onbuzz 4.10.0 → 5.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "onbuzz",
-  "version": "4.10.0",
+  "version": "5.0.0",
   "description": "Loxia OnBuzz - Your AI Fleet",
   "type": "module",
   "main": "src/index.js",

package/src/core/__tests__/agentPool.test.js

@@ -94,6 +94,18 @@ describe('AgentPool', () => {
       expect(agent.mode).toBe('agent');
     });
 
+    test('defaults skills to [] when config omits them', async () => {
+      const agent = await pool.createAgent(agentCfg());
+      expect(agent.skills).toEqual([]);
+    });
+
+    test('stores skill names from config.skills', async () => {
+      // Marketplace install wires an agent to its (already-installed)
+      // skills by NAME via config.skills — verify the pool persists them.
+      const agent = await pool.createAgent(agentCfg({ skills: ['code-review', 'research'] }));
+      expect(agent.skills).toEqual(['code-review', 'research']);
+    });
+
     test('initializes model-specific conversation for preferredModel', async () => {
       const agent = await pool.createAgent(agentCfg({ preferredModel: 'gpt-4' }));
       expect(agent.conversations['gpt-4']).toBeDefined();

package/src/core/__tests__/agentScheduler.errorCategorisation.test.js

@@ -77,10 +77,29 @@ const errorClasses = [
   { name: 'network ETIMEDOUT',       msg: 'connect ETIMEDOUT', expectBroadcast: false, label: 'network-error' },
   { name: 'network ENOTFOUND',       msg: 'getaddrinfo ENOTFOUND api.foo', expectBroadcast: false, label: 'network-error' },
   { name: 'fetch failed',            msg: 'fetch failed', expectBroadcast: false, label: 'network-error' },
-  // -- PERSISTENT (broadcast) --
+  // -- PERSISTENT: real LLM-PROVIDER key failures → api-key-error --
+  // These MUST keep pausing the agent with "check your API key", because
+  // they genuinely are key problems. Each is a real provider signature.
   { name: 'auth: API key',           msg: 'Invalid API key provided',           expectBroadcast: true, label: 'api-key-error' },
   { name: 'auth: 401',               msg: 'HTTP 401 Unauthorized',              expectBroadcast: true, label: 'api-key-error' },
-  { name: 'auth: 403',               msg: 'HTTP 403 Forbidden',                  expectBroadcast: true, label: 'api-key-error' },
+  { name: 'auth: Anthropic x-api-key', msg: 'authentication_error: invalid x-api-key', expectBroadcast: true, label: 'api-key-error' },
+  { name: 'auth: OpenAI incorrect',  msg: 'Incorrect API key provided: sk-***. You can find your API key at https://...', expectBroadcast: true, label: 'api-key-error' },
+  { name: 'auth: OpenAI code',       msg: 'invalid_api_key', expectBroadcast: true, label: 'api-key-error' },
+  { name: 'auth: api_key underscore', msg: 'request failed: api_key missing or invalid', expectBroadcast: true, label: 'api-key-error' },
+
+  // -- PROOF of Fix #3 (the narrowing): these used to be MISCLASSIFIED as
+  // api-key-error and paused the agent with misleading "check your API key"
+  // guidance. They are ordinary TOOL/permission errors (a Composio action
+  // returning 403/forbidden because a third-party app isn't connected).
+  // They must NO LONGER be api-key-error. They still surface as a persistent
+  // unknown (server-error → broadcast) so the user sees the real problem,
+  // but the agent is NOT told its LLM key is bad.
+  { name: 'composio 403 forbidden',  msg: 'Composio execute failed: HTTP 403 Forbidden — GMAIL app is not connected for this user', expectBroadcast: true, label: 'server-error' },
+  { name: 'composio forbidden text', msg: 'Tool error: forbidden — missing scope gmail.send', expectBroadcast: true, label: 'server-error' },
+  { name: 'bare unauthorized',       msg: 'The resource returned unauthorized access', expectBroadcast: true, label: 'server-error' },
+  { name: 'generic authentication',  msg: 'Slack authentication failed for the workspace', expectBroadcast: true, label: 'server-error' },
+
+  // -- PERSISTENT: genuinely unknown → server-error --
   { name: 'unknown: random 500',     msg: 'Random 500 Internal Server Error from the AI', expectBroadcast: true, label: 'server-error' },
   { name: 'unknown: weird shape',    msg: 'Provider returned malformed JSON',   expectBroadcast: true, label: 'server-error' },
 ];

