bosun 0.34.3 → 0.34.5

package/agent-endpoint.mjs

@@ -30,7 +30,7 @@ const TAG = "[agent-endpoint]";
 const DEFAULT_PORT = 18432;
 const MAX_BODY_SIZE = 1024 * 1024; // 1 MB
 const REQUEST_TIMEOUT_MS = 30_000; // 30 seconds
-const ACCESS_DENIED_COOLDOWN_MS = 10 * 60 * 1000; // 10 minutes
+const ACCESS_DENIED_COOLDOWN_MS = 10 * 60 * 1000; // 10 minutes
 const BOSUN_ROOT_HINT = __dirname.toLowerCase().replace(/\\/g, '/');
 
 // Valid status transitions when an agent self-reports
@@ -1387,4 +1387,4 @@ export class AgentEndpoint {
 export function createAgentEndpoint(options) {
   return new AgentEndpoint(options);
 }
-
+

package/agent-event-bus.mjs

@@ -112,8 +112,8 @@ export class AgentEventBus {
       options.staleThresholdMs || DEFAULTS.staleThresholdMs;
     this._staleCheckIntervalMs =
       options.staleCheckIntervalMs || DEFAULTS.staleCheckIntervalMs;
-    this._maxAutoRetries =
-      options.maxAutoRetries ?? DEFAULTS.maxAutoRetries;
+    this._maxAutoRetries =
+      options.maxAutoRetries ?? DEFAULTS.maxAutoRetries;
     this._dedupeWindowMs = options.dedupeWindowMs || DEFAULTS.dedupeWindowMs;
 
     /** @type {Array<{type: string, taskId: string, payload: object, ts: number}>} ring buffer */
@@ -203,7 +203,7 @@ export class AgentEventBus {
 
     // ── Dedup
     const key = `${type}:${taskId}`;
-    const last = this._recentEmits.get(key);
+    const last = this._recentEmits.get(key);
     if (typeof last === "number" && ts - last < this._dedupeWindowMs) return;
     this._recentEmits.set(key, ts);
     if (this._recentEmits.size > 200) {

package/agent-pool.mjs

@@ -75,6 +75,25 @@ const HARD_TIMEOUT_BUFFER_MS = 5 * 60_000; // 5 minutes
 
 /** Tag for console logging */
 const TAG = "[agent-pool]";
+const MAX_PROMPT_BYTES = 180_000;
+
+function sanitizeAndBoundPrompt(text) {
+  if (typeof text !== "string") return "";
+  // eslint-disable-next-line no-control-regex
+  const sanitized = text.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, "");
+  const bytes = Buffer.byteLength(sanitized, "utf8");
+  if (bytes <= MAX_PROMPT_BYTES) return sanitized;
+  const buf = Buffer.from(sanitized, "utf8").slice(0, MAX_PROMPT_BYTES);
+  const truncated = buf.toString("utf8");
+  const removedBytes = bytes - MAX_PROMPT_BYTES;
+  console.warn(
+    `${TAG} prompt truncated: ${bytes} → ${MAX_PROMPT_BYTES} bytes (removed ${removedBytes})`,
+  );
+  return (
+    truncated +
+    `\n\n[...prompt truncated — ${removedBytes} bytes removed to stay within API limits]`
+  );
+}
 
 function envFlagEnabled(value) {
   const raw = String(value ?? "")
@@ -243,13 +262,8 @@ function hasSdkPrerequisites(name) {
     return { ok: true, reason: null };
   }
   if (name === "copilot") {
-    // Copilot needs either a token or VS Code context
-    const hasToken = process.env.COPILOT_CLI_TOKEN || process.env.GITHUB_TOKEN;
-    // Copilot also works from VS Code extension context — check for common indicators
-    const hasVsCode = process.env.VSCODE_PID || process.env.COPILOT_AGENT_HOST;
-    if (!hasToken && !hasVsCode) {
-      return { ok: false, reason: "no COPILOT_CLI_TOKEN or GITHUB_TOKEN" };
-    }
+    // Copilot auth can come from multiple sources (OAuth manager, gh auth,
+    // VS Code Copilot login, env tokens). Don't block execution here.
     return { ok: true, reason: null };
   }
   if (name === "claude") {
@@ -775,7 +789,11 @@ async function launchCodexThread(prompt, cwd, timeoutMs, extra = {}) {
       // Codex steering: send a follow-up message to the live thread
       // Note: the thread is consumed in the streaming loop below, so
       // additional runStreamed calls are queued by the SDK
-      thread.runStreamed(steerPrompt, { signal: controller?.signal }).catch(() => {});
+      thread
+        .runStreamed(sanitizeAndBoundPrompt(steerPrompt), {
+          signal: controller?.signal,
+        })
+        .catch(() => {});
     });
   }
 
