bosun 0.28.0 → 0.28.2

package/desktop/main.mjs

@@ -1,8 +1,10 @@
-import { app, BrowserWindow } from "electron";
+import { app, BrowserWindow, session } from "electron";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { existsSync, readFileSync } from "node:fs";
 import { execFileSync, spawn } from "node:child_process";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
 import { homedir } from "node:os";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -12,9 +14,23 @@ let shuttingDown = false;
 let uiServerStarted = false;
 let uiOrigin = null;
 let uiApi = null;
+let runtimeConfigLoaded = false;
 
 const DAEMON_PID_FILE = resolve(homedir(), ".cache", "bosun", "daemon.pid");
 
+// Local/private-network patterns — TLS cert bypass for the embedded UI server
+const LOCAL_HOSTNAME_RE = [
+  /^127\./,
+  /^192\.168\./,
+  /^10\./,
+  /^172\.(1[6-9]|2[0-9]|3[01])\./,
+  /^::1$/,
+  /^localhost$/i,
+];
+function isLocalHost(hostname) {
+  return LOCAL_HOSTNAME_RE.some((re) => re.test(hostname));
+}
+
 function parseBoolEnv(value, fallback) {
   if (value === undefined || value === null) return fallback;
   const normalized = String(value).trim().toLowerCase();
@@ -86,16 +102,81 @@ async function loadBosunModule(file) {
   return import(pathToFileURL(modulePath).href);
 }
 
+async function loadRuntimeConfig() {
+  if (runtimeConfigLoaded) return;
+  try {
+    const config = await loadBosunModule("config.mjs");
+    if (typeof config?.loadConfig === "function") {
+      config.loadConfig(["node", "desktop"], { reloadEnv: true });
+    }
+  } catch (err) {
+    console.warn("[desktop] failed to load config env", err?.message || err);
+  }
+  runtimeConfigLoaded = true;
+}
+
 async function loadUiServerModule() {
   if (uiApi) return uiApi;
   uiApi = await loadBosunModule("ui-server.mjs");
   return uiApi;
 }
 
+function buildDaemonUiBaseUrl() {
+  const rawPort = Number(process.env.TELEGRAM_UI_PORT || "0");
+  if (!Number.isFinite(rawPort) || rawPort <= 0) return null;
+  const tlsDisabled = parseBoolEnv(process.env.TELEGRAM_UI_TLS_DISABLE, false);
+  const protocol = tlsDisabled ? "http" : "https";
+  const host =
+    process.env.TELEGRAM_UI_DESKTOP_HOST ||
+    process.env.TELEGRAM_UI_HOST ||
+    "127.0.0.1";
+  return `${protocol}://${host}:${rawPort}`;
+}
+
+async function probeUiServer(url) {
+  return new Promise((resolve) => {
+    try {
+      const isHttps = url.startsWith("https://");
+      const req = (isHttps ? httpsRequest : httpRequest)(
+        `${url}/api/status`,
+        {
+          method: "GET",
+          timeout: 1500,
+          rejectUnauthorized: false,
+        },
+        (res) => {
+          res.resume();
+          resolve(Boolean(res.statusCode && res.statusCode < 500));
+        },
+      );
+      req.on("error", () => resolve(false));
+      req.on("timeout", () => {
+        req.destroy();
+        resolve(false);
+      });
+      req.end();
+    } catch {
+      resolve(false);
+    }
+  });
+}
+
+async function resolveDaemonUiUrl() {
+  const useDaemon = parseBoolEnv(
+    process.env.BOSUN_DESKTOP_USE_DAEMON_UI,
+    true,
+  );
+  if (!useDaemon) return null;
+  const base = buildDaemonUiBaseUrl();
+  if (!base) return null;
+  const ok = await probeUiServer(base);
+  return ok ? base : null;
+}
+
 async function ensureDaemonRunning() {
   const autoStart = parseBoolEnv(
     process.env.BOSUN_DESKTOP_AUTO_START_DAEMON,
-    true,
+    false,
   );
   if (!autoStart) return;
 
