onbuzz 4.10.0 → 5.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "onbuzz",
-  "version": "4.10.0",
+  "version": "5.0.1",
   "description": "Loxia OnBuzz - Your AI Fleet",
   "type": "module",
   "main": "src/index.js",
@@ -64,8 +64,9 @@
   "dependencies": {
     "@babel/parser": "^7.28.5",
     "@babel/traverse": "^7.28.5",
+    "@composio/core": "^0.6.11",
+    "@huggingface/transformers": "^4.2.0",
     "blessed": "^0.1.81",
-    "blessed-contrib": "^4.11.0",
     "chalk": "^5.6.2",
     "discord.js": "^14.16.0",
     "docx": "^9.5.3",
@@ -77,12 +78,12 @@
     "ink": "^5.2.1",
     "jsonrepair": "^3.13.2",
     "mammoth": "^1.11.0",
-    "node-telegram-bot-api": "^0.67.0",
     "ollama": "^0.6.3",
     "pdf2json": "^3.1.4",
     "postcss": "^8.5.6",
     "postcss-less": "^6.0.0",
     "postcss-scss": "^4.0.9",
+    "pptxgenjs": "^4.0.1",
     "prettier": "^3.6.2",
     "puppeteer": "^24.25.0",
     "puppeteer-extra": "^3.3.6",
@@ -94,12 +95,15 @@
     "strip-ansi": "^7.1.2",
     "stylelint": "^16.25.0",
     "stylelint-config-standard": "^39.0.1",
+    "telegraf": "^4.16.3",
     "tiktoken": "^1.0.15",
     "typescript": "^5.9.3",
+    "update-notifier": "^7.3.1",
     "uuid": "^11.1.0",
     "ws": "^8.16.0"
   },
   "optionalDependencies": {
+    "electron-updater": "^6.8.9",
     "whatsapp-web.js": "^1.34.6"
   },
   "devDependencies": {
@@ -107,16 +111,31 @@
     "@yao-pkg/pkg": "^6.0.0",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
-    "esbuild": "^0.24.0",
+    "esbuild": "^0.25.10",
     "eslint": "^8.57.1",
     "eslint-plugin-security": "^3.0.1",
     "jest": "^29.7.0",
-    "jsdoc": "^4.0.2"
+    "jest-html-reporters": "^3.1.7",
+    "jest-junit": "^16.0.0",
+    "jsdoc": "^4.0.2",
+    "jsdom": "^25.0.1"
+  },
+  "overrides": {
+    "qs": "^6.15.2",
+    "uuid": "$uuid"
   },
   "build": {
     "appId": "com.loxia.autopilot",
     "productName": "Loxia Autopilot",
+    "executableName": "loxia-autopilot",
     "npmRebuild": false,
+    "publish": [
+      {
+        "provider": "github",
+        "owner": "Loxia-ai",
+        "repo": "autopilot"
+      }
+    ],
     "directories": {
       "output": "electron-dist"
     },

package/src/core/__tests__/agentPool.test.js

@@ -94,6 +94,18 @@ describe('AgentPool', () => {
       expect(agent.mode).toBe('agent');
     });
 
+    test('defaults skills to [] when config omits them', async () => {
+      const agent = await pool.createAgent(agentCfg());
+      expect(agent.skills).toEqual([]);
+    });
+
+    test('stores skill names from config.skills', async () => {
+      // Marketplace install wires an agent to its (already-installed)
+      // skills by NAME via config.skills — verify the pool persists them.
+      const agent = await pool.createAgent(agentCfg({ skills: ['code-review', 'research'] }));
+      expect(agent.skills).toEqual(['code-review', 'research']);
+    });
+
     test('initializes model-specific conversation for preferredModel', async () => {
       const agent = await pool.createAgent(agentCfg({ preferredModel: 'gpt-4' }));
       expect(agent.conversations['gpt-4']).toBeDefined();

