onbuzz 4.0.1 → 4.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "onbuzz",
-  "version": "4.0.1",
+  "version": "4.0.2",
   "description": "Loxia OnBuzz - Your AI Fleet",
   "type": "module",
   "main": "src/index.js",

package/src/core/__tests__/messageProcessor.sourceHeader.test.js

@@ -0,0 +1,195 @@
+/**
+ * MessageProcessor — source-header injection.
+ *
+ * Contract:
+ *   When a user message arrives carrying a `context.source` produced by
+ *   services/messageSource.js (Discord / Telegram ingress), the message
+ *   content queued on the agent is prefixed with a parenthesized
+ *   attribution line:
+ *
+ *       (Message by alice from Discord > MyGuild > #ops)
+ *       hi is anyone there?
+ *
+ *   The source object itself is also preserved on the queued message for
+ *   downstream consumers (relays, logs). Re-invocation with a message that
+ *   already carries the header is idempotent.
+ *
+ * These tests mock agentPool but exercise the real prependSourceHeader +
+ * createDiscordSource / createTelegramSource paths so the contract is
+ * verified end-to-end through the processMessage boundary.
+ */
+
+import { jest, describe, test, expect, beforeEach } from '@jest/globals';
+import { createMockLogger, createMockConfig, createMockAiService } from '../../__test-utils__/mockFactories.js';
+
+jest.unstable_mockModule('../../services/visualEditorBridge.js', () => ({
+  getVisualEditorBridge: jest.fn(() => ({
+    isEnabled: () => false,
+    hasInstance: () => false,
+  })),
+  InstanceStatus: { IDLE: 'idle', RUNNING: 'running', ERROR: 'error' },
+}));
+
+jest.unstable_mockModule('../../utilities/tagParser.js', () => ({
+  default: jest.fn().mockImplementation(() => ({
+    extractToolCommands: jest.fn().mockReturnValue([]),
+    normalizeToolCommand: jest.fn((c) => c),
+    extractAgentRedirects: jest.fn().mockReturnValue([]),
+    parseXMLParameters: jest.fn().mockReturnValue({}),
+    decodeHtmlEntities: jest.fn((s) => s),
+  })),
+}));
+
+jest.unstable_mockModule('../../tools/visualEditorTool.js', () => ({
+  VisualEditorTool: { injectContextIntoMessage: jest.fn((msg) => msg) },
+}));
+
+// Import the REAL messageSource factories — this is intentional. The
+// integration value of these tests is the end-to-end contract between the
+// source module and the processor.
+const { createDiscordSource, createTelegramSource, createWebSource } =
+  await import('../../services/messageSource.js');
+const { default: MessageProcessor } = await import('../messageProcessor.js');
+
+function makeMP() {
+  const config = createMockConfig();
+  const logger = createMockLogger();
+  const agentPool = {
+    getAgent: jest.fn().mockResolvedValue({
+      id: 'agent-1',
+      name: 'TestAgent',
+      mode: 'chat',
+      conversations: { full: { messages: [] } },
+      messageQueues: { userMessages: [], interAgentMessages: [], toolResults: [] },
+    }),
+    addUserMessage: jest.fn().mockResolvedValue(undefined),
+    addInterAgentMessage: jest.fn().mockResolvedValue(undefined),
+  };
+  const contextManager = { getContext: jest.fn() };
+  const mp = new MessageProcessor(
+    config, logger, { getTool: jest.fn() }, agentPool, contextManager, createMockAiService()
+  );
+  return { mp, agentPool };
+}
+
+describe('MessageProcessor — source header injection', () => {
+  let mp, agentPool;
+  beforeEach(() => {
+    jest.clearAllMocks();
+    ({ mp, agentPool } = makeMP());
+  });
+
+  test('Discord guild message → content prefixed with attribution line', async () => {
+    const source = createDiscordSource({
+      id: 'm1',
+      author: { id: 'u1', username: 'alice' },
+      guild: { id: 'g1', name: 'MyGuild' },
+      channel: { id: 'c1', name: 'ops', isThread: () => false },
+    });
+
+    await mp.processMessage('agent-1', 'hi is anyone there?', {
+      sessionId: 'discord-g1-c1',
+      source,
+    });
+
+    expect(agentPool.addUserMessage).toHaveBeenCalledTimes(1);
+    const [, queued] = agentPool.addUserMessage.mock.calls[0];