package/src/core/__tests__/agentScheduler.toolFeedbackLoop.test.js

@@ -0,0 +1,209 @@
+/**
+ * PROOF TESTS for the silent tool-execution death-loop.
+ *
+ * Reproduced from export Coder-Spark-2445 (2026-06-08): an agent asked to
+ * read Gmail emitted the IDENTICAL `find-action` + `connection-status`
+ * Composio calls six turns in a row and never progressed. Forensics on the
+ * export:
+ *   - every assistant turn carried `pendingToolExecution: true`
+ *   - `messageQueues.toolResults` was EMPTY (0 items)
+ *   - no `toolResults` were ever attached to any turn
+ *   - prompt tokens stayed flat (~42.5k→43.3k) — no results re-entered context
+ *   - 0/6 assistant messages had a structured `toolCalls` array; the calls
+ *     lived inside `content` as bridged ```json {"toolId",...}``` blocks
+ *
+ * Two defects produced and sustained the loop, both covered here:
+ *
+ *   Defect B — a turn flagged `pendingToolExecution:true` whose execution
+ *   produced ZERO results was left stuck forever with no feedback. The fix
+ *   (`_recoverStuckPendingToolMessage`) clears the flag and queues a
+ *   diagnostic so the agent gets unblocked.
+ *
+ *   Defect C — loop detection keyed tool-call repetition on the structured
+ *   `m.toolCalls` array only, so content-embedded (bridged) tool calls were
+ *   invisible — exactly this agent's path. The fix
+ *   (`_extractToolSignaturesFromContent` + content-aware hashing) makes the
+ *   detector see them.
+ *
+ * (Defect A — surfacing swallowed execution errors instead of returning [] —
+ * is proven in messageProcessor.test.js.)
+ */
+import { jest, describe, test, expect, beforeEach } from '@jest/globals';
+import { createMockLogger } from '../../__test-utils__/mockFactories.js';
+
+const mockShouldAgentBeActive = jest.fn(() => ({ active: false, reason: 'idle' }));
+const mockGetActiveAgents = jest.fn(() => []);
+const mockShouldSkipIteration = jest.fn(() => false);
+jest.unstable_mockModule('../../services/agentActivityService.js', () => ({
+  shouldAgentBeActive: mockShouldAgentBeActive,
+  getActiveAgents: mockGetActiveAgents,
+  shouldSkipIteration: mockShouldSkipIteration,
+}));
+
+const { default: AgentScheduler } = await import('../agentScheduler.js');
+
+// The EXACT bridged tool-call content the export's agent emitted each turn
+// (`autopilot-backend` toolCallBridge → CLI inline-JSON form).
+function bridgedBlock(toolId, params) {
+  return `\n**Calling ${toolId}**\n\n` +
+    '```json\n' + JSON.stringify({ toolId, parameters: params }, null, 2) + '\n```\n';
+}
+const FIND_ACTION = bridgedBlock('composio', { actions: [{ type: 'find-action', query: 'read gmail emails inbox', topK: 5 }] });
+const CONNECTION_STATUS = bridgedBlock('composio', { actions: [{ type: 'connection-status', toolkitSlug: 'gmail' }] });
+const STUCK_TURN_CONTENT = FIND_ACTION + CONNECTION_STATUS;
+
+function makeScheduler() {
+  const logger = createMockLogger();
+  const agentPool = {
+    getAgent: jest.fn(),
+    persistAgentState: jest.fn().mockResolvedValue(undefined),
+  };
+  const scheduler = new AgentScheduler(agentPool, {}, { abortRequest: jest.fn() }, logger);
+  return { scheduler, agentPool, logger };
+}
+
+function makeAgent(messages) {
+  return {
+    id: 'a1',
+    conversations: {
+      full: { messages, lastUpdated: null },
+      'Kimi-K2.6': { messages, lastUpdated: null },
+    },
+    messageQueues: { toolResults: [], interAgentMessages: [], userMessages: [] },
+  };
+}
+
+beforeEach(() => jest.clearAllMocks());
+
+describe('Defect C — loop detection sees content-embedded (bridged) tool calls', () => {
