bosun 0.33.0 → 0.33.2

package/.env.example

@@ -435,6 +435,12 @@ TELEGRAM_MINIAPP_ENABLED=false
 # BOSUN_ENFORCE_TASK_LABEL=true
 # Optional issue fetch cap per sync/poll cycle (default: 1000)
 # GITHUB_ISSUES_LIST_LIMIT=1000
+# Task context limits (comments + attachments)
+# BOSUN_TASK_CONTEXT_MAX_COMMENTS=8
+# BOSUN_TASK_CONTEXT_MAX_COMMENT_CHARS=1200
+# BOSUN_TASK_CONTEXT_MAX_ATTACHMENTS=20
+# Max upload size for task/chat attachments (MB)
+# BOSUN_ATTACHMENT_MAX_MB=25
 
 # Jira backend (KANBAN_BACKEND=jira)
 # Jira Cloud site URL (no trailing slash)

package/agent-event-bus.mjs

@@ -785,6 +785,7 @@ export class AgentEventBus {
         branchName:
           result?.branch || task?.branchName || task?.meta?.branch_name,
         description: task?.description || "",
+        taskContext: task?._taskContextBlock || task?.meta?.taskContextBlock || "",
       });
       this.emit(AGENT_EVENT.AUTO_REVIEW, taskId, {
         title: task?.title || "",

package/agent-prompts.mjs

@@ -240,6 +240,7 @@ You are the always-on reliability guardian for bosun in devmode.
 
 ## Description
 {{TASK_DESCRIPTION}}
+{{TASK_CONTEXT}}
 
 ## Environment
 - Working Directory: {{WORKTREE_PATH}}
@@ -326,6 +327,7 @@ Please:
 
 Original task description:
 {{TASK_DESCRIPTION}}
+{{TASK_CONTEXT}}
 `,
   taskExecutorContinueHasCommits: `# {{TASK_ID}} — CONTINUE (Verify and Push)
 
@@ -336,6 +338,7 @@ You already made commits.
 2. If passing, push: git push origin HEAD
 3. If failing, fix issues, commit, and push.
 4. Task is not complete until push succeeds.
+{{TASK_CONTEXT}}
 `,
   taskExecutorContinueHasEdits: `# {{TASK_ID}} — CONTINUE (Commit and Push)
 
@@ -346,6 +349,7 @@ You made file edits but no commit yet.
 2. Run relevant tests.
 3. Commit with conventional format.
 4. Push: git push origin HEAD
+{{TASK_CONTEXT}}
 `,
   taskExecutorContinueNoProgress: `# CONTINUE - Resume Implementation
 
@@ -360,6 +364,7 @@ Execute now:
 
 Task: {{TASK_TITLE}}
 Description: {{TASK_DESCRIPTION}}
+{{TASK_CONTEXT}}
 `,
   reviewer: `You are a senior code reviewer for a production software project.
 
@@ -385,6 +390,7 @@ Review the following PR diff for CRITICAL issues ONLY.
 
 ## Task Description
 {{TASK_DESCRIPTION}}
+{{TASK_CONTEXT}}
 
 ## Response Format
 Respond with JSON only:

package/config.mjs

@@ -65,7 +65,8 @@ function isWslInteropRuntime() {
 }
 
 function resolveConfigDir(repoRoot) {
-  // 1. Explicit env override
+  // 1. Explicit env override (BOSUN_HOME supersedes BOSUN_DIR; both are aliases)
+  if (process.env.BOSUN_HOME) return resolve(process.env.BOSUN_HOME);
   if (process.env.BOSUN_DIR) return resolve(process.env.BOSUN_DIR);
 
   // 2. Platform-aware user home
@@ -86,6 +87,55 @@ function resolveConfigDir(repoRoot) {
   return resolve(baseDir, "bosun");
 }
 
