quadwork 1.19.2 → 2.0.0

package/server/bridges/telegram.js

@@ -0,0 +1,210 @@
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+
+const CONFIG_DIR = path.join(os.homedir(), ".quadwork");
+
+const instances = new Map();
+
+function cursorPath(projectId) {
+  return path.join(CONFIG_DIR, `tg-bridge-cursor-${projectId}.json`);
+}
+
+function offsetPath(projectId) {
+  return path.join(CONFIG_DIR, `tg-bridge-offset-${projectId}.json`);
+}
+
+function readCursor(projectId) {
+  try {
+    const data = JSON.parse(fs.readFileSync(cursorPath(projectId), "utf-8"));
+    return data.last_seen_id || 0;
+  } catch {
+    return 0;
+  }
+}
+
+function writeCursor(projectId, sinceId) {
+  try {
+    fs.writeFileSync(cursorPath(projectId), JSON.stringify({ last_seen_id: sinceId }), { mode: 0o600 });
+  } catch {}
+}
+
+function readOffset(projectId) {
+  try {
+    const data = JSON.parse(fs.readFileSync(offsetPath(projectId), "utf-8"));
+    return data.offset || 0;
+  } catch {
+    return 0;
+  }
+}
+
+function writeOffset(projectId, offset) {
+  try {
+    fs.writeFileSync(offsetPath(projectId), JSON.stringify({ offset }), { mode: 0o600 });
+  } catch {}
+}
+
+async function sendTelegram(botToken, chatId, text) {
+  const url = `https://api.telegram.org/bot${botToken}/sendMessage`;
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ chat_id: chatId, text }),
+    signal: AbortSignal.timeout(10000),
+  });
+  if (!res.ok) throw new Error(`Telegram sendMessage ${res.status}`);
+}
+
+async function pollLoop(projectId, botToken, chatId, qwPort) {
+  const inst = instances.get(projectId);
+  if (!inst || inst.stopping) return;
+
+  try {
+    let sinceId = inst.cursor;
+    const r = await fetch(
+      `http://127.0.0.1:${qwPort}/api/chat?project=${encodeURIComponent(projectId)}&since_id=${sinceId}&limit=50`,
+      { signal: AbortSignal.timeout(5000) }
+    );
+    if (!r.ok) throw new Error(`Chat API ${r.status}`);
+    const messages = await r.json();
+
+    for (const msg of messages) {
+      if (inst.stopping) return;
+      if (msg.sender === "tg" || msg.sender === "telegram-bridge" || (msg.sender && msg.sender.startsWith("tg:"))) continue;
+      if (inst.forwardedIds.has(msg.id)) continue;
+
+      const text = `**${msg.sender}**: ${msg.text}`;
+      const truncated = text.length > 4000 ? text.slice(0, 4000) + "…" : text;
+      await sendTelegram(botToken, chatId, truncated);
+
+      inst.forwardedIds.add(msg.id);
+      if (inst.forwardedIds.size > 2000) {
+        const arr = [...inst.forwardedIds];
+        inst.forwardedIds = new Set(arr.slice(-1000));
+      }
+
+      if (msg.id > inst.cursor) {
+        inst.cursor = msg.id;
+        writeCursor(projectId, inst.cursor);
+      }
+    }
+  } catch (err) {
+    inst.lastError = err.message;
+  }
+
+  if (!inst.stopping) {
+    inst.timer = setTimeout(() => pollLoop(projectId, botToken, chatId, qwPort), 2000);
+  }
+}
+
+async function startTelegramUpdates(projectId, botToken, chatId, qwPort) {
+  const inst = instances.get(projectId);
+  if (!inst || inst.stopping) return;
+
+  let offset = readOffset(projectId);
+  let retryDelay = 500;
+
+  async function tick() {
+    if (!inst || inst.stopping) return;
+    try {
+      const allowedUpdates = encodeURIComponent(JSON.stringify(["message"]));
+      const url = `https://api.telegram.org/bot${botToken}/getUpdates?offset=${offset}&timeout=10&allowed_updates=${allowedUpdates}`;
+      const res = await fetch(url, { signal: AbortSignal.timeout(30000) });
+      if (!res.ok) throw new Error(`Telegram getUpdates ${res.status}`);
+      const data = await res.json();
+      retryDelay = 500;
+      if (data.ok && data.result) {
+        for (const update of data.result) {
+          offset = update.update_id + 1;
+          writeOffset(projectId, offset);
+          const text = update.message?.text;
+          const from = update.message?.from?.username || update.message?.from?.first_name || "unknown";
+          const msgChatId = String(update.message?.chat?.id);
+          if (!text || msgChatId !== String(chatId)) continue;
+
+          try {
+            await fetch(`http://127.0.0.1:${qwPort}/api/chat?project=${encodeURIComponent(projectId)}`, {
+              method: "POST",
+              headers: {
+                "Content-Type": "application/json",
+                "X-Bridge-Sender": `tg:${from}`,
+              },
+              body: JSON.stringify({
+                project: projectId,
+                text,
+                channel: "general",
+              }),
+              signal: AbortSignal.timeout(5000),
+            });
+          } catch {}
+        }
+      }
+    } catch (err) {
+      if (!inst.stopping) {
+        inst.lastError = err.message;
+        retryDelay = Math.min(retryDelay * 2, 30000);
+      }
+    }
+
+    if (!inst.stopping) {
+      inst.updateTimer = setTimeout(tick, retryDelay);
+    }
+  }
+
+  tick();
+}
+
+function start(projectId, botToken, chatId, qwPort) {
+  if (instances.has(projectId)) return;
+
+  const oldCursor = path.join(CONFIG_DIR, `telegram-bridge-cursor-${projectId}.json`);
+  const newCursor = cursorPath(projectId);
+  if (!fs.existsSync(newCursor) && fs.existsSync(oldCursor)) {
+    try { fs.renameSync(oldCursor, newCursor); } catch {}
+  }
+
+  const inst = {
+    cursor: readCursor(projectId),
+    forwardedIds: new Set(),
+    timer: null,
+    updateTimer: null,
+    stopping: false,
+    lastError: null,
+    startedAt: Date.now(),
+  };
+  instances.set(projectId, inst);
+
+  pollLoop(projectId, botToken, chatId, qwPort).catch((err) => {
+    console.error(`[bridge] telegram ${projectId} poll crashed: ${err.message}`);
+    inst.lastError = err.message;
+    stop(projectId);
+  });
+
+  startTelegramUpdates(projectId, botToken, chatId, qwPort).catch((err) => {
+    console.error(`[bridge] telegram ${projectId} updates crashed: ${err.message}`);
+    inst.lastError = err.message;
+  });
+
+  console.log(`[bridge] telegram ${projectId}: started`);
+}
+
+function stop(projectId) {
+  const inst = instances.get(projectId);
+  if (!inst) return;
+  inst.stopping = true;
+  if (inst.timer) clearTimeout(inst.timer);
+  if (inst.updateTimer) clearTimeout(inst.updateTimer);
+  instances.delete(projectId);
+  console.log(`[bridge] telegram ${projectId}: stopped`);
+}
+
+function isRunning(projectId) {
+  return instances.has(projectId);
+}
+
+function getLastError(projectId) {
+  const inst = instances.get(projectId);
+  return inst?.lastError || null;
+}
+
+module.exports = { start, stop, isRunning, getLastError, readCursor };

