bosun 0.28.1 → 0.28.3

package/.env.example

@@ -169,6 +169,13 @@ TELEGRAM_MINIAPP_ENABLED=false
 # Priority threshold for immediate delivery: 1=critical only, 2=critical+errors (default: 1)
 # TELEGRAM_IMMEDIATE_PRIORITY=1
 
+# ─── Auto-Delete Old Messages ──────────────────────────────────────────────────────────
+# Automatically delete bot messages older than N days to keep chat tidy.
+# Set to 0 to disable. Default: 3 days.
+# Note: Telegram’s API may silently skip messages older than 48 h in private
+# chats — those will just remain; no error is raised.
+# TELEGRAM_HISTORY_RETENTION_DAYS=3
+
 # ─── Presence & Multi-Instance Coordination ──────────────────────────────────
 # Presence heartbeat allows discovering multiple bosun instances.
 # Heartbeat interval in seconds (default: 60)

package/README.md

@@ -5,11 +5,19 @@
 
 Bosun is a production-grade supervisor for AI coding agents. It routes tasks across executors, automates PR lifecycles, and keeps operators in control through Telegram, the Mini App dashboard, and optional WhatsApp notifications.
 
-[Website](https://bosun.virtengine.com) · [Docs](https://bosun.virtengine.com/docs/) · [GitHub](https://github.com/virtengine/bosun?tab=readme-ov-file#bosun) · [npm](https://www.npmjs.com/package/bosun) · [Issues](https://github.com/virtengine/bosun/issues)
+<p align="center">
+  <a href="https://bosun.virtengine.com">Website</a> · <a href="https://bosun.virtengine.com/docs/">Docs</a> · <a href="https://github.com/virtengine/bosun?tab=readme-ov-file#bosun">GitHub</a> · <a href="https://www.npmjs.com/package/bosun">npm</a> · <a href="https://github.com/virtengine/bosun/issues">Issues</a>
+</p>
 
-[![CI](https://github.com/virtengine/bosun/actions/workflows/ci.yaml/badge.svg?branch=main)](https://github.com/virtengine/bosun/actions/workflows/ci.yaml)
-[![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
-[![npm](https://img.shields.io/npm/v/bosun.svg)](https://www.npmjs.com/package/bosun)
+<p align="center">
+  <img src="site/social-card.png" alt="bosun — AI agent supervisor" width="100%" />
+</p>
+
+<p align="center">
+  <a href="https://github.com/virtengine/bosun/actions/workflows/ci.yaml"><img src="https://github.com/virtengine/bosun/actions/workflows/ci.yaml/badge.svg?branch=main" alt="CI" /></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-blue.svg" alt="License" /></a>
+  <a href="https://www.npmjs.com/package/bosun"><img src="https://img.shields.io/npm/v/bosun.svg" alt="npm" /></a>
+</p>
 
 ---
 

package/desktop/launch.mjs

@@ -1,4 +1,4 @@
-import { existsSync } from "node:fs";
+import { existsSync, statSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync, spawn } from "node:child_process";
@@ -7,6 +7,28 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const desktopDir = resolve(__dirname);
 const binName = process.platform === "win32" ? "electron.cmd" : "electron";
 const electronBin = resolve(desktopDir, "node_modules", ".bin", binName);
+const chromeSandbox = resolve(
+  desktopDir,
+  "node_modules",
+  "electron",
+  "dist",
+  "chrome-sandbox",
+);
+
+function shouldDisableSandbox() {
+  if (process.env.BOSUN_DESKTOP_DISABLE_SANDBOX === "1") return true;
+  if (process.platform !== "linux") return false;
+  if (!existsSync(chromeSandbox)) return true;
+  try {
+    const stats = statSync(chromeSandbox);
+    const mode = stats.mode & 0o7777;
+    const isRootOwned = stats.uid === 0;
+    const isSetuid = mode === 0o4755;
+    return !(isRootOwned && isSetuid);
+  } catch {
+    return true;
+  }
+}
 
 function ensureElectronInstalled() {
   if (existsSync(electronBin)) return true;
@@ -28,11 +50,18 @@ function launch() {
     process.exit(1);
   }
 
