@ipul-labs/forge 1.21.2 → 1.35.0

package/lib/server/forge/routes.js

@@ -16,40 +16,21 @@
  * in the query string, or as a JSON array in a POST body.
  */
 import { Router } from "express";
+import { openEventStream } from "./sse.js";
 import { parseCiTrace } from "./core/ciTraceParser.js";
 import * as configStore from "./core/configStore.js";
-import { listDeployments } from "./core/k8s.js";
 import { ForgeAgent } from "./core/ForgeAgent.js";
-import crypto from "node:crypto";
-import { probeQuota } from "./core/quotaClient.js";
 import { validate as runValidation } from "./core/validator.js";
 import { createProvider } from "./core/providers/index.js";
 import * as jobStore from "./core/jobs.js";
+import { workspaces } from "./core/localRepo.js";
+import { WorkspaceBusyError } from "./core/workspaces.js";
 import { FORGE_EVENTS } from "../../shared/events.js";
+import { requirePrincipal, requireRole } from "./auth/middleware.js";
 const router = Router();
-// ─── Auth middleware ──────────────────────────────────────────────────────────
-function requireAuth(req, res, next) {
-    const token = process.env.FORGE_TOKEN;
-    if (!token) {
-        res.status(503).json({
-            error: "Forge is not configured. Set FORGE_TOKEN env var.",
-        });
-        return;
-    }
-    const auth = req.headers.authorization
-        ?? (req.query.token ? `Bearer ${req.query.token}` : null);
-    if (!auth?.startsWith("Bearer ")) {
-        res.status(401).json({ error: "Missing Authorization header." });
-        return;
-    }
-    const provided = Buffer.from(auth.slice(7));
-    const expected = Buffer.from(token);
-    if (provided.length !== expected.length || !crypto.timingSafeEqual(provided, expected)) {
-        res.status(403).json({ error: "Invalid token." });
-        return;
-    }
-    next();
-}
+// Authentication happens upstream (server.ts mounts createAuth's stack);
+// this router only enforces that it ran, plus per-route minimum roles.
+router.use(requirePrincipal);
 // ─── Error handler ────────────────────────────────────────────────────────────
 function redactSecrets(text) {
     return text
@@ -121,13 +102,17 @@ const FALLBACK_MODELS = [
     { id: "claude-sonnet-4-6", label: "Claude Sonnet 4.6", provider: "claude" },
     { id: "claude-haiku-4-5-20251001", label: "Claude Haiku 4.5", provider: "claude" },
 ];
+// A workspace key from Settings wins; ANTHROPIC_API_KEY covers self-hosted installs.
+function modelListKey() {
+    return configStore.getAnthropicKey() || process.env.ANTHROPIC_API_KEY || "";
+}
 async function fetchAnthropicModels() {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 5_000);
     try {
         const res = await fetch("https://api.anthropic.com/v1/models?limit=100", {
             headers: {
-                "x-api-key": process.env.ANTHROPIC_API_KEY ?? "",
+                "x-api-key": modelListKey(),
                 "anthropic-version": "2023-06-01",
             },
             signal: controller.signal,
@@ -148,13 +133,13 @@ async function fetchAnthropicModels() {
         clearTimeout(timeout);
     }
 }
-router.get("/status", requireAuth, async (_req, res) => {
+router.get("/status", async (_req, res) => {
     let models = FALLBACK_MODELS.map((m) => ({
         ...m,
         ...(MODEL_RATES[m.id] ? { rates: MODEL_RATES[m.id] } : {}),
     }));
     try {
-        if (process.env.ANTHROPIC_API_KEY) {
+        if (modelListKey()) {
             models = await fetchAnthropicModels();
         }
     }
@@ -163,14 +148,7 @@ router.get("/status", requireAuth, async (_req, res) => {
         console.warn("[forge] fetchAnthropicModels failed, using fallback:", err?.message);
     }
     const repos = getAvailableRepos();
-    const agents = [
-        { id: "claude", label: "Claude", configured: true },
-        {
-            id: "openclaw",
-            label: "OpenClaw",
-            configured: Boolean(process.env.OPENCLAW_GATEWAY_URL),
-        },
-    ];
+    const agents = [{ id: "claude", label: "Claude", configured: true }];
     res.json({
         ok: true,
         project: configStore.getPrimaryProject(),
@@ -180,8 +158,8 @@ router.get("/status", requireAuth, async (_req, res) => {
         defaultModel: process.env.FORGE_MODEL ?? "claude-sonnet-4-6",
         models,
         agents,
-        defaultAgent: process.env.OPENCLAW_GATEWAY_URL ? "openclaw" : "claude",
-        hasApiKey: Boolean(process.env.ANTHROPIC_API_KEY),
+        defaultAgent: "claude",
+        hasApiKey: Boolean(modelListKey()),
         // Test-deploy URL template stored in configStore.defaults — editable
         // from Settings → Defaults. Supports "{branch}" / "{slug}" placeholders
         // for ephemeral per-branch deploys. Empty string means "no link".