package/server/config.js

@@ -6,46 +6,27 @@ const CONFIG_PATH = path.join(os.homedir(), ".quadwork", "config.json");
 
 const DEFAULT_CONFIG = {
   port: 8400,
-  agentchattr_url: "http://127.0.0.1:8300",
-  agentchattr_dir: path.join(os.homedir(), ".quadwork", "agentchattr"),
-  // #405 / quadwork#278: display name used as the chat sender for
-  // messages posted from the dashboard. AC's registry name validator
-  // accepts 1–32 alphanumeric + dash + underscore characters; mirror
-  // that here so the sanitized value matches what AC will accept.
   operator_name: "user",
   projects: [],
 };
 
-// Reserved sender names that the operator must NOT be able to claim
-// — these are the registered agent identities (current + legacy
-// aliases) plus AC's own "system" sender. Without this denylist a
-// hand-edited or PUT /api/config'd `operator_name = "head"` would
-// post chat messages with sender:"head", reopening the impersonation
-// vector #230 closed. Case-insensitive match.
+// Reserved sender names that the operator must NOT be able to claim.
 const RESERVED_OPERATOR_NAMES = new Set([
   "head",
   "dev",
   "re1",
   "re2",
-  // Legacy agent aliases — preserved in routing logic in a few
-  // places, so block them too even though new projects no longer
-  // register under these names.
   "reviewer1",
   "reviewer2",
   "t1",
   "t2a",
   "t2b",
   "t3",
-  // AC's own broadcast / housekeeping sender.
   "system",
 ]);
 