-  const child = spawn(electronBin, [desktopDir], {
+  const disableSandbox = shouldDisableSandbox();
+  const args = [desktopDir];
+  if (disableSandbox) {
+    args.push("--no-sandbox", "--disable-gpu-sandbox");
+  }
+
+  const child = spawn(electronBin, args, {
     stdio: "inherit",
     env: {
       ...process.env,
       BOSUN_DESKTOP: "1",
+      ...(disableSandbox ? { ELECTRON_DISABLE_SANDBOX: "1" } : {}),
     },
   });
 

package/desktop/main.mjs

@@ -1,4 +1,4 @@
-import { app, BrowserWindow } from "electron";
+import { app, BrowserWindow, session } from "electron";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { existsSync, readFileSync } from "node:fs";
@@ -18,6 +18,19 @@ let runtimeConfigLoaded = false;
 
 const DAEMON_PID_FILE = resolve(homedir(), ".cache", "bosun", "daemon.pid");
 
+// Local/private-network patterns — TLS cert bypass for the embedded UI server
+const LOCAL_HOSTNAME_RE = [
+  /^127\./,
+  /^192\.168\./,
+  /^10\./,
+  /^172\.(1[6-9]|2[0-9]|3[01])\./,
+  /^::1$/,
+  /^localhost$/i,
+];
+function isLocalHost(hostname) {
+  return LOCAL_HOSTNAME_RE.some((re) => re.test(hostname));
+}
+
 function parseBoolEnv(value, fallback) {
   if (value === undefined || value === null) return fallback;
   const normalized = String(value).trim().toLowerCase();
@@ -163,7 +176,7 @@ async function resolveDaemonUiUrl() {
 async function ensureDaemonRunning() {
   const autoStart = parseBoolEnv(
     process.env.BOSUN_DESKTOP_AUTO_START_DAEMON,
-    true,
+    false,
   );
   if (!autoStart) return;
 
@@ -239,6 +252,7 @@ async function buildUiUrl() {
 
 async function createMainWindow() {
   if (mainWindow) return;
+  const iconPath = resolveBosunRuntimePath("logo.png");
 
   mainWindow = new BrowserWindow({
     width: 1280,
@@ -246,6 +260,7 @@ async function createMainWindow() {
     minWidth: 960,
     minHeight: 640,
     backgroundColor: "#0b0b0c",
+    ...(existsSync(iconPath) ? { icon: iconPath } : {}),
     show: false,
     webPreferences: {
       contextIsolation: true,
@@ -269,9 +284,34 @@ async function createMainWindow() {
 
 async function bootstrap() {
   try {
+    if (process.env.ELECTRON_DISABLE_SANDBOX === "1") {
+      app.commandLine.appendSwitch("no-sandbox");
+      app.commandLine.appendSwitch("disable-gpu-sandbox");
+    }
     app.setAppUserModelId("com.virtengine.bosun");
+    const iconPath = resolveBosunRuntimePath("logo.png");
+    if (existsSync(iconPath)) {
+      try {
+        app.setIcon(iconPath);
+      } catch {
+        /* best effort */
+      }
+    }
     process.chdir(resolveBosunRoot());
     await loadRuntimeConfig();
+
+    // Bypass TLS verification for the local embedded UI server.
+    // setCertificateVerifyProc works at the OpenSSL level — it fires before
+    // the higher-level `certificate-error` event and stops the repeated
+    // "handshake failed" logs from Chromium's ssl_client_socket_impl.
+    session.defaultSession.setCertificateVerifyProc((request, callback) => {
+      if (isLocalHost(request.hostname)) {
+        callback(0); // 0 = verified OK
+        return;
+      }
+      callback(-3); // -3 = use Chromium default chain verification
+    });
+
     await ensureDaemonRunning();
     await createMainWindow();
     await maybeAutoUpdate();
@@ -331,10 +371,15 @@ app.on("before-quit", () => {
 app.on(
   "certificate-error",
   (event, _webContents, url, _error, _certificate, callback) => {
-    if (uiOrigin && url.startsWith(uiOrigin)) {
-      event.preventDefault();
-      callback(true);
-      return;
+    try {
+      const hostname = new URL(url).hostname;
+      if ((uiOrigin && url.startsWith(uiOrigin)) || isLocalHost(hostname)) {
+        event.preventDefault();
+        callback(true);
+        return;
+      }
+    } catch {
+      // malformed URL — fall through
     }
     callback(false);
   },