+    expect(queued.content).toBe(
+      '(Message by alice from Discord > MyGuild > #ops)\nhi is anyone there?'
+    );
+    // Source is also preserved structurally for downstream consumers.
+    expect(queued.source).toBe(source);
+    expect(queued.role).toBe('user');
+  });
+
+  test('Telegram private message → Telegram > DM attribution', async () => {
+    const source = createTelegramSource({
+      message_id: 1,
+      chat: { id: 42, type: 'private' },
+      from: { id: 7, username: 'alice' },
+    });
+
+    await mp.processMessage('agent-1', 'status?', {
+      sessionId: 'telegram-42',
+      source,
+    });
+
+    const [, queued] = agentPool.addUserMessage.mock.calls[0];
+    expect(queued.content).toBe('(Message by alice from Telegram > DM)\nstatus?');
+    expect(queued.source).toBe(source);
+  });
+
+  test('Discord thread message → parent + thread path in header', async () => {
+    const source = createDiscordSource({
+      id: 'm2',
+      author: { username: 'alice' },
+      guild: { id: 'g', name: 'MyGuild' },
+      channel: {
+        id: 't1', name: 'deploy-thread',
+        parentId: 'c1', parent: { name: 'ops' },
+        isThread: () => true,
+      },
+    });
+
+    await mp.processMessage('agent-1', 'deploy status?', { sessionId: 's', source });
+
+    const [, queued] = agentPool.addUserMessage.mock.calls[0];
+    expect(queued.content).toBe(
+      '(Message by alice from Discord > MyGuild > #ops > deploy-thread)\ndeploy status?'
+    );
+  });
+
+  test('no source on context → content passes through untouched', async () => {
+    await mp.processMessage('agent-1', 'raw input', { sessionId: 's' });
+    const [, queued] = agentPool.addUserMessage.mock.calls[0];
+    expect(queued.content).toBe('raw input');
+    expect(queued.source).toBeNull();
+  });
+
+  test('web source → no header (web UI interactions stay clean)', async () => {
+    const source = createWebSource({ sessionId: 'web-1', userName: 'operator' });
+    await mp.processMessage('agent-1', 'hello', { sessionId: 'web-1', source });
+
+    const [, queued] = agentPool.addUserMessage.mock.calls[0];
+    expect(queued.content).toBe('hello');
+    expect(queued.source).toBe(source);  // structurally preserved even when no header rendered
+  });
+
+  test('idempotency — re-processing a message that already has the header does not double-prefix', async () => {
+    const source = createDiscordSource({
+      author: { username: 'alice' },
+      guild: { name: 'MyGuild' },
+      channel: { id: 'c', name: 'ops', isThread: () => false },
+    });
+
+    // First call — fresh content gets prefixed.
+    await mp.processMessage('agent-1', 'hi', { source });
+    const firstContent = agentPool.addUserMessage.mock.calls[0][1].content;
+    expect(firstContent.startsWith('(Message by alice')).toBe(true);
+
+    // Second call — pass the ALREADY-prefixed content back through (as
+    // would happen on replay / state-restore paths). The header must not
+    // be duplicated.
+    jest.clearAllMocks();
+    ({ mp, agentPool } = makeMP());
+    await mp.processMessage('agent-1', firstContent, { source });
+    const secondContent = agentPool.addUserMessage.mock.calls[0][1].content;
+    expect(secondContent).toBe(firstContent);
+    // i.e. not "(Message by alice ...)\n(Message by alice ...)\nhi"
+    const headerCount = (secondContent.match(/\(Message by alice/g) || []).length;
+    expect(headerCount).toBe(1);
+  });
+
+  test('unknown user fallback keeps the header well-formed', async () => {
+    const source = createDiscordSource({
+      // no author
+      guild: { name: 'G' },
+      channel: { id: 'c', name: 'general', isThread: () => false },
+    });
+    await mp.processMessage('agent-1', 'ping', { source });
+    const [, queued] = agentPool.addUserMessage.mock.calls[0];
+    expect(queued.content).toBe(
+      '(Message by unknown user from Discord > G > #general)\nping'
+    );
+  });
+});