@@ -189,12 +167,11 @@ router.get("/status", requireAuth, async (_req, res) => {
         maxCiFixAttempts: configStore.get().defaults?.maxCiFixAttempts ?? 3,
     });
 });
-router.use(requireAuth);
 // ─── Config ───────────────────────────────────────────────────────────────────
 router.get("/config", (_req, res) => {
     res.json(configStore.getPublic());
 });
-router.put("/config", async (req, res) => {
+router.put("/config", requireRole("admin"), async (req, res) => {
     try {
         await configStore.patch(req.body ?? {});
         res.json(configStore.getPublic());
@@ -203,6 +180,52 @@ router.put("/config", async (req, res) => {
         handleError(res, err, "updating config");
     }
 });
+// ─── Workspaces ───────────────────────────────────────────────────────────────
+// Local checkouts (base clones + per-issue worktrees) under the cache root.
+// Admin-only: they expose this machine's disk and deleting one is permanent.
+function workspaceError(res, err, operation) {
+    if (err instanceof WorkspaceBusyError) {
+        res.status(409).json({ error: err.message });
+    }
+    else if (err instanceof Error && /^Unknown workspace/.test(err.message)) {
+        res.status(404).json({ error: err.message });
+    }
+    else {
+        handleError(res, err, operation);
+    }
+}
+router.get("/workspaces", requireRole("admin"), async (_req, res) => {
+    try {
+        const list = await workspaces.list();
+        // Ids are root-relative; the absolute path stays on the server.
+        res.json({ workspaces: list.map(({ path: _path, ...rest }) => rest) });
+    }
+    catch (err) {
+        workspaceError(res, err, "listing workspaces");
+    }
+});
+router.delete("/workspaces", requireRole("admin"), async (req, res) => {
+    const id = typeof req.query.id === "string" ? req.query.id : "";
+    if (!id) {
+        res.status(400).json({ error: "Workspace id is required." });
+        return;
+    }
+    try {
+        await workspaces.remove(id);
+        res.json({ removed: id });
+    }
+    catch (err) {
+        workspaceError(res, err, "deleting workspace");
+    }
+});
+router.post("/workspaces/purge", requireRole("admin"), async (req, res) => {
+    try {
+        res.json(await workspaces.purge({ includeBases: req.body?.includeBases === true }));
+    }
+    catch (err) {
+        workspaceError(res, err, "purging workspaces");
+    }
+});
 // ─── Issues ───────────────────────────────────────────────────────────────────
 router.get("/issues", async (req, res) => {
     try {
@@ -279,69 +302,187 @@ router.get("/issues", async (req, res) => {
         handleError(res, error, "listOpenIssues");
     }
 });
-router.post("/issues", async (req, res) => {
+const MAX_LABELS = 50;
+const MAX_LABEL_LENGTH = 255;
+/**
+ * Validates an optional `labels` body field: `labels` is undefined when the
+ * field was absent, the trimmed, de-duplicated list otherwise. Commas are
+ * refused because GitLab sends labels as one comma-separated string.
+ */
+function parseLabels(raw) {
+    if (raw === undefined)
+        return {};
+    if (!Array.isArray(raw) || raw.length > MAX_LABELS)
+        return { error: `labels must be an array of at most ${MAX_LABELS} strings.` };
+    const labels = [];
+    for (const item of raw) {
+        if (typeof item !== "string")
+            return { error: "labels must be strings." };
+        const label = item.trim();
+        if (!label)
+            continue;
+        if (label.length > MAX_LABEL_LENGTH || label.includes(","))
+            return { error: `Invalid label: ${label.slice(0, 40)}` };
+        if (!labels.includes(label))
+            labels.push(label);
+    }
+    return { labels };
+}
+router.post("/issues", requireRole("operator"), async (req, res) => {
     const { title, description = "" } = req.body;
     if (!title?.trim()) {
         res.status(400).json({ error: "title is required." });
         return;
     }
+    const { labels, error: labelsError } = parseLabels(req.body.labels);
+    if (labelsError) {
+        res.status(400).json({ error: labelsError });
+        return;
+    }
     try {
-        const issue = await createProvider(parseRepo(req)).createIssue(title.trim(), description.trim());
+        const issue = await createProvider(parseRepo(req)).createIssue(title.trim(), description.trim(), labels);
         res.json({ issue });
-        broadcast({ type: FORGE_EVENTS.ISSUE_CREATED, iid: issue.iid });
+        broadcastFor(req, { type: FORGE_EVENTS.ISSUE_CREATED, iid: issue.iid });
     }
     catch (error) {
         handleError(res, error, "createIssue");
     }
 });
-router.put("/issues/:iid", async (req, res) => {
-    const { title, description = "" } = req.body;
-    if (!title?.trim()) {
-        res.status(400).json({ error: "title is required." });
+/** Partial update: only the fields present in the body change. */
+router.put("/issues/:iid", requireRole("operator"), async (req, res) => {
+    const { title, description } = req.body;
+    if (title !== undefined && !(typeof title === "string" && title.trim())) {
+        res.status(400).json({ error: "title can't be blank." });
+        return;
+    }
+    if (description !== undefined && typeof description !== "string") {
+        res.status(400).json({ error: "description must be a string." });
+        return;
+    }
+    const { labels, error: labelsError } = parseLabels(req.body.labels);
+    if (labelsError) {
+        res.status(400).json({ error: labelsError });
+        return;
