bosun 0.28.0 → 0.28.2

package/ui/tabs/telemetry.js

@@ -0,0 +1,167 @@
+/* ─────────────────────────────────────────────────────────────
+ *  Tab: Telemetry — analytics, quality signals, alerts
+ * ────────────────────────────────────────────────────────────── */
+import { h } from "preact";
+import { useMemo } from "preact/hooks";
+import htm from "htm";
+
+const html = htm.bind(h);
+
+import {
+  telemetrySummary,
+  telemetryErrors,
+  telemetryExecutors,
+  telemetryAlerts,
+  loadTelemetrySummary,
+  loadTelemetryErrors,
+  loadTelemetryExecutors,
+  loadTelemetryAlerts,
+  scheduleRefresh,
+} from "../modules/state.js";
+import { Card, EmptyState, SkeletonCard, Badge } from "../components/shared.js";
+
+function formatCount(value) {
+  if (value == null) return "–";
+  return String(value);
+}
+
+function formatSeconds(value) {
+  if (!value && value !== 0) return "–";
+  if (value >= 60) return `${Math.round(value / 60)}m`;
+  return `${value}s`;
+}
+
+function severityBadge(sev = "medium") {
+  const normalized = String(sev).toLowerCase();
+  if (normalized === "high" || normalized === "critical") return "danger";
+  if (normalized === "medium") return "warning";
+  return "info";
+}
+
+export function TelemetryTab() {
+  const summary = telemetrySummary.value;
+  const errors = telemetryErrors.value || [];
+  const executors = telemetryExecutors.value || {};
+  const alerts = telemetryAlerts.value || [];
+
+  const hasSummary = summary && summary.total > 0;
+
+  const executorRows = useMemo(
+    () => Object.entries(executors).sort((a, b) => b[1] - a[1]),
+    [executors],
+  );
+
+  const alertRows = useMemo(
+    () => alerts.slice(-10).reverse(),
+    [alerts],
+  );
+
+  return html`
+    <section class="telemetry-tab">
+      <div class="section-header">
+        <h2>Telemetry</h2>
+        <button
+          class="btn btn-ghost btn-sm"
+          onClick=${() => {
+            loadTelemetrySummary();
+            loadTelemetryErrors();
+            loadTelemetryExecutors();
+            loadTelemetryAlerts();
+            scheduleRefresh(4000);
+          }}
+        >
+          Refresh
+        </button>
+      </div>
+
+      ${!hasSummary
+        ? html`<${EmptyState}
+            title="No telemetry yet"
+            description="Telemetry appears here once agents start running."
+          />`
+        : html`<${Card} title="Summary" class="telemetry-summary">
+            <div class="metric-grid">
+              <div>
+                <div class="metric-label">Sessions</div>
+                <div class="metric-value">${formatCount(summary.total)}</div>
+              </div>
+              <div>
+                <div class="metric-label">Success</div>
+                <div class="metric-value">
+                  ${formatCount(summary.success)} (${summary.successRate}%)
+                </div>
+              </div>
+              <div>
+                <div class="metric-label">Avg Duration</div>
+                <div class="metric-value">${formatSeconds(summary.avgDuration)}</div>
+              </div>
+              <div>
+                <div class="metric-label">Errors</div>
+                <div class="metric-value">${formatCount(summary.totalErrors)}</div>
+              </div>
+            </div>
+          </${Card}>`}
+
+      <div class="telemetry-grid">
+        <${Card} title="Top Errors">
+          ${errors.length === 0
+            ? html`<${EmptyState}
+                title="No errors logged"
+                description="Errors appear here when failures are detected."
+              />`
+            : html`<ul class="telemetry-list">
+                ${errors.slice(0, 8).map(
+                  (err) => html`<li>
+                    <span class="telemetry-label">${err.fingerprint}</span>
+                    <span class="telemetry-count">${err.count}</span>
+                  </li>`,
+                )}
+              </ul>`}
+        </${Card}>
+
+        <${Card} title="Executors">
+          ${executorRows.length === 0
+            ? html`<${EmptyState}
+                title="No executor data"
+                description="Run tasks to populate executor usage."
+              />`
+            : html`<ul class="telemetry-list">
+                ${executorRows.map(
+                  ([name, count]) => html`<li>
+                    <span class="telemetry-label">${name}</span>
+                    <span class="telemetry-count">${count}</span>
+                  </li>`,
+                )}
+              </ul>`}
+        </${Card}>
+      </div>
+
+      <${Card} title="Recent Alerts">
+        ${alertRows.length === 0
+          ? html`<${EmptyState}
+              title="No alerts"
+              description="Analyzer alerts will show up here."
+            />`
+          : html`<ul class="telemetry-alerts">
+              ${alertRows.map(
+                (alert) => html`<li>
+                  <div>
+                    <div class="telemetry-alert-title">
+                      ${alert.type || "alert"}
+                      <${Badge} tone=${severityBadge(alert.severity)}>${
+                        String(alert.severity || "medium").toUpperCase()
+                      }</${Badge}>
+                    </div>
+                    <div class="telemetry-alert-meta">
+                      ${alert.attempt_id || "unknown"}
+                      ${alert.executor ? html` · ${alert.executor}` : ""}
+                    </div>
+                  </div>
+                </li>`,
+              )}
+            </ul>`}
+      </${Card}>
+    </section>
+  `;
+}
+