package/src/core/messageProcessor.js

@@ -12,6 +12,7 @@ import TagParser from '../utilities/tagParser.js';
 import { TOOL_IDS, COMMAND_FORMATS } from '../utilities/toolConstants.js';
 import { getVisualEditorBridge } from '../services/visualEditorBridge.js';
 import { VisualEditorTool } from '../tools/visualEditorTool.js';
+import { prependSourceHeader } from '../services/messageSource.js';
 
 class MessageProcessor {
   constructor(config, logger, toolsRegistry, agentPool, contextManager, aiService, modelRouterService = null, modelsService = null) {
@@ -132,6 +133,18 @@ class MessageProcessor {
         this.logger.warn?.(`Failed to inject visual context: ${err.message}`);
       }
 
+      // Prepend the source attribution header when the message arrived from
+      // an external channel (Discord / Telegram). The header is plain text
+      // of the form "(Message by alice from Discord > MyGuild > #ops)" and
+      // becomes part of the persisted content, so the agent sees it in its
+      // LLM context and the operator sees it in the web-UI transcript. The
+      // operation is idempotent — re-serialization (state restore, replay)
+      // won't double-prefix. Sources of kind web/api/internal produce no
+      // header and leave the content untouched. See services/messageSource.js.
+      if (context.source) {
+        enhancedMessage = prependSourceHeader(enhancedMessage, context.source);
+      }
+
       await this.agentPool.addUserMessage(agentId, {
         content: enhancedMessage,
         role: 'user',
@@ -140,6 +153,10 @@ class MessageProcessor {
         sessionId: context.sessionId,
         visualContextInjected,
         streamingEnabled: context.streamingEnabled !== false, // Pass streaming preference from context
+        // Preserve the structured source on the queued message too, so any
+        // downstream consumer (logs, analytics, relay) can reason about
+        // provenance without re-parsing the inline header.
+        source: context.source || null,
         // Flow execution context (if this message is part of a flow)
         isFlowExecution: context.isFlowExecution || false,
         flowRunId: context.flowRunId,

package/src/core/orchestrator.js

@@ -388,7 +388,7 @@ class Orchestrator {
    * @private
    */
   async _handleSendMessage(request) {
-    const { agentId, message, mode, contextReferences, apiKey, customApiKeys, streamingEnabled } = request.payload;
+    const { agentId, message, mode, contextReferences, apiKey, customApiKeys, streamingEnabled, source } = request.payload;
 
     const context = {
       projectDir: request.projectDir,
@@ -398,7 +398,11 @@ class Orchestrator {
       contextReferences: contextReferences || [],
       apiKey: apiKey, // Pass Loxia API key through context
       customApiKeys: customApiKeys || {}, // Pass custom API keys through context
-      streamingEnabled: streamingEnabled !== false // Default to true if not specified
+      streamingEnabled: streamingEnabled !== false, // Default to true if not specified
+      // Provenance metadata from the inbound adapter (Discord/Telegram/…).
+      // Preserved verbatim by messageProcessor and agentPool so the agent
+      // can see where the message came from. See services/messageSource.js.
+      source: source || null,
     };
 
     return await this.routeToAgent(agentId, message, context);

package/src/interfaces/webServer.js

@@ -4862,6 +4862,32 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
       }
     });
 
+    // DEBUG: manually fire a `visual_editor_open` broadcast so the UI's
+    // panel-open path can be tested independently of the agent tool path.
+    // Exercised via: POST /api/visual-editor/debug-broadcast  { agentId, appUrl }.
+    // This isolates the two failure surfaces when open-editor doesn't work —
+    // either the backend never emits the WS event (bug in the tool / context /
+    // webServer wiring) or the UI never reacts to it (bug in store / hook).
+    this.app.post('/api/visual-editor/debug-broadcast', async (req, res) => {
+      const { agentId, appUrl, editorUrl } = req.body || {};
+      if (!agentId || !appUrl) {
+        return res.status(400).json({ success: false, error: 'agentId and appUrl are required' });
+      }
+      try {
+        this.broadcastToSession(null, {
+          type: 'visual_editor_open',
+          data: {
+            agentId,
+            appUrl,
+            editorUrl: editorUrl || `http://localhost:4000?agentId=${agentId}&appUrl=${encodeURIComponent(appUrl)}`
+          }
+        });
+        res.json({ success: true, message: 'visual_editor_open broadcast to all connections' });
+      } catch (err) {
+        res.status(500).json({ success: false, error: err.message });
+      }
+    });
+
     // Disconnect agent from visual editor (server keeps running)
     this.app.post('/api/visual-editor/stop', async (req, res) => {
       try {