+function getConfigSearchDirs(repoRoot) {
+  const dirs = new Set();
+  if (process.env.BOSUN_HOME) dirs.add(resolve(process.env.BOSUN_HOME));
+  if (process.env.BOSUN_DIR) dirs.add(resolve(process.env.BOSUN_DIR));
+  dirs.add(resolveConfigDir(repoRoot));
+  if (process.env.APPDATA) dirs.add(resolve(process.env.APPDATA, "bosun"));
+  if (process.env.LOCALAPPDATA) dirs.add(resolve(process.env.LOCALAPPDATA, "bosun"));
+  if (process.env.USERPROFILE) dirs.add(resolve(process.env.USERPROFILE, "bosun"));
+  if (process.env.HOME) dirs.add(resolve(process.env.HOME, "bosun"));
+  return [...dirs].filter(Boolean);
+}
+
+function collectRepoPathsFromConfig(cfg, configDir) {
+  const paths = [];
+  const pushPath = (path) => {
+    if (!path) return;
+    paths.push(isAbsolute(path) ? path : resolve(configDir, path));
+  };
+
+  const repos = cfg.repositories || cfg.repos || [];
+  if (Array.isArray(repos)) {
+    for (const repo of repos) {
+      const repoPath = typeof repo === "string" ? repo : (repo?.path || repo?.repoRoot);
+      pushPath(repoPath);
+    }
+  }
+
+  const workspaces = cfg.workspaces || [];
+  if (Array.isArray(workspaces)) {
+    for (const ws of workspaces) {
+      const wsBase = ws?.path
+        ? (isAbsolute(ws.path) ? ws.path : resolve(configDir, ws.path))
+        : (ws?.id ? resolve(configDir, "workspaces", ws.id) : null);
+      const wsRepos = ws?.repos || ws?.repositories || [];
+      if (!Array.isArray(wsRepos)) continue;
+      for (const repo of wsRepos) {
+        const repoPath = typeof repo === "string" ? repo : (repo?.path || repo?.repoRoot);
+        if (repoPath) {
+          pushPath(repoPath);
+          continue;
+        }
+        if (wsBase && repo?.name) pushPath(resolve(wsBase, repo.name));
+      }
+    }
+  }
+
+  return paths;
+}
+
 function ensurePromptWorkspaceGitIgnore(repoRoot) {
   const gitignorePath = resolve(repoRoot, ".gitignore");
   const entry = "/.bosun/";
@@ -575,33 +625,26 @@ function detectRepoRoot() {
   }
 
   // 4. Check bosun config for workspace repos
-  const configDir = process.env.BOSUN_DIR || resolve(process.env.HOME || process.env.USERPROFILE || "", "bosun");
+  const configDirs = getConfigSearchDirs();
+  let fallbackRepo = null;
   for (const cfgName of CONFIG_FILES) {
-    const cfgPath = resolve(configDir, cfgName);
-    if (existsSync(cfgPath)) {
+    for (const configDir of configDirs) {
+      const cfgPath = resolve(configDir, cfgName);
+      if (!existsSync(cfgPath)) continue;
       try {
         const cfg = JSON.parse(readFileSync(cfgPath, "utf8"));
-        // Check workspace repos
-        const repos = cfg.repositories || cfg.repos || [];
-        if (Array.isArray(repos) && repos.length > 0) {
-          const primary = repos.find((r) => r.primary) || repos[0];
-          const repoPath = primary?.path || primary?.repoRoot;
-          if (repoPath && existsSync(resolve(repoPath))) return resolve(repoPath);
+        const repoPaths = collectRepoPathsFromConfig(cfg, configDir);
+        for (const repoPath of repoPaths) {
+          if (!repoPath || !existsSync(repoPath)) continue;
+          if (existsSync(resolve(repoPath, ".git"))) return repoPath;
+          fallbackRepo ??= repoPath;
         }
-        // Check workspaces
-        const workspaces = cfg.workspaces;
-        if (Array.isArray(workspaces) && workspaces.length > 0) {
-          const ws = workspaces[0];
-          const wsRepos = ws?.repos || ws?.repositories || [];
-          if (Array.isArray(wsRepos) && wsRepos.length > 0) {
-            const primary = wsRepos.find((r) => r.primary) || wsRepos[0];
-            const repoPath = primary?.path || primary?.repoRoot;
-            if (repoPath && existsSync(resolve(repoPath))) return resolve(repoPath);
-          }
-        }
-      } catch { /* invalid config */ }
+      } catch {
+        /* invalid config */
+      }
     }
   }
+  if (fallbackRepo) return fallbackRepo;
 
   // 5. Final fallback — warn and return cwd.  This is unlikely to be a valid
   // git repo (e.g. when the daemon spawns with cwd=homedir), but returning
@@ -2069,6 +2112,25 @@ export function loadConfig(argv = process.argv, options = {}) {
 
