agent-nuvira 3.3.1 → 3.3.4

package/dist/web-dashboard/server.js

@@ -17,6 +17,8 @@ import { fileURLToPath } from 'node:url';
 import { homedir } from 'node:os';
 import { parseRbacUsers } from '../enterprise/rbac.js';
 import { registerDagHandlers } from '../observability/dag-bridge.js';
+import { debugLogDir, debugLoggingEnabled, debugLogsForSession } from '../observability/debug-log.js';
+import { scrubSecrets } from '../gateway/gateway-log.js';
 import { resolveBuffConfigDir, resolveBuffConfigPath, resolveNuviraHome } from '../config/paths.js';
 import { loadEnv } from '../utils/env.js';
 import { ConfigManager } from '../config/manager.js';
@@ -51,7 +53,7 @@ import { setSkillEnabled } from '../learning/hub-skill-catalog.js';
 // mock node:fs before importing the server (router's package.json read would
 // hit the mocked readFileSync).
 import { createConfiguredAdapters } from '../gateway/adapters.js';
-import { ChannelDirectory, PLATFORM_ENV_VARS } from '../gateway/channel-directory.js';
+import { ChannelDirectory, PLATFORM_ENV_VARS, platformConfigVars } from '../gateway/channel-directory.js';
 import { applyEnvToProcess, configurablePlatforms, platformConfigStatus, platformEnvVarMeta, redactValue, writeEnvFile, } from '../gateway/platform-config.js';
 // ─── Constants ──────────────────────────────────────────────────────────────
 const PORT = parseInt(envBuff('DASHBOARD_PORT') || '3030', 10);
@@ -469,6 +471,88 @@ function generateZip(files) {
     parts.push(new Uint8Array(eocd));
     return Buffer.concat(parts.map((p) => Buffer.from(p.buffer, p.byteOffset, p.byteLength)));
 }
+// ─── WS2 (#24) — the attachable support bundle ──────────────────────────────
+/** Cap on the transcript the bundle carries, so one long chat cannot make a 50 MB zip. */
+const MAX_SUPPORT_TRANSCRIPT_CHARS = 400_000;
+/**
+ * The front page of a support bundle: what is inside, and — just as important —
+ * what is deliberately NOT.
+ *
+ * Load-bearing rather than decorative. A bundle exists to be pasted into a bug
+ * report, often a public one, so it has to say plainly that credentials are
+ * redacted and that the logs carry previews instead of payloads. A user who
+ * cannot tell what they are about to attach either does not attach it or
+ * attaches it and regrets it, and both of those make the artifact useless.
+ */
+function renderSupportManifest(opts) {
+    const named = (values) => [
+        ...new Set(values.filter((v) => typeof v === 'string' && v.length > 0)),
+    ];
+    const surfaces = named(opts.logs.map((l) => l.header.surface));
+    const versions = named(opts.logs.map((l) => l.header.version));
+    const backends = [
+        ...new Set(opts.logs
+            .map((l) => [l.header.provider, l.header.model, l.header.transport].filter(Boolean).join(' / '))
+            .filter((b) => b.length > 0)),
+    ];
+    return [
+        'nuvira support bundle',
+        `generated: ${opts.generatedAt.toISOString()}`,
+        `session: ${opts.sessionId}`,
+        `surface(s): ${surfaces.join(', ') || 'unknown'}`,
+        `version(s): ${versions.join(', ') || 'unknown'}`,
+        `debug logs: ${opts.logs.length} (oldest first)`,
+        ...(backends.length > 0 ? [`backend(s) seen: ${backends.join(' | ')}`] : []),
+        ...(opts.turns !== null ? [`conversation turns: ${opts.turns}`] : []),
+        '',
+        'contents:',
+        ...opts.files.map((f) => `  - ${f}`),
+        '',
+        'notes:',
+        '  - credentials are redacted, with the same scrubber the gateway log uses',
+        '  - a session debug log carries bounded previews and event lines, not full payloads',
+        '  - each log names the backend that ACTUALLY served its turn, after any failover',
+        ...(opts.turns !== null
+            ? ['  - conversation.txt is your own chat with the agent, included so the reading is unambiguous']
+            : []),
+        '',
+    ].join('\n');
+}
+/**
+ * The conversation as text — the other half of a bug report, and the reason the
+ * bundle is worth more than the log alone ("it did not answer" needs the ask).
+ *
+ * Redacted with the same `scrubSecrets` for the same reason as the logs: a user
+ * pasting this into a public issue must not leak a key they happened to type
+ * into a prompt three turns earlier. Bounded by characters, and it SAYS when it
+ * was cut, so a truncated bundle is never mistaken for the whole story.