@@ -791,7 +809,8 @@ async function launchCodexThread(prompt, cwd, timeoutMs, extra = {}) {
 
   // ── 4. Stream the turn ───────────────────────────────────────────────────
   try {
-    const turn = await thread.runStreamed(prompt, {
+    const safePrompt = sanitizeAndBoundPrompt(prompt);
+    const turn = await thread.runStreamed(safePrompt, {
       signal: controller.signal,
     });
 
@@ -2237,7 +2256,8 @@ async function resumeCodexThread(threadId, prompt, cwd, timeoutMs, extra = {}) {
   let hardTimer;
 
   try {
-    const turn = await thread.runStreamed(prompt, {
+    const safePrompt = sanitizeAndBoundPrompt(prompt);
+    const turn = await thread.runStreamed(safePrompt, {
       signal: controller.signal,
     });
     let finalResponse = "";

package/agent-work-report.mjs

@@ -359,4 +359,4 @@ export function shouldSendWeeklyReport(options = {}) {
     return true;
   }
   return lastSentMs < scheduledThisWeek.getTime();
-}
+}

package/bosun.schema.json

@@ -49,6 +49,11 @@
           "type": "string",
           "enum": ["internal", "vk", "github", "jira"]
         },
+        "syncPolicy": {
+          "type": "string",
+          "enum": ["internal-primary", "bidirectional"],
+          "default": "internal-primary"
+        },
         "projectId": { "type": "string" },
         "github": {
           "type": "object",

package/desktop/main.mjs

@@ -41,6 +41,38 @@ function parseBoolEnv(value, fallback) {
   return fallback;
 }
 
+function isWslInteropRuntime() {
+  return Boolean(
+    process.env.WSL_DISTRO_NAME
+    || process.env.WSL_INTEROP
+    || (process.platform === "win32"
+      && String(process.env.HOME || "")
+        .trim()
+        .startsWith("/home/")),
+  );
+}
+
+function resolveDesktopConfigDir() {
+  if (process.env.BOSUN_HOME) return resolve(process.env.BOSUN_HOME);
+  if (process.env.BOSUN_DIR) return resolve(process.env.BOSUN_DIR);
+
+  const preferWindowsDirs = process.platform === "win32" && !isWslInteropRuntime();
+  const baseDir = preferWindowsDirs
+    ? process.env.APPDATA
+      || process.env.LOCALAPPDATA
+      || process.env.USERPROFILE
+      || process.env.HOME
+      || homedir()
+    : process.env.HOME
+      || process.env.XDG_CONFIG_HOME
+      || process.env.USERPROFILE
+      || process.env.APPDATA
+      || process.env.LOCALAPPDATA
+      || homedir();
+
+  return resolve(baseDir, "bosun");
+}
+
 function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -223,7 +255,11 @@ async function ensureDaemonRunning() {
 async function startUiServer() {
   if (uiServerStarted) return;
   const api = await loadUiServerModule();
-  const server = await api.startTelegramUiServer({});
+  const server = await api.startTelegramUiServer({
+    dependencies: {
+      configDir: resolveDesktopConfigDir(),
+    },
+  });
   if (!server) {
     throw new Error("Failed to start Telegram UI server.");
   }

