bosun 0.40.21 → 0.41.1

package/lib/codebase-audit.mjs

@@ -23,8 +23,6 @@ const SOURCE_TYPES = new Map([
 
 const SUMMARY_MARKERS = ["CLAUDE:SUMMARY", "BOSUN:SUMMARY"];
 const WARN_MARKERS = ["CLAUDE:WARN", "BOSUN:WARN"];
-const SUMMARY_LINE_RE = /^\s*(?:\/\/|#)\s*(?:CLAUDE|BOSUN):SUMMARY\b/i;
-const WARN_LINE_RE = /^\s*(?:\/\/|#)\s*(?:CLAUDE|BOSUN):WARN\b/i;
 const GENERATED_PATTERNS = [
   /^\.git(?:\/|$)/,
   /^node_modules(?:\/|$)/,
@@ -151,6 +149,101 @@ function getSourceType(pathValue) {
   return SOURCE_TYPES.get(extname(pathValue).toLowerCase()) || null;
 }
 
+function parseImportSpecifiers(content, language) {
+  if (language !== "javascript" && language !== "typescript") return [];
+  const specs = new Set();
+  const importRegex = /import\s+(?:[^"'`]+?\s+from\s+)?["'`]([^"'`]+)["'`]/g;
+  const dynamicImportRegex = /import\(\s*["'`]([^"'`]+)["'`]\s*\)/g;
+  const requireRegex = /require\(\s*["'`]([^"'`]+)["'`]\s*\)/g;
+  for (const pattern of [importRegex, dynamicImportRegex, requireRegex]) {
+    let match;
+    while ((match = pattern.exec(content)) !== null) {
+      if (match[1]) specs.add(match[1]);
+    }
+    pattern.lastIndex = 0;
+  }
+  return [...specs];
+}
+
+function resolveLocalImportPath(repoRoot, fromFile, specifier) {
+  if (!specifier || !specifier.startsWith(".")) return "";
+  const fromDir = dirname(fromFile);
+  const absoluteBase = resolve(fromDir, specifier);
+  const candidates = [
+    absoluteBase,
+    `${absoluteBase}.js`,
+    `${absoluteBase}.mjs`,
+    `${absoluteBase}.cjs`,
+    `${absoluteBase}.ts`,
+    `${absoluteBase}.tsx`,
+    `${absoluteBase}.jsx`,
+    resolve(absoluteBase, "index.js"),
+    resolve(absoluteBase, "index.mjs"),
+    resolve(absoluteBase, "index.cjs"),
+    resolve(absoluteBase, "index.ts"),
+    resolve(absoluteBase, "index.tsx"),
+    resolve(absoluteBase, "index.jsx"),
+  ];
+  for (const candidate of candidates) {
+    const info = safeStat(candidate);
+    if (info?.isFile()) return toPosix(relative(repoRoot, candidate));
+  }
+  return "";
+}
+
+function findCycleMembers(edgesByFile) {
+  const states = new Map();
+  const stack = [];
+  const inCycles = new Set();
+
+  function visit(node) {
+    const state = states.get(node) || 0;
+    if (state === 2) return;
+    if (state === 1) {
+      const cycleStart = stack.lastIndexOf(node);
+      if (cycleStart >= 0) {
+        for (let index = cycleStart; index < stack.length; index += 1) inCycles.add(stack[index]);
+        inCycles.add(node);
+      }
+      return;
+    }
+    states.set(node, 1);
+    stack.push(node);
+    for (const dep of edgesByFile.get(node) || []) visit(dep);
+    stack.pop();
+    states.set(node, 2);
+  }
+
+  for (const node of edgesByFile.keys()) visit(node);
+  return inCycles;
+}
+
+function appendCircularDependencyWarnings(files, repoRoot, warningKinds) {
+  const sourceSet = new Set(files.map((file) => file.path));
+  const edgesByFile = new Map();
+  for (const file of files) {
+    if (file.language !== "javascript" && file.language !== "typescript") continue;
+    const deps = [];
+    for (const specifier of file.importSpecifiers || []) {
+      const resolved = resolveLocalImportPath(repoRoot, file.absolutePath, specifier);
+      if (resolved && sourceSet.has(resolved)) deps.push(resolved);
+    }
+    edgesByFile.set(file.path, deps);
+  }
+  const cycleMembers = findCycleMembers(edgesByFile);
+  for (const file of files) {
+    if (!cycleMembers.has(file.path)) continue;
+    if (file.warnings.some((warning) => warning.kind === "circular-deps")) continue;
+    file.warnings.push({
+      kind: "circular-deps",
+      text: "Module participates in circular dependency chains; avoid reordering imports or eager top-level side effects.",
+      functionName: "__module__",
+      lineIndex: file.firstFunctionLine,
+    });
+    warningKinds["circular-deps"] = (warningKinds["circular-deps"] || 0) + 1;
+  }
+}
+
 function detectCategory(relPath) {
   if (/(^|\/)(tests?|__tests__|fixtures?|sandbox)(\/|$)|\.(test|spec)\./i.test(relPath)) return "test";
   if (/(^|\/)(config|configs)(\/|$)|(^|\/)(AGENTS|CLAUDE)\.md$/i.test(relPath)) return "config";
@@ -159,15 +252,20 @@ function detectCategory(relPath) {
   return "core";
 }
 
