botmux 3.13.0 → 3.14.0

package/dist/dashboard.js

@@ -11,7 +11,7 @@ import { logger } from './utils/logger.js';
 import { gracefulProcessExitCode } from './pm2-graceful-exit.js';
 import { config, isWildcardBindHost } from './config.js';
 import { listenWithProbe } from './utils/listen-with-probe.js';
-import { parseCookie, buildSetCookie, verifyHmac, cliAuthBind, decideDashboardAuth, loadPersistedToken, loadOrCreatePersistedToken, rotatePersistedToken, loadDashboardSecret, loadOrCreateDashboardSecret, } from './dashboard/auth.js';
+import { parseCookie, buildSetCookie, verifyHmac, cliAuthBind, decideDashboardAuth, loadPersistedToken, loadOrCreatePersistedToken, rotatePersistedToken, loadDashboardSecret, loadOrCreateDashboardSecret, describeDashboardTokenError, } from './dashboard/auth.js';
 import { DaemonRegistry, botsRosterSignature } from './dashboard/registry.js';
 import { Aggregator, subscribeDaemon } from './dashboard/aggregator.js';
 import { createSessionPresentationCoordinator } from './dashboard/session-presentation.js';
@@ -28,6 +28,8 @@ import { handleDashboardTriggerApi } from './dashboard/trigger-api.js';
 import { handleConnectorApi } from './dashboard/connector-api.js';
 import { redactGroupsForPublic, redactSchedulesForPublic, redactSessionEventForPublic, redactSessionsForPublic, redactSettingsForPublic, } from './dashboard/public-redact.js';
 import { handleWebhookRoute } from './dashboard/webhook-routes.js';
+import { handleFeedbackAnalyticsApi } from './dashboard/feedback-analytics-api.js';
+import { FeedbackAnalyticsService } from './services/feedback-analytics.js';
 import { handleFederationApi } from './dashboard/federation-api.js';
 import { buildFederatedRoster } from './services/federation-roster.js';
 import { resolveLiveBotTransport } from './services/team-roster.js';
@@ -54,6 +56,7 @@ import { detectGlobalInstallManager, formatGlobalInstallCommand, resolveGlobalIn
 import { filterCliRuntimeUpdateEntriesForTargets, listCliRuntimeUpdateEntries, selectCodexRuntimeUpdateTargets, } from './core/cli-runtime-update.js';
 import { claimRestartLease, clearRestartIntent, clearRestartLease, hasActiveRestartLease, writeManualIntentIfAbsent, writeRestartIntent, } from './services/restart-intent-store.js';
 import { withFileLock } from './utils/file-lock.js';
+import { evaluateRestartShutdownPreflight } from './cli/restart-shutdown-preflight.js';
 import { spawn } from 'node:child_process';
 import { applySettingsWrite, defaultSettingsWriteApplierDeps, hasResolvedCodexNotifierRecipient, resolveCodexNotifierRecipientView, } from './dashboard/settings-write-applier.js';
 import { addBotsToGroup, bindOncall, disbandGroup, leaveGroup, unbindOncall, } from './dashboard/groups-action-helpers.js';
@@ -61,8 +64,9 @@ import { createDaemonInternalApi } from './dashboard/daemon-internal-api.js';
 import { listTeamReports, readTeamBoard, setTeamBoardEntry } from './services/team-board-store.js';
 import { createCliAdapterSync } from './adapters/cli/registry.js';
 import { hd2dAssetPath, hd2dStatus, startHd2dDownload } from './dashboard/hd2d-assets.js';
-import { buildSkillInstallAuditSummary, installLocalSkillLinks, readSkillRegistry, removeInstalledSkill, removeInstalledSkills, updateInstalledSkillAsync, } from './services/skill-registry-store.js';
+import { buildSkillInstallAuditSummary, installLocalSkillLinks, readSkillRegistry, removeInstalledSkill, removeInstalledSkills, sweepStoreTrash, updateInstalledSkillAsync, } from './services/skill-registry-store.js';
 import { readSkillPackRegistry } from './services/skill-pack-store.js';
+import { dashboardSessionActionTimeoutMs } from './dashboard/session-action-timeout.js';
 import { cloneSkillPack, createSkillPack, deleteSkillPack, getSkillPack, listSkillPacks, updateSkillPack, SkillPackStoreError, } from './services/skill-pack-store.js';
 import { redactGitUrlCredentials } from './core/skills/sources.js';
 import { enrichPackForDashboard, enrichPacksForDashboard, sanitizeSkillForDashboard, } from './dashboard/skill-pack-response.js';