package/git-commit-helpers.mjs

@@ -0,0 +1,83 @@
+/**
+ * git-commit-helpers.mjs — Git commit utilities for Bosun
+ *
+ * Ensures Bosun Bot is credited in commits and PRs via GitHub's
+ * Co-authored-by trailer convention.
+ *
+ * GitHub App bot user ID: 262908237
+ * Noreply email: 262908237+bosun-ve[bot]@users.noreply.github.com
+ * GitHub appearance: https://github.com/apps/bosun-ve
+ */
+
+const BOSUN_BOT_TRAILER =
+  "Co-authored-by: bosun-ve[bot] <262908237+bosun-ve[bot]@users.noreply.github.com>";
+
+const BOSUN_PR_CREDIT =
+  "\n\n---\n*Created by [Bosun Bot](https://github.com/apps/bosun-ve)*";
+
+// ── Commit message helpers ────────────────────────────────────────────────────
+
+/**
+ * Appends the Bosun bot Co-authored-by trailer to a commit message.
+ *
+ * GitHub displays the bot in the Contributors graph when this trailer is present.
+ * The Co-authored-by line must be separated from the message body by a blank line.
+ *
+ * @param {string} message - original commit message
+ * @returns {string} commit message with trailer appended
+ */
+export function appendBosunCoAuthor(message) {
+  if (message.includes("Co-authored-by: bosun-ve")) return message;
+  const trimmed = message.trimEnd();
+  return `${trimmed}\n\n${BOSUN_BOT_TRAILER}`;
+}
+
+/**
+ * Builds a complete commit message with an optional Bosun bot credit trailer.
+ *
+ * @param {string} title - commit title (first line / summary)
+ * @param {string} [body] - commit body (optional extended description)
+ * @param {Object} [opts]
+ * @param {boolean} [opts.addBosunCredit=true] - whether to append the co-author trailer
+ * @returns {string} full commit message
+ */
+export function buildCommitMessage(title, body = "", { addBosunCredit = true } = {}) {
+  const parts = [title.trimEnd()];
+  if (body && body.trim()) {
+    parts.push(""); // blank line
+    parts.push(body.trimEnd());
+  }
+  const base = parts.join("\n");
+  return addBosunCredit ? appendBosunCoAuthor(base) : base;
+}
+
+// ── PR body helpers ───────────────────────────────────────────────────────────
+
+/**
+ * Appends the Bosun Bot credit footer to a PR body.
+ *
+ * @param {string} body - original PR description
+ * @returns {string} PR body with Bosun Bot credit appended
+ */
+export function appendBosunPrCredit(body) {
+  if (body.includes("Bosun Bot") || body.includes("bosun-ve")) return body;
+  return body.trimEnd() + BOSUN_PR_CREDIT;
+}
+
+/**
+ * Returns the Bosun bot Co-authored-by trailer string (for direct use).
+ *
+ * @returns {string}
+ */
+export function getBosunCoAuthorTrailer() {
+  return BOSUN_BOT_TRAILER;
+}
+
+/**
+ * Returns the Bosun bot PR credit footer markdown (for direct use).
+ *
+ * @returns {string}
+ */
+export function getBosunPrCredit() {
+  return BOSUN_PR_CREDIT;
+}

package/kanban-adapter.mjs

@@ -1280,6 +1280,8 @@ class GitHubIssuesAdapter {
     /** @type {Map<string, {fields: any, time: number}>} projectNumber → {fields, time} */
     this._projectFieldsCache = new Map();
     this._projectFieldsCacheTTL = 300_000; // 5 minutes
+    /** @type {Set<string>} projects already warned for missing Status field */
+    this._projectStatusFieldWarned = new Set();
     this._repositoryNodeId = null;
 
     // Auto-sync toggle: set GITHUB_PROJECT_AUTO_SYNC=false to disable project sync
@@ -1309,6 +1311,46 @@ class GitHubIssuesAdapter {
     this._issueListCache = new Map();
     /** @type {Map<string, {data: object|null, ts: number}>} issueNum → {data, ts} */
     this._sharedStateCache = new Map();
+    this._lastKnownTasks = [];
+    this._taskListBackoffUntil = 0;
+    this._taskListBackoffMs = parseDelayMs(
+      process.env.GH_TASK_LIST_BACKOFF_MS,
+      90_000,
+      5_000,
+    );
+    this._taskListBackoffWarnAt = 0;
+  }
+
+  _cacheLastKnownTasks(tasks) {
+    if (!Array.isArray(tasks)) return;
+    this._lastKnownTasks = tasks.map((task) => ({
+      ...task,
+      meta: task?.meta ? { ...task.meta } : {},
+    }));
+    this._taskListBackoffUntil = 0;
+    this._taskListBackoffWarnAt = 0;
+  }
+
+  _setTaskListBackoff() {
+    const now = Date.now();
+    this._taskListBackoffUntil = Math.max(
+      this._taskListBackoffUntil || 0,
+      now + this._taskListBackoffMs,
+    );
+  }
+
+  _getBackoffTasks(filters = {}) {
+    let fallback = this._lastKnownTasks.map((task) => ({
+      ...task,
+      meta: task?.meta ? { ...task.meta } : {},
+    }));
+
+    if (filters.status) {
+      const normalizedFilter = normaliseStatus(filters.status);
+      fallback = fallback.filter((task) => task.status === normalizedFilter);
+    }
+
+    return fallback;
   }
 