package/src/core/__tests__/agentScheduler.errorCategorisation.test.js

@@ -77,10 +77,29 @@ const errorClasses = [
   { name: 'network ETIMEDOUT',       msg: 'connect ETIMEDOUT', expectBroadcast: false, label: 'network-error' },
   { name: 'network ENOTFOUND',       msg: 'getaddrinfo ENOTFOUND api.foo', expectBroadcast: false, label: 'network-error' },
   { name: 'fetch failed',            msg: 'fetch failed', expectBroadcast: false, label: 'network-error' },
-  // -- PERSISTENT (broadcast) --
+  // -- PERSISTENT: real LLM-PROVIDER key failures → api-key-error --
+  // These MUST keep pausing the agent with "check your API key", because
+  // they genuinely are key problems. Each is a real provider signature.
   { name: 'auth: API key',           msg: 'Invalid API key provided',           expectBroadcast: true, label: 'api-key-error' },
   { name: 'auth: 401',               msg: 'HTTP 401 Unauthorized',              expectBroadcast: true, label: 'api-key-error' },
-  { name: 'auth: 403',               msg: 'HTTP 403 Forbidden',                  expectBroadcast: true, label: 'api-key-error' },
+  { name: 'auth: Anthropic x-api-key', msg: 'authentication_error: invalid x-api-key', expectBroadcast: true, label: 'api-key-error' },
+  { name: 'auth: OpenAI incorrect',  msg: 'Incorrect API key provided: sk-***. You can find your API key at https://...', expectBroadcast: true, label: 'api-key-error' },
+  { name: 'auth: OpenAI code',       msg: 'invalid_api_key', expectBroadcast: true, label: 'api-key-error' },
+  { name: 'auth: api_key underscore', msg: 'request failed: api_key missing or invalid', expectBroadcast: true, label: 'api-key-error' },
+
+  // -- PROOF of Fix #3 (the narrowing): these used to be MISCLASSIFIED as
+  // api-key-error and paused the agent with misleading "check your API key"
+  // guidance. They are ordinary TOOL/permission errors (a Composio action
+  // returning 403/forbidden because a third-party app isn't connected).
+  // They must NO LONGER be api-key-error. They still surface as a persistent
+  // unknown (server-error → broadcast) so the user sees the real problem,
+  // but the agent is NOT told its LLM key is bad.
+  { name: 'composio 403 forbidden',  msg: 'Composio execute failed: HTTP 403 Forbidden — GMAIL app is not connected for this user', expectBroadcast: true, label: 'server-error' },
+  { name: 'composio forbidden text', msg: 'Tool error: forbidden — missing scope gmail.send', expectBroadcast: true, label: 'server-error' },
+  { name: 'bare unauthorized',       msg: 'The resource returned unauthorized access', expectBroadcast: true, label: 'server-error' },
+  { name: 'generic authentication',  msg: 'Slack authentication failed for the workspace', expectBroadcast: true, label: 'server-error' },
+
+  // -- PERSISTENT: genuinely unknown → server-error --
   { name: 'unknown: random 500',     msg: 'Random 500 Internal Server Error from the AI', expectBroadcast: true, label: 'server-error' },
   { name: 'unknown: weird shape',    msg: 'Provider returned malformed JSON',   expectBroadcast: true, label: 'server-error' },
 ];

