@recombine-ai/bosun 0.16.2 → 0.17.1

package/src/backend/git-mode/types.ts

@@ -0,0 +1,82 @@
+export const gitModePhases = [
+	'idle',
+	'preparing',
+	'flushing',
+	'refreshing',
+	'awaiting-changes',
+	'processing',
+	'restarting',
+	'fatal'
+] as const
+
+export type GitModePhase = (typeof gitModePhases)[number]
+export type GitModePreparationStage = 'preflight' | 'browser-writes'
+export type ActivationReason = 'page-open' | 'focus'
+export type ChangeAction = 'save' | 'discard'
+
+export type GitModeFatalKind = 'branch-mismatch' | 'merge-conflict' | 'general'
+
+export interface GitModeFatal {
+	kind: GitModeFatalKind
+	title: string
+	message: string
+	prUrl: string | null
+}
+
+export interface GitModeStatus {
+	enabled: boolean
+	phase: GitModePhase
+	operationId: string | null
+	hasChanges: boolean
+	canPrepareRelease: boolean
+	fatal: GitModeFatal | null
+	prUrl: string | null
+	reloadToken: string | null
+	deferredReason: string | null
+	tabNeedsFlush: boolean
+	preparationStage: GitModePreparationStage | null
+}
+
+export interface ChangeChoice {
+	action: ChangeAction
+	description?: string
+}
+
+export interface GitModeConfig {
+	enabled: boolean
+	projectDir: string
+	currentBranch: string
+	personalBranch: string
+	idleMs: number
+	currentUpstream: string
+	currentUpstreamRemote: string
+	currentUpstreamBranch: string
+	personalUpstream: string
+	personalUpstreamRemote: string
+	personalUpstreamBranch: string
+	launchId: string
+	runtimeStatePath: string
+	restartExitCode: number
+}
+
+export interface GitModeService {
+	isUsageBlocked(): boolean
+	status(input: { tabId: string }): Promise<GitModeStatus>
+	unregister(input: { tabId: string }): Promise<GitModeStatus>
+	activate(input: { tabId: string; reason: ActivationReason }): Promise<GitModeStatus>
+	flushAck(input: {
+		tabId: string
+		operationId: string
+		stage: GitModePreparationStage
+		blockedReason?: string
+	}): Promise<GitModeStatus>
+	startManual(input: { tabId: string } & ChangeChoice): Promise<GitModeStatus>
+	prepareRelease(input: { tabId: string }): Promise<GitModeStatus>
+	resolveChanges(
+		input: {
+			tabId: string
+			operationId: string
+		} & ChangeChoice
+	): Promise<GitModeStatus>
+	dispose(): Promise<void>
+}

package/src/backend/git-mode/write-tracker.spec.ts

@@ -0,0 +1,46 @@
+import { describe, expect, it, vi } from 'vitest'
+
+import { RepositoryWriteTracker } from './write-tracker'
+
+describe('RepositoryWriteTracker', () => {
+	it('drains all operations admitted before the repository lock', async () => {
+		const tracker = new RepositoryWriteTracker()
+		let releaseFirst!: () => void
+		let releaseSecond!: () => void
+		const first = tracker.track(() => new Promise<void>((resolve) => (releaseFirst = resolve)))
+		const second = tracker.track(() => new Promise<void>((resolve) => (releaseSecond = resolve)))
+		const drained = vi.fn()
+		const draining = tracker.drain().then(drained)
+		await Promise.resolve()
+
+		expect(tracker.activeCount).toBe(2)
+		releaseFirst()
+		await first
+		await Promise.resolve()
+		expect(drained).not.toHaveBeenCalled()
+
+		releaseSecond()
+		await Promise.all([second, draining])
+		expect(drained).toHaveBeenCalledOnce()
+		expect(tracker.activeCount).toBe(0)
+	})
+
+	it('resolves immediately when no writes are active', async () => {
+		const tracker = new RepositoryWriteTracker()
+		await expect(tracker.drain()).resolves.toBeUndefined()
+	})
+
+	it('atomically closes admission while allowing previously admitted writes to drain', async () => {
+		const tracker = new RepositoryWriteTracker()
+		let release!: () => void
+		const admitted = tracker.track(() => new Promise<void>((resolve) => (release = resolve)))
+
+		tracker.close()
+		await expect(tracker.track(async () => {})).rejects.toThrow(/shutting down/)
+
+		const draining = tracker.drain()
+		release()
+		await Promise.all([admitted, draining])
+		expect(tracker.activeCount).toBe(0)
+	})
+})