-// Sanitize an operator-supplied display name to match AC's name
-// validator (registry.py: 1–32 alnum + dash + underscore) AND to
-// reject any reserved agent identity. Empty / non-string / reserved
-// input falls back to "user". Used both when reading the config (in
-// case the file was hand-edited) and on /api/chat sends (so even a
-// stale on-disk value can't impersonate an agent).
+// Sanitize operator display name: 1–32 alnum + dash + underscore,
+// reject reserved agent identities.
 function sanitizeOperatorName(value) {
   if (typeof value !== "string") return "user";
   const cleaned = value.trim().replace(/[^A-Za-z0-9_-]/g, "");
@@ -169,43 +150,6 @@ function resolveProjectChattr(projectId) {
   };
 }
 
-/**
- * Resolve the command + args to spawn AgentChattr from its cloned directory.
- * Returns { command, args, cwd } or null if not fully set up.
- * Requires .venv/bin/python — never falls back to bare python3.
- */
-function resolveChattrSpawn(agentchattrDir) {
-  const dir = agentchattrDir || path.join(os.homedir(), ".quadwork", "agentchattr");
-  const runPy = path.join(dir, "run.py");
-  const venvPython = path.join(dir, ".venv", "bin", "python");
-  if (!fs.existsSync(runPy) || !fs.existsSync(venvPython)) return null;
-  return { command: venvPython, args: ["run.py"], cwd: dir };
-}
-
-/**
- * Fetch AgentChattr's real session token from its HTML and save to project config.
- * AgentChattr generates its own token at startup; this syncs it back.
- */
-async function syncChattrToken(projectId) {
-  const config = readConfig();
-  const project = config.projects?.find((p) => p.id === projectId);
-  if (!project) return;
-  const url = project.agentchattr_url || config.agentchattr_url || "http://127.0.0.1:8300";
-  try {
-    const res = await fetch(url);
-    if (!res.ok) return;
-    const html = await res.text();
-    const match = html.match(/__SESSION_TOKEN__="([^"]+)"/);
-    if (match && match[1]) {
-      const realToken = match[1];
-      if (project.agentchattr_token !== realToken) {
-        project.agentchattr_token = realToken;
-        writeSecureFile(CONFIG_PATH, JSON.stringify(config, null, 2));
-      }
-    }
-  } catch {}
-}
-
 // --- #540: Secure file/directory helpers ---
 // All paths under ~/.quadwork/ may contain secrets (tokens, configs,
 // chat exports). Use these helpers instead of raw fs calls to ensure
@@ -230,4 +174,4 @@ function writeConfig(cfg) {
   writeSecureFile(CONFIG_PATH, JSON.stringify(cfg, null, 2));
 }
 
-module.exports = { readConfig, resolveAgentCwd, resolveAgentCommand, resolveProjectChattr, resolveChattrSpawn, syncChattrToken, sanitizeOperatorName, CONFIG_PATH, ensureSecureDir, writeSecureFile, writeConfig };
+module.exports = { readConfig, resolveAgentCwd, resolveAgentCommand, resolveProjectChattr, sanitizeOperatorName, CONFIG_PATH, ensureSecureDir, writeSecureFile, writeConfig };