package/src/core/__tests__/agentScheduler.toolFeedbackLoop.test.js

@@ -0,0 +1,209 @@
+/**
+ * PROOF TESTS for the silent tool-execution death-loop.
+ *
+ * Reproduced from export Coder-Spark-2445 (2026-06-08): an agent asked to
+ * read Gmail emitted the IDENTICAL `find-action` + `connection-status`
+ * Composio calls six turns in a row and never progressed. Forensics on the
+ * export:
+ *   - every assistant turn carried `pendingToolExecution: true`
+ *   - `messageQueues.toolResults` was EMPTY (0 items)
+ *   - no `toolResults` were ever attached to any turn
+ *   - prompt tokens stayed flat (~42.5k→43.3k) — no results re-entered context
+ *   - 0/6 assistant messages had a structured `toolCalls` array; the calls
+ *     lived inside `content` as bridged ```json {"toolId",...}``` blocks
+ *
+ * Two defects produced and sustained the loop, both covered here:
+ *
+ *   Defect B — a turn flagged `pendingToolExecution:true` whose execution
+ *   produced ZERO results was left stuck forever with no feedback. The fix
+ *   (`_recoverStuckPendingToolMessage`) clears the flag and queues a
+ *   diagnostic so the agent gets unblocked.
+ *
+ *   Defect C — loop detection keyed tool-call repetition on the structured
+ *   `m.toolCalls` array only, so content-embedded (bridged) tool calls were
+ *   invisible — exactly this agent's path. The fix
+ *   (`_extractToolSignaturesFromContent` + content-aware hashing) makes the
+ *   detector see them.
+ *
+ * (Defect A — surfacing swallowed execution errors instead of returning [] —
+ * is proven in messageProcessor.test.js.)
+ */
+import { jest, describe, test, expect, beforeEach } from '@jest/globals';
+import { createMockLogger } from '../../__test-utils__/mockFactories.js';
+
+const mockShouldAgentBeActive = jest.fn(() => ({ active: false, reason: 'idle' }));
+const mockGetActiveAgents = jest.fn(() => []);
+const mockShouldSkipIteration = jest.fn(() => false);
+jest.unstable_mockModule('../../services/agentActivityService.js', () => ({
+  shouldAgentBeActive: mockShouldAgentBeActive,
+  getActiveAgents: mockGetActiveAgents,
+  shouldSkipIteration: mockShouldSkipIteration,
+}));
+
+const { default: AgentScheduler } = await import('../agentScheduler.js');
+
+// The EXACT bridged tool-call content the export's agent emitted each turn
+// (`autopilot-backend` toolCallBridge → CLI inline-JSON form).
+function bridgedBlock(toolId, params) {
+  return `\n**Calling ${toolId}**\n\n` +
+    '```json\n' + JSON.stringify({ toolId, parameters: params }, null, 2) + '\n```\n';
+}
+const FIND_ACTION = bridgedBlock('composio', { actions: [{ type: 'find-action', query: 'read gmail emails inbox', topK: 5 }] });
+const CONNECTION_STATUS = bridgedBlock('composio', { actions: [{ type: 'connection-status', toolkitSlug: 'gmail' }] });
+const STUCK_TURN_CONTENT = FIND_ACTION + CONNECTION_STATUS;
+
+function makeScheduler() {
+  const logger = createMockLogger();
+  const agentPool = {
+    getAgent: jest.fn(),
+    persistAgentState: jest.fn().mockResolvedValue(undefined),
+  };
+  const scheduler = new AgentScheduler(agentPool, {}, { abortRequest: jest.fn() }, logger);
+  return { scheduler, agentPool, logger };
+}
+
+function makeAgent(messages) {
+  return {
+    id: 'a1',
+    conversations: {
+      full: { messages, lastUpdated: null },
+      'Kimi-K2.6': { messages, lastUpdated: null },
+    },
+    messageQueues: { toolResults: [], interAgentMessages: [], userMessages: [] },
+  };
+}
+
+beforeEach(() => jest.clearAllMocks());
+
+describe('Defect C — loop detection sees content-embedded (bridged) tool calls', () => {
+  test('_extractToolSignaturesFromContent parses the exact stuck-turn content', () => {
+    const { scheduler } = makeScheduler();
+    const sigs = scheduler._extractToolSignaturesFromContent(STUCK_TURN_CONTENT);
+    expect(sigs).toHaveLength(2);
+    expect(sigs.every(s => s.startsWith('composio:'))).toBe(true);
+    expect(sigs[0]).toContain('find-action');
+    expect(sigs[1]).toContain('connection-status');
+  });
+
+  test('returns [] for plain prose and never throws on junk', () => {
+    const { scheduler } = makeScheduler();
+    expect(scheduler._extractToolSignaturesFromContent('just talking, no tools')).toEqual([]);
+    expect(scheduler._extractToolSignaturesFromContent(null)).toEqual([]);
+    expect(scheduler._extractToolSignaturesFromContent(42)).toEqual([]);
+  });
+
+  test('produces a stable per-toolId signature even with unusual param ordering', () => {
+    const { scheduler } = makeScheduler();
+    const sigs = scheduler._extractToolSignaturesFromContent('{"toolId":"gmail","other":1}');
+    expect(sigs).toHaveLength(1);
+    expect(sigs[0].startsWith('gmail:')).toBe(true);
+    // Same content → same signature (repetition is detectable).
+    expect(scheduler._extractToolSignaturesFromContent('{"toolId":"gmail","other":1}')).toEqual(sigs);
+  });
+
+  test('state hash reflects the bridged tool call even when visible prose is identical & truncated', () => {
+    // THE regression: two turns whose first 500 prose chars are identical but
+    // whose embedded tool call differs. Old detection (output-truncated +
+    // structured-toolCalls-only) hashed them the same → blind. Content-aware
+    // hashing must now distinguish them.
+    const { scheduler } = makeScheduler();
+    const prose = 'x'.repeat(520); // exceeds the 500-char output window