@@ -148,6 +229,13 @@ async function startUiServer() {
 }
 
 async function buildUiUrl() {
+  await loadRuntimeConfig();
+  const daemonUrl = await resolveDaemonUiUrl();
+  if (daemonUrl) {
+    uiOrigin = new URL(daemonUrl).origin;
+    return daemonUrl;
+  }
+  await startUiServer();
   const api = await loadUiServerModule();
   const uiServerUrl = api.getTelegramUiUrl();
   if (!uiServerUrl) {
@@ -164,6 +252,7 @@ async function buildUiUrl() {
 
 async function createMainWindow() {
   if (mainWindow) return;
+  const iconPath = resolveBosunRuntimePath("logo.png");
 
   mainWindow = new BrowserWindow({
     width: 1280,
@@ -171,6 +260,7 @@ async function createMainWindow() {
     minWidth: 960,
     minHeight: 640,
     backgroundColor: "#0b0b0c",
+    ...(existsSync(iconPath) ? { icon: iconPath } : {}),
     show: false,
     webPreferences: {
       contextIsolation: true,
@@ -194,10 +284,35 @@ async function createMainWindow() {
 
 async function bootstrap() {
   try {
+    if (process.env.ELECTRON_DISABLE_SANDBOX === "1") {
+      app.commandLine.appendSwitch("no-sandbox");
+      app.commandLine.appendSwitch("disable-gpu-sandbox");
+    }
     app.setAppUserModelId("com.virtengine.bosun");
+    const iconPath = resolveBosunRuntimePath("logo.png");
+    if (existsSync(iconPath)) {
+      try {
+        app.setIcon(iconPath);
+      } catch {
+        /* best effort */
+      }
+    }
     process.chdir(resolveBosunRoot());
+    await loadRuntimeConfig();
+
+    // Bypass TLS verification for the local embedded UI server.
+    // setCertificateVerifyProc works at the OpenSSL level — it fires before
+    // the higher-level `certificate-error` event and stops the repeated
+    // "handshake failed" logs from Chromium's ssl_client_socket_impl.
+    session.defaultSession.setCertificateVerifyProc((request, callback) => {
+      if (isLocalHost(request.hostname)) {
+        callback(0); // 0 = verified OK
+        return;
+      }
+      callback(-3); // -3 = use Chromium default chain verification
+    });
+
     await ensureDaemonRunning();
-    await startUiServer();
     await createMainWindow();
     await maybeAutoUpdate();
   } catch (error) {
@@ -231,8 +346,10 @@ async function shutdown(reason) {
   }
 
   try {
-    const api = await loadUiServerModule();
-    api.stopTelegramUiServer();
+    if (uiServerStarted) {
+      const api = await loadUiServerModule();
+      api.stopTelegramUiServer();
+    }
   } catch (error) {
     console.error("[desktop] failed to stop ui-server", error);
   }
@@ -243,7 +360,7 @@ async function shutdown(reason) {
 app.on("before-quit", () => {
   shuttingDown = true;
   try {
-    if (uiApi?.stopTelegramUiServer) {
+    if (uiServerStarted && uiApi?.stopTelegramUiServer) {
       uiApi.stopTelegramUiServer();
     }
   } catch (error) {
@@ -254,10 +371,15 @@ app.on("before-quit", () => {
 app.on(
   "certificate-error",
   (event, _webContents, url, _error, _certificate, callback) => {
-    if (uiOrigin && url.startsWith(uiOrigin)) {
-      event.preventDefault();
-      callback(true);
-      return;
+    try {
+      const hostname = new URL(url).hostname;
+      if ((uiOrigin && url.startsWith(uiOrigin)) || isLocalHost(hostname)) {
+        event.preventDefault();
+        callback(true);
+        return;
+      }
+    } catch {
+      // malformed URL — fall through
     }
     callback(false);
   },

package/desktop/package.json

@@ -3,6 +3,14 @@
   "version": "0.1.0",
   "private": true,
   "type": "module",
+  "author": "VirtEngine Maintainers <hello@virtengine.com>",
+  "homepage": "https://bosun.virtengine.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/virtengine/bosun.git",
+    "directory": "/desktop"
+  },
+
   "main": "main.mjs",
   "description": "Electron wrapper for the Bosun desktop portal",
   "scripts": {

package/desktop-shortcut.mjs

@@ -9,7 +9,7 @@
  * - Linux:   .desktop entry
  */
 
-import { spawnSync } from "node:child_process";
+import { spawnSync, execSync } from "node:child_process";
 import {
   existsSync,
   readFileSync,
@@ -182,22 +182,41 @@ function installMacShortcut(desktopDir) {
 
