bosun 0.40.21 → 0.41.1

package/infra/session-tracker.mjs

@@ -13,16 +13,20 @@
 
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, unlinkSync } from "node:fs";
 import { resolve, dirname } from "node:path";
+import { randomBytes } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { buildSessionInsights } from "../lib/session-insights.mjs";
+import { isTestRuntime } from "./test-runtime.mjs";
+import { addCompletedSession } from "./runtime-accumulator.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const SESSIONS_DIR = resolve(__dirname, "..", "logs", "sessions");
 
 const TAG = "[session-tracker]";
 
-/** Default: keep last 10 messages per task session. */
-const DEFAULT_MAX_MESSAGES = 10;
+/** Default: keep last 300 messages per task session.
+ *  Previously 10 — far too few for historic session review. */
+const DEFAULT_MAX_MESSAGES = 300;
 
 /** Default: keep a larger history for manual/primary chat sessions. */
 const DEFAULT_CHAT_MAX_MESSAGES = 2000;
@@ -35,6 +39,22 @@ const MAX_MESSAGE_CHARS = 100_000;
 
 /** Maximum total sessions to keep in memory. */
 const MAX_SESSIONS = 100;
+const TERMINAL_SESSION_STATUSES = new Set(["completed", "failed", "idle", "archived"]);
+
+function isTerminalSessionStatus(status) {
+  return TERMINAL_SESSION_STATUSES.has(String(status || "").trim().toLowerCase());
+}
+
+function randomToken(length = 8) {
+  return randomBytes(Math.ceil(length / 2)).toString("hex").slice(0, length);
+}
+
+function resolveSessionTrackerPersistDir(options = {}) {
+  if (options.persistDir !== undefined) {
+    return options.persistDir;
+  }
+  return isTestRuntime() ? null : SESSIONS_DIR;
+}
 
 function resolveSessionMaxMessages(type, metadata, explicitMax, fallbackMax) {
   if (Number.isFinite(explicitMax)) {
@@ -173,6 +193,7 @@ export class SessionTracker {
       taskId,
       taskTitle,
       id: taskId,
+      sessionKey: `${taskId}:${Date.now()}:${randomToken(8)}`,
       type: "task",
       maxMessages: this.#maxMessages,
       startedAt: Date.now(),
@@ -183,6 +204,7 @@ export class SessionTracker {
       totalEvents: 0,
       turnCount: 0,
       status: "active",
+      accumulatedAt: null,
       lastActivityAt: Date.now(),
       metadata: {},
       insights: buildSessionInsights({ messages: [] }),
@@ -246,7 +268,7 @@ export class SessionTracker {
     // Direct message format (role/content)
     if (event && event.role && event.content !== undefined) {
       const msg = {
-        id: event.id || `msg-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
+      id: event.id || `msg-${Date.now()}-${randomToken(6)}`,
         type: event.type || undefined,
         role: event.role,
         content: String(event.content).slice(0, MAX_MESSAGE_CHARS),
@@ -303,25 +325,8 @@ export class SessionTracker {
     session.endedAt = Date.now();
     session.status = status;
     this.#refreshDerivedState(session);
+    this.#accumulateCompletedSession(session, taskId);
     this.#markDirty(taskId);
-
-    // Lazy import to avoid top-level await issues
-    import("./runtime-accumulator.mjs")
-      .then((module) => {
-        if (module.addCompletedSession) {
-          module.addCompletedSession({
-            id: taskId,
-            taskId: taskId,
-            taskTitle: session.taskTitle,
-            executor: session.executor,
-            model: session.model,
-            startedAt: session.startedAt,
-            endedAt: session.endedAt,
-            status: status,
-          });
-        }
-      })
-      .catch(() => {});
   }
 