+    const turnA = { role: 'assistant', content: prose + FIND_ACTION };       // no .toolCalls array
+    const turnB = { role: 'assistant', content: prose + CONNECTION_STATUS };
+
+    const hashA = scheduler.generateAgentStateHash(makeAgent([turnA]));
+    const hashB = scheduler.generateAgentStateHash(makeAgent([turnB]));
+    expect(hashA).not.toBe(hashB);
+
+    // And two IDENTICAL stuck turns hash the same — so repetition is detected.
+    const hash1 = scheduler.generateAgentStateHash(makeAgent([{ role: 'assistant', content: prose + FIND_ACTION }]));
+    expect(hash1).toBe(hashA);
+  });
+});
+
+describe('Defect B — a flagged turn with zero results is unstuck, not left to loop', () => {
+  test('clears stuck pendingToolExecution AND queues a diagnostic when content had tool calls', async () => {
+    const { scheduler, agentPool } = makeScheduler();
+    const msg = { id: 'ai-response-1', role: 'assistant', content: STUCK_TURN_CONTENT, pendingToolExecution: true };
+    const agent = makeAgent([msg]);
+    agentPool.getAgent.mockResolvedValue(agent);
+
+    const recovered = await scheduler._recoverStuckPendingToolMessage('a1', 'ai-response-1', STUCK_TURN_CONTENT);
+
+    expect(recovered).toBe(true);
+    // Flag cleared in BOTH conversation buckets.
+    expect(agent.conversations.full.messages[0].pendingToolExecution).toBe(false);
+    expect(agent.conversations['Kimi-K2.6'].messages[0].pendingToolExecution).toBe(false);
+    // A diagnostic tool-result is queued so the next turn gives the agent feedback.
+    expect(agent.messageQueues.toolResults).toHaveLength(1);
+    const diag = agent.messageQueues.toolResults[0];
+    expect(diag.status).toBe('failed');
+    expect(diag.result).toMatch(/TOOL NOT EXECUTED/);
+    expect(agentPool.persistAgentState).toHaveBeenCalledWith('a1');
+  });
+
+  test('clears the flag but does NOT nag when the turn was plain text (no tool calls)', async () => {
+    const { scheduler, agentPool } = makeScheduler();
+    const msg = { id: 'ai-response-2', role: 'assistant', content: 'All done, here is your summary.', pendingToolExecution: true };
+    const agent = makeAgent([msg]);
+    agentPool.getAgent.mockResolvedValue(agent);
+
+    const recovered = await scheduler._recoverStuckPendingToolMessage('a1', 'ai-response-2', msg.content);
+
+    expect(recovered).toBe(true);
+    expect(agent.conversations.full.messages[0].pendingToolExecution).toBe(false);
+    expect(agent.messageQueues.toolResults).toHaveLength(0); // no false-alarm diagnostic
+  });
+
+  test('no-op when the message is not pending or not found', async () => {
+    const { scheduler, agentPool } = makeScheduler();
+    const agent = makeAgent([{ id: 'ai-response-3', role: 'assistant', content: STUCK_TURN_CONTENT, pendingToolExecution: false }]);
+    agentPool.getAgent.mockResolvedValue(agent);
+
+    expect(await scheduler._recoverStuckPendingToolMessage('a1', 'ai-response-3', STUCK_TURN_CONTENT)).toBe(false);
+    expect(await scheduler._recoverStuckPendingToolMessage('a1', 'does-not-exist', STUCK_TURN_CONTENT)).toBe(false);
+    expect(agent.messageQueues.toolResults).toHaveLength(0);
+  });
+
+  test('returns false (no throw) when responseMessageId is missing or agent absent', async () => {
+    const { scheduler, agentPool } = makeScheduler();
+    expect(await scheduler._recoverStuckPendingToolMessage('a1', null, 'x')).toBe(false);
+    agentPool.getAgent.mockResolvedValue(null);
+    expect(await scheduler._recoverStuckPendingToolMessage('a1', 'ai-response-x', 'x')).toBe(false);
+  });
+
+  test('swallows internal errors and returns false (never throws into the caller)', async () => {
+    const { scheduler, agentPool, logger } = makeScheduler();
+    const agent = makeAgent([{ id: 'ai-response-9', role: 'assistant', content: STUCK_TURN_CONTENT, pendingToolExecution: true }]);
+    agentPool.getAgent.mockResolvedValue(agent);
+    agentPool.persistAgentState.mockRejectedValueOnce(new Error('disk full'));
+
+    const recovered = await scheduler._recoverStuckPendingToolMessage('a1', 'ai-response-9', STUCK_TURN_CONTENT);
+    expect(recovered).toBe(false);
+    expect(logger.warn).toHaveBeenCalled();
+  });
+});
+
+describe('Defect B wiring — _executeToolsAsync unsticks a zero-result tool turn', () => {
+  test('when execution yields no results, the flagged turn is recovered (not left looping)', async () => {
+    const { scheduler, agentPool } = makeScheduler();
+    const msg = { id: 'ai-response-1', role: 'assistant', content: STUCK_TURN_CONTENT, pendingToolExecution: true };
+    const agent = makeAgent([msg]);
+    agentPool.getAgent.mockResolvedValue(agent);
+
+    // Real wiring: extraction/execution returns ZERO results (the runtime
+    // failure), so _executeToolsAsync must take the else branch and recover.
+    scheduler.messageProcessor = {
+      extractToolCommands: jest.fn().mockResolvedValue([]),
+      extractAndExecuteTools: jest.fn().mockResolvedValue([]),
+      toolsRegistry: { getTool: jest.fn().mockReturnValue(null) },
+    };
+
+    await scheduler._executeToolsAsync('a1', STUCK_TURN_CONTENT, 'sess-1', 'ai-response-1');
+
+    // The stuck flag is cleared and a diagnostic queued — the loop is broken.
+    expect(agent.conversations.full.messages[0].pendingToolExecution).toBe(false);
+    expect(agent.messageQueues.toolResults).toHaveLength(1);
+    expect(agent.messageQueues.toolResults[0].result).toMatch(/TOOL NOT EXECUTED/);
+  });
+});