+    }
+    const changes = {};
+    if (title !== undefined)
+        changes.title = title.trim();
+    if (description !== undefined)
+        changes.description = description.trim();
+    if (labels !== undefined)
+        changes.labels = labels;
+    if (Object.keys(changes).length === 0) {
+        res.status(400).json({ error: "Nothing to update." });
         return;
     }
     try {
-        const issue = await createProvider(parseRepo(req)).updateIssue(Number(req.params.iid), { title: title.trim(), description: description.trim() });
+        const iid = Number(req.params.iid);
+        const issue = await createProvider(parseRepo(req)).updateIssue(iid, changes);
         res.json({ issue });
+        broadcastFor(req, { type: FORGE_EVENTS.ISSUE_UPDATED, iid });
     }
     catch (error) {
         handleError(res, error, "updateIssue");
     }
 });
-router.post("/issues/:iid/close", async (req, res) => {
+/** What closing or deleting an issue would tear down. Lookups are best-effort. */
+async function issueFootprint(provider, iid) {
+    const [openMrs, prefixed] = await Promise.all([
+        provider.listForgeMRsForIssue(iid).catch(() => []),
+        provider.listBranchesByPrefix(`forge/issue-${iid}-`).catch(() => []),
+    ]);
+    const environments = (await Promise.all(teardownBranches(prefixed, iid).map((b) => provider.listEnvironmentsForBranch(b).catch(() => [])))).flat();
+    return { openMrs, branches: prefixed, environments };
+}
+/** Branches to tear down: the suffixed ones plus the legacy `forge/issue-:iid`, which may not exist. */
+function teardownBranches(branches, iid) {
+    return [...branches, `forge/issue-${iid}`];
+}
+/**
+ * Shared teardown before an issue is closed or deleted. Refuses (409) while a
+ * Forge MR is open — the user should merge or close it first; the frontend
+ * surfaces the message verbatim. Otherwise stops the issue's ephemeral
+ * environments and deletes its forge branches. Returns the stopped-environment
+ * count, or null when it already answered.
+ */
+async function retireIssueWork(res, provider, iid, verb) {
+    const { openMrs, branches, environments } = await issueFootprint(provider, iid);
+    if (openMrs.length > 0) {
+        const mr = openMrs[0];
+        res.status(409).json({
+            error: `Cannot ${verb}: active MR !${mr.iid} is still open. Merge or close it first.`,
+            openMr: { iid: mr.iid, web_url: mr.web_url, title: mr.title },
+        });
+        return null;
+    }
+    // Stop environments BEFORE deleting branches — on most providers deleting
+    // the branch orphans the environment rather than tearing it down. Each
+    // stop is best-effort (already-stopped envs 4xx).
+    await Promise.all(environments.map((e) => provider.stopEnvironment(e.id).catch(() => { })));
+    // Now delete the branches. Also best-effort.
+    await Promise.all(teardownBranches(branches, iid).map((b) => provider.deleteBranch(b).catch(() => { })));
+    return environments.length;
+}
+// Preview of what closing or deleting the issue would do, so the confirm
+// dialog can say it (and name a blocking MR) before anything happens.
+router.get("/issues/:iid/footprint", async (req, res) => {
+    const iid = Number(req.params.iid);
+    if (!Number.isInteger(iid) || iid <= 0) {
+        res.status(400).json({ error: "Invalid issue id." });
+        return;
+    }
+    try {
+        const { openMrs, branches, environments } = await issueFootprint(createProvider(parseRepo(req)), iid);
+        const mr = openMrs[0];
+        res.json({
+            openMr: mr ? { iid: mr.iid, web_url: mr.web_url, title: mr.title } : null,
+            branches: branches.length,
+            environments: environments.length,
+        });
+    }
+    catch (error) {
+        handleError(res, error, "getIssueFootprint");
+    }
+});
+router.post("/issues/:iid/close", requireRole("operator"), async (req, res) => {
     try {
         const iid = Number(req.params.iid);
         const provider = createProvider(parseRepo(req));
-        // Refuse if there's an open Forge MR — the user should merge or close the
-        // MR first. The frontend surfaces this message verbatim.
-        const openMrs = await provider.listForgeMRsForIssue(iid).catch(() => []);
-        if (openMrs.length > 0) {
-            const mr = openMrs[0];
-            res.status(409).json({
-                error: `Cannot close: active MR !${mr.iid} is still open. Merge or close it first.`,
-                openMr: { iid: mr.iid, web_url: mr.web_url, title: mr.title },
-            });
+        const stoppedEnvironments = await retireIssueWork(res, provider, iid, "close");
+        if (stoppedEnvironments === null)
             return;
-        }
-        // Stop any ephemeral environments attached to forge branches for this
-        // issue BEFORE deleting branches — on most providers deleting the
-        // branch orphans the environment rather than tearing it down. Each
-        // stop is best-effort (already-stopped envs 4xx).
-        const branches = await provider.listBranchesByPrefix(`forge/issue-${iid}-`).catch(() => []);
-        const baseBranch = `forge/issue-${iid}`;
-        const all = [...branches, baseBranch];
-        const envs = (await Promise.all(all.map((b) => provider.listEnvironmentsForBranch(b).catch(() => [])))).flat();
-        await Promise.all(envs.map((e) => provider.stopEnvironment(e.id).catch(() => { })));
-        // Now delete the branches. Also best-effort.
