@aion0/forge 0.8.4 → 0.8.6

package/RELEASE_NOTES.md

@@ -1,12 +1,8 @@
-# Forge v0.8.4
+# Forge v0.8.6
 
-Released: 2026-05-20
+Released: 2026-05-21
 
-## Changes since v0.8.3
+## Changes since v0.8.5
 
-### Other
-- fix(http-protocol): apply manifest parameter defaults before template expansion
-- fix(http-protocol): drop unsubstituted {args.*} query params
 
-
-**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.8.3...v0.8.4
+**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.8.5...v0.8.6

package/app/api/agents/route.ts

@@ -11,7 +11,17 @@ export async function GET(req: Request) {
     return NextResponse.json(info);
   }
 
-  const agents = listAgents();
+  // ?include=cli|api|all (default: cli) — API profiles aren't useful in
+  // Terminal / Task / Pipeline pickers (no CLI binary to spawn), so the
+  // default hides them. WorkspaceView's API mode passes ?include=all
+  // (or ?include=api) to surface them when needed.
+  const include = (url.searchParams.get('include') || 'cli').toLowerCase();
+  const all = listAgents();
+  const agents = include === 'all'
+    ? all
+    : include === 'api'
+      ? all.filter((a: any) => a.backendType === 'api')
+      : all.filter((a: any) => a.backendType !== 'api');
   const defaultAgent = getDefaultAgentId();
   return NextResponse.json({ agents, defaultAgent });
 }

package/app/api/jobs/preview/route.ts

@@ -46,6 +46,48 @@ function pickPath(obj: unknown, path: string): unknown {
   return cur;
 }
 
+/**
+ * Guess the right items_path purely from the response shape, so the UI
+ * can offer it even when the user left the field blank (or set it wrong).
+ *   - top-level array            → ''                      (scheduler iterates directly)
+ *   - object with exactly one array-valued key → that key
+ *   - object with several array-valued keys    → prefer common names
+ *   - top-level single object    → ''                      (scheduler wraps as 1-item)
+ */
+function suggestItemsPath(parsed: unknown): string | null {
+  if (Array.isArray(parsed)) return '';
+  if (parsed && typeof parsed === 'object') {
+    const obj = parsed as Record<string, unknown>;
+    const arrayKeys = Object.entries(obj).filter(([, v]) => Array.isArray(v)).map(([k]) => k);
+    if (arrayKeys.length === 0) return '';
+    // Only suggest a non-empty items_path when one of the keys looks
+    // like a *list payload* name. Otherwise this is probably a detail
+    // object (e.g. mantis.get_bug returns {id, summary, ..., history,
+    // notes}) — `history` is an internal array, not the items list.
+    // For detail responses, empty items_path → scheduler wraps the
+    // single object as a 1-item list.
+    const common = ['items', 'data', 'results', 'records', 'bugs', 'issues', 'merge_requests', 'mrs', 'projects', 'pipelines'];
+    for (const name of common) if (arrayKeys.includes(name)) return name;
+    return '';
+  }
+  return null;
+}
+
+/**
+ * Pick the most-likely unique-identifier key from the sample item.
+ * Order matches what users typically expect, with `iid` (GitLab project-scoped
+ * issue/MR id) preferred over the global `id` when both exist.
+ */
+function suggestDedupField(itemKeys: string[]): string | null {
+  // Prefer the globally-unique `id` over GitLab's project-scoped `iid`
+  // so dedup remains safe if a job ever spans multiple projects.
+  const priority = ['id', 'iid', 'key', 'uuid', 'global_id', 'guid', 'sha', 'commit_id'];
+  for (const p of priority) if (itemKeys.includes(p)) return p;
+  const trailingId = itemKeys.find((k) => /_id$/i.test(k));
+  if (trailingId) return trailingId;
+  return null;
+}
+
 /**
  * Best-effort match a workflow input name to a key on the sample item.
  * The mantis case (bug_id ← id, base_branch ← nothing) drove this list:
@@ -109,11 +151,10 @@ export async function POST(req: Request) {
   const callName = `${source_connector}.${source_tool}`;
   let toolResult;
   try {
-    toolResult = await dispatchTool({
-      id: `jobs-preview-${Date.now()}`,
-      name: callName,
-      input: source_input || {},
-    });
+    toolResult = await dispatchTool(
+      { id: `jobs-preview-${Date.now()}`, name: callName, input: source_input || {} },
+      { noTruncation: true },
+    );
   } catch (e) {
     return NextResponse.json({ ok: false, error: `connector call threw: ${(e as Error).message}` }, { status: 500 });
   }
@@ -136,6 +177,11 @@ export async function POST(req: Request) {
     }, { status: 200 });
   }
 