@@ -618,11 +622,19 @@ function vcMeetingConsumerProfilesApiDeps() {
                 return false;
             }
         },
-        managedSideEffectIsolation: bot => evaluateVcMeetingConsumerIsolation({
+        managedSideEffectEligible: bot => evaluateVcMeetingConsumerIsolation({
             sandbox: bot.sandbox,
             platform: process.platform,
             backendType: resolvePairedSpawnBackendType(bot.cliId ?? config.daemon.cliId, undefined, bot.backendType, config.daemon.backendType),
         }).ok,
+        sandboxIsolated: bot => {
+            const decision = evaluateVcMeetingConsumerIsolation({
+                sandbox: bot.sandbox,
+                platform: process.platform,
+                backendType: resolvePairedSpawnBackendType(bot.cliId ?? config.daemon.cliId, undefined, bot.backendType, config.daemon.backendType),
+            });
+            return decision.ok && decision.isolated;
+        },
         reloadDaemons: reloadVcMeetingBotConfigOnDaemons,
     };
 }
@@ -1898,6 +1910,7 @@ function configuredBotAgentFields() {
                 cliPathOverride: b.cliRuntime ? undefined : b.cliPathOverride,
                 wrapperCli: b.wrapperCli,
                 model: b.model,
+                reasoningEffort: b.reasoningEffort,
             }]));
     }
     catch {
@@ -1914,6 +1927,7 @@ function withConfiguredCliId(bot, ids) {
         cliPathOverride: bot.cliPathOverride || fallback?.cliPathOverride,
         wrapperCli: bot.wrapperCli || fallback?.wrapperCli,
         model: bot.model || fallback?.model,
+        reasoningEffort: bot.reasoningEffort || fallback?.reasoningEffort,
     };
 }
 function liveBots() {
@@ -2317,7 +2331,7 @@ function dashboardSkillCliIds() {
     const ids = new Set();
     // Always scan all known CLI skill dirs, not just configured bots — users may
     // want to discover codex/trae/... skills even before creating a bot for them.
-    const allCliIds = ['claude-code', 'seed', 'relay', 'aiden', 'coco', 'codex', 'codex-app', 'cursor', 'gemini', 'genius', 'opencode', 'antigravity', 'mtr', 'hermes', 'mira', 'mir', 'traex', 'pi', 'copilot', 'oh-my-pi', 'kimi', 'grok', 'kiro-cli', 'riff'];
+    const allCliIds = ['claude-code', 'seed', 'relay', 'aiden', 'coco', 'codex', 'codex-app', 'cursor', 'gemini', 'genius', 'opencode', 'opencode2', 'antigravity', 'mtr', 'hermes', 'mira', 'mir', 'traex', 'pi', 'copilot', 'oh-my-pi', 'kimi', 'grok', 'kiro-cli', 'riff', 'reasonix', 'dsh'];
     for (const cliId of allCliIds)
         ids.add(cliId);
     try {
@@ -2533,6 +2547,10 @@ const dashboardSummaryEndpoint = createDashboardSummaryEndpoint({
         logger.warn(`[dashboard-summary] live snapshot unavailable: ${error instanceof Error ? error.message : String(error)}`);
     },
 });
+let feedbackAnalyticsService;
+function analyticsService() {
+    return feedbackAnalyticsService ??= new FeedbackAnalyticsService(config.session.dataDir);
+}
 const server = createServer(async (req, res) => {
     try {
         const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
@@ -2614,6 +2632,45 @@ const server = createServer(async (req, res) => {
         if (await daemonInternalApi.handle(req, res, url)) {
             return;
         }
+        // OAuth 回调接收页（/oauth/callback）— 也在 cookie/token gate 之前：飞书
+        // authorize 跳回来的浏览器请求不带 dashboard token（redirect_uri 固定），
+        // 挡在门外用户就只能回到人肉贴 URL 的旧流程。安全面：URL 里只有一次性
+        // code + 随机 state；处理方仍要求 state 命中某个 daemon 进程的 pending
+        // 表（5 分钟过期、一次即焚）并用 app_secret 换 token——本页面自身不持有
+        // 任何敏感能力，等价于把「用户手工回贴」自动化。
+        if (req.method === 'GET' && url.pathname === '/oauth/callback') {
+            const page = (title, body, ok) => {
+                res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