+ */
+function renderSupportTranscript(sessionId, record, generatedAt) {
+    const lines = [
+        `Conversation with the dashboard agent (session ${sessionId})`,
+        `Exported: ${generatedAt.toISOString()}`,
+        `Turns: ${record.turns.length}`,
+        '─'.repeat(60),
+        '',
+    ];
+    let used = 0;
+    let truncated = false;
+    for (const turn of record.turns) {
+        const body = scrubSecrets(turn.content);
+        if (used + body.length > MAX_SUPPORT_TRANSCRIPT_CHARS) {
+            truncated = true;
+            break;
+        }
+        used += body.length;
+        lines.push(turn.role === 'user' ? 'You:' : 'Agent:');
+        lines.push(body);
+        lines.push('');
+    }
+    if (truncated) {
+        lines.push(`[truncated at ${MAX_SUPPORT_TRANSCRIPT_CHARS} characters — the full transcript is in the session store]`);
+    }
+    return lines.join('\n');
+}
 let activePipeline = null; // goal/description of current pipeline
 let activeNodes = [];
 let activeEdges = [];
@@ -4747,6 +4831,9 @@ function handleRequest(req, res) {
                         varName: v.varName,
                         set: v.set,
                         value: canWrite ? v.value : v.set ? redactValue(v.value) : '',
+                        // `prompt` carries the "(optional)" marker for additive transport
+                        // modes (platformEnvVarMeta), so the form labels them without the UI
+                        // having to know which vars are required.
                         prompt: m?.prompt ?? v.varName,
                         secret: m?.secret ?? false,
                     };
@@ -4780,7 +4867,10 @@ function handleRequest(req, res) {
             }
             const body = await readJsonBody(req);
             const values = (body?.values ?? {});
-            const allowed = new Set(PLATFORM_ENV_VARS[platform]);
+            // platformConfigVars, not PLATFORM_ENV_VARS: the form renders every managed
+            // var (including the additional transport modes), so a key it displays must
+            // be writable here — otherwise a value the UI offers is rejected as unknown.
+            const allowed = new Set(platformConfigVars(platform));
             const clean = {};
             for (const [key, value] of Object.entries(values)) {
                 if (!allowed.has(key)) {
@@ -4819,7 +4909,7 @@ function handleRequest(req, res) {
             writeJson(res, 400, { ok: false, error: `Platform '${platform}' is not env-configurable.` });
             return;
         }
-        const keys = PLATFORM_ENV_VARS[platform];
+        const keys = platformConfigVars(platform);
         writeEnvFile({}, keys);
         applyEnvToProcess({}, keys);
         writeJson(res, 200, { ok: true, removed: keys, status: platformConfigStatus(platform) });
@@ -5448,14 +5538,34 @@ function handleRequest(req, res) {
                 : newChatSessionId();
             const provider = typeof body?.provider === 'string' ? body.provider : undefined;
             const model = typeof body?.model === 'string' ? body.model : undefined;
-            // P8 — turn attachments (file picker / paste-as-attachment / drag-drop).
-            // The GUI reads files client-side and sends the text inline; the server
-            // injects them into the SAME answerOnce context as [Attachment: name].
-            const rawAttachments = Array.isArray(body?.attachments) ? body.attachments : [];
-            const attachments = rawAttachments
-                .filter((a) => !!a && typeof a.name === 'string' && typeof a.content === 'string' && a.name.trim().length > 0)
-                .map((a) => ({ name: a.name.trim().slice(0, 120), content: a.content.slice(0, 300_000) }))
-                .slice(0, 10);
+            // WS5 (#27) — per-turn isolation and resume, from the GUI.
+            //
+            // Read as a strict TRI-state, because the three cases are genuinely
+            // different here: `true` asks for it, `false` declines a deployment-wide
+            // `NUVIRA_ISOLATE`/`NUVIRA_RESUME` for this one turn, and ABSENT (`undefined`)
+            // defers to that environment. Collapsing absent into `false` would make the
+            // GUI's silence outrank the deployment's configuration — the same defect the
+            // CLI's option defaults had.
+            const worktree = body?.worktree === true ? true : body?.worktree === false ? false : undefined;
+            const keepWorktree = body?.keepWorktree === true ? true : body?.keepWorktree === false ? false : undefined;
+            const resume = typeof body?.resume === 'string'
+                ? body.resume
+                : body?.resume === true
+                    ? true
+                    : body?.resume === false
+                        ? false
+                        : undefined;
+            // P8 + P2 — turn attachments (file picker / paste-as-attachment / drag-drop).