+  // Always compute the shape-based items_path suggestion — UI offers it
+  // both on success ("you may also want this") and on failure ("apply
+  // this and retry"), so the user never has to guess.
+  const suggestedItemsPath = suggestItemsPath(parsed);
+
   let items = pickPath(parsed, items_path || '');
   // Same single-object-as-1-item-list logic as the scheduler, so the
   // preview matches what runtime will see.
@@ -152,6 +198,7 @@ export async function POST(req: Request) {
         ? `items_path resolved to an empty array — no sample item available`
         : `items_path "${items_path || '(empty)'}" did not resolve to an array or object`,
       top_level_keys: topKeys,
+      suggested_items_path: suggestedItemsPath,
     }, { status: 200 });
   }
 
@@ -188,6 +235,8 @@ export async function POST(req: Request) {
     sample_item: sampleItem,
     item_keys: itemKeys,
     suggested_template: suggestedTemplate,
+    suggested_items_path: suggestedItemsPath,
+    suggested_dedup_field: suggestDedupField(itemKeys),
     total_items: items.length,
   });
 }

package/app/api/jobs/recipes/route.ts

@@ -0,0 +1,59 @@
+/**
+ * /api/jobs/recipes
+ *
+ *   GET                              — list installed recipes
+ *   GET ?name=<name>                 — fetch a single recipe (UI form metadata)
+ *   POST   { action: 'instantiate',  name, params }   — create Job from recipe
+ *   POST   { action: 'upload',       yaml }            — save a user-supplied recipe yaml
+ *   POST   { action: 'delete',       name }            — delete a recipe file
+ */
+
+import { NextResponse } from 'next/server';
+import {
+  listRecipes,
+  getRecipe,
+  saveRecipeYaml,
+  deleteRecipe,
+  instantiateRecipe,
+} from '@/lib/jobs/recipes';
+
+export async function GET(req: Request) {
+  const { searchParams } = new URL(req.url);
+  const name = searchParams.get('name');
+  if (name) {
+    const r = getRecipe(name);
+    if (!r) return NextResponse.json({ error: 'not found' }, { status: 404 });
+    return NextResponse.json({ recipe: r });
+  }
+  return NextResponse.json({ recipes: listRecipes() });
+}
+
+export async function POST(req: Request) {
+  let body: any;
+  try { body = await req.json(); }
+  catch { return NextResponse.json({ ok: false, error: 'invalid JSON body' }, { status: 400 }); }
+  const action = body?.action;
+
+  if (action === 'instantiate') {
+    if (!body.name) return NextResponse.json({ ok: false, error: 'name required' }, { status: 400 });
+    const r = instantiateRecipe(body.name, body.params || {});
+    if (!r.ok) return NextResponse.json(r, { status: 400 });
+    return NextResponse.json(r);
+  }
+
+  if (action === 'upload') {
+    if (typeof body.yaml !== 'string' || !body.yaml.trim()) {
+      return NextResponse.json({ ok: false, error: 'yaml required' }, { status: 400 });
+    }
+    const r = saveRecipeYaml(body.yaml);
+    return NextResponse.json(r, { status: r.ok ? 200 : 400 });
+  }
+
+  if (action === 'delete') {
+    if (!body.name) return NextResponse.json({ ok: false, error: 'name required' }, { status: 400 });
+    const ok = deleteRecipe(body.name);
+    return NextResponse.json({ ok }, { status: ok ? 200 : 404 });
+  }
+
+  return NextResponse.json({ ok: false, error: 'unknown action' }, { status: 400 });
+}

package/app/api/skills/install-local/route.ts

@@ -30,6 +30,19 @@ import { homedir } from 'node:os';
 import { getDb } from '@/src/core/db/database';
 import { getDbPath } from '@/src/config';
 