     // First run
     isFirstRun,
+
+    // Security controls
+    security: Object.freeze({
+      // List of trusted issue creators (primary GitHub account or configured list)
+      trustedCreators:
+        configData.trustedCreators ||
+        process.env.BOSUN_TRUSTED_CREATORS?.split(",") ||
+        [],
+      // Enforce all new tasks go to backlog unless planner config allows auto-push
+      enforceBacklog:
+        typeof configData.enforceBacklog === "boolean"
+          ? configData.enforceBacklog
+          : true,
+      // Control agent triggers: restrict agent activation to trusted sources
+      agentTriggerControl:
+        typeof configData.agentTriggerControl === "boolean"
+          ? configData.agentTriggerControl
+          : true,
+    }),
   };
 
   return Object.freeze(config);

package/kanban-adapter.mjs

@@ -63,6 +63,10 @@ import {
   removeTask as removeInternalTask,
   updateTask as patchInternalTask,
 } from "./task-store.mjs";
+import {
+  listTaskAttachments,
+  mergeTaskAttachments,
+} from "./task-attachments.mjs";
 import { randomUUID } from "node:crypto";
 
 const TAG = "[kanban]";
@@ -269,6 +273,149 @@ function extractPrFromText(text) {
   return null;
 }
 
+function isBosunStateComment(text) {
+  const raw = String(text || "").toLowerCase();
+  if (!raw) return false;
+  return raw.includes("bosun-state") || raw.includes("codex:ignore");
+}
+
+function normalizeAttachmentName(name, url) {
+  const raw = String(name || "").trim();
+  if (raw && !/^(?:https?:)?\/\//i.test(raw)) return raw;
+  if (!url) return raw || "attachment";
+  try {
+    const parsed = new URL(url);
+    const base = decodeURIComponent(parsed.pathname.split("/").pop() || "");
+    return base || raw || "attachment";
+  } catch {
+    const parts = String(url).split("/").filter(Boolean);
+    return parts[parts.length - 1] || raw || "attachment";
+  }
+}
+
+function guessAttachmentKind(url, name, isImage) {
+  const text = `${url || ""} ${name || ""}`.toLowerCase();
+  if (isImage) return "image";
+  if (/\.(png|jpe?g|gif|webp|bmp|svg)(\?|#|$)/i.test(text)) return "image";
+  return "file";
+}
+
+function guessContentType(name, kind) {
+  const text = String(name || "").toLowerCase();
+  if (kind === "image") {
+    if (text.endsWith(".png")) return "image/png";
+    if (text.endsWith(".jpg") || text.endsWith(".jpeg")) return "image/jpeg";
+    if (text.endsWith(".gif")) return "image/gif";
+    if (text.endsWith(".webp")) return "image/webp";
+    if (text.endsWith(".svg")) return "image/svg+xml";
+  }
+  if (text.endsWith(".pdf")) return "application/pdf";
+  if (text.endsWith(".json")) return "application/json";
+  if (text.endsWith(".csv")) return "text/csv";
+  if (text.endsWith(".txt") || text.endsWith(".log")) return "text/plain";
+  if (text.endsWith(".zip")) return "application/zip";
+  if (text.endsWith(".xlsx")) return "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
+  if (text.endsWith(".docx")) return "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
+  return kind === "image" ? "image/*" : "application/octet-stream";
+}
+
+function isLikelyAttachmentUrl(url, isImage = false) {
+  if (!url) return false;
+  const text = String(url).toLowerCase();
+  if (isImage) return true;
+  if (text.includes("user-images.githubusercontent.com")) return true;
+  if (text.includes("github.com/user-attachments")) return true;
+  if (text.includes("/attachments/")) return true;
+  if (text.includes("/files/")) return true;
+  return /\.(png|jpe?g|gif|webp|bmp|svg|pdf|json|csv|txt|log|zip|gz|tgz|xz|tar|rar|7z|docx?|xlsx?|pptx?)(\?|#|$)/i.test(text);
+}
+
+function extractMarkdownLinks(text) {
+  const raw = String(text || "");
+  if (!raw) return [];
+  const results = [];
+  const imageRe = /!\[([^\]]*)\]\(([^)]+)\)/g;
+  const linkRe = /\[([^\]]+)\]\(([^)]+)\)/g;
+  const htmlImgRe = /<img[^>]+src=["']([^"']+)["'][^>]*>/gi;
+  const htmlLinkRe = /<a[^>]+href=["']([^"']+)["'][^>]*>/gi;
+  const urlRe = /\bhttps?:\/\/[^\s<>()]+/gi;
+
+  let match;
+  while ((match = imageRe.exec(raw))) {
+    const url = String(match[2] || "").trim().split(/\s+/)[0];
+    if (url) results.push({ url, label: match[1] || "", isImage: true });
+  }
+  while ((match = linkRe.exec(raw))) {
+    const url = String(match[2] || "").trim().split(/\s+/)[0];
+    if (url) results.push({ url, label: match[1] || "", isImage: false });
+  }
+  while ((match = htmlImgRe.exec(raw))) {