+                res.end(`<!doctype html><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title><body style="font-family:system-ui;display:flex;align-items:center;justify-content:center;min-height:90vh;background:#f5f6f8"><div style="text-align:center;padding:32px 40px;background:#fff;border-radius:16px;box-shadow:0 4px 24px rgba(0,0,0,.08)"><div style="font-size:56px">${ok ? '✅' : '❌'}</div><h2 style="margin:12px 0 8px">${title}</h2><p style="color:#666;max-width:420px">${body}</p></div></body>`);
+            };
+            if (!url.searchParams.get('code') || !url.searchParams.get('state')) {
+                page('回调参数缺失', '未收到授权码。请回到 Dashboard 重新发起授权。', false);
+                return;
+            }
+            // state 只在生成链接的那个 daemon 进程内存里，逐个询问在线 daemon。
+            let outcome = null;
+            for (const d of registry.list()) {
+                try {
+                    const r = await fetchDaemonIpc(d.ipcPort, '/api/oauth-callback', {
+                        method: 'POST',
+                        headers: { 'content-type': 'application/json' },
+                        body: JSON.stringify({ url: url.toString() }),
+                    });
+                    const j = await r.json().catch(() => null);
+                    if (j?.matched) {
+                        outcome = { ok: !!j.ok, message: String(j.message ?? '') };
+                        break;
+                    }
+                }
+                catch { /* daemon offline mid-iteration — try the next */ }
+            }
+            if (!outcome) {
+                page('授权未完成', '没有找到等待中的授权请求（可能已超时，链接有效期 5 分钟）。请回到 Dashboard 重新点击授权。', false);
+                return;
+            }
+            page(outcome.ok ? '授权完成' : '授权失败', outcome.ok ? '已完成授权，本页可以关闭。回到 Dashboard 即可看到状态更新。' : outcome.message, outcome.ok);
+            return;
+        }
         // CLI rotate (HMAC + loopback only) — for `botmux dashboard rotate`.
         // Publish the new token only after a durable write succeeds.
         if (req.method === 'POST' && url.pathname === '/__cli/rotate') {
@@ -2626,7 +2683,7 @@ const server = createServer(async (req, res) => {
             }
             catch (e) {
                 logger.warn(`[dashboard] Failed to persist token to ${TOKEN_PATH}: ${e.message}`);
-                return jsonRes(res, 500, { error: 'token_persist_failed' });
+                return jsonRes(res, 500, describeDashboardTokenError('token_persist_failed', e, TOKEN_PATH));
             }
         }
         // CLI get-or-create URL (HMAC + loopback only). Existing links survive
@@ -2641,7 +2698,7 @@ const server = createServer(async (req, res) => {
             }
             catch (e) {
                 logger.warn(`[dashboard] Failed to ensure token at ${TOKEN_PATH}: ${e.message}`);
-                return jsonRes(res, 500, { error: 'token_persist_failed' });
+                return jsonRes(res, 500, describeDashboardTokenError('token_persist_failed', e, TOKEN_PATH));
             }
         }
         // CLI read current URL (HMAC + loopback only) — for start/restart hints and
@@ -2656,7 +2713,7 @@ const server = createServer(async (req, res) => {
             }
             catch (e) {
                 logger.warn(`[dashboard] Failed to read token from ${TOKEN_PATH}: ${e.message}`);
-                return jsonRes(res, 500, { error: 'token_unavailable' });
+                return jsonRes(res, 500, describeDashboardTokenError('token_unavailable', e, TOKEN_PATH));
             }
             if (!token)
                 return jsonRes(res, 404, { error: 'no_active_token' });
@@ -2723,6 +2780,10 @@ const server = createServer(async (req, res) => {
                 message: 'v2 workflow dashboard APIs are retired; use /api/v3/runs for v3 run visibility',
             });
         }
+        if (url.pathname.startsWith('/api/feedback/analytics/')) {
+            await handleFeedbackAnalyticsApi(req, res, url, { service: analyticsService() });
+            return;
+        }
         if (req.method === 'GET' && url.pathname === '/__dev/reload') {
             if (!dashboardDevReloadEnabled())
                 return jsonRes(res, 404, { error: 'dev_reload_disabled' });
@@ -3323,6 +3384,26 @@ const server = createServer(async (req, res) => {