+  test('_extractToolSignaturesFromContent parses the exact stuck-turn content', () => {
+    const { scheduler } = makeScheduler();
+    const sigs = scheduler._extractToolSignaturesFromContent(STUCK_TURN_CONTENT);
+    expect(sigs).toHaveLength(2);
+    expect(sigs.every(s => s.startsWith('composio:'))).toBe(true);
+    expect(sigs[0]).toContain('find-action');
+    expect(sigs[1]).toContain('connection-status');
+  });
+
+  test('returns [] for plain prose and never throws on junk', () => {
+    const { scheduler } = makeScheduler();
+    expect(scheduler._extractToolSignaturesFromContent('just talking, no tools')).toEqual([]);
+    expect(scheduler._extractToolSignaturesFromContent(null)).toEqual([]);
+    expect(scheduler._extractToolSignaturesFromContent(42)).toEqual([]);
+  });
+
+  test('produces a stable per-toolId signature even with unusual param ordering', () => {
+    const { scheduler } = makeScheduler();
+    const sigs = scheduler._extractToolSignaturesFromContent('{"toolId":"gmail","other":1}');
+    expect(sigs).toHaveLength(1);
+    expect(sigs[0].startsWith('gmail:')).toBe(true);
+    // Same content → same signature (repetition is detectable).
+    expect(scheduler._extractToolSignaturesFromContent('{"toolId":"gmail","other":1}')).toEqual(sigs);
+  });
+
+  test('state hash reflects the bridged tool call even when visible prose is identical & truncated', () => {
+    // THE regression: two turns whose first 500 prose chars are identical but
+    // whose embedded tool call differs. Old detection (output-truncated +
+    // structured-toolCalls-only) hashed them the same → blind. Content-aware
+    // hashing must now distinguish them.
+    const { scheduler } = makeScheduler();
+    const prose = 'x'.repeat(520); // exceeds the 500-char output window
+    const turnA = { role: 'assistant', content: prose + FIND_ACTION };       // no .toolCalls array
+    const turnB = { role: 'assistant', content: prose + CONNECTION_STATUS };
+
+    const hashA = scheduler.generateAgentStateHash(makeAgent([turnA]));
+    const hashB = scheduler.generateAgentStateHash(makeAgent([turnB]));
+    expect(hashA).not.toBe(hashB);
+
+    // And two IDENTICAL stuck turns hash the same — so repetition is detected.
+    const hash1 = scheduler.generateAgentStateHash(makeAgent([{ role: 'assistant', content: prose + FIND_ACTION }]));
+    expect(hash1).toBe(hashA);
+  });
+});
+
+describe('Defect B — a flagged turn with zero results is unstuck, not left to loop', () => {
+  test('clears stuck pendingToolExecution AND queues a diagnostic when content had tool calls', async () => {
+    const { scheduler, agentPool } = makeScheduler();
+    const msg = { id: 'ai-response-1', role: 'assistant', content: STUCK_TURN_CONTENT, pendingToolExecution: true };
+    const agent = makeAgent([msg]);
+    agentPool.getAgent.mockResolvedValue(agent);
+
+    const recovered = await scheduler._recoverStuckPendingToolMessage('a1', 'ai-response-1', STUCK_TURN_CONTENT);
+
+    expect(recovered).toBe(true);
+    // Flag cleared in BOTH conversation buckets.
+    expect(agent.conversations.full.messages[0].pendingToolExecution).toBe(false);
+    expect(agent.conversations['Kimi-K2.6'].messages[0].pendingToolExecution).toBe(false);
+    // A diagnostic tool-result is queued so the next turn gives the agent feedback.
+    expect(agent.messageQueues.toolResults).toHaveLength(1);
+    const diag = agent.messageQueues.toolResults[0];
+    expect(diag.status).toBe('failed');
+    expect(diag.result).toMatch(/TOOL NOT EXECUTED/);
+    expect(agentPool.persistAgentState).toHaveBeenCalledWith('a1');
+  });
+