package/server/file-chat.js

@@ -0,0 +1,318 @@
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const { ensureSecureDir, writeSecureFile } = require("./config");
+
+const MENTION_RE = /@(\w[\w-]*)/g;
+
+// Per-project state keyed by projectId
+const projectState = new Map();
+
+function getState(projectId) {
+  if (!projectState.has(projectId)) {
+    projectState.set(projectId, { nextId: null, cache: [] });
+  }
+  return projectState.get(projectId);
+}
+
+function chatDir(projectId) {
+  return path.join(os.homedir(), ".quadwork", projectId, "chat");
+}
+
+function chatFile(projectId) {
+  return path.join(chatDir(projectId), "general.jsonl");
+}
+
+function writerLockPath(projectId) {
+  return path.join(chatDir(projectId), ".writer.pid");
+}
+
+function parseMentions(text) {
+  if (typeof text !== "string") return [];
+  const mentions = [];
+  let m;
+  while ((m = MENTION_RE.exec(text)) !== null) {
+    mentions.push(m[1].toLowerCase());
+  }
+  return [...new Set(mentions)];
+}
+
+// --- Writer lock ---
+
+function acquireWriterLock(projectId) {
+  const lockPath = writerLockPath(projectId);
+  const dir = chatDir(projectId);
+  ensureSecureDir(dir);
+
+  if (fs.existsSync(lockPath)) {
+    let existingPid;
+    try {
+      existingPid = parseInt(fs.readFileSync(lockPath, "utf-8").trim(), 10);
+    } catch {
+      // Corrupt lock file — overwrite
+    }
+    if (existingPid) {
+      try {
+        process.kill(existingPid, 0);
+        throw new Error(`QuadWork already running on this directory (pid ${existingPid})`);
+      } catch (err) {
+        if (err.code === "ESRCH") {
+          console.warn(`[file-chat] Stale writer lock for project ${projectId} (pid ${existingPid}), replacing`);
+        } else if (!err.code) {
+          throw err;
+        }
+      }
+    }
+  }
+
+  writeSecureFile(lockPath, String(process.pid));
+}
+
+function releaseWriterLock(projectId) {
+  try {
+    fs.unlinkSync(writerLockPath(projectId));
+  } catch {}
+}
+
+// --- ID recovery ---
+
+function recoverNextId(projectId) {
+  const filePath = chatFile(projectId);
+  let maxId = 0;
+
+  if (!fs.existsSync(filePath)) return 1;
+
+  const content = fs.readFileSync(filePath, "utf-8");
+  const lines = content.split("\n");
+  for (const line of lines) {
+    if (!line.trim()) continue;
+    try {
+      const record = JSON.parse(line);
+      if (typeof record.id === "number" && record.id > maxId) {
+        maxId = record.id;
+      }
+    } catch {
+      console.warn(`[file-chat] Skipped corrupt JSONL line in project ${projectId}`);
+    }
+  }
+
+  return maxId + 1;
+}
+
+// --- Core functions ---
+
+const CACHE_SIZE = 200;
+
+function initProject(projectId) {
+  const dir = chatDir(projectId);
+  ensureSecureDir(dir);
+
+  acquireWriterLock(projectId);
+
+  const state = getState(projectId);
+  state.nextId = recoverNextId(projectId);
+
+  // Populate cache from existing file
+  const filePath = chatFile(projectId);
+  if (fs.existsSync(filePath)) {
+    const content = fs.readFileSync(filePath, "utf-8");
+    const lines = content.split("\n");
+    const records = [];
+    for (const line of lines) {
+      if (!line.trim()) continue;
+      try {
+        records.push(JSON.parse(line));
+      } catch {
+        // already warned during recoverNextId
+      }
+    }
+    state.cache = records.slice(-CACHE_SIZE);
+  }
+
+  console.log(`[file-chat] Initialized project ${projectId}, next ID: ${state.nextId}, cached: ${state.cache.length} messages`);
+}
+
+function shutdownProject(projectId) {
+  releaseWriterLock(projectId);
+  projectState.delete(projectId);
+}
+
+function appendMessage(projectId, { sender, channel = "general", text, type = "message" }, _skipLoopGuard = false) {
+  const state = getState(projectId);
+  if (state.nextId === null) {
+    throw new Error(`Project ${projectId} not initialized — call initProject first`);
+  }
+
+  const id = state.nextId++;
+  const seq = id; // seq mirrors id for single-channel
+  const record = {
+    id,
+    seq,
+    ts: new Date().toISOString(),
+    sender: sender || "system",
+    channel,
+    type,
+    text: text || "",
+    mentions: parseMentions(text),
+  };
+
+  const dir = chatDir(projectId);
+  ensureSecureDir(dir);