 function installLinuxShortcut(desktopDir) {
   const desktopPath = resolve(desktopDir, `${APP_NAME}.desktop`);
+  const appDir = resolve(homedir(), ".local", "share", "applications");
+  const appPath = resolve(appDir, `${APP_NAME}.desktop`);
+  const iconPath = resolve(__dirname, "logo.png");
   const content = [
     "[Desktop Entry]",
     "Type=Application",
     `Name=${APP_NAME}`,
     "Comment=Bosun Desktop Portal",
+    `Icon=${iconPath}`,
     `Exec=${buildShellCommand()}`,
     `Path=${getWorkingDirectory()}`,
     "Terminal=false",
     "StartupNotify=true",
     "Categories=Development;Utility;",
+    "NoDisplay=false",
     "",
   ].join("\n");
 
   try {
     writeFileSync(desktopPath, content, "utf8");
     chmodSync(desktopPath, 0o755);
+    mkdirSync(appDir, { recursive: true });
+    writeFileSync(appPath, content, "utf8");
+    chmodSync(appPath, 0o755);
+
+    try {
+      execSync(`gio set "${desktopPath}" metadata::trusted true`, {
+        stdio: "ignore",
+      });
+      execSync(`gio set "${appPath}" metadata::trusted true`, {
+        stdio: "ignore",
+      });
+    } catch {
+      /* best effort */
+    }
     return {
       success: true,
       method: "Linux desktop entry",

package/monitor.mjs

@@ -49,6 +49,7 @@ import {
   initStatusBoard,
   pushStatusBoardUpdate,
 } from "./telegram-bot.mjs";
+import { startAnalyzer, stopAnalyzer } from "./agent-work-analyzer.mjs";
 import { PRCleanupDaemon } from "./pr-cleanup-daemon.mjs";
 import {
   execPrimaryPrompt,
@@ -227,6 +228,123 @@ const ANOMALY_SIGNAL_PATH = resolve(
   "anomaly-signals.json",
 );
 