-        await Promise.all(all.map((b) => provider.deleteBranch(b).catch(() => { })));
         const issue = await provider.closeIssue(iid);
-        res.json({ issue, stoppedEnvironments: envs.length });
-        broadcast({ type: FORGE_EVENTS.ISSUE_CLOSED, iid });
+        res.json({ issue, stoppedEnvironments });
+        broadcastFor(req, { type: FORGE_EVENTS.ISSUE_CLOSED, iid });
     }
     catch (error) {
         handleError(res, error, "closeIssue");
     }
 });
+// Permanent and irreversible on GitLab, so it needs approver like merging.
+router.delete("/issues/:iid", requireRole("approver"), async (req, res) => {
+    try {
+        const iid = Number(req.params.iid);
+        const provider = createProvider(parseRepo(req));
+        const stoppedEnvironments = await retireIssueWork(res, provider, iid, "delete");
+        if (stoppedEnvironments === null)
+            return;
+        await provider.deleteIssue(iid);
+        res.json({ deleted: true, iid, stoppedEnvironments });
+        broadcastFor(req, { type: FORGE_EVENTS.ISSUE_DELETED, iid });
+    }
+    catch (error) {
+        handleError(res, error, "deleteIssue");
+    }
+});
+router.get("/labels", async (req, res) => {
+    try {
+        res.json({ labels: await createProvider(parseRepo(req)).listLabels() });
+    }
+    catch (error) {
+        handleError(res, error, "listLabels");
+    }
+});
 router.get("/issues/:iid", async (req, res) => {
     try {
         const issue = await createProvider(parseRepo(req)).getIssue(Number(req.params.iid));
@@ -453,7 +594,7 @@ router.get("/mr/:mrIid/detail", async (req, res) => {
         handleError(res, error, "getMR");
     }
 });
-router.post("/mr/:mrIid/rebase", async (req, res) => {
+router.post("/mr/:mrIid/rebase", requireRole("operator"), async (req, res) => {
     try {
         const provider = createProvider(parseRepo(req));
         if (!provider.supportsRebase) {
@@ -476,7 +617,7 @@ router.get("/mr/:mrIid/diffs", async (req, res) => {
         handleError(res, error, "getMRDiffs");
     }
 });
-router.post("/mr/:mrIid/auto-merge", async (req, res) => {
+router.post("/mr/:mrIid/auto-merge", requireRole("approver"), async (req, res) => {
     try {
         const provider = createProvider(parseRepo(req));
         await provider.setAutoMergeMR(Number(req.params.mrIid));
@@ -486,7 +627,7 @@ router.post("/mr/:mrIid/auto-merge", async (req, res) => {
         handleError(res, error, "setAutoMergeMR");
     }
 });
-router.post("/mr/:mrIid/cancel-auto-merge", async (req, res) => {
+router.post("/mr/:mrIid/cancel-auto-merge", requireRole("approver"), async (req, res) => {
     try {
         const provider = createProvider(parseRepo(req));
         await provider.cancelAutoMergeMR(Number(req.params.mrIid));
@@ -496,29 +637,29 @@ router.post("/mr/:mrIid/cancel-auto-merge", async (req, res) => {
         handleError(res, error, "cancelAutoMergeMR");
     }
 });
-router.post("/mr/:mrIid/merge", async (req, res) => {
+router.post("/mr/:mrIid/merge", requireRole("approver"), async (req, res) => {
     try {
         const provider = createProvider(parseRepo(req));
         await provider.mergeMR(Number(req.params.mrIid));
         res.json({ ok: true });
-        broadcast({ type: FORGE_EVENTS.MR_MERGED, mrIid: Number(req.params.mrIid) });
+        broadcastFor(req, { type: FORGE_EVENTS.MR_MERGED, mrIid: Number(req.params.mrIid) });
     }
     catch (error) {
         handleError(res, error, "mergeMR");
     }
 });
-router.post("/mr/:mrIid/close", async (req, res) => {
+router.post("/mr/:mrIid/close", requireRole("approver"), async (req, res) => {
     try {
         const provider = createProvider(parseRepo(req));
         await provider.closeMR(Number(req.params.mrIid));
         res.json({ ok: true });
-        broadcast({ type: FORGE_EVENTS.MR_CLOSED, mrIid: Number(req.params.mrIid) });
+        broadcastFor(req, { type: FORGE_EVENTS.MR_CLOSED, mrIid: Number(req.params.mrIid) });
     }
     catch (error) {
         handleError(res, error, "closeMR");
     }
 });
-router.post("/mr/:mrIid/reopen", async (req, res) => {
+router.post("/mr/:mrIid/reopen", requireRole("approver"), async (req, res) => {
     try {
         const provider = createProvider(parseRepo(req));
         await provider.reopenMR(Number(req.params.mrIid));
@@ -528,7 +669,7 @@ router.post("/mr/:mrIid/reopen", async (req, res) => {
         handleError(res, error, "reopenMR");
     }
 });
-router.post("/mr/:mrIid/draft", async (req, res) => {
+router.post("/mr/:mrIid/draft", requireRole("operator"), async (req, res) => {
     try {
         const draft = Boolean(req.body?.draft);
         const provider = createProvider(parseRepo(req));
@@ -543,7 +684,7 @@ router.post("/mr/:mrIid/draft", async (req, res) => {
 // The job is kicked off synchronously and runs to completion regardless of
 // whether a client is listening. The client opens /jobs/:jobId/stream to
 // attach (or reattach after a reload).