+    const url = String(match[1] || "").trim();
+    if (url) results.push({ url, label: "", isImage: true });
+  }
+  while ((match = htmlLinkRe.exec(raw))) {
+    const url = String(match[1] || "").trim();
+    if (url) results.push({ url, label: "", isImage: false });
+  }
+  while ((match = urlRe.exec(raw))) {
+    const url = String(match[0] || "").trim();
+    if (url) results.push({ url, label: "", isImage: false });
+  }
+
+  return results;
+}
+
+function extractAttachmentsFromText(text, meta = {}) {
+  const links = extractMarkdownLinks(text);
+  const attachments = [];
+  for (const link of links) {
+    if (!isLikelyAttachmentUrl(link.url, link.isImage)) continue;
+    const name = normalizeAttachmentName(link.label, link.url);
+    const kind = guessAttachmentKind(link.url, name, link.isImage);
+    attachments.push({
+      id: meta?.id || null,
+      name,
+      url: link.url,
+      kind,
+      contentType: meta?.contentType || guessContentType(name, kind),
+      size: meta?.size ?? null,
+      source: meta?.source || "unknown",
+      sourceType: meta?.sourceType || null,
+      commentId: meta?.commentId || null,
+      author: meta?.author || null,
+      createdAt: meta?.createdAt || null,
+    });
+  }
+  return attachments;
+}
+
+function normalizeCommentList(comments) {
+  if (!Array.isArray(comments)) return [];
+  return comments
+    .map((comment) => {
+      const body =
+        comment?.body ||
+        comment?.bodyText ||
+        comment?.body_html ||
+        comment?.text ||
+        "";
+      const trimmed = String(body || "").trim();
+      if (!trimmed || isBosunStateComment(trimmed)) return null;
+      return {
+        id: comment?.id || comment?.databaseId || null,
+        author:
+          comment?.author?.login ||
+          comment?.author?.displayName ||
+          comment?.author?.name ||
+          null,
+        createdAt: comment?.createdAt || comment?.created || null,
+        body: trimmed,
+        url: comment?.url || null,
+      };
+    })
+    .filter(Boolean);
+}
+
 class InternalAdapter {
   constructor() {
     this.name = "internal";
@@ -291,6 +438,18 @@ class InternalAdapter {
         extractBaseBranchFromLabels(labelBag) ||
         extractBaseBranchFromText(task.description || task.body || ""),
     );
+    const rawComments = Array.isArray(task.meta?.comments)
+      ? task.meta.comments
+      : [];
+    const normalizedComments = normalizeCommentList(rawComments);
+    const existingAttachments = []
+      .concat(Array.isArray(task.attachments) ? task.attachments : [])
+      .concat(Array.isArray(task.meta?.attachments) ? task.meta.attachments : []);
+    const localAttachments = listTaskAttachments(task.id, "internal");
+    const mergedAttachments = mergeTaskAttachments(
+      existingAttachments,
+      localAttachments,
+    );
     return {
       id: String(task.id || ""),
       title: task.title || "",
@@ -317,7 +476,13 @@ class InternalAdapter {
       createdAt: task.createdAt || null,
       updatedAt: task.updatedAt || null,
       backend: "internal",
-      meta: task.meta || {},
+      attachments: mergedAttachments,
+      comments: normalizedComments,
+      meta: {
+        ...(task.meta || {}),
+        comments: normalizedComments,
+        attachments: mergedAttachments,
+      },
     };
   }
 
@@ -3027,6 +3192,28 @@ To re-enable bosun for this task, remove the \`${this._codexLabels.ignore}\` lab
       extractBaseBranchFromLabels(labels) ||
         extractBaseBranchFromText(issue.body || ""),
     );
+    const comments = normalizeCommentList(
+      Array.isArray(issue.comments) ? issue.comments : [],
+    );
+    const descriptionAttachments = extractAttachmentsFromText(issue.body || "", {
+      source: "github",
+      sourceType: "issue",
+      createdAt: issue.createdAt || issue.created_at || null,
+    });
+    const commentAttachments = comments.flatMap((comment) =>
+      extractAttachmentsFromText(comment.body, {
+        source: "github",
+        sourceType: "comment",
+        commentId: comment.id,
+        author: comment.author,
+        createdAt: comment.createdAt,
+      }),
+    );
+    const localAttachments = listTaskAttachments(issue.number, "github");
+    const mergedAttachments = mergeTaskAttachments(
+      mergeTaskAttachments(descriptionAttachments, commentAttachments),
+      localAttachments,
+    );
 