-function hasMarker(content, markers) {
-  const matcher = markers === SUMMARY_MARKERS ? SUMMARY_LINE_RE : WARN_LINE_RE;
-  return content.split(/\r?\n/).some((line) => matcher.test(line));
+function isAnnotationLine(line, markers) {
+  const trimmed = String(line || "").trim();
+  if (!trimmed.startsWith("//") && !trimmed.startsWith("#")) return false;
+  return markers.some((marker) => new RegExp(`\\b${marker}\\b`).test(trimmed));
 }
 
-function extractAnnotationLines(content) {
+function extractAnnotationLines(content, markers = SUMMARY_MARKERS) {
   const lines = content.split(/\r?\n/);
-  const summaryLine = lines.find((line) => SUMMARY_LINE_RE.test(line)) || "";
-  const warnLines = lines.filter((line) => WARN_LINE_RE.test(line));
+  return lines.filter((line) => isAnnotationLine(line, markers));
+}
+
+function collectAnnotations(content) {
+  const summaryLine = extractAnnotationLines(content, SUMMARY_MARKERS)[0] || "";
+  const warnLines = extractAnnotationLines(content, WARN_MARKERS);
   return { summaryLine, warnLines };
 }
 
@@ -210,7 +308,8 @@ export function scanRepository(rootDir, options = {}) {
     if (isGeneratedPath(relPath)) return;
 
     const content = readText(absolutePath);
-    const annotations = extractAnnotationLines(content);
+    const contentLines = content.split(/\r?\n/);
+    const annotations = collectAnnotations(content);
     const functionMatches = findFunctionMatches(content, sourceType.language);
     const warnings = analyzeFileWarnings(content, sourceType.language, functionMatches);
     for (const warning of warnings) {
@@ -223,12 +322,14 @@ export function scanRepository(rootDir, options = {}) {
       language: sourceType.language,
       extension: extname(absolutePath).toLowerCase(),
       comment: sourceType.comment,
-      lines: content === "" ? 0 : content.split(/\r?\n/).length,
+      lines: content === "" ? 0 : contentLines.length,
       category: detectCategory(relPath),
-      hasSummary: hasMarker(content, SUMMARY_MARKERS),
-      hasWarn: hasMarker(content, WARN_MARKERS),
+      hasSummary: annotations.summaryLine !== "",
+      hasWarn: annotations.warnLines.length > 0,
       summaryLine: annotations.summaryLine,
       warnLines: annotations.warnLines,
+      importSpecifiers: parseImportSpecifiers(content, sourceType.language),
+      firstFunctionLine: functionMatches[0]?.lineIndex ?? findInsertionIndex(contentLines),
       warnings,
     });
   }
@@ -261,6 +362,7 @@ export function scanRepository(rootDir, options = {}) {
     const relPath = toPosix(relative(repoRoot, targetDir));
     if (getSourceType(targetDir) && !isGeneratedPath(relPath)) addFile(targetDir);
   }
+  appendCircularDependencyWarnings(files, repoRoot, warningKinds);
 
