandSettingsTokens(entry.host_match, settings);
+  if (entry.login_redirect) out.login_redirect = expandSettingsTokens(entry.login_redirect, settings);
+  return out;
+}
+
+function toConnectorPayload(def: PluginDefinition) {
+  const inst = getInstalledPlugin(def.id);
+  const settings = inst?.config;
+  const entries = getConnectorsForPlugin(def).map(e => expandConnector(e, settings));
+
+  // Hoist host_match / login_redirect to plugin level for 1:1 cases — the
+  // common case (and what the spec example shows). Pull from the first entry
+  // when those came from the top-level plugin fields.
+  const hostMatch = def.host_match
+    ? expandSettingsTokens(def.host_match, settings)
+    : entries[0]?.host_match;
+  const loginRedirect = def.login_redirect
+    ? expandSettingsTokens(def.login_redirect, settings)
+    : entries[0]?.login_redirect;
+  // Default to 'main' so existing connectors (Mantis, GitLab) keep their
+  // current execution path. Plugins on strict-CSP sites opt into 'isolated'.
+  const runner = def.runner || entries[0]?.runner || 'main';
+
+  return {
+    plugin_id: def.id,
+    name: def.name,
+    icon: def.icon,
+    version: def.version,
+    author: def.author || 'forge',
+    description: def.description || '',
+    mode: def.mode || 'browser-side',
+    installed: !!inst,
+    ...(hostMatch ? { host_match: hostMatch } : {}),
+    ...(loginRedirect ? { login_redirect: loginRedirect } : {}),
+    runner,
+    entries,
+  };
+}
+
+export async function GET(req: Request) {
+  const url = new URL(req.url);
+  const id = url.searchParams.get('id');
+
+  // Single-connector detail
+  if (id) {
+    const def = getPlugin(id);
+    if (!def || def.category !== 'connector') {
+      return NextResponse.json({ error: 'connector not found' }, { status: 404 });
+    }
+    return NextResponse.json({ connector: toConnectorPayload(def) });
+  }
+
+  // List all connectors (installed or not — extension surfaces both for marketplace)
+  const onlyInstalled = url.searchParams.get('installed') === 'true';
+  const sources = listPlugins().filter(s => s.category === 'connector');
+
+  const connectors = sources
+    .map(s => getPlugin(s.id))
+    .filter((d): d is PluginDefinition => !!d)
+    .filter(d => !onlyInstalled || !!getInstalledPlugin(d.id))
+    .map(toConnectorPayload);
+
+  return NextResponse.json({ connectors });
+}

package/app/api/health/tools/route.ts

@@ -0,0 +1,14 @@
+/**
+ * GET /api/health/tools — array of external-tool checks (glab, gh, git, jq).
+ *
+ * Used by the Pipelines view to show a banner when something needed by a
+ * built-in workflow is missing, with install instructions inline. See
+ * lib/health.ts for the catalog and `[tools]` startup log lines.
+ */
+
+import { NextResponse } from 'next/server';
+import { checkTools } from '@/lib/health';
+
+export async function GET() {
+  return NextResponse.json({ tools: checkTools() });
+}