package/desktop/package.json

@@ -3,6 +3,14 @@
   "version": "0.1.0",
   "private": true,
   "type": "module",
+  "author": "VirtEngine Maintainers <hello@virtengine.com>",
+  "homepage": "https://bosun.virtengine.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/virtengine/bosun.git",
+    "directory": "/desktop"
+  },
+
   "main": "main.mjs",
   "description": "Electron wrapper for the Bosun desktop portal",
   "scripts": {

package/desktop-shortcut.mjs

@@ -9,7 +9,7 @@
  * - Linux:   .desktop entry
  */
 
-import { spawnSync } from "node:child_process";
+import { spawnSync, execSync } from "node:child_process";
 import {
   existsSync,
   readFileSync,
@@ -182,22 +182,41 @@ function installMacShortcut(desktopDir) {
 
 function installLinuxShortcut(desktopDir) {
   const desktopPath = resolve(desktopDir, `${APP_NAME}.desktop`);
+  const appDir = resolve(homedir(), ".local", "share", "applications");
+  const appPath = resolve(appDir, `${APP_NAME}.desktop`);
+  const iconPath = resolve(__dirname, "logo.png");
   const content = [
     "[Desktop Entry]",
     "Type=Application",
     `Name=${APP_NAME}`,
     "Comment=Bosun Desktop Portal",
+    `Icon=${iconPath}`,
     `Exec=${buildShellCommand()}`,
     `Path=${getWorkingDirectory()}`,
     "Terminal=false",
     "StartupNotify=true",
     "Categories=Development;Utility;",
+    "NoDisplay=false",
     "",
   ].join("\n");
 
   try {
     writeFileSync(desktopPath, content, "utf8");
     chmodSync(desktopPath, 0o755);
+    mkdirSync(appDir, { recursive: true });
+    writeFileSync(appPath, content, "utf8");
+    chmodSync(appPath, 0o755);
+
+    try {
+      execSync(`gio set "${desktopPath}" metadata::trusted true`, {
+        stdio: "ignore",
+      });
+      execSync(`gio set "${appPath}" metadata::trusted true`, {
+        stdio: "ignore",
+      });
+    } catch {
+      /* best effort */
+    }
     return {
       success: true,
       method: "Linux desktop entry",