package/src/core/__tests__/messageProcessor.test.js

@@ -659,11 +659,60 @@ describe('MessageProcessor', () => {
       expect(results).toEqual([]);
     });
 
-    test('returns empty array on error', async () => {
+    // REGRESSION: the silent agent death-loop. Previously this path returned
+    // [] on any error — which left the assistant turn flagged
+    // pendingToolExecution with ZERO feedback, so the agent re-emitted the
+    // identical tool call forever. The fix surfaces the failure as a real
+    // tool result so the agent sees it and can change course.
+    test('surfaces extraction errors as a failed tool result (never silent [])', async () => {
       mockExtractToolCommands.mockImplementation(() => { throw new Error('parse crash'); });
       const results = await mp.extractAndExecuteTools('bad', 'a1', {});
-      expect(results).toEqual([]);
+      expect(results).toHaveLength(1);
+      expect(results[0].status).toBe('failed');
+      expect(results[0].error).toBe('parse crash');
+      // Extraction itself threw before any command was captured → generic id.
+      expect(results[0].toolId).toBe('tool-execution');
       expect(logger.error).toHaveBeenCalled();
     });
+
+    test('happy path: extracts, executes, and returns the completed result', async () => {
+      mockExtractToolCommands.mockReturnValue([
+        { toolId: 'terminal', parameters: { command: 'ls' }, type: 'json' }
+      ]);
+      mockNormalizeToolCommand.mockImplementation(cmd => ({
+        toolId: cmd.toolId, parameters: cmd.parameters, type: 'json', rawContent: ''
+      }));
+      const tool = { execute: jest.fn().mockResolvedValue('file-a\nfile-b') };
+      toolsRegistry.getTool.mockReturnValue(tool);
+      agentPool.getAgent.mockResolvedValue(makeAgent());
+
+      const results = await mp.extractAndExecuteTools('**Calling terminal**', 'a1', { sessionId: 's1' });
+      expect(results).toHaveLength(1);
+      expect(results[0]).toMatchObject({ toolId: 'terminal', status: 'completed', result: 'file-a\nfile-b' });
+      expect(tool.execute).toHaveBeenCalled();
+    });
+
+    test('surfaces execution errors AND attributes them to the tool the agent called', async () => {
+      // Extraction succeeds (composio), but a downstream step throws. The
+      // failed result must name "composio" so the agent's feedback is
+      // actionable rather than a generic blob.
+      mockExtractToolCommands.mockReturnValue([
+        { toolId: 'composio', parameters: { actions: [{ type: 'find-action', query: 'gmail' }] }, type: 'json' }
+      ]);
+      mockNormalizeToolCommand.mockImplementation(cmd => ({
+        toolId: cmd.toolId, parameters: cmd.parameters, type: 'json', rawContent: ''
+      }));
+      // Force the catch: getAgent (called inside the try, before executeTools)
+      // throws.
+      agentPool.getAgent.mockRejectedValueOnce(new Error('agent store offline'));
+
+      const results = await mp.extractAndExecuteTools('**Calling composio**', 'a1', {});
+      expect(results).toHaveLength(1);
+      expect(results[0]).toMatchObject({
+        toolId: 'composio',
+        status: 'failed',
+        error: 'agent store offline',
+      });
+    });
   });
 });