   const result = {
     rootDir: repoRoot,
@@ -432,7 +534,7 @@ function hasNearbyWarn(lines, lineIndex) {
   const start = Math.max(0, lineIndex - 2);
   const end = Math.min(lines.length - 1, lineIndex + 1);
   for (let index = start; index <= end; index += 1) {
-    if (WARN_LINE_RE.test(lines[index])) return true;
+    if (isAnnotationLine(lines[index], WARN_MARKERS)) return true;
   }
   return false;
 }
@@ -447,8 +549,9 @@ export function generateWarnings(rootDir, options = {}) {
       const inserts = [];
       for (const warning of file.warnings) {
         if (hasNearbyWarn(lines, warning.lineIndex)) continue;
+        const preferredIndex = Number.isInteger(warning.lineIndex) ? warning.lineIndex : findInsertionIndex(lines);
         inserts.push({
-          index: warning.functionName ? warning.lineIndex : findInsertionIndex(lines),
+          index: warning.functionName ? preferredIndex : findInsertionIndex(lines),
           text: buildCommentLine(file.comment, "CLAUDE:WARN", warning.text),
         });
       }
@@ -618,7 +721,8 @@ function findStaleWarnings(content, language) {
   const matcher = patterns[language];
   if (!matcher) return stale;
   for (let index = 0; index < lines.length; index += 1) {
-    if (!WARN_LINE_RE.test(lines[index])) continue;
+    if (!isAnnotationLine(lines[index], WARN_MARKERS)) continue;
+    if (/circular dependency/i.test(lines[index])) continue;
     const window = lines.slice(index + 1, index + 5).join("\n");
     if (!matcher.test(window)) stale.push(index + 1);
   }
@@ -666,9 +770,21 @@ export function runConformity(rootDir, options = {}) {
 
 export function migrateAnnotations(rootDir, options = {}) {
   const scan = scanRepository(rootDir, options);
+  const migrateLegacyAnnotationMarkers = (content) =>
+    content
+      .replace(/BOSUN:SUMMARY/g, "CLAUDE:SUMMARY")
+      .replace(/BOSUN:WARN/g, "CLAUDE:WARN")
+      .replace(
+        /^(\s*(?:\/\/|#)\s*)(?:LEGACY:)?SUMMARY\s*[:\-]\s*/gim,
+        "$1CLAUDE:SUMMARY ",
+      )
+      .replace(
+        /^(\s*(?:\/\/|#)\s*)(?:LEGACY:)?WARN(?:ING)?\s*[:\-]\s*/gim,
+        "$1CLAUDE:WARN ",
+      );
   const changed = updateFiles(
-    scan.files.filter((file) => file.hasSummary || file.hasWarn),
-    (file, content) => content.replace(/BOSUN:SUMMARY/g, "CLAUDE:SUMMARY").replace(/BOSUN:WARN/g, "CLAUDE:WARN"),
+    scan.files,
+    (file, content) => migrateLegacyAnnotationMarkers(content),
     options,
   );
   return {
@@ -804,4 +920,3 @@ export async function runAuditCli(argv, io = {}) {
   const shouldFail = command === "conformity" || Boolean(flags.ci);
   return { exitCode: shouldFail && result.ok === false ? 1 : 0, result };
 }
-