   /**
@@ -1341,7 +1383,15 @@ class GitHubIssuesAdapter {
         "json",
       ]);
 
-      if (!Array.isArray(fields)) {
+      const normalizedFields = Array.isArray(fields)
+        ? fields
+        : Array.isArray(fields?.fields)
+          ? fields.fields
+          : Array.isArray(fields?.data)
+            ? fields.data
+            : null;
+
+      if (!Array.isArray(normalizedFields)) {
         console.warn(
           `${TAG} project field-list returned non-array for project ${projectNumber}`,
         );
@@ -1349,7 +1399,7 @@ class GitHubIssuesAdapter {
       }
 
       // Find the Status field
-      const statusField = fields.find(
+      const statusField = normalizedFields.find(
         (f) =>
           f.name === "Status" &&
           (f.type === "SINGLE_SELECT" || f.data_type === "SINGLE_SELECT"),
@@ -1366,7 +1416,7 @@ class GitHubIssuesAdapter {
       // Cache the result (also cache the raw fields array for getProjectFields)
       this._projectFieldsCache.set(cacheKey, {
         fields: result,
-        rawFields: fields,
+        rawFields: normalizedFields,
         time: now,
       });
 
@@ -1950,10 +2000,9 @@ class GitHubIssuesAdapter {
 
       return tasks;
     } catch (err) {
-      console.warn(
-        `${TAG} failed to list tasks from project ${projectNumber}: ${err.message}`,
+      throw new Error(
+        `project ${projectNumber} list failed: ${err?.message || err}`,
       );
-      return [];
     }
   }
 
@@ -1981,9 +2030,16 @@ class GitHubIssuesAdapter {
       // Get project fields
       const fields = await this._getProjectFields(projectNumber);
       if (!fields || !fields.statusFieldId) {
-        console.warn(`${TAG} cannot sync to project: no status field found`);
+        const projectKey = String(projectNumber || "");
+        if (!this._projectStatusFieldWarned.has(projectKey)) {
+          this._projectStatusFieldWarned.add(projectKey);
+          console.warn(
+            `${TAG} cannot sync to project ${projectKey}: no Status field found`,
+          );
+        }
         return false;
       }
+      this._projectStatusFieldWarned.delete(String(projectNumber || ""));
 
       // Map codex status to project status option using configurable mapping
       const targetStatusName = this._normalizeProjectStatus(status, true);
@@ -2256,6 +2312,24 @@ class GitHubIssuesAdapter {
   }
 
   async listTasks(_projectId, filters = {}) {
+    const now = Date.now();
+    if (this._taskListBackoffUntil > now) {
+      const fallback = this._getBackoffTasks(filters);
+      if (fallback.length > 0) {
+        if (now - this._taskListBackoffWarnAt > 15_000) {
+          this._taskListBackoffWarnAt = now;
+          const sec = Math.max(
+            1,
+            Math.ceil((this._taskListBackoffUntil - now) / 1000),
+          );
+          console.warn(
+            `${TAG} task list in backoff (${sec}s remaining) — serving ${fallback.length} cached task(s)`,
+          );
+        }
+        return fallback;
+      }
+    }
+
     // If project mode is enabled, read from project board
     if (this._projectMode === "kanban" && this._projectNumber) {
       const projectNumber = await this._resolveProjectNumber();
@@ -2296,6 +2370,7 @@ class GitHubIssuesAdapter {
             }
           }
 
+          this._cacheLastKnownTasks(filtered);
           return filtered;
         } catch (err) {
           console.warn(
@@ -2345,8 +2420,20 @@ class GitHubIssuesAdapter {
       } else {
         args.push("--state", "open");
       }
-      rawIssues = await this._gh(args);
-      this._issueListCache.set(listCacheKey, { data: rawIssues, ts: nowMs });
+      try {
+        rawIssues = await this._gh(args);
+        this._issueListCache.set(listCacheKey, { data: rawIssues, ts: nowMs });
+      } catch (err) {
+        this._setTaskListBackoff();
+        const fallback = this._getBackoffTasks(filters);
+        if (fallback.length > 0) {
+          console.warn(
+            `${TAG} failed to list issues (${err.message}); serving ${fallback.length} cached task(s)`,
+          );
+          return fallback;
+        }
+        throw err;
+      }
     }
 
     let normalized = (Array.isArray(rawIssues) ? rawIssues : []).map((i) =>
@@ -2390,6 +2477,7 @@ class GitHubIssuesAdapter {
       }
     }
 