   /**
@@ -485,6 +490,8 @@ export class SessionTracker {
    * @param {string} taskId
    */
   removeSession(taskId) {
+    const session = this.#sessions.get(taskId);
+    this.#accumulateCompletedSession(session, taskId);
     this.#sessions.delete(taskId);
     this.#dirty.delete(taskId);
     // Remove persisted session file if it exists
@@ -516,7 +523,7 @@ export class SessionTracker {
    * Create a new session with explicit options.
    * @param {{ id: string, type?: string, taskId?: string, metadata?: Object }} opts
    */
-  createSession({ id, type = "manual", taskId, metadata = {}, maxMessages }) {
+  createSession({ id, type = "manual", taskId, metadata = {}, maxMessages, sessionKey }) {
     // Evict oldest non-active sessions if at capacity
     if (this.#sessions.size >= MAX_SESSIONS && !this.#sessions.has(id)) {
       this.#evictOldest();
@@ -533,6 +540,9 @@ export class SessionTracker {
       id,
       taskId: taskId || id,
       taskTitle: metadata.title || id,
+      sessionKey:
+        String(sessionKey || "").trim() ||
+        `${taskId || id}:${Date.now()}:${randomToken(8)}`,
       type,
       status: "active",
       createdAt: now,
@@ -543,6 +553,7 @@ export class SessionTracker {
       totalEvents: 0,
       turnCount: 0,
       lastActivityAt: Date.now(),
+      accumulatedAt: null,
       metadata,
       maxMessages: resolvedMax,
       insights: buildSessionInsights({ messages: [] }),
@@ -611,10 +622,11 @@ export class SessionTracker {
     const session = this.#sessions.get(sessionId);
     if (!session) return;
     session.status = status;
-    if (status === "completed" || status === "archived") {
+    if (status === "completed" || status === "archived" || status === "failed" || status === "idle") {
       session.endedAt = Date.now();
     }
     this.#refreshDerivedState(session);
+    this.#accumulateCompletedSession(session, sessionId);
     this.#markDirty(sessionId);
   }
 
@@ -687,7 +699,7 @@ export class SessionTracker {
       return { ok: false, error: "Only user messages can be edited" };
     }
 
-    target.id = target.id || `msg-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+    target.id = target.id || `msg-${Date.now()}-${randomToken(6)}`;
     target.content = nextContent.slice(0, MAX_MESSAGE_CHARS);
     target.edited = true;
     target.editedAt = new Date().toISOString();
@@ -807,6 +819,7 @@ export class SessionTracker {
     const type = event._sessionType || "task";
     this.createSession({
       id: taskId,
+      sessionKey: `${taskId}:${Date.now()}:${randomToken(8)}`,
       type,
       taskId,
       metadata: { autoCreated: true },
@@ -828,7 +841,8 @@ export class SessionTracker {
         return (a[1].lastActivityAt || a[1].startedAt) - (b[1].lastActivityAt || b[1].startedAt);
       });
     const toEvict = sorted.slice(0, evictCount);
-    for (const [id] of toEvict) {
+    for (const [id, session] of toEvict) {
+      this.#accumulateCompletedSession(session, id);
       this.#sessions.delete(id);
     }
   }
@@ -848,6 +862,7 @@ export class SessionTracker {
         session.status = "completed";
         session.endedAt = now;
         this.#refreshDerivedState(session);
+        this.#accumulateCompletedSession(session, id);
         this.#markDirty(id);
         reaped++;
       }
@@ -871,6 +886,43 @@ export class SessionTracker {
     }
   }
 