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bosun",
-  "version": "0.40.21",
+  "version": "0.41.1",
   "description": "Bosun Autonomous Engineering — manages AI agent executors with failover, extremely powerful workflow builder, and a massive amount of included default workflow templates for autonomous engineering, creates PRs via Vibe-Kanban API, and sends Telegram notifications. Supports N executors with weighted distribution, multi-repo projects, and auto-setup.",
   "type": "module",
   "license": "Apache-2.0",
@@ -71,10 +71,17 @@
     "./container-runner": "./infra/container-runner.mjs",
     "./compat": "./compat.mjs",
     "./task-cli": "./task/task-cli.mjs",
+    "./task-pipeline": "./task/pipeline.mjs",
+    "./task-msg-hub": "./task/msg-hub.mjs",
+    "./workflow-cli": "./workflow/workflow-cli.mjs",
+    "./pipeline-workflows": "./workflow/pipeline-workflows.mjs",
     "./github-auth-manager": "./github/github-auth-manager.mjs",
     "./git-commit-helpers": "./git/git-commit-helpers.mjs",
     "./opencode-shell": "./shell/opencode-shell.mjs",
-    "./context-indexer": "./workspace/context-indexer.mjs"
+    "./context-indexer": "./workspace/context-indexer.mjs",
+    "./msg-hub": "./workflow/msg-hub.mjs",
+    "./declarative-workflows": "./workflow/declarative-workflows.mjs",
+    "./pipeline": "./workflow/pipeline.mjs"
   },
   "bin": {
     "bosun": "cli.mjs",
@@ -106,8 +113,10 @@
     "pretest": "npm run syntax:check",
     "test": "node --max-old-space-size=4096 node_modules/vitest/vitest.mjs run --config vitest.config.mjs",
     "test:vitest": "node --max-old-space-size=4096 node_modules/vitest/vitest.mjs run --config vitest.config.mjs",
-    "test:node": "node --test tests/*.node.test.mjs",
+    "test:node": "node --import ./tests/node-test-bootstrap.mjs --test tests/*.node.test.mjs",
     "test:all": "npm run test:vitest && npm run test:node",
+    "test:e2e": "npx playwright test server/playwright-ui-e2e.mjs",
+    "test:e2e:all": "npx playwright test server/playwright-ui-e2e.mjs server/playwright-ui-smoke.mjs",
     "test:voice-provider-smoke": "vitest run --config vitest.config.mjs tests/voice-provider-smoke.test.mjs",
     "check:native-call-parity": "vitest run --config vitest.config.mjs tests/voice-provider-smoke.test.mjs tests/native-call-parity-checklist.test.mjs",
     "test:watch": "vitest",
@@ -147,6 +156,7 @@
     "agent/agent-custom-tools.mjs",
     "agent/agent-endpoint.mjs",
     "agent/agent-event-bus.mjs",
+    "agent/retry-queue.mjs",
     "agent/agent-pool.mjs",
     "agent/agent-prompts.mjs",
     "agent/agent-sdk.mjs",
@@ -200,7 +210,8 @@
     "infra/library-manager.mjs",
     "infra/maintenance.mjs",
     "workflow/manual-flows.mjs",
-    "workflow-templates/code-quality.mjs",
+    "workflow/pipeline-workflows.mjs",
+    "workflow/workflow-cli.mjs",
     "workflow/mcp-discovery-proxy.mjs",
     "workflow/mcp-workflow-adapter.mjs",
     "workflow/mcp-registry.mjs",
@@ -222,6 +233,7 @@
     "agent/review-agent.mjs",
     "git/sdk-conflict-resolver.mjs",
     "infra/session-tracker.mjs",
+    "infra/test-runtime.mjs",
     "setup.mjs",
     "server/setup-web-server.mjs",
     "shell/pwsh-runtime.mjs",
@@ -241,7 +253,10 @@
     "task/task-claims.mjs",
     "task/task-context.mjs",
     "task/task-attachments.mjs",
+    "task/pipeline.mjs",
+    "task/msg-hub.mjs",
     "task/task-executor.mjs",
+    "task/task-executor-pipeline.mjs",
     "task/task-store.mjs",
     "telegram/telegram-bot.mjs",
     "server/ui-server.mjs",
@@ -289,6 +304,8 @@
     "workflow/workflow-engine.mjs",
     "workflow/workflow-migration.mjs",
     "workflow/workflow-nodes.mjs",
+    "workflow/workflow-nodes/custom-loader.mjs",
+    "workflow/project-detection.mjs",
     "workflow/workflow-templates.mjs",
     "workflow/workflow-contract.mjs",
     "workflow/pipeline.mjs",
@@ -303,13 +320,18 @@
     "workflow-templates/research.mjs",
     "workflow-templates/security.mjs",
     "workflow-templates/task-batch.mjs",
+    "workflow-templates/task-execution.mjs",
     "workflow-templates/task-lifecycle.mjs",
     "workflow-templates/issue-continuation.mjs",
+    "workflow-templates/continuation-loop.mjs",
+    "workflow-templates/code-quality.mjs",
     "workflow-templates/bosun-native.mjs",
     "bosun-tui.mjs",
     "tui/",
     "tools/",
-    "ui/vendor/"
+    "ui/vendor/",
+    "workflow/msg-hub.mjs",
+    "workflow/declarative-workflows.mjs"
   ],
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "latest",
@@ -327,12 +349,12 @@
     "express-rate-limit": "^8.0.0",
     "hono": "^4.12.7",
     "htm": "3.1.1",
+    "ink": "^5.0.0",
+    "ink-text-input": "^6.0.0",
     "preact": "10.25.4",
     "qrcode-terminal": "^0.12.0",
     "vibe-kanban": "latest",
-    "ws": "^8.19.0",
-    "ink": "^5.0.0",
-    "ink-text-input": "^6.0.0"
+    "ws": "^8.19.0"
   },
   "devDependencies": {
     "@emotion/react": "^11.14.0",