-router.post("/issues/:iid/analyze", (req, res) => {
+router.post("/issues/:iid/analyze", requireRole("operator"), (req, res) => {
     const { iid } = req.params;
     const primary = parseRepo(req);
     const secondaryProjects = parseSecondaryRepos(req, primary);
@@ -556,13 +697,83 @@ router.post("/issues/:iid/analyze", (req, res) => {
         ? req.body.kind
         : "fresh";
     const previousChanges = Array.isArray(req.body.previousChanges) ? req.body.previousChanges : null;
-    const jobId = jobStore.createJob("analyze", (send, signal) => agent.analyzeIssue(Number(iid), send, req.body.model || undefined, undefined, req.body.prompt || undefined, kind, { signal }, previousChanges), { meta: { iid: Number(iid) }, onComplete: () => broadcast({ type: FORGE_EVENTS.ANALYSIS_DONE, iid: Number(iid) }) });
-    broadcast({ type: FORGE_EVENTS.ANALYSIS_STARTED, iid: Number(iid), jobId });
+    const analyses = res.locals.analyses;
+    const repoKey = analysisRepoKey(req);
+    const existingMrIid = Number.isInteger(req.body.existingMrIid) ? req.body.existingMrIid : undefined;
+    const jobId = jobStore.createJob("analyze", async (send, signal) => {
+        let result = null;
+        const capture = (event) => {
+            if (event.type === "result")
+                result = event.data;
+            send(event);
+        };
+        const out = await agent.analyzeIssue(Number(iid), capture, req.body.model || undefined, undefined, req.body.prompt || undefined, kind, { signal, agentMode: req.body.agentMode }, previousChanges);
+        // Saved before `done`, so the result outlives this job's stream and buffer:
+        // any browser, any time later, gets it from GET /issues/:iid/analyses.
+        if (result && analyses && !signal.aborted) {
+            const analysis = await analyses.create({
+                repo: repoKey,
+                issueIid: Number(iid),
+                id: jobId,
+                result,
+                model: req.body.model || "",
+                mrIid: existingMrIid,
+                prompt: req.body.prompt,
+            });
+            send({ type: "analysis_saved", analysis: { ...analysis } });
+        }
+        return out;
+    }, { meta: { iid: Number(iid) }, onComplete: () => broadcastFor(req, { type: FORGE_EVENTS.ANALYSIS_DONE, iid: Number(iid) }) });
+    broadcastFor(req, { type: FORGE_EVENTS.ANALYSIS_STARTED, iid: Number(iid), jobId });
     res.json({ jobId });
 });
+// ─── Saved analyses ───────────────────────────────────────────────────────────
+// Same repo key the browser cache uses: the selected repo, or "default".
+function analysisRepoKey(req) {
+    const fromQuery = typeof req.query.repo === "string" ? req.query.repo : "";
+    const fromBody = typeof req.body?.repo === "string" ? req.body.repo : "";
+    return fromQuery || fromBody || "default";
+}
+function analysisStore(res) {
+    const store = res.locals.analyses;
+    if (!store)
+        res.status(503).json({ error: "Saved analyses aren't available." });
+    return store;
+}
+router.get("/issues/:iid/analyses", async (req, res) => {
+    const store = analysisStore(res);
+    if (!store)
+        return;
+    res.json({ analyses: await store.list(analysisRepoKey(req), Number(req.params.iid)) });
+});
+router.put("/issues/:iid/analyses/:id", requireRole("operator"), async (req, res) => {
+    const store = analysisStore(res);
+    if (!store)
+        return;
+    const entry = req.body?.analysis;
+    if (!entry || entry.id !== req.params.id || typeof entry.result !== "object" || entry.result === null) {
+        res.status(400).json({ error: "analysis with a matching id and a result is required." });
+        return;
+    }
+    res.json({ analysis: await store.put(analysisRepoKey(req), Number(req.params.iid), entry) });
+});
+router.delete("/issues/:iid/analyses/:id", requireRole("operator"), async (req, res) => {
+    const store = analysisStore(res);
+    if (!store)
+        return;
+    await store.remove(analysisRepoKey(req), Number(req.params.iid), req.params.id);
+    res.json({ deleted: true });
+});
+router.delete("/issues/:iid/analyses", requireRole("operator"), async (req, res) => {
+    const store = analysisStore(res);
+    if (!store)
+        return;
+    await store.clear(analysisRepoKey(req), Number(req.params.iid));
+    res.json({ deleted: true });
+});