+const AGENT_ALERT_POLL_MS = 10_000;
+let agentWorkAnalyzerActive = false;
+let agentAlertsOffset = 0;
+let agentAlertsTimer = null;
+const agentAlertsDedup = new Map();
+
+function getAgentAlertsPath() {
+  return resolve(repoRoot, ".cache", "agent-work-logs", "agent-alerts.jsonl");
+}
+
+function rememberAlert(key) {
+  agentAlertsDedup.set(key, Date.now());
+  if (agentAlertsDedup.size > 200) {
+    const sorted = [...agentAlertsDedup.entries()].sort((a, b) => a[1] - b[1]);
+    for (const [oldKey] of sorted.slice(0, 100)) {
+      agentAlertsDedup.delete(oldKey);
+    }
+  }
+}
+
+function formatAgentAlert(alert) {
+  const severity = String(alert.severity || "medium").toUpperCase();
+  const type = alert.type || "alert";
+  const lines = [
+    `🔎 Agent Analyzer: ${severity} ${type}`,
+    `Attempt: ${alert.attempt_id || "unknown"}`,
+  ];
+  if (alert.task_id) lines.push(`Task: ${alert.task_id}`);
+  if (alert.executor) lines.push(`Executor: ${alert.executor}`);
+  if (alert.recommendation) lines.push(`Recommendation: ${alert.recommendation}`);
+  if (alert.error_count) lines.push(`Errors: ${alert.error_count}`);
+  if (alert.idle_time_ms) {
+    lines.push(`Idle: ${Math.round(alert.idle_time_ms / 1000)}s`);
+  }
+  if (alert.cost_usd) lines.push(`Cost: $${Number(alert.cost_usd).toFixed(3)}`);
+  return lines.join("\n");
+}
+
+async function pollAgentAlerts() {
+  if (process.env.VITEST) return;
+  const path = getAgentAlertsPath();
+  if (!existsSync(path)) return;
+  let data;
+  try {
+    data = await readFile(path, "utf8");
+  } catch {
+    return;
+  }
+  if (!data || data.length <= agentAlertsOffset) return;
+  const chunk = data.slice(agentAlertsOffset);
+  agentAlertsOffset = data.length;
+  const lines = chunk.split(/\r?\n/);
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let alert;
+    try {
+      alert = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    const dedupKey = `${alert.type || "alert"}:${alert.attempt_id || "unknown"}:${alert.timestamp || ""}`;
+    if (agentAlertsDedup.has(dedupKey)) continue;
+    rememberAlert(dedupKey);
+    console.warn(
+      `[agent-work-analyzer] ${alert.severity || "medium"} ${alert.type || "alert"} ${alert.attempt_id || ""}`,
+    );
+    if (
+      telegramToken &&
+      telegramChatId &&
+      process.env.AGENT_ALERTS_NOTIFY === "true"
+    ) {
+      void sendTelegramMessage(formatAgentAlert(alert), {
+        dedupKey: `agent-alert:${alert.type || "alert"}:${alert.attempt_id || "unknown"}`,
+      }).catch(() => {});
+    }
+  }
+}
+
+function startAgentWorkAnalyzer() {
+  if (agentWorkAnalyzerActive) return;
+  if (process.env.AGENT_WORK_ANALYZER_ENABLED === "false") return;
+  try {
+    void startAnalyzer();
+    agentWorkAnalyzerActive = true;
+    console.log("[monitor] agent-work analyzer started");
+  } catch (err) {
+    console.warn(`[monitor] agent-work analyzer failed to start: ${err.message}`);
+  }
+}
+
+function stopAgentWorkAnalyzer() {
+  if (!agentWorkAnalyzerActive) return;
+  try {
+    stopAnalyzer();
+  } catch {
+    /* ignore */
+  }
+  agentWorkAnalyzerActive = false;
+}
+
+function startAgentAlertTailer() {
+  if (agentAlertsTimer) return;
+  agentAlertsTimer = setInterval(() => {
+    void pollAgentAlerts();
+  }, AGENT_ALERT_POLL_MS);
+  agentAlertsTimer.unref?.();
+  void pollAgentAlerts();
+}
+
+function stopAgentAlertTailer() {
+  if (agentAlertsTimer) {
+    clearInterval(agentAlertsTimer);
+    agentAlertsTimer = null;
+  }
+}
+
 /**
  * Write an anomaly signal to the shared signal file for the orchestrator to pick up.
  * The orchestrator reads this file in Process-AnomalySignals and acts accordingly.
@@ -1157,6 +1275,8 @@ function restartSelf(reason) {
   stopTaskPlannerStatusLoop();
   stopMonitorMonitorSupervisor({ preserveRunning: true });
   stopAutoUpdateLoop();
+  stopAgentAlertTailer();
+  stopAgentWorkAnalyzer();
   stopSelfWatcher();
   stopWatcher();
   stopEnvWatchers();
@@ -7900,6 +8020,27 @@ async function sendTelegramMessage(text, options = {}) {
   });
 }
 
+globalThis.__bosunNotifyAnomaly = (anomaly) => {
+  if (process.env.BOSUN_INTERNAL_ANOMALY_NOTIFY === "false") return;
+  if (!telegramToken || !telegramChatId) return;
+  const icon =
+    anomaly.severity === "CRITICAL"
+      ? "🔴"
+      : anomaly.severity === "HIGH"
+        ? "🟠"
+        : anomaly.severity === "MEDIUM"
+          ? "🟡"
+          : "⚪️";
+  const lines = [
+    `${icon} Internal Anomaly: ${anomaly.type}`,
+    `Attempt: ${anomaly.processId || anomaly.shortId || "unknown"}`,
+    anomaly.message ? `Message: ${anomaly.message}` : null,
+  ].filter(Boolean);
+  void sendTelegramMessage(lines.join("\n"), {
+    dedupKey: `internal-anomaly:${anomaly.type}:${anomaly.processId || anomaly.shortId || "unknown"}`,
+  }).catch(() => {});
+};
+
 function enqueueTelegramCommand(handler) {
   telegramCommandQueue.push(handler);
   void drainTelegramCommandQueue();
@@ -10775,6 +10916,8 @@ function selfRestartForSourceChange(filename) {
   stopTaskPlannerStatusLoop();
   stopMonitorMonitorSupervisor({ preserveRunning: true });
   stopAutoUpdateLoop();
+  stopAgentAlertTailer();
+  stopAgentWorkAnalyzer();
   stopSelfWatcher();
   stopWatcher();
   stopEnvWatchers();
@@ -11262,6 +11405,8 @@ process.on("SIGINT", async () => {
     prCleanupDaemon.stop();
   }
   stopAutoUpdateLoop();
+  stopAgentAlertTailer();
+  stopAgentWorkAnalyzer();
   stopSelfWatcher();
   stopEnvWatchers();
   if (watcher) {
@@ -11304,6 +11449,8 @@ process.on("exit", () => {
   stopTaskPlannerStatusLoop();
   stopGitHubReconciler();
   stopMonitorMonitorSupervisor();
+  stopAgentAlertTailer();
+  stopAgentWorkAnalyzer();
   if (vkLogStream) {
     vkLogStream.stop();
     vkLogStream = null;
@@ -11323,6 +11470,8 @@ process.on("SIGTERM", async () => {
     vkLogStream = null;
   }
   stopAutoUpdateLoop();
+  stopAgentAlertTailer();
+  stopAgentWorkAnalyzer();
   stopSelfWatcher();
   stopEnvWatchers();
   if (watcher) {
@@ -12225,6 +12374,8 @@ void restoreLiveDigest()
   .then(() => initStatusBoard().catch(() => {}));
 