package/server/setup-web-server.mjs

@@ -19,6 +19,7 @@ import { fileURLToPath } from "node:url";
 import { createRequire } from "node:module";
 import { execSync } from "node:child_process";
 import { homedir } from "node:os";
+import { ensureTestRuntimeSandbox } from "../infra/test-runtime.mjs";
 import { scaffoldSkills } from "../agent/bosun-skills.mjs";
 import { ensureCodexConfig, ensureTrustedProjects } from "../shell/codex-config.mjs";
 import {
@@ -28,6 +29,7 @@ import {
   resolveWorkflowTemplateIds,
   normalizeTemplateOverridesById,
 } from "../workflow/workflow-templates.mjs";
+import { discoverTelegramChats } from "../telegram/get-telegram-chat-id.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -1420,6 +1422,9 @@ function resolveConfigDir() {
     if (isExpectedHome) return cwd;
   }
 
+  const sandbox = ensureTestRuntimeSandbox();
+  if (sandbox?.configDir) return sandbox.configDir;
+
   const preferWindowsDirs =
     process.platform === "win32" && !isWslInteropRuntime();
   const baseDir = preferWindowsDirs
@@ -1977,6 +1982,20 @@ function handleValidate(body) {
   return { ok: true, valid: Object.keys(errors).length === 0, errors };
 }
 
+async function handleTelegramChatIdLookup(body) {
+  const token = String(body?.token || "").trim();
+  if (!token) {
+    return { ok: false, status: 400, error: "TELEGRAM_BOT_TOKEN is required" };
+  }
+
+  try {
+    const { chats, message } = await discoverTelegramChats(token);
+    return { ok: true, status: 200, chats, message };
+  } catch (err) {
+    return { ok: false, status: 500, error: err.message || String(err) };
+  }
+}
+
 function handleApply(body) {
   try {
     const { env = {}, configJson = {} } = body || {};
@@ -2575,6 +2594,15 @@ async function handleRequest(req, res) {
           }
           jsonResponse(res, 200, handleValidate(await readBody(req)));
           return;
+        case "telegram-chat-id": {
+          if (req.method !== "POST") {
+            jsonResponse(res, 405, { ok: false, error: "POST required" });
+            return;
+          }
+          const result = await handleTelegramChatIdLookup(await readBody(req));
+          jsonResponse(res, result.status, result);
+          return;
+        }
         case "apply":
           if (req.method !== "POST") {
             jsonResponse(res, 405, { ok: false, error: "POST required" });
@@ -2980,6 +3008,7 @@ export async function startSetupServer(options = {}) {
 export {
   applyTelegramMiniAppSetupEnv,
   applyNonBlockingSetupEnvDefaults,
+  handleTelegramChatIdLookup,
   normalizeWorkflowTemplateOverrides,
   normalizeTelegramUiPort,
   normalizeRepoConfigEntry,
@@ -2995,4 +3024,3 @@ if (process.argv[1] && resolve(process.argv[1]) === resolve(__filename_setup_web
     process.exit(1);
   });
 }
-