 // ─── Refine ───────────────────────────────────────────────────────────────────
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-router.post("/issues/:iid/refine", (req, res) => {
+router.post("/issues/:iid/refine", requireRole("operator"), (req, res) => {
     const { iid } = req.params;
     const { feedback, previousChanges, ciContext, validationState, claudeSessionId } = req.body;
     if (!feedback?.trim() && !ciContext?.trim()) {
@@ -586,10 +797,10 @@ router.post("/issues/:iid/refine", (req, res) => {
         secondaryProjects: parseSecondaryRepos(req, primary),
         agent: req.body.agent || "claude",
     });
-    const jobId = jobStore.createJob("refine", (send, signal) => agent.refineIssue(Number(iid), previousChanges, feedback?.trim() ?? "", send, undefined, ciContext?.trim(), validationState ?? null, safeSessionId, { signal }), { onComplete: () => broadcast({ type: FORGE_EVENTS.REFINE_DONE, iid: Number(iid) }) });
+    const jobId = jobStore.createJob("refine", (send, signal) => agent.refineIssue(Number(iid), previousChanges, feedback?.trim() ?? "", send, undefined, ciContext?.trim(), validationState ?? null, safeSessionId, { signal }), { onComplete: () => broadcastFor(req, { type: FORGE_EVENTS.REFINE_DONE, iid: Number(iid) }) });
     res.json({ jobId });
 });
-router.post("/issues/:iid/ci-fix", (req, res) => {
+router.post("/issues/:iid/ci-fix", requireRole("operator"), (req, res) => {
     const { iid } = req.params;
     const { ciContext, model } = req.body;
     if (!ciContext?.trim()) {
@@ -602,7 +813,7 @@ router.post("/issues/:iid/ci-fix", (req, res) => {
         secondaryProjects: parseSecondaryRepos(req, primary),
         agent: req.body.agent || "claude",
     });
-    const jobId = jobStore.createJob("ci-fix", (send, signal) => agent.ciFixIssue(Number(iid), ciContext.trim(), send, model, { signal }), { onComplete: () => broadcast({ type: FORGE_EVENTS.CI_FIX_DONE, iid: Number(iid) }) });
+    const jobId = jobStore.createJob("ci-fix", (send, signal) => agent.ciFixIssue(Number(iid), ciContext.trim(), send, model, { signal }), { onComplete: () => broadcastFor(req, { type: FORGE_EVENTS.CI_FIX_DONE, iid: Number(iid) }) });
     res.json({ jobId });
 });
 router.get("/jobs/:jobId/trace", async (req, res) => {
@@ -641,10 +852,7 @@ router.get("/jobs/:jobId/stream", (req, res) => {
         res.status(404).json({ error: "Job not found." });
         return;
     }
-    res.setHeader("Content-Type", "text/event-stream");
-    res.setHeader("Cache-Control", "no-cache");
-    res.setHeader("Connection", "keep-alive");
-    res.flushHeaders();
+    openEventStream(req, res);
     let unsubscribe = () => { };
     const write = (event) => {
         if (res.writableEnded)
@@ -668,7 +876,7 @@ router.get("/jobs/:jobId/stream", (req, res) => {
             res.end();
     });
 });
-router.post("/jobs/:jobId/cancel", (req, res) => {
+router.post("/jobs/:jobId/cancel", requireRole("operator"), (req, res) => {
     const jobId = req.params.jobId;
     if (!jobStore.getJob(jobId)) {
         res.status(404).json({ error: "Job not found." });
@@ -682,7 +890,7 @@ router.post("/jobs/:jobId/cancel", (req, res) => {
 // Pre-flight check: overlay the proposed changes on a cached clone of the
 // target repo, run lint/typecheck/test, and report results. Nothing is pushed
 // to GitLab — this is a sandbox check to prevent CI errors.
-router.post("/validate", (req, res) => {
+router.post("/validate", requireRole("operator"), (req, res) => {
     const { analysis } = req.body;
     if (!analysis?.changes?.length) {
         res.status(400).json({ error: "analysis with changes is required." });
@@ -695,10 +903,17 @@ router.post("/validate", (req, res) => {
     const secondaryRepos = parseSecondaryRepos(req, primary);
     const repos = [primary, ...secondaryRepos].filter(Boolean);
     const enrichedAnalysis = repos.length ? { ...analysis, repos } : analysis;
-    const jobId = jobStore.createJob("validate", (send) => runValidation(enrichedAnalysis, send), { idPrefix: "val" });
+    const iid = Number(analysis.issue?.iid) || null;
+    const jobId = jobStore.createJob("validate", (send) => runValidation(enrichedAnalysis, send), {
+        // No meta.iid: /issues/:iid/active-job would take it for an analysis.
+        idPrefix: "val",
+        // Lets a client that stopped watching clear its "validating" badge.