+  const filePath = chatFile(projectId);
+
+  const line = JSON.stringify(record) + "\n";
+
+  let retries = 3;
+  while (retries > 0) {
+    try {
+      fs.appendFileSync(filePath, line, { mode: 0o600 });
+      try { fs.chmodSync(filePath, 0o600); } catch {}
+      break;
+    } catch (err) {
+      retries--;
+      if (retries === 0) {
+        console.error(`[file-chat] Append failure for project ${projectId}: ${err.message}`);
+        throw err;
+      }
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 100);
+    }
+  }
+
+  state.cache.push(record);
+  if (state.cache.length > CACHE_SIZE) {
+    state.cache = state.cache.slice(-CACHE_SIZE);
+  }
+
+  return record;
+}
+
+function readMessages(projectId, { since_id = 0, limit = 50 } = {}) {
+  const state = getState(projectId);
+
+  // Try cache first
+  if (state.cache.length > 0) {
+    const cacheMinId = state.cache[0].id;
+    if (since_id >= cacheMinId || since_id === 0) {
+      let results = since_id > 0
+        ? state.cache.filter((m) => m.id > since_id)
+        : state.cache;
+      return results.slice(-limit);
+    }
+  }
+
+  // Fall back to disk
+  const filePath = chatFile(projectId);
+  if (!fs.existsSync(filePath)) {
+    console.warn(`[file-chat] Missing chat file for project ${projectId}, creating empty`);
+    const dir = chatDir(projectId);
+    ensureSecureDir(dir);
+    writeSecureFile(filePath, "");
+    return [];
+  }
+
+  const content = fs.readFileSync(filePath, "utf-8");
+  const lines = content.split("\n");
+  const results = [];
+  for (const line of lines) {
+    if (!line.trim()) continue;
+    try {
+      const record = JSON.parse(line);
+      if (since_id > 0 && record.id <= since_id) continue;
+      results.push(record);
+    } catch {
+      console.warn(`[file-chat] Skipped corrupt JSONL line in project ${projectId}`);
+    }
+  }
+
+  return results.slice(-limit);
+}
+
+function getNextId(projectId) {
+  const state = getState(projectId);
+  if (state.nextId === null) {
+    state.nextId = recoverNextId(projectId);
+  }
+  return state.nextId;
+}
+
+// #717: per-project loop guard state
+const _loopGuardState = new Map();
+
+function checkLoopGuard(projectId, msg, maxHops = 30) {
+  let state = _loopGuardState.get(projectId) || { hops: 0, paused: false };
+
+  if (msg.sender === "user") {
+    const isResume = typeof msg.text === "string" && msg.text.trim() === "/continue";
+    state.hops = 0;
+    state.paused = false;
+    _loopGuardState.set(projectId, state);
+    if (isResume) {
+      appendMessageInternal(projectId, {
+        sender: "system",
+        type: "system",
+        text: "Loop guard resumed.",
+        channel: msg.channel || "general",
+      });
+    }
+    return;
+  }
+
+  if (msg.type === "system") return;
+  if (state.paused) return;
+
+  state.hops++;
+  if (state.hops >= maxHops) {
+    state.paused = true;
+    appendMessageInternal(projectId, {
+      sender: "system",
+      type: "system",
+      text: `Loop guard: paused after ${maxHops} agent-to-agent messages with no human reply. Type /continue to resume.`,
+      channel: msg.channel || "general",
+    });
+  }
+  _loopGuardState.set(projectId, state);
+}
+
+function isLoopGuardPaused(projectId) {
+  const state = _loopGuardState.get(projectId);
+  return state ? state.paused : false;
+}
+
+function resetLoopGuard(projectId) {
+  _loopGuardState.delete(projectId);
+}
+
+function appendMessageInternal(projectId, opts) {
+  return appendMessage(projectId, opts, true);
+}
+
+// #715: per-agent shim tokens for authenticated sends.
+// Map<"projectId:agentId", token>
+const _shimTokens = new Map();
+
+function registerShimToken(projectId, agentId, token) {
+  _shimTokens.set(`${projectId}:${agentId}`, token);
+}
+
+function validateShimToken(projectId, agentId, token) {
+  return _shimTokens.get(`${projectId}:${agentId}`) === token;
+}
+
+module.exports = {
+  initProject,
+  shutdownProject,
+  appendMessage,
+  readMessages,
+  getNextId,
+  parseMentions,
+  MENTION_RE,
+  checkLoopGuard,
+  isLoopGuardPaused,
+  resetLoopGuard,
+  registerShimToken,
+  validateShimToken,
+  // exposed for testing
+  _getState: getState,
+  _chatDir: chatDir,
+  _chatFile: chatFile,
+};