package/monitor.mjs

@@ -157,6 +157,7 @@ import { WorkspaceMonitor } from "./workspace-monitor.mjs";
 import { VkLogStream } from "./vk-log-stream.mjs";
 import { VKErrorResolver } from "./vk-error-resolver.mjs";
 import { createAnomalyDetector } from "./anomaly-detector.mjs";
+import { resolvePwshRuntime } from "./pwsh-runtime.mjs";
 import {
   getWorktreeManager,
   acquireWorktree,
@@ -7555,12 +7556,21 @@ function buildPlannerTaskDescription({
   reason,
   numTasks,
   runtimeContext,
+  userPrompt,
 }) {
   return [
     "## Task Planner — Auto-created by bosun",
     "",
     `**Trigger reason:** ${reason || "manual"}`,
     `**Requested task count:** ${numTasks}`,
+    ...(userPrompt
+      ? [
+          "",
+          "### User Planning Prompt",
+          "",
+          userPrompt,
+        ]
+      : []),
     "",
     "### Planner Prompt (Injected by bosun)",
     "",
@@ -8689,6 +8699,7 @@ async function triggerTaskPlanner(
   details,
   {
     taskCount,
+    userPrompt,
     notify = true,
     preferredMode,
     allowCodexWhenDisabled = false,
@@ -8724,6 +8735,7 @@ async function triggerTaskPlanner(
       try {
         result = await triggerTaskPlannerViaKanban(reason, details, {
           taskCount,
+          userPrompt,
           notify,
         });
       } catch (kanbanErr) {
@@ -8753,6 +8765,7 @@ async function triggerTaskPlanner(
         }
         result = await triggerTaskPlannerViaCodex(reason, details, {
           taskCount,
+          userPrompt,
           notify,
           allowWhenDisabled: allowCodexWhenDisabled,
         });
@@ -8761,6 +8774,7 @@ async function triggerTaskPlanner(
       try {
         result = await triggerTaskPlannerViaCodex(reason, details, {
           taskCount,
+          userPrompt,
           notify,
           allowWhenDisabled: allowCodexWhenDisabled,
         });
@@ -8784,6 +8798,7 @@ async function triggerTaskPlanner(
 
         result = await triggerTaskPlannerViaKanban(reason, details, {
           taskCount,
+          userPrompt,
           notify,
         });
       }
@@ -8818,7 +8833,7 @@ async function triggerTaskPlanner(
 async function triggerTaskPlannerViaKanban(
   reason,
   details,
-  { taskCount, notify = true } = {},
+  { taskCount, userPrompt, notify = true } = {},
 ) {
   const defaultPlannerTaskCount = Number(
     process.env.TASK_PLANNER_DEFAULT_COUNT || "30",
@@ -8844,12 +8859,15 @@ async function triggerTaskPlannerViaKanban(
     );
   }
 
-  const desiredTitle = `[${plannerTaskSizeLabel}] Plan next tasks (${reason || "backlog-empty"})`;
+  const desiredTitle = userPrompt
+    ? `[${plannerTaskSizeLabel}] Plan next tasks (${reason || "backlog-empty"}) — ${userPrompt.slice(0, 60)}${userPrompt.length > 60 ? "…" : ""}`
+    : `[${plannerTaskSizeLabel}] Plan next tasks (${reason || "backlog-empty"})`;
   const desiredDescription = buildPlannerTaskDescription({
     plannerPrompt,
     reason,
     numTasks,
     runtimeContext,
+    userPrompt,
   });
 
   // Check for existing planner tasks to avoid duplicates
@@ -8941,7 +8959,7 @@ async function triggerTaskPlannerViaKanban(
 async function triggerTaskPlannerViaCodex(
   reason,
   details,
-  { taskCount, notify = true, allowWhenDisabled = false } = {},
+  { taskCount, userPrompt, notify = true, allowWhenDisabled = false } = {},
 ) {
   if (!codexEnabled && !allowWhenDisabled) {
     throw new Error(
@@ -8973,6 +8991,17 @@ async function triggerTaskPlannerViaCodex(
     "## Execution Context",
     `- Trigger reason: ${reason || "manual"}`,
     `- Requested task count: ${numTasks}`,
+    ...(userPrompt
+      ? [
+          "",
+          "## User Planning Prompt",
+          "",
+          userPrompt,
+          "",
+          "Incorporate the above user prompt into any relevant planning decisions.",
+        ]
+      : []),
+    "",
     "Context JSON:",
     "```json",
     safeJsonBlock(runtimeContext),
@@ -10590,21 +10619,16 @@ async function startProcess() {
   let orchestratorArgs = [...scriptArgs];
 