                 return jsonRes(res, 401, { ok: false, error: 'unauthorized' });
             if (updateInFlight)
                 return jsonRes(res, 409, { ok: false, error: 'update_in_flight' });
+            // The real restart runs in a detached `botmux restart` child, whose
+            // shutdown-capability throw would only reach the maintenance-restart log
+            // — the UI would then poll a reconnect that never happens and mislabel it
+            // as "restart is slow". Detect that fail-closed boundary synchronously so
+            // we can return a precise, actionable error instead of firing a restart
+            // that is guaranteed to die silently. A read failure is non-authoritative
+            // and falls through to the existing behavior (never fabricate a block).
+            try {
+                const preflight = evaluateRestartShutdownPreflight();
+                if (preflight.bootstrapRequired) {
+                    return jsonRes(res, 409, {
+                        ok: false,
+                        error: 'bootstrap_shutdown_protocol_required',
+                        unsafeDaemons: preflight.unsafeDaemonNames,
+                    });
+                }
+            }
+            catch (error) {
+                logger.warn(`[dashboard] restart shutdown-capability preflight unavailable: ${error instanceof Error ? error.message : error}`);
+            }
             let body = {};
             try {
                 const parsed = await readJsonBody(req);
@@ -3970,7 +4051,25 @@ const server = createServer(async (req, res) => {
             const owner = aggregator.ownerOf(sid);
             if (!owner)
                 return jsonRes(res, 404, { ok: false, error: 'unknown_session' });
-            const upstream = await proxyToDaemon(owner, `/api/sessions/${sid}/${op}`, { method: 'POST' });
+            // Defensive client-side deadline: the daemon side of every op here replies
+            // promptly (close resolves its fence on the worker's flushed ACK; restart/
+            // resume/start return after a fire-and-forget IPC). Close gets a separate
+            // 60s budget because Riff's 23s remote-cancel prepare and 29s worker-kill
+            // backstop are serialized; all other actions stay bounded at 15s.
+            let upstream;
+            try {
+                upstream = await proxyToDaemon(owner, `/api/sessions/${sid}/${op}`, {
+                    method: 'POST',
+                    signal: AbortSignal.timeout(dashboardSessionActionTimeoutMs(op)),
+                });
+            }
+            catch (err) {
+                const timedOut = err?.name === 'TimeoutError' || err?.name === 'AbortError';
+                return jsonRes(res, timedOut ? 504 : 502, {
+                    ok: false,
+                    error: timedOut ? 'daemon_timeout' : (err?.message ?? String(err)),
+                });
+            }
             res.writeHead(upstream.status, { 'content-type': 'application/json' });
             res.end(await upstream.text());
             return;
@@ -4635,6 +4734,7 @@ const server = createServer(async (req, res) => {
                             : d.cliPathOverride,
                         wrapperCli: j.wrapperCli || d.wrapperCli,
                         model: j.model || d.model,
+                        reasoningEffort: j.reasoningEffort || d.reasoningEffort,
                     }, j);
                 }
                 catch (e) {
@@ -4804,6 +4904,35 @@ const server = createServer(async (req, res) => {
             res.end(await upstream.text());
             return;
         }
+        let mBotFeedback;
+        if (req.method === 'PUT' && (mBotFeedback = url.pathname.match(/^\/api\/bots\/([^/]+)\/feedback$/))) {
+            const appId = decodeURIComponent(mBotFeedback[1]);
+            const chunks = [];
+            for await (const c of req)
+                chunks.push(c);
+            const raw = Buffer.concat(chunks).toString('utf8') || '{}';