+            //
+            // The GUI sends TEXT inline. For anything it cannot decode as text (PDF, DOCX,
+            // XLSX, PPTX, images) it sends the BYTES as base64 and the extraction happens
+            // here, through the same `read_extract` the agent uses for a file in the project
+            // folder — so a refusal reaches the turn as a refusal instead of as mojibake.
+            // Previously every file was read with `File.text()` client-side, which is how a
+            // PDF arrived as `%PDF-1.4 …` with nothing indicating extraction had failed
+            // (TOOL_TRUTHFULNESS_TRACKER.md findings #1/#7 and P2).
+            const { hydrateAttachments } = await import('./attachment-extract.js');
+            const attachments = await hydrateAttachments(body?.attachments);
             // P3 — an attached project's bounded snapshot rides into the turn as
             // `[Project context]`, so "assess THIS project" works without the user
             // describing the codebase. Cache misses rebuild automatically.
@@ -5500,7 +5610,16 @@ function handleRequest(req, res) {
             // Mark the failover log BEFORE the turn so a failure can report which
             // models were actually tried (same contract as the gateway).
             const attemptMark = markFailoverAttempts();
-            const result = await chatConsole.answer(sessionId, message, { provider, model, projectContext, projectPath, attachments });
+            const result = await chatConsole.answer(sessionId, message, {
+                provider,
+                model,
+                projectContext,
+                projectPath,
+                attachments,
+                ...(worktree === undefined ? {} : { worktree }),
+                ...(keepWorktree === undefined ? {} : { keepWorktree }),
+                ...(resume === undefined ? {} : { resume }),
+            });
             // The response is written below — remove the disconnect listener so a
             // post-completion close can never touch the console again.
             res.off('close', onResClose);
@@ -5521,7 +5640,12 @@ function handleRequest(req, res) {
             // retrying on its own — a manual re-send on top of the queued one would
             // run the same ask twice.
             let retryQueued = false;
-            if (result.generationFailed === true) {
+            // WS5 (#27) — a REFUSED turn is failed but not retryable: the turn declined
+            // to run (isolation was asked for and could not be made), and the answer is
+            // the reason, already in `content`. The retry machinery below would replace
+            // that reason with a "keep trying" offer for a request that cannot succeed,
+            // and would queue a background re-run of the very ask that refused.
+            if (result.generationFailed === true && result.refused !== true) {
                 const report = chatRetryBroker.onFailure(sessionId, message, attemptMark);
                 if (report) {
                     content = content.trim() ? `${content}\n\n${report}` : report;
@@ -5542,6 +5666,26 @@ function handleRequest(req, res) {
                 followups: result.followups ?? [],
                 provider: result.provider ?? null,
                 model: result.model ?? null,
+                // WS1 — the findings this turn recorded, with the gate's verdicts, so
+                // a dashboard client reads the same wire form the CLI, the gateway and
+                // the subagent report (the GUI card is a rendering decision; the FACT
+                // travels here rather than being dropped at the HTTP boundary).
+                findings: result.findings ?? [],
+                // WS5 — the isolation this turn ACTUALLY had, as the console reported it
+                // (absent when the turn was not isolated), never re-derived from the flags
+                // this request sent: a client that asked for isolation and got a refusal
+                // must be able to see the difference, and the refusal is the turn's own
+                // content. The diff arrives with it — `diff.payload` is the same
+                // `{files, summary}` shape the `git:diff` event and the diff card already
+                // use, so the GUI renders one card for both.
+                ...(result.worktree ? { worktree: result.worktree } : {}),
+                // WS5 — what a resume replayed. Sent for the same reason: a deployment
+                // that sets `NUVIRA_RESUME` gets resumed turns, and a reader who is never
+                // told cannot tell a replayed turn from a fresh one.
+                ...(result.resume ? { resume: result.resume } : {}),
+                // WS5 — whether the turn declined to run, so the client labels the failure
+                // as the refusal it is instead of offering a Retry that cannot help.
+                refused: result.refused === true,
                 generationFailed: result.generationFailed === true,
                 retryQueued,
             });
@@ -5650,6 +5794,89 @@ function handleRequest(req, res) {
         })();
         return;
     }
+    // GET /api/chat/:sessionId/support-bundle — the debug logs THIS conversation
+    // wrote, plus the conversation and a manifest, as one downloadable ZIP.
+    //
+    // WS2 (#24) taught every surface to write an attachable log; a log the user
+    // cannot FIND is only half an artifact, and `~/.nuvira/debug-logs/` is exactly
+    // the kind of path nobody goes and greps while filing a bug. So the chat the
+    // user is already looking at becomes the way in.