+  #accumulateCompletedSession(session, fallbackTaskId = "") {
+    if (!session || session.accumulatedAt) return false;
+    if (!isTerminalSessionStatus(session.status)) return false;
+    const taskId = String(session.taskId || session.id || fallbackTaskId || "").trim();
+    if (!taskId) return false;
+
+    const now = Date.now();
+    const endedAt = Number.isFinite(Number(session.endedAt)) && Number(session.endedAt) > 0
+      ? Number(session.endedAt)
+      : now;
+    const startedAt = Number.isFinite(Number(session.startedAt))
+      ? Number(session.startedAt)
+      : endedAt;
+    const tokenUsage = session.insights?.tokenUsage || null;
+
+    addCompletedSession({
+      id: session.id || taskId,
+      sessionId: session.id || taskId,
+      sessionKey: session.sessionKey || `${taskId}:${startedAt}:${endedAt}`,
+      taskId,
+      taskTitle: session.taskTitle,
+      executor: session.executor,
+      model: session.model,
+      startedAt,
+      endedAt,
+      durationMs: Math.max(0, endedAt - startedAt),
+      tokenCount: tokenUsage?.totalTokens || 0,
+      inputTokens: tokenUsage?.inputTokens || 0,
+      outputTokens: tokenUsage?.outputTokens || 0,
+      tokenUsage,
+      insights: session.insights || null,
+      status: String(session.status || "completed"),
+    });
+    session.accumulatedAt = new Date().toISOString();
+    return true;
+  }
+
   #refreshDerivedState(session) {
     if (!session) return;
     try {
@@ -908,10 +960,14 @@ export class SessionTracker {
           taskId: session.taskId,
           title: session.taskTitle || session.title || null,
           taskTitle: session.taskTitle || null,
+          sessionKey: session.sessionKey || null,
           type: session.type || "task",
           status: session.status,
           createdAt: session.createdAt || new Date(session.startedAt).toISOString(),
           lastActiveAt: session.lastActiveAt || new Date(session.lastActivityAt).toISOString(),
+          startedAt: session.startedAt || null,
+          endedAt: session.endedAt || null,
+          accumulatedAt: session.accumulatedAt || null,
           turnCount: session.turnCount || 0,
           messages: session.messages || [],
           metadata: session.metadata || {},
@@ -978,20 +1034,30 @@ export class SessionTracker {
         this.#sessions.set(id, {
           id,
           taskId: data.taskId || id,
-          taskTitle: data.metadata?.title || id,
+          taskTitle: data.taskTitle || data.title || data.metadata?.title || id,
+          sessionKey:
+            String(data.sessionKey || "").trim() ||
+            `${data.taskId || id}:${data.startedAt || Date.now()}:${endedAt || data.startedAt || Date.now()}`,
           type: data.type || "task",
           status,
           createdAt: data.createdAt || new Date().toISOString(),
           lastActiveAt: data.lastActiveAt || new Date().toISOString(),
-          startedAt: data.createdAt ? new Date(data.createdAt).getTime() : Date.now(),
+          startedAt: data.startedAt || (data.createdAt ? new Date(data.createdAt).getTime() : Date.now()),
           endedAt,
           messages: data.messages || [],
           totalEvents: (data.messages || []).length,
           turnCount: data.turnCount || 0,
+          accumulatedAt: data.accumulatedAt || null,
           lastActivityAt: lastActive || Date.now(),
           metadata: data.metadata || {},
           insights: data.insights || buildSessionInsights({ messages: data.messages || [] }),
         });
+        const restored = this.#sessions.get(id);
+        if (restored && isTerminalSessionStatus(restored.status) && !restored.accumulatedAt) {
+          if (this.#accumulateCompletedSession(restored, id)) {
+            this.#markDirty(id);
+          }
+        }
       }
     } catch {
       // Directory read failed — proceed without disk data
@@ -1524,9 +1590,10 @@ let _instance = null;
  */
 export function getSessionTracker(options) {
   if (!_instance) {
+    const persistDir = resolveSessionTrackerPersistDir(options || {});
     _instance = new SessionTracker({
-      persistDir: SESSIONS_DIR,
       ...options,
+      persistDir,
     });
     console.log(`${TAG} initialized (maxMessages=${_instance.getStats ? DEFAULT_MAX_MESSAGES : "?"})`);
   }