   if (scriptLower.endsWith(".ps1")) {
-    const configuredPwsh = String(process.env.PWSH_PATH || "").trim();
-    const bundledPwsh = resolve(__dirname, ".cache", "bosun", "pwsh", "pwsh");
-    const bundledPwshExists = existsSync(bundledPwsh);
-    const pwshCmd = configuredPwsh || (bundledPwshExists ? bundledPwsh : "pwsh");
-    const pwshExists = configuredPwsh
-      ? configuredPwsh.includes("/") || configuredPwsh.includes("\\")
-        ? existsSync(configuredPwsh)
-        : commandExists(configuredPwsh)
-      : bundledPwshExists || commandExists("pwsh");
-    if (!pwshExists) {
-      const pwshLabel = configuredPwsh
-        ? `PWSH_PATH (${configuredPwsh})`
-        : bundledPwshExists
-          ? `bundled pwsh (${bundledPwsh})`
-          : "pwsh on PATH";
+    const pwshRuntime = resolvePwshRuntime({ preferBundled: true });
+    if (!pwshRuntime.exists) {
+      const pwshLabel =
+        pwshRuntime.source === "env"
+          ? `PWSH_PATH (${pwshRuntime.command})`
+          : pwshRuntime.source === "bundled"
+            ? `bundled pwsh (${pwshRuntime.command})`
+            : pwshRuntime.source === "powershell"
+              ? `powershell on PATH`
+              : "pwsh on PATH";
       const pauseMs = Math.max(orchestratorPauseMs, 60_000);
       const pauseMin = Math.max(1, Math.round(pauseMs / 60_000));
       monitorSafeModeUntil = Math.max(monitorSafeModeUntil, Date.now() + pauseMs);
@@ -10622,7 +10646,7 @@ async function startProcess() {
       setTimeout(startProcess, pauseMs);
       return;
     }
-    orchestratorCmd = pwshCmd;
+    orchestratorCmd = pwshRuntime.command;
     orchestratorArgs = ["-File", scriptPath, ...scriptArgs];
   } else if (scriptLower.endsWith(".sh")) {
     const shellCmd =

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "bosun",
-  "version": "0.28.1",
+  "version": "0.28.3",
   "description": "AI-powered orchestrator supervisor — manages AI agent executors with failover, auto-restarts on failure, analyzes crashes with Codex SDK, creates PRs via Vibe-Kanban API, and sends Telegram notifications. Supports N executors with weighted distribution, multi-repo projects, and auto-setup.",
   "type": "module",
   "license": "Apache 2.0",
-  "author": "VirtEngine Maintainers <maintainers@virtengine.com>",
+  "author": "VirtEngine Maintainers <hello@virtengine.com>",
   "homepage": "https://bosun.virtengine.com",
   "repository": {
     "type": "git",
@@ -152,6 +152,7 @@
     "sdk-conflict-resolver.mjs",
     "session-tracker.mjs",
     "setup.mjs",
+    "pwsh-runtime.mjs",
     "shared-knowledge.mjs",
     "shared-state-manager.mjs",
     "shared-workspace-cli.mjs",

package/preflight.mjs

@@ -1,6 +1,7 @@
 import { spawnSync } from "node:child_process";
 import { resolve } from "node:path";
 import os from "node:os";
+import { resolvePwshRuntime } from "./pwsh-runtime.mjs";
 
 const isWindows = process.platform === "win32";
 const MIN_FREE_GB = Number(process.env.BOSUN_MIN_FREE_GB || "10");
@@ -179,6 +180,7 @@ function checkToolchain() {
     "node",
     shellMode ? "shell" : "pwsh",
   ]);
+  const pwshRuntime = resolvePwshRuntime({ preferBundled: true });
 
   const tools = [
     checkToolVersion(
@@ -213,7 +215,7 @@ function checkToolchain() {
     ),
     checkToolVersion(
       "pwsh",
-      "pwsh",
+      pwshRuntime.command,
       ["-NoProfile", "-Command", "$PSVersionTable.PSVersion.ToString()"],
       "Install PowerShell 7+ (pwsh) and ensure it is on PATH.",
     ),