package/app/api/issue-scanner-gitlab/route.ts

@@ -0,0 +1,95 @@
+import { NextResponse } from 'next/server';
+import {
+  getConfig, saveConfig, listConfigs, scanAndTrigger,
+  startScanner, getProcessedIssues, resetProcessedIssue,
+  type GitLabAutofixConfig,
+} from '@/lib/issue-scanner-gitlab';
+import { startPipeline } from '@/lib/pipeline';
+
+// GET /api/issue-scanner-gitlab?project=PATH
+export async function GET(req: Request) {
+  const { searchParams } = new URL(req.url);
+  const projectPath = searchParams.get('project');
+  if (projectPath) {
+    return NextResponse.json({
+      config: getConfig(projectPath),
+      processed: getProcessedIssues(projectPath),
+    });
+  }
+  return NextResponse.json({ configs: listConfigs() });
+}
+
+// POST /api/issue-scanner-gitlab
+export async function POST(req: Request) {
+  const body = await req.json();
+
+  if (body.action === 'save-config') {
+    const c: GitLabAutofixConfig = {
+      projectPath: body.projectPath,
+      projectName: body.projectName,
+      enabled: !!body.enabled,
+      interval: body.interval || 30,
+      labels: body.labels || [],
+      baseBranch: body.baseBranch || '',
+      baseBranchRule: body.baseBranchRule || 'milestone',
+      mrTitleTemplate: body.mrTitleTemplate || '',
+      mrBodyTemplate: body.mrBodyTemplate || '',
+      assigneeFilter: body.assigneeFilter ?? 'me',
+    };
+    saveConfig(c);
+    startScanner();
+    return NextResponse.json({ ok: true });
+  }
+
+  if (body.action === 'scan') {
+    const c = getConfig(body.projectPath);
+    if (!c) return NextResponse.json({ error: 'Not configured' }, { status: 400 });
+    return NextResponse.json(scanAndTrigger(c));
+  }
+
+  if (body.action === 'trigger') {
+    const c = getConfig(body.projectPath);
+    const projectName = c?.projectName || body.projectName;
+    try {
+      const pipeline = startPipeline('gitlab-issue-fix-and-review', {
+        issue_id: String(body.issueId),
+        project: projectName,
+        base_branch: body.baseBranch || c?.baseBranch || 'auto',
+        base_branch_rule: c?.baseBranchRule || 'milestone',
+        mr_title_template: c?.mrTitleTemplate || '',
+        mr_body_template: c?.mrBodyTemplate || '',
+        extra_context: body.context || '',
+      });
+      return NextResponse.json({ ok: true, pipelineId: pipeline.id });
+    } catch (e) {
+      return NextResponse.json({ ok: false, error: String(e) }, { status: 500 });
+    }
+  }
+
+  if (body.action === 'reset') {
+    resetProcessedIssue(body.projectPath, body.issueId);
+    return NextResponse.json({ ok: true });
+  }
+
+  if (body.action === 'retry') {
+    resetProcessedIssue(body.projectPath, body.issueId);
+    const c = getConfig(body.projectPath);
+    const projectName = c?.projectName || body.projectName;
+    try {
+      const pipeline = startPipeline('gitlab-issue-fix-and-review', {
+        issue_id: String(body.issueId),
+        project: projectName,
+        base_branch: c?.baseBranch || 'auto',
+        base_branch_rule: c?.baseBranchRule || 'milestone',
+        mr_title_template: c?.mrTitleTemplate || '',
+        mr_body_template: c?.mrBodyTemplate || '',
+        extra_context: body.context || '',
+      });
+      return NextResponse.json({ ok: true, pipelineId: pipeline.id });
+    } catch (e) {
+      return NextResponse.json({ ok: false, error: String(e) }, { status: 500 });
+    }
+  }
+
+  return NextResponse.json({ error: 'Invalid action' }, { status: 400 });
+}

package/app/api/jobs/[id]/reset_dedup/route.ts

@@ -0,0 +1,15 @@
+/**
+ * POST /api/jobs/<id>/reset_dedup — wipe job_seen for this job so the
+ * next tick re-dispatches every item it finds.
+ */
+
+import { NextResponse } from 'next/server';
+import { getJob, resetDedup } from '@/lib/jobs/store';
+
+export async function POST(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  const job = getJob(id);
+  if (!job) return NextResponse.json({ error: 'job not found' }, { status: 404 });
+  const removed = resetDedup(id);
+  return NextResponse.json({ ok: true, removed });
+}