package/infra/test-runtime.mjs

@@ -0,0 +1,267 @@
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, relative, resolve } from "node:path";
+
+const TEST_RUNTIME_ENV_KEYS = [
+  "VITEST",
+  "VITEST_POOL_ID",
+  "VITEST_WORKER_ID",
+  "JEST_WORKER_ID",
+];
+
+const TEST_GIT_IDENTITY_KEYS = [
+  "GIT_AUTHOR_NAME",
+  "GIT_AUTHOR_EMAIL",
+  "GIT_COMMITTER_NAME",
+  "GIT_COMMITTER_EMAIL",
+  "VE_GIT_AUTHOR_NAME",
+  "VE_GIT_AUTHOR_EMAIL",
+];
+
+let cachedSandboxContext = null;
+
+function sanitizeToken(value, fallback) {
+  const normalized = String(value || "")
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9._-]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+  return normalized || fallback;
+}
+
+function pathsEqual(left, right) {
+  const a = resolve(String(left || ""));
+  const b = resolve(String(right || ""));
+  if (process.platform === "win32") {
+    return a.toLowerCase() === b.toLowerCase();
+  }
+  return a === b;
+}
+
+function getWorkerToken() {
+  return sanitizeToken(
+    process.env.VITEST_POOL_ID ||
+      process.env.VITEST_WORKER_ID ||
+      process.env.JEST_WORKER_ID ||
+      process.pid,
+    "default",
+  );
+}
+
+function buildDefaultSandboxRoot() {
+  return resolve(
+    tmpdir(),
+    "bosun-test-sandbox",
+    getWorkerToken(),
+  );
+}
+
+function buildSandboxContext(rootDir) {
+  const sandboxRoot = resolve(rootDir);
+  const configDir = resolve(sandboxRoot, "bosun-home");
+  const homeDir = resolve(sandboxRoot, "home");
+  const appDataDir = resolve(homeDir, "AppData", "Roaming");
+  const localAppDataDir = resolve(homeDir, "AppData", "Local");
+  const xdgConfigDir = resolve(homeDir, ".config");
+  const bosunDataDir = resolve(configDir, ".bosun");
+  const workflowDir = resolve(bosunDataDir, "workflows");
+  const runsDir = resolve(bosunDataDir, "workflow-runs");
+  const cacheDir = resolve(bosunDataDir, ".cache");
+  const gitGlobalConfigPath = resolve(homeDir, ".gitconfig");
+
+  return {
+    sandboxRoot,
+    configDir,
+    homeDir,
+    appDataDir,
+    localAppDataDir,
+    xdgConfigDir,
+    workflowDir,
+    runsDir,
+    cacheDir,
+    gitGlobalConfigPath,
+  };
+}
+
+function ensureDir(path) {
+  mkdirSync(path, { recursive: true });
+}
+
+function ensureSandboxFiles(context) {
+  ensureDir(context.sandboxRoot);
+  ensureDir(context.configDir);
+  ensureDir(context.homeDir);
+  ensureDir(context.appDataDir);
+  ensureDir(context.localAppDataDir);
+  ensureDir(context.xdgConfigDir);
+  ensureDir(context.workflowDir);
+  ensureDir(context.runsDir);
+  ensureDir(context.cacheDir);
+  if (!existsSync(context.gitGlobalConfigPath)) {
+    ensureDir(dirname(context.gitGlobalConfigPath));
+    writeFileSync(context.gitGlobalConfigPath, "", "utf8");
+  }
+}
+
+function setEnvValue(key, value, force) {
+  if (!force && process.env[key]) return;
+  process.env[key] = value;
+}
+
+export function isTestRuntime() {
+  if (process.env.BOSUN_TEST_SANDBOX === "1") return true;
+  for (const key of TEST_RUNTIME_ENV_KEYS) {
+    if (process.env[key]) return true;
+  }
+  if (process.env.NODE_ENV === "test") return true;
+  const argv = Array.isArray(process.argv)
+    ? process.argv.join(" ").toLowerCase()
+    : "";
+  return argv.includes("vitest") || argv.includes("--test");
+}
+
+function isPathInside(parentPath, childPath) {
+  const parent = resolve(String(parentPath || ""));
+  const child = resolve(String(childPath || ""));
+  const rel = relative(parent, child);
+  if (!rel) return true;
+  return !rel.startsWith("..") && rel !== "..";
+}
+
+export function ensureTestRuntimeSandbox(options = {}) {
+  if (!isTestRuntime()) return null;
+  const force = options.force === true;
+  const requestedRoot =
+    options.rootDir ||
+    process.env.BOSUN_TEST_SANDBOX_ROOT ||
+    buildDefaultSandboxRoot();
+  const context =
+    cachedSandboxContext && pathsEqual(cachedSandboxContext.sandboxRoot, requestedRoot)
+      ? cachedSandboxContext
+      : buildSandboxContext(requestedRoot);
+  cachedSandboxContext = context;
+
+  ensureSandboxFiles(context);
+
+  setEnvValue("BOSUN_TEST_SANDBOX", "1", force);
+  setEnvValue("BOSUN_TEST_SANDBOX_ROOT", context.sandboxRoot, force);
+  setEnvValue("GIT_CONFIG_GLOBAL", context.gitGlobalConfigPath, force);