+            const upstream = await proxyToDaemon(appId, `/api/bot-feedback`, { method: 'PUT', headers: { 'content-type': 'application/json' }, body: raw });
+            res.writeHead(upstream.status, { 'content-type': 'application/json' });
+            res.end(await upstream.text());
+            return;
+        }
+        const mChatFeedback = url.pathname.match(/^\/api\/bots\/([^/]+)\/chats\/([^/]+)\/feedback$/);
+        if (req.method === 'PUT' && mChatFeedback) {
+            const chunks = [];
+            for await (const c of req)
+                chunks.push(c);
+            const upstream = await proxyToDaemon(decodeURIComponent(mChatFeedback[1]), `/api/chat-feedback/${encodeURIComponent(decodeURIComponent(mChatFeedback[2]))}`, { method: 'PUT', headers: { 'content-type': 'application/json' }, body: Buffer.concat(chunks).toString('utf8') || '{}' });
+            res.writeHead(upstream.status, { 'content-type': 'application/json' });
+            res.end(await upstream.text());
+            return;
+        }
+        const mEffectiveFeedback = url.pathname.match(/^\/api\/bots\/([^/]+)\/feedback\/effective$/);
+        if (req.method === 'GET' && mEffectiveFeedback) {
+            const upstream = await proxyToDaemon(decodeURIComponent(mEffectiveFeedback[1]), `/api/feedback-effective${url.search}`, { method: 'GET' });
+            res.writeHead(upstream.status, { 'content-type': 'application/json' });
+            res.end(await upstream.text());
+            return;
+        }
         // PUT /api/bots/:appId/env — proxy to that bot's daemon. Body
         // `{ env: string }` (raw JSON text; '' = clear).
         let mBotEnv;
@@ -5008,9 +5137,37 @@ const server = createServer(async (req, res) => {
             res.end(await upstream.text());
             return;
         }
+        // 会话群标签授权（Dashboard 一站式）：GET status / POST auth-link，
+        // 均代理到对应 bot 的 daemon（state 必须驻留在生成链接的进程内）。
+        let mBotTagAuth;
+        if (mBotTagAuth = url.pathname.match(/^\/api\/bots\/([^/]+)\/session-group-tag-(status|auth|config)$/)) {
+            const appId = decodeURIComponent(mBotTagAuth[1]);
+            const kind = mBotTagAuth[2];
+            const methodOk = (kind === 'status' && req.method === 'GET')
+                || (kind === 'auth' && req.method === 'POST')
+                || (kind === 'config' && req.method === 'PUT');
+            if (methodOk) {
+                let body;
+                if (req.method !== 'GET') {
+                    const chunks = [];
+                    for await (const c of req)
+                        chunks.push(c);
+                    body = Buffer.concat(chunks).toString('utf8') || '{}';
+                }
+                const upstream = await proxyToDaemon(appId, `/api/session-group-tag-${kind}`, {
+                    method: req.method,
+                    headers: { 'content-type': 'application/json' },
+                    ...(body !== undefined ? { body } : {}),
+                });
+                res.writeHead(upstream.status, { 'content-type': 'application/json' });
+                res.end(await upstream.text());
+                return;
+            }
+        }
         // PUT /api/bots/:appId/p2p-mode — proxy to that bot's daemon. Body
-        // `{ p2pMode: 'chat' | 'thread' }` ('thread' = per-message DM session;
-        // anything else clears back to the flat continuous chat default).
+        // `{ p2pMode: 'chat' | 'thread' | 'group' }` ('thread' = per-message DM
+        // session; 'group' = per-message dedicated session group; anything else
+        // clears back to the flat continuous chat default).
         let mBotP2pMode;
         if (req.method === 'PUT' && (mBotP2pMode = url.pathname.match(/^\/api\/bots\/([^/]+)\/p2p-mode$/))) {
             const appId = decodeURIComponent(mBotP2pMode[1]);
@@ -5027,6 +5184,25 @@ const server = createServer(async (req, res) => {
             res.end(await upstream.text());
             return;
         }
+        // PUT /api/bots/:appId/envelope-injection — proxy to that bot's daemon.