package/pwsh-runtime.mjs

@@ -0,0 +1,62 @@
+import { existsSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { execSync } from "node:child_process";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const BUNDLED_PWSH_PATH = resolve(__dirname, ".cache", "bosun", "pwsh", "pwsh");
+
+function commandExists(cmd) {
+  try {
+    execSync(`${process.platform === "win32" ? "where" : "which"} ${cmd}`, {
+      stdio: "ignore",
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function isPathLike(value) {
+  return value.includes("/") || value.includes("\\");
+}
+
+export function resolvePwshRuntime({ preferBundled = true } = {}) {
+  const configured = String(process.env.PWSH_PATH || "").trim();
+  if (configured) {
+    if (isPathLike(configured)) {
+      if (existsSync(configured)) {
+        return { command: configured, source: "env", exists: true };
+      }
+      return { command: configured, source: "env", exists: false };
+    }
+    if (commandExists(configured)) {
+      return { command: configured, source: "env", exists: true };
+    }
+    return { command: configured, source: "env", exists: false };
+  }
+
+  if (preferBundled && existsSync(BUNDLED_PWSH_PATH)) {
+    return { command: BUNDLED_PWSH_PATH, source: "bundled", exists: true };
+  }
+
+  if (commandExists("pwsh")) {
+    return { command: "pwsh", source: "path", exists: true };
+  }
+
+  if (process.platform === "win32" && commandExists("powershell")) {
+    return { command: "powershell", source: "powershell", exists: true };
+  }
+
+  return { command: "pwsh", source: "missing", exists: false };
+}
+
+export function resolvePwshCommand(options = {}) {
+  return resolvePwshRuntime(options).command;
+}
+
+export function hasPwshRuntime(options = {}) {
+  return resolvePwshRuntime(options).exists;
+}
+
+export { BUNDLED_PWSH_PATH };

package/rotate-agent-logs.sh

@@ -15,11 +15,12 @@ REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 LOG_DIR="$REPO_ROOT/.cache/agent-work-logs"
 ARCHIVE_DIR="$LOG_DIR/archive"
 
-# Retention periods
-STREAM_RETENTION_DAYS=30
-ERROR_RETENTION_DAYS=90
-SESSION_RETENTION_COUNT=100
-ARCHIVE_RETENTION_DAYS=180
+# Retention periods (override via env)
+STREAM_RETENTION_DAYS="${AGENT_WORK_STREAM_RETENTION_DAYS:-30}"
+ERROR_RETENTION_DAYS="${AGENT_WORK_ERROR_RETENTION_DAYS:-90}"
+SESSION_RETENTION_COUNT="${AGENT_WORK_SESSION_RETENTION_COUNT:-100}"
+ARCHIVE_RETENTION_DAYS="${AGENT_WORK_ARCHIVE_RETENTION_DAYS:-180}"
+METRICS_ROTATION_ENABLED="${AGENT_WORK_METRICS_ROTATION_ENABLED:-true}"
 
 # ── Functions ───────────────────────────────────────────────────────────────
 
@@ -111,10 +112,10 @@ if [ -f "$LOG_DIR/agent-alerts.jsonl" ]; then
   rotate_file "$LOG_DIR/agent-alerts.jsonl" "$ALERTS_ARCHIVE" "$STREAM_RETENTION_DAYS"
 fi
 
-# Metrics log is kept indefinitely (compressed monthly)
+# Metrics log is kept indefinitely (compressed monthly unless disabled)
 if [ -f "$LOG_DIR/agent-metrics.jsonl" ]; then
   # Only rotate on first day of month
-  if [ "$(date +%d)" = "01" ]; then
+  if [ "$METRICS_ROTATION_ENABLED" != "false" ] && [ "$(date +%d)" = "01" ]; then
     METRICS_ARCHIVE="agent-metrics-$(date -d 'last month' +%Y%m).jsonl.gz"
     rotate_file "$LOG_DIR/agent-metrics.jsonl" "$METRICS_ARCHIVE" ""
   fi