package/app/api/jobs/[id]/route.ts

@@ -0,0 +1,31 @@
+/**
+ * GET    /api/jobs/<id>     { job, recent_runs: [..20..] }
+ * PATCH  /api/jobs/<id>     partial update
+ * DELETE /api/jobs/<id>     cascade
+ */
+
+import { NextResponse } from 'next/server';
+import { getJob, updateJob, deleteJob, listRuns } from '@/lib/jobs/store';
+
+export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  const job = getJob(id);
+  if (!job) return NextResponse.json({ error: 'job not found' }, { status: 404 });
+  return NextResponse.json({ job, recent_runs: listRuns(id, 20) });
+}
+
+export async function PATCH(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  const job = getJob(id);
+  if (!job) return NextResponse.json({ error: 'job not found' }, { status: 404 });
+  let body: any = {};
+  try { body = await req.json(); } catch {}
+  const ok = updateJob(id, body);
+  return NextResponse.json({ ok, job: getJob(id) });
+}
+
+export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  const ok = deleteJob(id);
+  return NextResponse.json({ ok });
+}

package/app/api/jobs/[id]/run/route.ts

@@ -0,0 +1,44 @@
+/**
+ * POST /api/jobs/<id>/run — manually fire one tick.
+ *
+ * Inserts the run row synchronously, returns its id (202), and runs the
+ * actual work in the background. Poll GET /api/jobs/<id>/runs/<run_id>
+ * (or /api/jobs/<id>) to observe completion.
+ *
+ * Query params:
+ *   reset_dedup=1   wipe job_seen before running. Useful for "force re-dispatch
+ *                   the same items I tested with last time" while iterating
+ *                   on a pipeline. Recorded as note on the run for audit.
+ */
+
+import { NextResponse } from 'next/server';
+import { prepareRun, executeRun } from '@/lib/jobs/scheduler';
+import { resetDedup } from '@/lib/jobs/store';
+
+export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  const url = new URL(req.url);
+  const shouldReset = url.searchParams.get('reset_dedup') === '1';
+  let removedDedupKeys = 0;
+  if (shouldReset) {
+    try { removedDedupKeys = resetDedup(id); }
+    catch (e) {
+      return NextResponse.json({ error: 'reset_dedup failed: ' + (e as Error).message }, { status: 500 });
+    }
+  }
+  let prepared;
+  try {
+    prepared = prepareRun(id, 'manual');
+  } catch (e) {
+    return NextResponse.json({ error: (e as Error).message }, { status: 404 });
+  }
+  void executeRun(prepared.job, prepared.runId).catch((err) => {
+    console.error('[jobs] manual run crashed', err);
+  });
+  return NextResponse.json({
+    accepted: true,
+    run_id: prepared.runId,
+    dedup_reset: shouldReset,
+    removed_dedup_keys: shouldReset ? removedDedupKeys : undefined,
+  }, { status: 202 });
+}

package/app/api/jobs/[id]/runs/[runId]/route.ts

@@ -0,0 +1,15 @@
+/**
+ * GET /api/jobs/<id>/runs/<runId> — { run, dispatches: [...] }
+ */
+
+import { NextResponse } from 'next/server';
+import { getJob, getRun, listDispatches } from '@/lib/jobs/store';
+
+export async function GET(_req: Request, { params }: { params: Promise<{ id: string; runId: string }> }) {
+  const { id, runId } = await params;
+  const job = getJob(id);
+  if (!job) return NextResponse.json({ error: 'job not found' }, { status: 404 });
+  const run = getRun(runId);
+  if (!run || run.job_id !== id) return NextResponse.json({ error: 'run not found' }, { status: 404 });
+  return NextResponse.json({ run, dispatches: listDispatches(runId) });
+}

package/app/api/jobs/[id]/runs/route.ts

@@ -0,0 +1,15 @@
+/**
+ * GET /api/jobs/<id>/runs?limit=20 — list runs for a job.
+ */
+
+import { NextResponse } from 'next/server';
+import { getJob, listRuns } from '@/lib/jobs/store';
+
+export async function GET(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  const job = getJob(id);
+  if (!job) return NextResponse.json({ error: 'job not found' }, { status: 404 });
+  const url = new URL(req.url);
+  const limit = Math.min(200, Math.max(1, Number(url.searchParams.get('limit') || 20)));
+  return NextResponse.json({ runs: listRuns(id, limit) });
+}