package/ui-server.mjs

@@ -600,6 +600,7 @@ const SETTINGS_KNOWN_KEYS = [
   "TELEGRAM_COMMAND_CONCURRENCY", "TELEGRAM_VERBOSITY", "TELEGRAM_BATCH_NOTIFICATIONS",
   "TELEGRAM_BATCH_INTERVAL_SEC", "TELEGRAM_BATCH_MAX_SIZE", "TELEGRAM_IMMEDIATE_PRIORITY",
   "TELEGRAM_API_BASE_URL", "TELEGRAM_HTTP_TIMEOUT_MS", "TELEGRAM_RETRY_ATTEMPTS",
+  "TELEGRAM_HISTORY_RETENTION_DAYS",
   "PROJECT_NAME", "TELEGRAM_MINIAPP_ENABLED", "TELEGRAM_UI_PORT", "TELEGRAM_UI_HOST",
   "TELEGRAM_UI_PUBLIC_HOST", "TELEGRAM_UI_BASE_URL", "TELEGRAM_UI_ALLOW_UNSAFE",
   "TELEGRAM_UI_AUTH_MAX_AGE_SEC", "TELEGRAM_UI_TUNNEL",
@@ -1204,6 +1205,17 @@ async function startTunnel(localPort) {
     return null;
   }
 
+  // ── SECURITY: Block tunnel when auth is disabled ─────────────────────
+  if (isAllowUnsafe()) {
+    console.error(
+      "[telegram-ui] ⛔ REFUSING to start tunnel — TELEGRAM_UI_ALLOW_UNSAFE=true\n" +
+      "  A public tunnel with no authentication lets ANYONE on the internet\n" +
+      "  control your agents, read secrets, and execute commands.\n" +
+      "  Either set TELEGRAM_UI_ALLOW_UNSAFE=false or TELEGRAM_UI_TUNNEL=disabled.",
+    );
+    return null;
+  }
+
   const cfBin = await findCloudflared();
   if (!cfBin) {
     if (tunnelMode === "auto") {
@@ -2202,6 +2214,60 @@ async function tailFile(filePath, lineCount, maxBytes = 1_000_000) {
   };
 }
 