package/src/backend/git-mode/write-tracker.ts

@@ -0,0 +1,39 @@
+/**
+ * Counts repository-facing backend work that was admitted before Git mode closed its write gate.
+ * JavaScript runs the admission check and `track` call synchronously, so a Git lock transition
+ * either observes an already-counted operation or causes the caller to be rejected.
+ */
+export class RepositoryWriteTracker {
+	private active = 0
+	private accepting = true
+	private idleWaiters = new Set<() => void>()
+
+	track<T>(operation: () => Promise<T>): Promise<T> {
+		if (!this.accepting) {
+			return Promise.reject(new Error('Bosun is shutting down; repository writes are closed.'))
+		}
+		this.active += 1
+		return Promise.resolve()
+			.then(operation)
+			.finally(() => {
+				this.active -= 1
+				if (this.active !== 0) return
+				for (const resolve of this.idleWaiters) resolve()
+				this.idleWaiters.clear()
+			})
+	}
+
+	close(): void {
+		this.accepting = false
+	}
+
+	async drain(): Promise<void> {
+		while (this.active > 0) {
+			await new Promise<void>((resolve) => this.idleWaiters.add(resolve))
+		}
+	}
+
+	get activeCount(): number {
+		return this.active
+	}
+}

package/src/backend/lib/backend-restart.spec.ts

@@ -0,0 +1,27 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+import {
+	registerManagedBackendRestartHandler,
+	scheduleManagedBackendRestart
+} from './backend-restart'
+
+describe('managed backend restart', () => {
+	afterEach(() => {
+		vi.useRealTimers()
+		delete process.env.BOSUN_NPX_RUN
+	})
+
+	it('routes a managed restart through graceful shutdown with the requested exit code', async () => {
+		vi.useFakeTimers()
+		process.env.BOSUN_NPX_RUN = 'true'
+		const handler = vi.fn()
+		const unregister = registerManagedBackendRestartHandler(handler)
+
+		expect(scheduleManagedBackendRestart(76)).toBe(true)
+		await vi.advanceTimersByTimeAsync(500)
+
+		expect(handler).toHaveBeenCalledOnce()
+		expect(handler).toHaveBeenCalledWith(76)
+		unregister()
+	})
+})

package/src/backend/lib/backend-restart.ts

@@ -2,13 +2,27 @@ const MANAGED_BACKEND_RESTART_EXIT_CODE = 75
 const MANAGED_BACKEND_RESTART_DELAY_MS = 500
 
 let restartTimer: ReturnType<typeof setTimeout> | null = null
+let restartHandler: ((exitCode: number) => void | Promise<void>) | null = null
 
-export function scheduleManagedBackendRestart(): boolean {
+export function registerManagedBackendRestartHandler(
+	handler: (exitCode: number) => void | Promise<void>
+): () => void {
+	restartHandler = handler
+	return () => {
+		if (restartHandler === handler) restartHandler = null
+	}
+}
+
+export function scheduleManagedBackendRestart(
+	exitCode = MANAGED_BACKEND_RESTART_EXIT_CODE
+): boolean {
 	if (process.env.BOSUN_NPX_RUN !== 'true') return false
 	if (restartTimer) return true
+	if (!Number.isInteger(exitCode) || exitCode < 1 || exitCode > 255) return false
 
 	restartTimer = setTimeout(() => {
-		process.exit(MANAGED_BACKEND_RESTART_EXIT_CODE)
+		if (restartHandler) void restartHandler(exitCode)
+		else process.exit(exitCode)
 	}, MANAGED_BACKEND_RESTART_DELAY_MS)
 	restartTimer.unref()
 	return true