+  test('clears the flag but does NOT nag when the turn was plain text (no tool calls)', async () => {
+    const { scheduler, agentPool } = makeScheduler();
+    const msg = { id: 'ai-response-2', role: 'assistant', content: 'All done, here is your summary.', pendingToolExecution: true };
+    const agent = makeAgent([msg]);
+    agentPool.getAgent.mockResolvedValue(agent);
+
+    const recovered = await scheduler._recoverStuckPendingToolMessage('a1', 'ai-response-2', msg.content);
+
+    expect(recovered).toBe(true);
+    expect(agent.conversations.full.messages[0].pendingToolExecution).toBe(false);
+    expect(agent.messageQueues.toolResults).toHaveLength(0); // no false-alarm diagnostic
+  });
+
+  test('no-op when the message is not pending or not found', async () => {
+    const { scheduler, agentPool } = makeScheduler();
+    const agent = makeAgent([{ id: 'ai-response-3', role: 'assistant', content: STUCK_TURN_CONTENT, pendingToolExecution: false }]);
+    agentPool.getAgent.mockResolvedValue(agent);
+
+    expect(await scheduler._recoverStuckPendingToolMessage('a1', 'ai-response-3', STUCK_TURN_CONTENT)).toBe(false);
+    expect(await scheduler._recoverStuckPendingToolMessage('a1', 'does-not-exist', STUCK_TURN_CONTENT)).toBe(false);
+    expect(agent.messageQueues.toolResults).toHaveLength(0);
+  });
+
+  test('returns false (no throw) when responseMessageId is missing or agent absent', async () => {
+    const { scheduler, agentPool } = makeScheduler();
+    expect(await scheduler._recoverStuckPendingToolMessage('a1', null, 'x')).toBe(false);
+    agentPool.getAgent.mockResolvedValue(null);
+    expect(await scheduler._recoverStuckPendingToolMessage('a1', 'ai-response-x', 'x')).toBe(false);
+  });
+
+  test('swallows internal errors and returns false (never throws into the caller)', async () => {
+    const { scheduler, agentPool, logger } = makeScheduler();
+    const agent = makeAgent([{ id: 'ai-response-9', role: 'assistant', content: STUCK_TURN_CONTENT, pendingToolExecution: true }]);
+    agentPool.getAgent.mockResolvedValue(agent);
+    agentPool.persistAgentState.mockRejectedValueOnce(new Error('disk full'));
+
+    const recovered = await scheduler._recoverStuckPendingToolMessage('a1', 'ai-response-9', STUCK_TURN_CONTENT);
+    expect(recovered).toBe(false);
+    expect(logger.warn).toHaveBeenCalled();
+  });
+});
+
+describe('Defect B wiring — _executeToolsAsync unsticks a zero-result tool turn', () => {
+  test('when execution yields no results, the flagged turn is recovered (not left looping)', async () => {
+    const { scheduler, agentPool } = makeScheduler();
+    const msg = { id: 'ai-response-1', role: 'assistant', content: STUCK_TURN_CONTENT, pendingToolExecution: true };
+    const agent = makeAgent([msg]);
+    agentPool.getAgent.mockResolvedValue(agent);
+
+    // Real wiring: extraction/execution returns ZERO results (the runtime
+    // failure), so _executeToolsAsync must take the else branch and recover.
+    scheduler.messageProcessor = {
+      extractToolCommands: jest.fn().mockResolvedValue([]),
+      extractAndExecuteTools: jest.fn().mockResolvedValue([]),
+      toolsRegistry: { getTool: jest.fn().mockReturnValue(null) },
+    };
+
+    await scheduler._executeToolsAsync('a1', STUCK_TURN_CONTENT, 'sess-1', 'ai-response-1');
+
+    // The stuck flag is cleared and a diagnostic queued — the loop is broken.
+    expect(agent.conversations.full.messages[0].pendingToolExecution).toBe(false);
+    expect(agent.messageQueues.toolResults).toHaveLength(1);
+    expect(agent.messageQueues.toolResults[0].result).toMatch(/TOOL NOT EXECUTED/);
+  });
+});