+        // Body `{ envelopeInjection: 'auto'|'off'|'' }` (''/other clears back to
+        // the inline default). #794: hook 注入 per-turn 上下文的 per-bot 开关。
+        let mBotEnvelopeInjection;
+        if (req.method === 'PUT' && (mBotEnvelopeInjection = url.pathname.match(/^\/api\/bots\/([^/]+)\/envelope-injection$/))) {
+            const appId = decodeURIComponent(mBotEnvelopeInjection[1]);
+            const chunks = [];
+            for await (const c of req)
+                chunks.push(c);
+            const raw = Buffer.concat(chunks).toString('utf8') || '{}';
+            const upstream = await proxyToDaemon(appId, `/api/bot-envelope-injection`, {
+                method: 'PUT',
+                headers: { 'content-type': 'application/json' },
+                body: raw,
+            });
+            res.writeHead(upstream.status, { 'content-type': 'application/json' });
+            res.end(await upstream.text());
+            return;
+        }
         // PUT /api/bots/:appId/skill-injection — proxy to that bot's daemon. Body
         // `{ skillInjection: 'global'|'prompt'|'off'|'' }` (''/other clears back to
         // the machine default). Governs how botmux built-in skills reach global-
@@ -5049,7 +5225,8 @@ const server = createServer(async (req, res) => {
         }
         // PUT /api/bots/:appId/grant-prefs — proxy to that bot's daemon. Body carries
         // any subset of `{ restrictGrantCommands?: boolean, autoGrantRequestCards?: boolean,
-        // messageQuotaDefaultLimit?: number|null, grantDefaultDurationMs?: number|null }`.
+        // p2pOpen?: boolean, messageQuotaDefaultLimit?: number|null,
+        // grantDefaultDurationMs?: number|null }`.
         let mBotGrantPrefs;
         if (req.method === 'PUT' && (mBotGrantPrefs = url.pathname.match(/^\/api\/bots\/([^/]+)\/grant-prefs$/))) {
             const appId = decodeURIComponent(mBotGrantPrefs[1]);
@@ -5642,6 +5819,9 @@ listenWithProbe({
         logger.warn(`[dashboard] Failed to persist port to ${PORT_PATH}: ${e.message}`);
     }
     logger.info(`[dashboard] listening on ${config.dashboard.host}:${port}`);
+    // Reclaim any `.trash-*` skill trees left by an interrupted background unlink
+    // (crash/restart mid-delete). Best-effort and fire-and-forget.
+    sweepStoreTrash();
     startPlatformTunnelIfBound();
 }).catch((err) => {
     logger.error(`[dashboard] could not bind near ${config.dashboard.host}:${config.dashboard.port} after probing — set BOTMUX_DASHBOARD_PORT to a free port. ${err.message}`);
@@ -5751,8 +5931,14 @@ function startPlatformTunnelIfBound() {
         if (!binding)
             return;
         const existingToken = currentDashboardToken();
-        loadOrCreatePersistedToken(TOKEN_PATH);
+        // An already-materialized dashboard token is sufficient to start the
+        // tunnel. Avoid re-validating its path via secureHostFilePath(): on Linux
+        // the request-time read is descriptor-pinned, while deployments whose HOME
+        // is a root-owned symlink (common on managed dev hosts) can make the
+        // path-returning helper fail even though the 0600 file is safely readable.
+        // Only the first token creation needs the path+lock helper.
         if (!existingToken) {
+            loadOrCreatePersistedToken(TOKEN_PATH);
             logger.info('[platform-tunnel] 已初始化 dashboard token');
         }
         const version = readBotmuxVersion();
@@ -5910,6 +6096,7 @@ function shutdown() {
     resourceMonitor.stop();
     platformTunnel?.stop();
     debugTerminalManager.shutdown();
+    feedbackAnalyticsService?.close();
     if (oauthCallbackServer.listening)
         oauthCallbackServer.close();
     server.close(() => process.exit(gracefulProcessExitCode()));