+/**
+ * Refuse to clobber an existing skill (registry-synced or previously
+ * uploaded). The wrapper-dir / frontmatter inside a zip can easily
+ * collide with an existing name without the user noticing — better to
+ * fail loudly than silently overwrite. To re-install, the user must
+ * uninstall the existing one first.
+ */
+function nameConflict(name: string): { conflict: true; source: 'registry' | 'local' } | { conflict: false } {
+  const row = db().prepare('SELECT source FROM skills WHERE name = ?').get(name) as any;
+  if (!row) return { conflict: false };
+  return { conflict: true, source: row.source === 'local' ? 'local' : 'registry' };
+}
+
 const MAX_BYTES = 5 * 1024 * 1024;          // 5 MB
 const MAX_FILE_BYTES = 1 * 1024 * 1024;     // 1 MB per file
 const MAX_FILES = 50;
@@ -153,11 +166,30 @@ function writeSkillToDisk(payload: InstallPayload, projectPath?: string): { targ
     ensureDir(dirname(target));
     writeFileSync(target, f.data, { mode: 0o600 });
   }
+  // Synthesize info.json if the upload didn't include one. The sync /
+  // refresh layer reads version + description from here; without it,
+  // a hand-uploaded skill shows up with blank metadata. `source: "local"`
+  // (plus uploaded_at) marks it as a manual upload — distinguishable
+  // from anything pulled from the remote registry.
+  const hasInfoJson = payload.files.some((f) => f.path === 'info.json');
+  if (!hasInfoJson) {
+    const info = {
+      name: payload.name,
+      version: payload.version || '0.1.0',
+      description: payload.description || '',
+      tags: [],
+      score: 0,
+      rating: 0,
+      source: 'local',
+      uploaded_at: new Date().toISOString(),
+    };
+    writeFileSync(join(root, 'info.json'), JSON.stringify(info, null, 2), { mode: 0o600 });
+  }
   return { targetDir: root };
 }
 
 function upsertSkillRow(payload: InstallPayload, projectPath?: string): void {
-  const existing = db().prepare('SELECT installed_global, installed_projects FROM skills WHERE name = ?')
+  const existing = db().prepare('SELECT installed_global, installed_projects, source FROM skills WHERE name = ?')
     .get(payload.name) as any;
   const installedProjects: string[] = existing
     ? (() => { try { return JSON.parse(existing.installed_projects || '[]'); } catch { return []; } })()
@@ -208,6 +240,13 @@ export async function POST(req: Request) {
         nameRaw || undefined,
       );
       if (!built.ok) return NextResponse.json({ ok: false, error: built.error }, { status: 400 });
+      {
+        const c = nameConflict(built.payload.name);
+        if (c.conflict) {
+          const which = c.source === 'registry' ? 'synced from the marketplace registry' : 'already uploaded';
+          return NextResponse.json({ ok: false, error: `A skill named "${built.payload.name}" is ${which}. Uninstall it first, or rename your upload (or the SKILL.md frontmatter \`name:\`) before re-uploading.` }, { status: 409 });
+        }
+      }
       writeSkillToDisk(built.payload, body.project_path || undefined);
       upsertSkillRow(built.payload, body.project_path || undefined);
       return NextResponse.json({ ok: true, name: built.payload.name, version: built.payload.version || '0.1.0' });
@@ -219,6 +258,13 @@ export async function POST(req: Request) {
         nameRaw || undefined,
       );
       if (!built.ok) return NextResponse.json({ ok: false, error: built.error }, { status: 400 });
+      {
+        const c = nameConflict(built.payload.name);
+        if (c.conflict) {
+          const which = c.source === 'registry' ? 'synced from the marketplace registry' : 'already uploaded';
+          return NextResponse.json({ ok: false, error: `A skill named "${built.payload.name}" is ${which}. Uninstall it first, or rename your upload (or the SKILL.md frontmatter \`name:\`) before re-uploading.` }, { status: 409 });
+        }
+      }
       writeSkillToDisk(built.payload, body.project_path || undefined);
       upsertSkillRow(built.payload, body.project_path || undefined);
       return NextResponse.json({ ok: true, name: built.payload.name, version: built.payload.version || '0.1.0' });
@@ -267,6 +313,13 @@ export async function POST(req: Request) {
 