package/src/backend/lib/middleware/cors.spec.ts

@@ -0,0 +1,67 @@
+import type { IncomingMessage, ServerResponse } from 'node:http'
+import { describe, expect, it, vi } from 'vitest'
+
+import { createCors, isAllowedBrowserOrigin } from './cors'
+
+const ALLOWED = 'http://localhost:5177'
+
+describe('createCors', () => {
+	it('allows the exact configured origin and never emits a wildcard', () => {
+		const { req, res, next, headers } = harness('POST', ALLOWED)
+		createCors(ALLOWED)(req, res, next)
+
+		expect(next).toHaveBeenCalledOnce()
+		expect(headers.get('Access-Control-Allow-Origin')).toBe(ALLOWED)
+		expect([...headers.values()]).not.toContain('*')
+	})
+
+	it.each([undefined, 'null', 'https://example.com', 'http://localhost:5178'])(
+		'rejects a state-changing request from %s',
+		(origin) => {
+			const { req, res, next, writeHead } = harness('POST', origin)
+			createCors(ALLOWED)(req, res, next)
+
+			expect(next).not.toHaveBeenCalled()
+			expect(writeHead).toHaveBeenCalledWith(403, expect.any(Object))
+		}
+	)
+
+	it('rejects a preflight from another origin', () => {
+		const { req, res, next, writeHead } = harness('OPTIONS', 'https://example.com')
+		createCors(ALLOWED)(req, res, next)
+
+		expect(next).not.toHaveBeenCalled()
+		expect(writeHead).toHaveBeenCalledWith(403)
+	})
+
+	it('allows an originless GET without granting browser read access', () => {
+		const { req, res, next, headers } = harness('GET', undefined)
+		createCors(ALLOWED)(req, res, next)
+
+		expect(next).toHaveBeenCalledOnce()
+		expect(headers.has('Access-Control-Allow-Origin')).toBe(false)
+	})
+})
+
+describe('isAllowedBrowserOrigin', () => {
+	it('requires an exact match', () => {
+		expect(isAllowedBrowserOrigin(ALLOWED, ALLOWED)).toBe(true)
+		expect(isAllowedBrowserOrigin(undefined, ALLOWED)).toBe(false)
+		expect(isAllowedBrowserOrigin('null', ALLOWED)).toBe(false)
+	})
+})
+
+function harness(method: string, origin: string | undefined) {
+	const headers = new Map<string, string | number | readonly string[]>()
+	const writeHead = vi.fn()
+	const end = vi.fn()
+	const next = vi.fn()
+	const req = { method, headers: { origin } } as unknown as IncomingMessage
+	const res = {
+		setHeader: (name: string, value: string | number | readonly string[]) =>
+			headers.set(name, value),
+		writeHead,
+		end
+	} as unknown as ServerResponse
+	return { req, res, next, headers, writeHead, end }
+}

package/src/backend/lib/middleware/cors.ts

@@ -1,14 +1,42 @@
-import type { IncomingMessage, ServerResponse } from 'http'
-
-export function cors(req: IncomingMessage, res: ServerResponse, next: () => void) {
-	res.setHeader('Access-Control-Allow-Origin', '*')
-	res.setHeader('Access-Control-Request-Method', '*')
-	res.setHeader('Access-Control-Allow-Methods', 'OPTIONS, GET, POST, PUT')
-	res.setHeader('Access-Control-Allow-Headers', '*')
-	if (req.method === 'OPTIONS') {
-		res.writeHead(200)
-		res.end()
-		return
+import type { IncomingMessage, ServerResponse } from 'node:http'
+
+const STATE_CHANGING_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE'])
+
+export function isAllowedBrowserOrigin(origin: string | undefined, allowedOrigin: string): boolean {
+	return origin === allowedOrigin
+}
+
+export function createCors(allowedOrigin: string) {
+	if (!allowedOrigin) throw new Error('Bosun browser origin is not configured.')
+
+	return function cors(req: IncomingMessage, res: ServerResponse, next: () => void) {
+		const origin = normalizeHeader(req.headers.origin)
+		const allowed = isAllowedBrowserOrigin(origin, allowedOrigin)
+
+		res.setHeader('Vary', 'Origin')
+		if (allowed) {
+			res.setHeader('Access-Control-Allow-Origin', allowedOrigin)
+			res.setHeader('Access-Control-Allow-Methods', 'OPTIONS, GET, POST, PUT, PATCH, DELETE')
+			res.setHeader('Access-Control-Allow-Headers', 'content-type, x-trpc-source')
+		}
+
+		if (req.method === 'OPTIONS') {
+			res.writeHead(allowed ? 204 : 403)
+			res.end()
+			return
+		}
+
+		if (STATE_CHANGING_METHODS.has(req.method ?? '') && !allowed) {
+			res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' })
+			res.end('Bosun rejected a state-changing request from an untrusted browser origin.')
+			return
+		}
+
+		next()
 	}
-	next()
+}
+
+function normalizeHeader(value: string | string[] | undefined): string | undefined {
+	if (Array.isArray(value)) return value.length === 1 ? value[0] : undefined
+	return value
 }