+async function readJsonlTail(filePath, maxLines = 2000) {
+  if (!existsSync(filePath)) return [];
+  const tail = await tailFile(filePath, maxLines);
+  return (tail.lines || [])
+    .map((line) => {
+      try {
+        return JSON.parse(line);
+      } catch {
+        return null;
+      }
+    })
+    .filter(Boolean);
+}
+
+function withinDays(entry, days) {
+  if (!days) return true;
+  const ts = Date.parse(entry?.timestamp || "");
+  if (!Number.isFinite(ts)) return true;
+  return ts >= Date.now() - days * 24 * 60 * 60 * 1000;
+}
+
+function summarizeTelemetry(metrics, days) {
+  const filtered = metrics.filter((m) => withinDays(m, days));
+  if (filtered.length === 0) return null;
+  const total = filtered.length;
+  const success = filtered.filter(
+    (m) => m.outcome?.status === "completed" || m.metrics?.success === true,
+  ).length;
+  const durations = filtered.map((m) => m.metrics?.duration_ms || 0);
+  const avgDuration =
+    durations.length > 0
+      ? Math.round(
+          durations.reduce((a, b) => a + b, 0) / durations.length / 1000,
+        )
+      : 0;
+  const totalErrors = filtered.reduce(
+    (sum, m) => sum + (m.error_summary?.total_errors || m.metrics?.errors || 0),
+    0,
+  );
+  const executors = {};
+  for (const m of filtered) {
+    const exec = m.executor || "unknown";
+    executors[exec] = (executors[exec] || 0) + 1;
+  }
+  return {
+    total,
+    success,
+    successRate: total > 0 ? Math.round((success / total) * 100) : 0,
+    avgDuration,
+    totalErrors,
+    executors,
+  };
+}
+
 async function listAgentLogFiles(query = "", limit = 60) {
   const entries = [];
   const files = await readdir(agentLogsDir).catch(() => []);
@@ -3172,6 +3238,79 @@ async function handleApi(req, res, url) {
     return;
   }
 
+  if (path === "/api/telemetry/summary") {
+    try {
+      const days = Number(url.searchParams.get("days") || "7");
+      const logDir = resolve(repoRoot, ".cache", "agent-work-logs");
+      const metricsPath = resolve(logDir, "agent-metrics.jsonl");
+      const metrics = await readJsonlTail(metricsPath, 3000);
+      const summary = summarizeTelemetry(metrics, days);
+      jsonResponse(res, 200, { ok: true, data: summary });
+    } catch (err) {
+      jsonResponse(res, 500, { ok: false, error: err.message });
+    }
+    return;
+  }
+
+  if (path === "/api/telemetry/errors") {
+    try {
+      const days = Number(url.searchParams.get("days") || "7");
+      const logDir = resolve(repoRoot, ".cache", "agent-work-logs");
+      const errorsPath = resolve(logDir, "agent-errors.jsonl");
+      const errors = (await readJsonlTail(errorsPath, 2000)).filter((e) =>
+        withinDays(e, days),
+      );
+      const byFingerprint = new Map();
+      for (const e of errors) {
+        const fp = e.data?.error_fingerprint || e.data?.error_message || "unknown";
+        byFingerprint.set(fp, (byFingerprint.get(fp) || 0) + 1);
+      }
+      const top = [...byFingerprint.entries()]
+        .sort((a, b) => b[1] - a[1])
+        .slice(0, 20)
+        .map(([fingerprint, count]) => ({ fingerprint, count }));
+      jsonResponse(res, 200, { ok: true, data: top });
+    } catch (err) {
+      jsonResponse(res, 500, { ok: false, error: err.message });
+    }
+    return;
+  }
+
+  if (path === "/api/telemetry/executors") {
+    try {
+      const days = Number(url.searchParams.get("days") || "7");
+      const logDir = resolve(repoRoot, ".cache", "agent-work-logs");
+      const metricsPath = resolve(logDir, "agent-metrics.jsonl");
+      const metrics = await readJsonlTail(metricsPath, 3000);
+      const summary = summarizeTelemetry(metrics, days);
+      jsonResponse(res, 200, {
+        ok: true,
+        data: summary?.executors || {},
+      });
+    } catch (err) {
+      jsonResponse(res, 500, { ok: false, error: err.message });
+    }
+    return;
+  }
+
+  if (path === "/api/telemetry/alerts") {
+    try {
+      const days = Number(url.searchParams.get("days") || "7");
+      const logDir = resolve(repoRoot, ".cache", "agent-work-logs");
+      const alertsPath = resolve(logDir, "agent-alerts.jsonl");
+      const alerts = (await readJsonlTail(alertsPath, 500)).filter((a) =>
+        withinDays(a, days),
+      );
+      jsonResponse(res, 200, {
+        ok: true,
+        data: alerts.slice(-50),
+      });
+    } catch (err) {
+      jsonResponse(res, 500, { ok: false, error: err.message });
+    }
+    return;
+  }
+
   if (path === "/api/agent-logs/context") {
     try {
       const query = url.searchParams.get("query") || "";
@@ -4808,6 +4947,25 @@ export async function startTelegramUiServer(options = {}) {
   if (uiServerTls) {
     console.log(`[telegram-ui] TLS enabled (self-signed) — Telegram WebApp buttons will use HTTPS`);
   }
+
+  // ── SECURITY: Warn loudly when auth is disabled ──────────────────────
+  if (isAllowUnsafe()) {
+    const tunnelMode = (process.env.TELEGRAM_UI_TUNNEL || "auto").toLowerCase();
+    const tunnelActive = tunnelMode !== "disabled" && tunnelMode !== "off" && tunnelMode !== "0";
+    const border = "═".repeat(68);
+    console.warn(`\n╔${border}╗`);
+    console.warn(`║ ⛔  DANGER: TELEGRAM_UI_ALLOW_UNSAFE=true — ALL AUTH IS DISABLED   ║`);
+    console.warn(`║                                                                    ║`);
+    console.warn(`║  Anyone with your URL can control agents, read secrets, and        ║`);
+    console.warn(`║  execute arbitrary commands on this machine.                        ║`);
+    if (tunnelActive) {
+      console.warn(`║                                                                    ║`);
+      console.warn(`║  🔴  TUNNEL IS ACTIVE — your UI is exposed to the PUBLIC INTERNET  ║`);
+      console.warn(`║  This means ANYONE can discover your URL and take control.         ║`);
+      console.warn(`║  Set TELEGRAM_UI_TUNNEL=disabled or TELEGRAM_UI_ALLOW_UNSAFE=false ║`);
+    }
+    console.warn(`╚${border}╝\n`);
+  }
   console.log(`[telegram-ui] LAN access: ${protocol}://${lanIp}:${actualPort}`);
   console.log(`[telegram-ui] Browser access: ${protocol}://${lanIp}:${actualPort}/?token=${sessionToken}`);
 