     const built = buildPayload(files, nameOverride);
     if (!built.ok) return NextResponse.json({ ok: false, error: built.error }, { status: 400 });
+    {
+      const c = nameConflict(built.payload.name);
+      if (c.conflict) {
+        const which = c.source === 'registry' ? 'synced from the marketplace registry' : 'already uploaded';
+        return NextResponse.json({ ok: false, error: `A skill named "${built.payload.name}" is ${which}. Uninstall it first, or rename your upload (or the SKILL.md frontmatter \`name:\`) before re-uploading.` }, { status: 409 });
+      }
+    }
     const { targetDir } = writeSkillToDisk(built.payload, projectPath);
     upsertSkillRow(built.payload, projectPath);
     return NextResponse.json({

package/app/api/workflows/marketplace/route.ts

@@ -0,0 +1,52 @@
+/**
+ * /api/workflows/marketplace
+ *
+ *   GET                      — list registry + installed recipes/pipelines (merged)
+ *   POST { action: 'sync' }                     — pull registry.json from forge-workflow
+ *   POST { action: 'install',   kind, name }    — download yaml → save to local dir
+ *   POST { action: 'uninstall', kind, name }    — remove the local yaml file
+ *
+ * `kind` is "recipe" | "pipeline". Built-in pipelines are protected
+ * elsewhere (lib/workflow-marketplace.ts excludes them from `installed`,
+ * and the pipelines delete-workflow route rejects them).
+ */
+
+import { NextResponse } from 'next/server';
+import {
+  syncMarketplace,
+  listMarketplace,
+  installFromMarketplace,
+  uninstallFromMarketplace,
+  type WorkflowKind,
+} from '@/lib/workflow-marketplace';
+
+export async function GET() {
+  return NextResponse.json(listMarketplace());
+}
+
+export async function POST(req: Request) {
+  let body: any;
+  try { body = await req.json(); }
+  catch { return NextResponse.json({ ok: false, error: 'invalid JSON body' }, { status: 400 }); }
+  const action = body?.action;
+
+  if (action === 'sync') {
+    const r = await syncMarketplace();
+    return NextResponse.json(r, { status: r.ok ? 200 : 502 });
+  }
+
+  if (action === 'install' || action === 'uninstall') {
+    const kind = body.kind as WorkflowKind;
+    const name = body.name;
+    if (kind !== 'recipe' && kind !== 'pipeline') {
+      return NextResponse.json({ ok: false, error: 'kind must be "recipe" or "pipeline"' }, { status: 400 });
+    }
+    if (!name) return NextResponse.json({ ok: false, error: 'name required' }, { status: 400 });
+    const r = action === 'install'
+      ? await installFromMarketplace(kind, name, { target_name: body.target_name, overwrite: !!body.overwrite })
+      : uninstallFromMarketplace(kind, name);
+    return NextResponse.json(r, { status: r.ok ? 200 : 400 });
+  }
+
+  return NextResponse.json({ ok: false, error: 'unknown action' }, { status: 400 });
+}

package/bin/forge-server.mjs

@@ -145,6 +145,27 @@ if (!isStop) {
     console.warn('[forge] Install Codex:        https://github.com/openai/codex#installation');
     console.warn('[forge] Or configure API-only profiles in Settings after login.');
   }
+
+  // ── Optional helpers used by built-in workflows (mr-review-fix etc.).
+  // Warn-only: Forge starts fine without them, but specific Jobs/Pipelines
+  // will fail at the shell node if they're missing — better to flag here.
+  const optional = [
+    { bin: 'jq',   used: 'shell pipelines that parse JSON output' },
+    { bin: 'glab', used: 'GitLab MR review / mr-review-fix workflow' },
+  ];
+  const missing = optional.filter((o) => !has(o.bin));
+  if (missing.length) {
+    console.warn(`[forge] ⚠️  Optional CLIs missing: ${missing.map((m) => m.bin).join(', ')}`);
+    for (const m of missing) console.warn(`[forge]    - ${m.bin}: used by ${m.used}`);
+    if (process.platform === 'darwin') {
+      console.warn(`[forge] Install with: brew install ${missing.map((m) => m.bin).join(' ')}`);
+    } else if (process.platform === 'linux') {
+      console.warn('[forge] Install via your distro\'s package manager.');
+      if (missing.some((m) => m.bin === 'glab')) {
+        console.warn('[forge]    glab: see https://gitlab.com/gitlab-org/cli#installation');
+      }
+    }
+  }
 }
 
 // ── Load <data-dir>/.env.local ──