package/src/backend/roleplay/agent-loader.ts

@@ -0,0 +1,49 @@
+import { createContext } from '@recombine-ai/engine'
+
+import { getAgentFactories } from '../lib/get-agent-factories'
+import { getRootPath } from '../lib/get-root-path'
+
+export const noop = () => void 0
+export const noopAsync = () => Promise.resolve()
+
+export async function loadAgentSteps(agentId: string) {
+	const { factory, basePath } = await getAgentFactory(agentId)
+	const ctx = createContext({})
+	const steps: any[] = []
+	const stepRegistry = {
+		addStep: (step: any) => {
+			steps.push(step)
+		},
+		getSteps: () => steps
+	}
+
+	await factory({
+		ctx,
+		getMessages: () => [],
+		logger: console,
+		scheduler: {
+			clearAllPendingActions: noopAsync,
+			registerAction: () => noopAsync
+		},
+		sendMessage: noopAsync,
+		stepRegistry,
+		stepTracer: {
+			addStepTrace: noop,
+			flush: noopAsync
+		},
+		config: {
+			enableTimers: false,
+			isTest: false
+		}
+	})
+
+	return { basePath, steps }
+}
+
+export async function getAgentFactory(agentId: string) {
+	const rootPath = await getRootPath()
+	const agentFactories = await getAgentFactories(rootPath)
+	const factory = agentFactories.factories[agentId]
+	if (!factory) throw new Error(`Cannot find agent ${agentId}`)
+	return { factory, basePath: agentFactories.basePath }
+}

package/src/backend/roleplay/old-server.ts

@@ -4,12 +4,37 @@ import { createAgents } from './agents'
 import { fsContextPersistence, fsStatePersistence } from './fs-persistence'
 import { MessageDispatcher } from './message-dispatcher'
 
-export async function oldServer(ws: WebSocket) {
+export interface OldServerOptions {
+	isUsageBlocked?: () => boolean
+	trackRepositoryOperation?: <T>(operation: () => Promise<T>) => Promise<T>
+}
+
+export async function oldServer(ws: WebSocket, options: OldServerOptions = {}) {
 	console.log('== Client connected ==')
+	const isUsageBlocked = options.isUsageBlocked ?? (() => false)
+	const trackRepositoryOperation =
+		options.trackRepositoryOperation ?? (<T>(operation: () => Promise<T>) => operation())
+	const rejectBlockedConnection = () => {
+		ws.send(
+			JSON.stringify({ channel: 'error', message: 'Bosun is refreshing the project. Please wait.' })
+		)
+		ws.close(1013, 'Bosun is refreshing the project')
+	}
+	if (isUsageBlocked()) {
+		rejectBlockedConnection()
+		return
+	}
 
 	const agents = createAgents(new MessageDispatcher(ws), fsStatePersistence, fsContextPersistence)
-
-	await agents.load()
+	const loaded = await trackRepositoryOperation(async () => {
+		if (isUsageBlocked()) {
+			rejectBlockedConnection()
+			return false
+		}
+		await agents.load()
+		return true
+	})
+	if (!loaded) return
 
 	// Queue websocket message handling so client-side multi-send sequences (e.g. select state -> send chat)
 	// are applied deterministically and don't race when handlers `await`.
@@ -23,62 +48,87 @@ export async function oldServer(ws: WebSocket) {
 				: event.toString()
 
 		messageQueue = messageQueue
-			.then(async () => {
-				let msg: WsMessage
-				try {
-					msg = JSON.parse(raw) as WsMessage
-				} catch (error) {
-					console.error('Error parsing websocket message', error)
-					return
-				}
+			.then(() =>
+				trackRepositoryOperation(async () => {
+					if (isUsageBlocked()) {
+						ws.send(
+							JSON.stringify({
+								channel: 'error',
+								message: 'Bosun is refreshing the project. Please wait.'
+							})
+						)
+						return
+					}
 
-				// @ts-ignore
-				console.log('--> ', msg.channel, msg.event?.type || '')
+					let msg: WsMessage
+					try {
+						msg = JSON.parse(raw) as WsMessage
+					} catch (error) {
+						console.error('Error parsing websocket message', error)
+						return
+					}
 
-				switch (msg.channel) {
-					case 'app-events':
-						switch (msg.event.type) {
-							case 'select-agent':
-								await agents.select(
-									msg.event.agent,
-									msg.event.state,
-									msg.event.region,
-									msg.event.promptOverrides
-								)
-								break
-							case 'prompt-overrides-updated':
-								await agents.updatePromptOverrides(msg.event.prompts)
-								break
-							case 'reload-project':
-								await agents.reload()
-								break
-							case 'context-updated':
-								await agents.updateContext(msg.event.context)
-								break
-							case 'prompt-updated':
-								await agents.updatePrompt(msg.event.prompt)
-								break
-							case 'trigger-action':
-								await agents.triggerAction(msg.event.action)
-								break
-							case 'step-selected':
-								await agents.selectStep(msg.event.step)
-								break
-							case 'hangup':
-								await agents.hangup(msg.event.agentId, msg.event.region)
-								break
+					// @ts-ignore
+					console.log('--> ', msg.channel, msg.event?.type || '')
 