     return {
       id: String(issue.number || ""),
@@ -3045,10 +3232,14 @@ To re-enable bosun for this task, remove the \`${this._codexLabels.ignore}\` lab
       baseBranch,
       branchName: branchMatch?.[1] || null,
       prNumber: prMatch?.[1] || null,
+      attachments: mergedAttachments,
+      comments,
       meta: {
         ...issue,
         task_url: issue.url || null,
         tags,
+        comments,
+        attachments: mergedAttachments,
         ...(baseBranch ? { base_branch: baseBranch, baseBranch } : {}),
         codex: codexMeta,
       },
@@ -3358,6 +3549,66 @@ class JiraAdapter {
         normalizedFieldValues[lcKey] = fieldValue;
       }
     }
+    const rawComments = Array.isArray(fields.comment?.comments)
+      ? fields.comment.comments
+      : [];
+    const comments = rawComments
+      .map((comment) => {
+        const body = this._commentToText(comment?.body).trim();
+        if (!body || isBosunStateComment(body)) return null;
+        return {
+          id: comment?.id || null,
+          author:
+            comment?.author?.displayName ||
+            comment?.author?.emailAddress ||
+            comment?.author?.accountId ||
+            null,
+          createdAt: comment?.created || null,
+          body,
+          url: comment?.self || null,
+        };
+      })
+      .filter(Boolean);
+    const commentAttachments = comments.flatMap((comment) =>
+      extractAttachmentsFromText(comment.body, {
+        source: "jira",
+        sourceType: "comment",
+        commentId: comment.id,
+        author: comment.author,
+        createdAt: comment.createdAt,
+      }),
+    );
+    const rawAttachments = Array.isArray(fields.attachment)
+      ? fields.attachment
+      : [];
+    const jiraAttachments = rawAttachments
+      .map((attachment) => {
+        const name = attachment?.filename || attachment?.name || "attachment";
+        const url = attachment?.content || attachment?.self || attachment?.thumbnail;
+        if (!url) return null;
+        const kind = guessAttachmentKind(
+          url,
+          name,
+          String(attachment?.mimeType || "").startsWith("image/"),
+        );
+        return {
+          id: attachment?.id || null,
+          name,
+          url,
+          kind,
+          contentType: attachment?.mimeType || guessContentType(name, kind),
+          size: attachment?.size ?? null,
+          source: "jira",
+          sourceType: "attachment",
+          createdAt: attachment?.created || null,
+        };
+      })
+      .filter(Boolean);
+    const localAttachments = listTaskAttachments(issueKey, "jira");
+    const mergedAttachments = mergeTaskAttachments(
+      mergeTaskAttachments(jiraAttachments, commentAttachments),
+      localAttachments,
+    );
     return {
       id: issueKey,
       title: fields.summary || "",
@@ -3378,11 +3629,15 @@ class JiraAdapter {
       taskUrl: issueKey ? `${this._baseUrl}/browse/${issueKey}` : null,
       createdAt: fields.created || null,
       updatedAt: fields.updated || null,
+      attachments: mergedAttachments,
+      comments,
       meta: {
         ...issue,
         labels,
         fields: normalizedFieldValues,
         tags,
+        comments,
+        attachments: mergedAttachments,
         ...(baseBranch ? { base_branch: baseBranch, baseBranch } : {}),
         codex: codexMeta,
       },
@@ -3546,7 +3801,7 @@ class JiraAdapter {
     const fieldList =
       fields.length > 0
         ? fields.join(",")
-        : "summary,description,status,assignee,priority,project,labels,comment,created,updated";
+        : "summary,description,status,assignee,priority,project,labels,comment,attachment,created,updated";
     return this._jira(
       `/rest/api/3/issue/${encodeURIComponent(issueKey)}?fields=${encodeURIComponent(fieldList)}`,
     );
@@ -3735,7 +3990,7 @@ class JiraAdapter {
     const data = await this._searchIssues(
       jql,
       maxResults,
-      "summary,description,status,assignee,priority,project,labels,comment,created,updated",
+      "summary,description,status,assignee,priority,project,labels,comment,attachment,created,updated",
     );
     let tasks = (Array.isArray(data?.issues) ? data.issues : []).map((issue) =>
       this._normaliseIssue(issue),