package/workspace-manager.mjs

@@ -412,7 +412,51 @@ export function pullWorkspaceRepos(configDir, workspaceId) {
   for (const repo of ws.repos || []) {
     const repoPath = resolve(ws.path, repo.name);
     if (!existsSync(repoPath)) {
-      results.push({ name: repo.name, success: false, error: "Directory not found" });
+      const repoUrl =
+        repo.url ||
+        (repo.slug ? `https://github.com/${repo.slug.replace(/\.git$/i, "")}.git` : "");
+      if (!repoUrl) {
+        results.push({
+          name: repo.name,
+          success: false,
+          error: "Directory not found and repo URL is missing",
+        });
+        continue;
+      }
+      try {
+        mkdirSync(ws.path, { recursive: true });
+        console.log(TAG, `Cloning ${repoUrl} into ${repoPath}...`);
+        const clone = spawnSync("git", ["clone", repoUrl, repoPath], {
+          encoding: "utf8",
+          timeout: 300000,
+          stdio: ["pipe", "pipe", "pipe"],
+        });
+        if (clone.status !== 0) {
+          results.push({
+            name: repo.name,
+            success: false,
+            error: `git clone failed: ${
+              clone.stderr || clone.stdout || clone.error?.message || "unknown error"
+            }`,
+          });
+          continue;
+        }
+        console.log(TAG, `Cloned ${repo.name} successfully`);
+      } catch (err) {
+        results.push({
+          name: repo.name,
+          success: false,
+          error: `git clone failed: ${err.message || err}`,
+        });
+        continue;
+      }
+    }
+    if (!existsSync(resolve(repoPath, ".git"))) {
+      results.push({
+        name: repo.name,
+        success: false,
+        error: "Directory exists but is not a git repository",
+      });
       continue;
     }
     try {