+        onComplete: () => { if (iid)
+            broadcastFor(req, { type: FORGE_EVENTS.VALIDATION_DONE, iid, jobId }); },
+    });
     res.json({ jobId });
 });
-router.post("/apply", async (req, res) => {
+router.post("/apply", requireRole("operator"), async (req, res) => {
     const { analysis } = req.body;
     if (!analysis?.issue || !analysis?.changes?.length) {
         res.status(400).json({ error: "Invalid or missing analysis payload." });
@@ -710,13 +925,13 @@ router.post("/apply", async (req, res) => {
         const agent = new ForgeAgent({ project: primary, secondaryProjects });
         const result = await agent.applyFix(analysis);
         res.json(result);
-        broadcast({ type: FORGE_EVENTS.FIX_APPLIED, iid: analysis.issue?.iid });
+        broadcastFor(req, { type: FORGE_EVENTS.FIX_APPLIED, iid: analysis.issue?.iid });
     }
     catch (error) {
         handleError(res, error, "applyFix");
     }
 });
-router.post("/commit-to-branch", async (req, res) => {
+router.post("/commit-to-branch", requireRole("operator"), async (req, res) => {
     const { branchName, analysis, repo: changeRepo } = req.body;
     if (!branchName?.trim()) {
         res.status(400).json({ error: "branchName is required." });
@@ -740,7 +955,7 @@ router.post("/commit-to-branch", async (req, res) => {
         handleError(res, error, "commitToBranch");
     }
 });
-router.post("/promote-branch", async (req, res) => {
+router.post("/promote-branch", requireRole("operator"), async (req, res) => {
     const { branchName, repo: targetRepo, issueIid } = req.body;
     if (!branchName?.trim()) {
         res.status(400).json({ error: "branchName is required." });
@@ -761,7 +976,7 @@ router.post("/promote-branch", async (req, res) => {
         handleError(res, error, "promoteBranchToMR");
     }
 });
-router.post("/deploy-branch", async (req, res) => {
+router.post("/deploy-branch", requireRole("operator"), async (req, res) => {
     const { analysis } = req.body;
     if (!analysis?.issue || !analysis?.changes?.length) {
         res.status(400).json({ error: "Invalid or missing analysis payload." });
@@ -798,6 +1013,70 @@ router.get("/mr/:mrIid/pipeline", async (req, res) => {
         handleError(res, error, "getPipelineStatus");
     }
 });
+const PIPELINE_HISTORY_PAGE_SIZE = 30;
+// Pipeline history for the repo: every ref and trigger (main, MRs, branches),
+// newest first. `nextPage` is null once a short page shows there's no more.
+router.get("/pipelines", async (req, res) => {
+    const requested = Number(req.query.page);
+    const page = Number.isInteger(requested) && requested > 0 ? requested : 1;
+    try {
+        const pipelines = await createProvider(parseRepo(req)).listRecentPipelines({
+            page,
+            perPage: PIPELINE_HISTORY_PAGE_SIZE,
+        });
+        res.json({ pipelines, nextPage: pipelines.length === PIPELINE_HISTORY_PAGE_SIZE ? page + 1 : null });
+    }
+    catch (error) {
+        handleError(res, error, "listRecentPipelines");
+    }
+});
+// The first environment a reviewer can actually open, or null.
+function firstLiveEnvironment(envs) {
+    return envs.find((e) => e.state === "available" && e.external_url) ?? null;
+}
+// Git refuses longer ref names on most hosts; anything past this is noise.
+const MAX_BRANCH_LENGTH = 255;
+// The MR's live review environment (per-MR ephemeral deploy, or a deploy from
+// its source branch), or null when the pipeline hasn't deployed one. Lookup
+// failures read as "none" — the UI only shows the link when there's something
+// to open, and keeps polling until there is.
+router.get("/mr/:mrIid/environment", async (req, res) => {
+    const mrIid = Number(req.params.mrIid);
+    if (!Number.isInteger(mrIid) || mrIid <= 0) {
+        res.status(400).json({ error: "Invalid MR id." });
+        return;
+    }
+    try {
+        const provider = createProvider(parseRepo(req));
+        const sourceBranch = await provider
+            .getMR(mrIid)
+            .then((mr) => mr.source_branch || undefined, () => undefined);
+        const envs = await provider
+            .listEnvironmentsForMR(mrIid, sourceBranch)
+            .catch(() => []);
+        res.json({ environment: firstLiveEnvironment(envs) });
+    }
+    catch (error) {
+        handleError(res, error, "getMREnvironment");
+    }
+});
+// Same as above for a branch with no MR (Deploy-to-Test branches).
+router.get("/branch-environment", async (req, res) => {
+    const branch = req.query.branch;
+    if (typeof branch !== "string" || !branch || branch.length > MAX_BRANCH_LENGTH) {
+        res.status(400).json({ error: "branch is required" });
+        return;
+    }
+    try {
+        const envs = await createProvider(parseRepo(req))
+            .listEnvironmentsForBranch(branch)
+            .catch(() => []);
+        res.json({ environment: firstLiveEnvironment(envs) });
+    }
+    catch (error) {
+        handleError(res, error, "getBranchEnvironment");
+    }
+});
 // Returns the latest branch pipeline (and its jobs) for any ref.
 // Used by Deploy-to-Test, which creates a branch with no MR, so MR-scoped
 // pipeline lookups don't apply.
@@ -861,20 +1140,33 @@ router.get("/issues/:iid/deploy-branches", async (req, res) => {
         handleError(res, error, "listDeployBranches");
     }
 });
-// Ephemeral environments (review apps) attached to any forge/issue-:iid-*
-// branch. Returns a flat list — each entry carries the branch it's tied to
-// so the UI can colocate it with its pipeline.