+    this._cacheLastKnownTasks(normalized);
     return normalized;
   }
 
@@ -5209,5 +5297,3 @@ export async function unmarkTaskIgnored(taskId) {
   );
   return false;
 }
-
-

package/maintenance.mjs

@@ -888,26 +888,93 @@ export function syncLocalTrackingBranches(repoRoot, branches) {
       );
       if (remoteCheck.status !== 0) continue;
 
-      // Compare: is local behind?
+      // Measure divergence in both directions up front
       const behindCheck = spawnSync(
         "git",
         ["rev-list", "--count", `${branch}..${remoteRef}`],
         { cwd: repoRoot, encoding: "utf8", timeout: 5000, windowsHide: true },
       );
       const behind = parseInt(behindCheck.stdout?.trim(), 10) || 0;
-      if (behind === 0) continue; // Already up to date
 
-      // Check if local has commits not in remote (diverged)
       const aheadCheck = spawnSync(
         "git",
         ["rev-list", "--count", `${remoteRef}..${branch}`],
         { cwd: repoRoot, encoding: "utf8", timeout: 5000, windowsHide: true },
       );
       const ahead = parseInt(aheadCheck.stdout?.trim(), 10) || 0;
-      if (ahead > 0) {
-        console.warn(
-          `[maintenance] local '${branch}' has ${ahead} commit(s) ahead of ${remoteRef} — skipping (diverged)`,
+
+      if (behind === 0 && ahead === 0) continue; // Already in sync
+
+      // Local is ahead of remote but not behind — try a plain push
+      if (behind === 0 && ahead > 0) {
+        const push = spawnSync(
+          "git",
+          ["push", "origin", `${branch}:refs/heads/${branch}`, "--quiet"],
+          { cwd: repoRoot, encoding: "utf8", timeout: 30_000, windowsHide: true },
         );
+        if (push.status === 0) {
+          console.log(
+            `[maintenance] pushed local '${branch}' to origin (${ahead} commit(s) ahead)`,
+          );
+          synced++;
+        } else {
+          console.warn(
+            `[maintenance] git push '${branch}' failed: ${(push.stderr || push.stdout || "").toString().trim()}`,
+          );
+        }
+        continue;
+      }
+
+      // Truly diverged: local has unique commits AND is missing remote commits.
+      // Attempt rebase onto remote then push (checked-out branch only).
+      if (ahead > 0) {
+        const statusCheck = spawnSync("git", ["status", "--porcelain"], {
+          cwd: repoRoot,
+          encoding: "utf8",
+          timeout: 5000,
+          windowsHide: true,
+        });
+        if (statusCheck.stdout?.trim()) {
+          console.warn(
+            `[maintenance] local '${branch}' diverged (${ahead}↑ ${behind}↓) but has uncommitted changes — skipping`,
+          );
+          continue;
+        }
+        if (branch === currentBranch) {
+          const rebase = spawnSync(
+            "git",
+            ["rebase", remoteRef, "--quiet"],
+            { cwd: repoRoot, encoding: "utf8", timeout: 60_000, windowsHide: true },
+          );
+          if (rebase.status !== 0) {
+            spawnSync("git", ["rebase", "--abort"], {
+              cwd: repoRoot, timeout: 10_000, windowsHide: true,
+            });
+            console.warn(
+              `[maintenance] rebase of '${branch}' onto ${remoteRef} failed (${ahead}↑ ${behind}↓) — skipping`,
+            );
+            continue;
+          }
+          const push = spawnSync(
+            "git",
+            ["push", "origin", `${branch}:refs/heads/${branch}`, "--quiet"],
+            { cwd: repoRoot, encoding: "utf8", timeout: 30_000, windowsHide: true },
+          );
+          if (push.status === 0) {
+            console.log(
+              `[maintenance] rebased and pushed '${branch}' (was ${ahead}↑ ${behind}↓)`,
+            );
+            synced++;
+          } else {
+            console.warn(
+              `[maintenance] push after rebase of '${branch}' failed: ${(push.stderr || push.stdout || "").toString().trim()}`,
+            );
+          }
+        } else {
+          console.warn(
+            `[maintenance] local '${branch}' diverged (${ahead}↑ ${behind}↓) and not checked out — skipping (rebase requires checkout)`,
+          );
+        }
         continue;
       }