Introduce gitleaks and dependabot configs and secret scan workflow

.github/dependabot.yml

@@ -0,0 +1,43 @@
+# Dependabot: security + version updates for AgentForge WebUI.
+# Docs: https://docs.github.com/en/code-security/dependabot
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+      day: "monday"
+    open-pull-requests-limit: 2
+    labels:
+      - "dependencies"
+      - "javascript"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      npm-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      npm-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+      day: "monday"
+    open-pull-requests-limit: 1
+    labels:
+      - "dependencies"
+      - "ci"
+    commit-message:
+      prefix: "chore(ci)"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/secret-scan.yml

@@ -0,0 +1,26 @@
+# Optional in-repo secret scan (gitleaks). Complements the GitGuardian GitHub App
+# check that already runs on pull requests.
+name: Secret Scan
+
+on:
+  pull_request:
+    branches: [main, master]
+  workflow_dispatch:
+
+concurrency:
+  group: secret-scan-${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  gitleaks:
+    name: Gitleaks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Run Gitleaks
+        uses: gitleaks/gitleaks-action@v3
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitleaks.toml

@@ -0,0 +1,5 @@
+# Gitleaks config for AgentForge WebUI
+title = "AgentForge WebUI"
+
+[extend]
+useDefault = true

CHANGELOG.md

@@ -6,6 +6,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-07-19
+
+Requires [AgentForge](https://github.com/bulletinmybeard/agent-forge) **≥ 0.13.0** for command permission profiles (`/api/permissions/profiles/*`). Command-permissions overrides (`/api/permissions/commands/*`) remain as in 0.12.
+
+### Added
+
+- **Command permission profiles** in the Command Permissions modal: list/apply YAML baseline, blank slate, builtin (`tight` / `open`) and user-saved profiles; save current policy as a named profile; delete user profiles (`useCommandPermissions` + `/api/permissions/profiles`)
+
+### Fixed
+
+- Pattern/command list textareas: Enter no longer collapses multi-line editing (draft lines keep trailing empty rows; blanks are stripped only on save/compare/validate)
+
 ## [0.2.0] - 2026-07-18
 
 Requires [AgentForge](https://github.com/bulletinmybeard/agent-forge) **≥ 0.12.0** for the command-permissions API (`/api/permissions/commands/*`).

README.md

@@ -4,7 +4,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
 [![Vite](https://img.shields.io/badge/Vite-8-646cff.svg?logo=vite&logoColor=white)](https://vitejs.dev/)
 [![Biome](https://img.shields.io/badge/lint%2Fformat-Biome-60a5fa.svg?logo=biome&logoColor=white)](https://biomejs.dev/)
-[![Requires AgentForge](https://img.shields.io/badge/requires-AgentForge%200.12.0%2B-blueviolet)](https://github.com/bulletinmybeard/agent-forge/releases/tag/v0.12.0)
+[![Requires AgentForge](https://img.shields.io/badge/requires-AgentForge%200.13.0%2B-blueviolet)](https://github.com/bulletinmybeard/agent-forge/releases/tag/v0.13.0)
 
 > [!NOTE]
 > **Experimental!**
@@ -15,15 +15,15 @@ AgentForge WebUI is a React SPA for [AgentForge](https://github.com/bulletinmybe
 It's a pure frontend: it streams the agent's think > act > observe loop over the backend's `/ws/chat` WebSocket and calls its REST API for sessions, uploads, memory, and configs. It does nothing on its own — a running AgentForge backend is required!
 
 > [!IMPORTANT]
-> **Backend version:** WebUI **0.2.0+** needs [AgentForge **v0.12.0**](https://github.com/bulletinmybeard/agent-forge/releases/tag/v0.12.0) or newer.
-> The **Command Permissions** modal and other features depend on APIs and schema shipped in that release (`/api/permissions/commands/*`, session `source` filtering, etc.). Older backends will fail those endpoints (e.g. 404).
+> **Backend version:** WebUI **0.3.0+** needs [AgentForge **v0.13.0**](https://github.com/bulletinmybeard/agent-forge/releases/tag/v0.13.0) or newer.
+> The **Command Permissions** modal (overrides + **profiles**) depends on APIs and schema from that release (`/api/permissions/commands/*`, `/api/permissions/profiles/*`, session `source` filtering, etc.). Older backends will fail those endpoints (e.g. 404).
 
 ## Features
 
 - Streaming chat over the `/ws/chat` WebSocket, with the full think > act > observe event stream rendered live
 - Mode picker for the `@mode` prefixes (chat, docs, search, agent, sql, logs, discover, pipeline, review, research, coding, scheduler, monitor, connectors, and custom agents), each with its own colour
 - Per-event message cards: routing, config, tool calls, confirm + secret dialogs, results, summaries, errors, search metadata, discovery, research, scheduler/monitor jobs, file diffs, agent warning/recovery/retry/escalation, model fallback, and session compaction
-- **Command Permissions** modal: manage shell/SSH allowlist, denylist, and confirm policy (runtime overrides on the AgentForge backend)
+- **Command Permissions** modal: manage shell/SSH allowlist, denylist, and confirm policy (runtime overrides on the AgentForge backend), plus named **profiles** (YAML baseline, blank slate, builtins `tight`/`open`, save-as / delete user profiles)
 - Connectors UI: connect and manage multi-account Google (Gmail, Drive, BigQuery, YouTube), GitLab, and GitHub connections, with per-connection product/permission display and an in-place read/write toggle
 - Canvas workspace for pinned snippets, results, and queries
 - Bookmarks: save tool-call sets and agent answers from any run, fuzzy-searchable in a modal
@@ -38,7 +38,7 @@ It's a pure frontend: it streams the agent's think > act > observe loop over the
 Prerequisites:
 
 - **Node 20.19+** (`engines` in `package.json`)
-- A running [AgentForge](https://github.com/bulletinmybeard/agent-forge) backend **[v0.12.0](https://github.com/bulletinmybeard/agent-forge/releases/tag/v0.12.0) or newer** (`scripts/deploy-local.sh` brings the stack up with the web service on `:8200`)
+- A running [AgentForge](https://github.com/bulletinmybeard/agent-forge) backend **[v0.13.0](https://github.com/bulletinmybeard/agent-forge/releases/tag/v0.13.0) or newer** (`scripts/deploy-local.sh` brings the stack up with the web service on `:8200`)
 
 ```bash
 npm install

package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-forge-webui",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "React SPA front-end for AgentForge — every mode, tool call, and connector in one chat UI",
   "type": "module",
   "engines": {