 // ── Start long-running devmode monitor-monitor supervisor ───────────────────
+startAgentWorkAnalyzer();
+startAgentAlertTailer();
 startMonitorMonitorSupervisor();
 startTaskPlannerStatusLoop();
 restartGitHubReconciler();

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "bosun",
-  "version": "0.28.0",
+  "version": "0.28.2",
   "description": "AI-powered orchestrator supervisor — manages AI agent executors with failover, auto-restarts on failure, analyzes crashes with Codex SDK, creates PRs via Vibe-Kanban API, and sends Telegram notifications. Supports N executors with weighted distribution, multi-repo projects, and auto-setup.",
   "type": "module",
   "license": "Apache 2.0",
-  "author": "VirtEngine Maintainers <maintainers@virtengine.com>",
+  "author": "VirtEngine Maintainers <hello@virtengine.com>",
   "homepage": "https://bosun.virtengine.com",
   "repository": {
     "type": "git",
@@ -189,6 +189,7 @@
     "hook-profiles.mjs",
     "agent-hook-bridge.mjs",
     "agent-supervisor.mjs",
+    "agent-work-analyzer.mjs",
     "startup-service.mjs",
     "telegram-sentinel.mjs",
     "whatsapp-channel.mjs",

package/rotate-agent-logs.sh

@@ -15,11 +15,12 @@ REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 LOG_DIR="$REPO_ROOT/.cache/agent-work-logs"
 ARCHIVE_DIR="$LOG_DIR/archive"
 
-# Retention periods
-STREAM_RETENTION_DAYS=30
-ERROR_RETENTION_DAYS=90
-SESSION_RETENTION_COUNT=100
-ARCHIVE_RETENTION_DAYS=180
+# Retention periods (override via env)
+STREAM_RETENTION_DAYS="${AGENT_WORK_STREAM_RETENTION_DAYS:-30}"
+ERROR_RETENTION_DAYS="${AGENT_WORK_ERROR_RETENTION_DAYS:-90}"
+SESSION_RETENTION_COUNT="${AGENT_WORK_SESSION_RETENTION_COUNT:-100}"
+ARCHIVE_RETENTION_DAYS="${AGENT_WORK_ARCHIVE_RETENTION_DAYS:-180}"
+METRICS_ROTATION_ENABLED="${AGENT_WORK_METRICS_ROTATION_ENABLED:-true}"
 
 # ── Functions ───────────────────────────────────────────────────────────────
 
@@ -111,10 +112,10 @@ if [ -f "$LOG_DIR/agent-alerts.jsonl" ]; then
   rotate_file "$LOG_DIR/agent-alerts.jsonl" "$ALERTS_ARCHIVE" "$STREAM_RETENTION_DAYS"
 fi
 
-# Metrics log is kept indefinitely (compressed monthly)
+# Metrics log is kept indefinitely (compressed monthly unless disabled)
 if [ -f "$LOG_DIR/agent-metrics.jsonl" ]; then
   # Only rotate on first day of month
-  if [ "$(date +%d)" = "01" ]; then
+  if [ "$METRICS_ROTATION_ENABLED" != "false" ] && [ "$(date +%d)" = "01" ]; then
     METRICS_ARCHIVE="agent-metrics-$(date -d 'last month' +%Y%m).jsonl.gz"
     rotate_file "$LOG_DIR/agent-metrics.jsonl" "$METRICS_ARCHIVE" ""
   fi