-							default:
-								console.error(`Unknown event type: ${msg.event.type}`)
-						}
-						break
-					case 'chat':
-						await agents.handleMessage(msg.message)
-						break
-					default:
-						console.error(`Unknown channel: ${msg.channel}`)
-				}
-			})
+					switch (msg.channel) {
+						case 'app-events':
+							switch (msg.event.type) {
+								case 'git-sync-request':
+									ws.send(
+										JSON.stringify({
+											channel: 'app-events',
+											event: {
+												type: 'git-sync-complete',
+												requestId: msg.event.requestId
+											}
+										})
+									)
+									break
+								case 'git-sync-complete':
+									break
+								case 'select-agent':
+									await agents.select(
+										msg.event.agent,
+										msg.event.state,
+										msg.event.region,
+										msg.event.promptOverrides
+									)
+									break
+								case 'prompt-overrides-updated':
+									await agents.updatePromptOverrides(msg.event.prompts)
+									break
+								case 'reload-project':
+									await agents.reload()
+									break
+								case 'context-updated':
+									await agents.updateContext(msg.event.context)
+									break
+								case 'prompt-updated':
+									await agents.updatePrompt(msg.event.prompt)
+									break
+								case 'trigger-action':
+									await agents.triggerAction(msg.event.action)
+									break
+								case 'step-selected':
+									await agents.selectStep(msg.event.step)
+									break
+								case 'hangup':
+									await agents.hangup(msg.event.agentId, msg.event.region)
+									break
+
+								default:
+									console.error(`Unknown event type: ${msg.event.type}`)
+							}
+							break
+						case 'chat':
+							await agents.handleMessage(msg.message)
+							break
+						default:
+							console.error(`Unknown channel: ${msg.channel}`)
+					}
+				})
+			)
 			.catch((error) => {
 				console.error('Error handling message', error)
 				try {

package/src/backend/roleplay/prompt-edit-proposals.ts

@@ -9,22 +9,51 @@ export type PromptEditProposal = {
 	createdAt: number
 }
 
-const proposals = new Map<string, PromptEditProposal>()
+export interface PromptEditTestSourceGuard {
+	suiteKey: string
+	testId: string
+	allowedFingerprints: string[]
+}
+
+type StoredPromptEditProposal = PromptEditProposal & {
+	testSourceGuard?: PromptEditTestSourceGuard
+}
+
+const proposals = new Map<string, StoredPromptEditProposal>()
 const PROPOSAL_TTL_MS = 12 * 60 * 60 * 1000
 
 export function createPromptEditProposal(
-	proposal: Omit<PromptEditProposal, 'id' | 'createdAt'>
+	proposal: Omit<PromptEditProposal, 'id' | 'createdAt'> & {
+		testSourceGuard?: PromptEditTestSourceGuard
+	}
 ): PromptEditProposal {
 	removeExpiredPromptEditProposals()
 	const stored = { ...proposal, id: randomUUID(), createdAt: Date.now() }
 	proposals.set(stored.id, stored)
-	return { ...stored }
+	return publicProposal(stored)
 }
 
 export function getPromptEditProposal(id: string): PromptEditProposal | null {
 	removeExpiredPromptEditProposals()
 	const proposal = proposals.get(id)
-	return proposal ? { ...proposal } : null
+	return proposal ? publicProposal(proposal) : null
+}
+
+export function getPromptEditProposalForAcceptance(id: string): StoredPromptEditProposal | null {
+	removeExpiredPromptEditProposals()
+	const proposal = proposals.get(id)
+	return proposal
+		? {
+				...proposal,
+				testSourceGuard: proposal.testSourceGuard
+					? {
+							suiteKey: proposal.testSourceGuard.suiteKey,
+							testId: proposal.testSourceGuard.testId,
+							allowedFingerprints: [...proposal.testSourceGuard.allowedFingerprints]
+						}
+					: undefined
+			}
+		: null
 }
 
 export function deletePromptEditProposal(id: string): boolean {
@@ -36,3 +65,8 @@ function removeExpiredPromptEditProposals(now = Date.now()) {
 		if (proposal.createdAt + PROPOSAL_TTL_MS <= now) proposals.delete(id)
 	}
 }
+
+function publicProposal(proposal: StoredPromptEditProposal): PromptEditProposal {
+	const { testSourceGuard: _testSourceGuard, ...result } = proposal
+	return { ...result }
+}