+// Ephemeral environments (review apps) for an issue: those deployed from any
+// forge/issue-:iid-* branch, plus those its open Forge MRs' pipelines deployed
+// (MR pipelines deploy from the merge-request ref, not the branch). Returns a
+// flat list — each entry carries the branch it's tied to so the UI can
+// colocate it with its pipeline.
 router.get("/issues/:iid/environments", async (req, res) => {
     try {
         const iid = Number(req.params.iid);
         const provider = createProvider(parseRepo(req));
-        const branches = await provider.listBranchesByPrefix(`forge/issue-${iid}-`).catch(() => []);
+        const [branches, openMrs] = await Promise.all([
+            provider.listBranchesByPrefix(`forge/issue-${iid}-`).catch(() => []),
+            provider.listForgeMRsForIssue(iid).catch(() => []),
+        ]);
         const all = [...branches, `forge/issue-${iid}`];
-        const envsByBranch = await Promise.all(all.map(async (branch) => {
-            const envs = await provider.listEnvironmentsForBranch(branch).catch(() => []);
-            return envs.map((e) => ({ ...e, branchName: branch }));
-        }));
-        res.json({ environments: envsByBranch.flat() });
+        const envLists = await Promise.all([
+            ...all.map(async (branch) => {
+                const envs = await provider.listEnvironmentsForBranch(branch).catch(() => []);
+                return envs.map((e) => ({ ...e, branchName: branch }));
+            }),
+            ...openMrs.map(async (mr) => {
+                const envs = await provider.listEnvironmentsForMR(mr.iid).catch(() => []);
+                return envs.map((e) => ({ ...e, branchName: mr.source_branch }));
+            }),
+        ]);
+        const seen = new Set();
+        const environments = envLists.flat().filter((e) => !seen.has(e.id) && seen.add(e.id));
+        res.json({ environments });
     }
     catch (error) {
         handleError(res, error, "listEnvironments");
@@ -910,7 +1202,7 @@ router.get("/issues/:iid/post-merge-pipeline", async (req, res) => {
     }
 });
 // ─── Resolution check ─────────────────────────────────────────────────────────
-router.post("/issues/:iid/resolution-check", async (req, res) => {
+router.post("/issues/:iid/resolution-check", requireRole("operator"), async (req, res) => {
     try {
         const primary = parseRepo(req);
         const secondaryProjects = parseSecondaryRepos(req, primary);
@@ -928,57 +1220,18 @@ router.post("/issues/:iid/resolution-check", async (req, res) => {
         handleError(res, error, "checkResolution");
     }
 });
-// ─── Rollout status ───────────────────────────────────────────────────────────
-router.get("/rollout", async (_req, res) => {
-    try {
-        const deployments = await listDeployments("test");
-        res.json({ deployments });
-    }
-    catch (error) {
-        handleError(res, error, "rollout");
-    }
-});
-// ─── Quota probe ──────────────────────────────────────────────────────────────
-// User-triggered: hits the Anthropic Messages API once with a 1-token request
-// just to read `anthropic-ratelimit-*` response headers. All real Forge work
-// still runs through the `claude` CLI (subscription).
-router.get("/quota", async (_req, res) => {
-    try {
-        const result = await probeQuota();
-        res.json(result);
-    }
-    catch (e) {
-        // Propagate the Anthropic status code if the probe itself failed,
-        // but still return whatever rate-limit headers came back.
-        const error = e;
-        const status = error?.status ?? 500;
-        res.status(status).json({
-            error: error?.message ?? "Quota probe failed",
-            rateLimit: error?.rateLimit ?? null,
-            operation: "quota",
-        });
-    }
-});
-// ─── Telemetry ───────────────────────────────────────────────────────────────
-router.get("/telemetry", async (_req, res) => {
-    try {
-        const { getSummary, getFailurePatterns, getRecentEvents } = await import("./core/telemetry.js");
-        const [summary, patterns, recent] = await Promise.all([
-            getSummary(),
-            getFailurePatterns(),
-            getRecentEvents(50),
-        ]);
-        res.json({ summary, patterns, recentEvents: recent });
-    }
-    catch (error) {
-        handleError(res, error, "getTelemetry");
-    }
-});
 // ─── Live event bus ──────────────────────────────────────────────────────────
 // SSE channel that broadcasts state-change events so the UI can refetch
 // without polling. The CLI and API endpoints call broadcast() after any
 // mutating operation (analyze, apply, merge, close, etc.).
 const sseClients = new Set();
+/**
+ * Tags an event with the repo the request was for, so a browser looking at
+ * another repo ignores it (issue numbers repeat across repos).
+ */
+function broadcastFor(req, event) {
+    broadcast({ ...event, repo: parseRepo(req) });
+}
 function broadcast(event) {
     const data = `data: ${JSON.stringify(event)}\n\n`;
     for (const res of sseClients) {
@@ -987,21 +1240,18 @@ function broadcast(event) {
     }
 }
 router.get("/events", (req, res) => {
-    res.setHeader("Content-Type", "text/event-stream");
-    res.setHeader("Cache-Control", "no-cache");
-    res.setHeader("Connection", "keep-alive");
-    res.flushHeaders();
+    openEventStream(req, res);
     res.write(":\n\n");
     sseClients.add(res);
     req.on("close", () => sseClients.delete(res));
 });
-router.post("/events", (req, res) => {
+router.post("/events", requireRole("operator"), (req, res) => {
     const { type, iid, mrIid } = req.body ?? {};
     if (!type) {
         res.status(400).json({ error: "type is required." });
         return;
     }
-    broadcast({ type, ...(iid != null && { iid }), ...(mrIid != null && { mrIid }) });
+    broadcastFor(req, { type, ...(iid != null && { iid }), ...(mrIid != null && { mrIid }) });
     res.json({ ok: true });
 });
 export { broadcast };