package/src/services/__tests__/messageSource.channelFilter.coherence.test.js

@@ -0,0 +1,101 @@
+/**
+ * Cross-module coherence: the aliases emitted by messageSource factories
+ * must compose correctly with channelFilter.resolveBlockTargets.
+ *
+ * This is the single test that catches "we renamed the alias format on one
+ * side of the fence and forgot the other side" — the exact kind of quiet
+ * drift that turns source-awareness back into a ghost feature.
+ *
+ * The agent's contract is:
+ *   1. Read an attribution header like "(Message by alice from Discord > G > #ops)".
+ *   2. Look up the corresponding alias in the bridged-channels list it was given.
+ *   3. Write <external to="<alias>">…</external>.
+ *   4. The relay resolves that back to the concrete channel and sends the reply.
+ *
+ * Step 2 resolves to messageSource's alias output. Step 4 resolves through
+ * channelFilter.resolveBlockTargets. These tests assert the two agree.
+ */
+
+import { describe, test, expect } from '@jest/globals';
+import {
+  createDiscordSource,
+  createTelegramSource,
+} from '../messageSource.js';
+import { resolveBlockTargets } from '../channelFilter.js';
+
+describe('messageSource ↔ channelFilter alias coherence', () => {
+  test('Discord guild alias resolves when the agent addresses it verbatim', () => {
+    const src = createDiscordSource({
+      author: { username: 'alice' },
+      guild: { name: 'MyGuild' },
+      channel: { id: 'c1', name: 'ops', isThread: () => false },
+    });
+
+    // The relay advertises bridged aliases in the same shape messageSource
+    // produces (both use `discord:#<name>`). Lock it in.
+    const ownedAliases = [src.alias];
+    const block = { to: [src.alias], text: 'reply' };
+
+    expect(resolveBlockTargets(block, ownedAliases)).toEqual([src.alias]);
+  });
+
+  test('agent can use shorthand (#ops) and it still resolves via substring match', () => {
+    const src = createDiscordSource({
+      author: { username: 'alice' },
+      guild: { name: 'MyGuild' },
+      channel: { id: 'c1', name: 'ops', isThread: () => false },
+    });
+    // Agent sees "#ops" in the header path, writes a short `to="#ops"`.
+    // channelFilter's substring match should still find the canonical alias.
+    const block = { to: ['#ops'], text: 'reply' };
+    expect(resolveBlockTargets(block, [src.alias])).toEqual([src.alias]);
+  });
+
+  test('guild-prefixed owned alias matches when agent addresses via channel shorthand', () => {
+    // The relay may advertise a guild-qualified alias (`discord:guild-123:#ops`)
+    // while the agent, reading the header path "Discord > MyGuild > #ops",
+    // writes the natural short form `to="#ops"`. channelFilter's endsWith
+    // path is what makes this pair compose — this locks that in.
+    const ownedAliases = ['discord:guild-123:#ops'];
+    const block = { to: ['#ops'], text: 'reply' };
+    expect(resolveBlockTargets(block, ownedAliases)).toEqual(ownedAliases);
+  });
+
+  test('Telegram per-chat alias routes when owned alias set advertises it', () => {
+    const src = createTelegramSource({
+      message_id: 1,
+      chat: { id: 999, type: 'supergroup', title: 'Ops' },
+      from: { username: 'alice' },
+    });
+    const ownedAliases = [src.alias, 'telegram'];
+    const block = { to: [src.alias], text: 'reply' };
+    expect(resolveBlockTargets(block, ownedAliases)).toContain(src.alias);
+  });
+
+  test('Telegram per-chat source alias DOES NOT wildcard-match bare owned "telegram"', () => {
+    // Regression guard on a tempting mistake. channelFilter matches "owned
+    // contains wanted", not the reverse. If the relay owns only 'telegram',
+    // an agent addressing `to="telegram:chat-999"` will NOT be routed there
+    // — by design. The agent is expected to use the alias advertised in its
+    // bridged-channel list (the system-prompt contract), not to invent
+    // narrower aliases from the header. Locking this in prevents accidental
+    // bidirectional-substring loosening of channelFilter later.
+    const src = createTelegramSource({
+      message_id: 1,
+      chat: { id: 999, type: 'supergroup', title: 'Ops' },
+      from: { username: 'alice' },
+    });
+    const ownedAliases = ['telegram'];
+    const block = { to: [src.alias], text: 'reply' };
+    expect(resolveBlockTargets(block, ownedAliases)).toEqual([]);
+  });
+
+  test('default block (no to=) still broadcasts to every owned alias', () => {
+    // Regression guard: adding source-awareness must not change the meaning
+    // of an unaddressed <external> block. It remains "broadcast to every
+    // bridged channel," exactly as before.
+    const block = { to: null, text: 'broadcast' };
+    const owned = ['discord:#ops', 'telegram'];
+    expect(resolveBlockTargets(block, owned).sort()).toEqual(owned.sort());
+  });
+});