+    //
+    // Selected by the log's OWN `# session:` header — never by recency, which with
+    // a second tab open is somebody else's conversation. And when there is no log
+    // the endpoint REFUSES rather than handing over a bundle without the one thing
+    // a bug report needs, saying which step is missing instead.
+    const chatBundleMatch = /^\/api\/chat\/([^/]+)\/support-bundle$/.exec(pathname);
+    if (chatBundleMatch && req.method === 'GET') {
+        void (async () => {
+            // The `?token=` fallback as well as the header, for the same reason the
+            // events stream has one: this is a plain GET that a browser or curl can be
+            // handed, so it must not depend on a JS fetch that sets headers.
+            const token = bearerToken(req) ?? new URL(req.url ?? '/', 'http://localhost').searchParams.get('token');
+            const admin = adminSessions.validate(token);
+            if (!admin) {
+                writeJson(res, 401, { ok: false, error: 'Not authenticated — log in first.' });
+                return;
+            }
+            if (!roleCan(admin.role, 'routing.operate')) {
+                writeJson(res, 403, { ok: false, error: `Access denied — role '${admin.role}' cannot read a chat session.` });
+                return;
+            }
+            const sessionId = decodeURIComponent(chatBundleMatch[1]);
+            try {
+                const logs = debugLogsForSession(sessionId);
+                if (logs.length === 0) {
+                    // Two different nothings with two different fixes, so they are NOT
+                    // collapsed into one message that fits neither.
+                    const enabled = debugLoggingEnabled();
+                    writeJson(res, 200, {
+                        ok: false,
+                        reason: enabled ? 'no_logs' : 'logging_disabled',
+                        error: enabled
+                            ? 'No debug log for this conversation yet. Logging is on, so the next turn here writes one — send a message (a log is written when the turn ENDS, not while it runs), then download again.'
+                            : `Session debug logging is off in the dashboard process, so there is nothing to attach yet. Set NUVIRA_DEBUG_LOG=1, restart the dashboard, send a message, then download again. Logs land in ${debugLogDir()}.`,
+                    });
+                    return;
+                }
+                const now = new Date();
+                const record = chatConsole.get(sessionId);
+                const safeId = sessionId.replace(/[^\w.-]/g, '_').slice(0, 48) || 'session';
+                const files = [];
+                for (const log of logs) {
+                    // The log's own basename carries its surface and start time, so two
+                    // turns of one conversation cannot collide inside the archive.
+                    files.push({ name: basename(log.path).replace(/[^\w.-]/g, '_'), content: log.text });
+                }
+                if (record) {
+                    files.push({ name: 'conversation.txt', content: renderSupportTranscript(sessionId, record, now) });
+                }
+                files.unshift({
+                    name: 'manifest.txt',
+                    content: renderSupportManifest({
+                        sessionId,
+                        logs,
+                        files: ['manifest.txt', ...files.map((f) => f.name)],
+                        turns: record ? record.turns.length : null,
+                        generatedAt: now,
+                    }),
+                });
+                const zip = generateZip(files);
+                res.writeHead(200, {
+                    'Content-Type': 'application/zip',
+                    'Content-Disposition': `attachment; filename="nuvira-support-${safeId}.zip"`,
+                    'Content-Length': zip.length,
+                });
+                res.end(zip);
+            }
+            catch (err) {
+                writeJson(res, 500, {
+                    ok: false,
+                    error: `Support bundle failed: ${err instanceof Error ? err.message : String(err)}`,
+                });
+            }
+        })();
+        return;
+    }
     // GET /api/chat/:sessionId/events — SSE stream of the session's LIVE
     // progress (agent working steps) + status while a turn is in flight. The
     // client subscribes FIRST, then POSTs the message; tool-call lines stream
@@ -5726,6 +5953,13 @@ function handleRequest(req, res) {
                         updatedAt: event.updatedAt,
                     })}\n\n`);
                 }
+                else if (event.kind === 'finding') {
+                    // WS1 — a recorded finding: the claim, the outcome, the evidence and
+                    // the verdict the GATE computed. Rendered as its own card so a
+                    // CONFIRMED verdict and a PLAUSIBLE guess never read the same in the
+                    // thread — the whole point of the row.
+                    res.write(`event: finding\ndata: ${JSON.stringify({ finding: event.finding })}\n\n`);
+                }
                 else if (event.kind === 'status') {
                     res.write(`event: status\ndata: ${JSON.stringify({ status: event.status })}\n\n`);
                 }