package/src/core/__tests__/messageProcessor.test.js

@@ -659,11 +659,60 @@ describe('MessageProcessor', () => {
       expect(results).toEqual([]);
     });
 
-    test('returns empty array on error', async () => {
+    // REGRESSION: the silent agent death-loop. Previously this path returned
+    // [] on any error — which left the assistant turn flagged
+    // pendingToolExecution with ZERO feedback, so the agent re-emitted the
+    // identical tool call forever. The fix surfaces the failure as a real
+    // tool result so the agent sees it and can change course.
+    test('surfaces extraction errors as a failed tool result (never silent [])', async () => {
       mockExtractToolCommands.mockImplementation(() => { throw new Error('parse crash'); });
       const results = await mp.extractAndExecuteTools('bad', 'a1', {});
-      expect(results).toEqual([]);
+      expect(results).toHaveLength(1);
+      expect(results[0].status).toBe('failed');
+      expect(results[0].error).toBe('parse crash');
+      // Extraction itself threw before any command was captured → generic id.
+      expect(results[0].toolId).toBe('tool-execution');
       expect(logger.error).toHaveBeenCalled();
     });
+
+    test('happy path: extracts, executes, and returns the completed result', async () => {
+      mockExtractToolCommands.mockReturnValue([
+        { toolId: 'terminal', parameters: { command: 'ls' }, type: 'json' }
+      ]);
+      mockNormalizeToolCommand.mockImplementation(cmd => ({
+        toolId: cmd.toolId, parameters: cmd.parameters, type: 'json', rawContent: ''
+      }));
+      const tool = { execute: jest.fn().mockResolvedValue('file-a\nfile-b') };
+      toolsRegistry.getTool.mockReturnValue(tool);
+      agentPool.getAgent.mockResolvedValue(makeAgent());
+
+      const results = await mp.extractAndExecuteTools('**Calling terminal**', 'a1', { sessionId: 's1' });
+      expect(results).toHaveLength(1);
+      expect(results[0]).toMatchObject({ toolId: 'terminal', status: 'completed', result: 'file-a\nfile-b' });
+      expect(tool.execute).toHaveBeenCalled();
+    });
+
+    test('surfaces execution errors AND attributes them to the tool the agent called', async () => {
+      // Extraction succeeds (composio), but a downstream step throws. The
+      // failed result must name "composio" so the agent's feedback is
+      // actionable rather than a generic blob.
+      mockExtractToolCommands.mockReturnValue([
+        { toolId: 'composio', parameters: { actions: [{ type: 'find-action', query: 'gmail' }] }, type: 'json' }
+      ]);
+      mockNormalizeToolCommand.mockImplementation(cmd => ({
+        toolId: cmd.toolId, parameters: cmd.parameters, type: 'json', rawContent: ''
+      }));
+      // Force the catch: getAgent (called inside the try, before executeTools)
+      // throws.
+      agentPool.getAgent.mockRejectedValueOnce(new Error('agent store offline'));
+
+      const results = await mp.extractAndExecuteTools('**Calling composio**', 'a1', {});
+      expect(results).toHaveLength(1);
+      expect(results[0]).toMatchObject({
+        toolId: 'composio',
+        status: 'failed',
+        error: 'agent store offline',
+      });
+    });
   });
 });