+  setEnvValue("GIT_CONFIG_NOSYSTEM", "1", force);
+
+  if (force) {
+    for (const key of TEST_GIT_IDENTITY_KEYS) {
+      delete process.env[key];
+    }
+  }
+
+  return context;
+}
+
+export function getTestRuntimeSandbox() {
+  if (cachedSandboxContext) return cachedSandboxContext;
+  return ensureTestRuntimeSandbox();
+}
+
+export function isSafeTestFilesystemPath(candidatePath) {
+  if (!candidatePath) return false;
+  const sandbox = getTestRuntimeSandbox();
+  const safeRoots = [tmpdir(), sandbox?.sandboxRoot].filter(Boolean);
+  return safeRoots.some((root) => isPathInside(root, candidatePath));
+}
+
+function getGitSubcommand(args = []) {
+  const values = Array.isArray(args) ? [...args] : [];
+  for (let i = 0; i < values.length; i++) {
+    const token = String(values[i] || "").trim();
+    if (!token) continue;
+    if (token === "-C" || token === "-c" || token === "--git-dir" || token === "--work-tree") {
+      i += 1;
+      continue;
+    }
+    if (token.startsWith("-")) continue;
+    return {
+      command: token,
+      rest: values.slice(i + 1).map((value) => String(value || "").trim()),
+    };
+  }
+  return { command: "", rest: [] };
+}
+
+function isDestructiveGitArgs(args = []) {
+  const { command, rest } = getGitSubcommand(args);
+  switch (command) {
+    case "add":
+    case "am":
+    case "apply":
+      return true;
+    case "branch":
+      if (rest.some((value) => value === "--show-current" || value === "--list" || value === "-l")) {
+        return false;
+      }
+      return true;
+    case "checkout":
+    case "cherry-pick":
+    case "clean":
+    case "commit":
+    case "fetch":
+    case "merge":
+    case "pull":
+    case "push":
+    case "rebase":
+    case "reset":
+    case "restore":
+    case "stash":
+    case "switch":
+    case "tag":
+      return true;
+    case "config":
+      return !rest.includes("--get");
+    case "remote":
+      return rest.some((value) => ["add", "remove", "rm", "rename", "set-head", "set-branches", "set-url"].includes(value));
+    case "worktree":
+      return rest.some((value) => ["add", "move", "lock", "remove", "prune", "repair", "unlock"].includes(value));
+    default:
+      return false;
+  }
+}
+
+const DESTRUCTIVE_GIT_SHELL_RE =
+  /(^|[;&|]\s*)git\s+(?:-[^\s]+\s+)*(?:add|am|apply|branch(?!\s+(?:--show-current|--list|-l)\b)|checkout|cherry-pick|clean|commit|config(?!\s+--get\b)|fetch|merge|pull|push|rebase|reset|remote\s+(?:add|remove|rm|rename|set-head|set-branches|set-url)\b|restore|stash|switch|tag|worktree\s+(?:add|move|lock|remove|prune|repair|unlock)\b)/i;
+
+function isDestructiveGitShell(command) {
+  return DESTRUCTIVE_GIT_SHELL_RE.test(String(command || ""));
+}
+
+function describeGitInvocation(command, args = []) {
+  if (Array.isArray(args) && args.length > 0) {
+    return [String(command || ""), ...args.map((value) => String(value || ""))]
+      .filter(Boolean)
+      .join(" ");
+  }
+  return String(command || "").trim();
+}
+
+export function assertSafeGitMutationInTests({ command = "", args = [], cwd = process.cwd() } = {}) {
+  if (!isTestRuntime()) return;
+  const isGitBinary = /(?:^|[/\\])git(?:\.exe)?$/i.test(String(command || "").trim());
+  const destructive =
+    Array.isArray(args) && args.length > 0
+      ? isGitBinary && isDestructiveGitArgs(args)
+      : isDestructiveGitShell(command);
+  if (!destructive) return;
+  const resolvedCwd = resolve(String(cwd || process.cwd()));
+  if (isSafeTestFilesystemPath(resolvedCwd)) return;
+  throw new Error(
+    `[test-runtime] blocked destructive git command outside sandbox/temp path: ${describeGitInvocation(command, args)} (cwd: ${resolvedCwd})`,
+  );
+}
+
+export function resolvePathForTestRuntime(candidatePath, persistentPath, sandboxPath) {
+  const resolvedCandidate = resolve(String(candidatePath || ""));
+  if (!isTestRuntime()) return resolvedCandidate;
+  if (!persistentPath || !sandboxPath) return resolvedCandidate;
+  const resolvedPersistent = resolve(String(persistentPath));
+  if (!pathsEqual(resolvedCandidate, resolvedPersistent)) return resolvedCandidate;
+  ensureTestRuntimeSandbox();
+  return resolve(String(sandboxPath));
+}