quadwork 1.5.2 → 1.5.3

package/out/setup.txt

@@ -11,7 +11,7 @@ d:I[11717,["/_next/static/chunks/04_t39bv8y9pe.js","/_next/static/chunks/0ox7p_s
 f:I[92243,["/_next/static/chunks/04_t39bv8y9pe.js","/_next/static/chunks/0ox7p_szjhn69.js"],"default",1]
 :HL["/_next/static/chunks/0ccoe1hsu70ql.css","style"]
 :HL["/_next/static/media/797e433ab948586e-s.p.0.q-h669a_dqa.woff2","font",{"crossOrigin":"","type":"font/woff2"}]
-0:{"P":null,"c":["","setup"],"q":"","i":false,"f":[[["",{"children":["setup",{"children":["__PAGE__",{}]}]},"$undefined","$undefined",16],[["$","$1","c",{"children":[[["$","link","0",{"rel":"stylesheet","href":"/_next/static/chunks/0ccoe1hsu70ql.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}],["$","script","script-0",{"src":"/_next/static/chunks/04_t39bv8y9pe.js","async":true,"nonce":"$undefined"}],["$","script","script-1",{"src":"/_next/static/chunks/0ox7p_szjhn69.js","async":true,"nonce":"$undefined"}]],["$","html",null,{"lang":"en","className":"geist_mono_8d43a2aa-module__8Li5zG__variable h-full","children":["$","body",null,{"className":"h-full flex flex-col","children":[["$","$L2",null,{}],["$","div",null,{"className":"flex flex-1 min-h-0","children":[["$","$L3",null,{}],["$","main",null,{"className":"flex-1 min-w-0 overflow-auto","children":["$","$L4",null,{"parallelRouterKey":"children","error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L5",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":[[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"},"children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"},"children":404}],["$","div",null,{"style":{"display":"inline-block"},"children":["$","h2",null,{"style":{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0},"children":"This page could not be found."}]}]]}]}]],[]],"forbidden":"$undefined","unauthorized":"$undefined"}]}]]}]]}]}]]}],{"children":[["$","$1","c",{"children":[null,["$","$L4",null,{"parallelRouterKey":"children","error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L5",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":"$undefined","forbidden":"$undefined","unauthorized":"$undefined"}]]}],{"children":[["$","$1","c",{"children":[["$","$L6",null,{}],[["$","script","script-0",{"src":"/_next/static/chunks/084lff9v4p_vh.js","async":true,"nonce":"$undefined"}]],["$","$L7",null,{"children":["$","$8",null,{"name":"Next.MetadataOutlet","children":"$@9"}]}]]}],{},null,false,null]},null,false,"$@a"]},null,false,null],["$","$1","h",{"children":[null,["$","$Lb",null,{"children":"$Lc"}],["$","div",null,{"hidden":true,"children":["$","$Ld",null,{"children":["$","$8",null,{"name":"Next.Metadata","children":"$Le"}]}]}],["$","meta",null,{"name":"next-size-adjust","content":""}]]}],false]],"m":"$undefined","G":["$f",[["$","link","0",{"rel":"stylesheet","href":"/_next/static/chunks/0ccoe1hsu70ql.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}]]],"S":true,"h":null,"s":"$undefined","l":"$undefined","p":"$undefined","d":"$undefined","b":"yMYfZ4LAn8Fy22suFUnOy"}
+0:{"P":null,"c":["","setup"],"q":"","i":false,"f":[[["",{"children":["setup",{"children":["__PAGE__",{}]}]},"$undefined","$undefined",16],[["$","$1","c",{"children":[[["$","link","0",{"rel":"stylesheet","href":"/_next/static/chunks/0ccoe1hsu70ql.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}],["$","script","script-0",{"src":"/_next/static/chunks/04_t39bv8y9pe.js","async":true,"nonce":"$undefined"}],["$","script","script-1",{"src":"/_next/static/chunks/0ox7p_szjhn69.js","async":true,"nonce":"$undefined"}]],["$","html",null,{"lang":"en","className":"geist_mono_8d43a2aa-module__8Li5zG__variable h-full","children":["$","body",null,{"className":"h-full flex flex-col","children":[["$","$L2",null,{}],["$","div",null,{"className":"flex flex-1 min-h-0","children":[["$","$L3",null,{}],["$","main",null,{"className":"flex-1 min-w-0 overflow-auto","children":["$","$L4",null,{"parallelRouterKey":"children","error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L5",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":[[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"},"children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"},"children":404}],["$","div",null,{"style":{"display":"inline-block"},"children":["$","h2",null,{"style":{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0},"children":"This page could not be found."}]}]]}]}]],[]],"forbidden":"$undefined","unauthorized":"$undefined"}]}]]}]]}]}]]}],{"children":[["$","$1","c",{"children":[null,["$","$L4",null,{"parallelRouterKey":"children","error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L5",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":"$undefined","forbidden":"$undefined","unauthorized":"$undefined"}]]}],{"children":[["$","$1","c",{"children":[["$","$L6",null,{}],[["$","script","script-0",{"src":"/_next/static/chunks/084lff9v4p_vh.js","async":true,"nonce":"$undefined"}]],["$","$L7",null,{"children":["$","$8",null,{"name":"Next.MetadataOutlet","children":"$@9"}]}]]}],{},null,false,null]},null,false,"$@a"]},null,false,null],["$","$1","h",{"children":[null,["$","$Lb",null,{"children":"$Lc"}],["$","div",null,{"hidden":true,"children":["$","$Ld",null,{"children":["$","$8",null,{"name":"Next.Metadata","children":"$Le"}]}]}],["$","meta",null,{"name":"next-size-adjust","content":""}]]}],false]],"m":"$undefined","G":["$f",[["$","link","0",{"rel":"stylesheet","href":"/_next/static/chunks/0ccoe1hsu70ql.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}]]],"S":true,"h":null,"s":"$undefined","l":"$undefined","p":"$undefined","d":"$undefined","b":"X4zdS6Y6HkLOaElNeHwnq"}
 10:[]
 a:"$W10"
 c:[["$","meta","0",{"charSet":"utf-8"}],["$","meta","1",{"name":"viewport","content":"width=device-width, initial-scale=1"}]]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quadwork",
-  "version": "1.5.2",
+  "version": "1.5.3",
   "description": "Unified dashboard for multi-agent coding teams — 4 AI agents, one terminal",
   "bin": {
     "quadwork": "./bin/quadwork.js"

package/server/routes.js

@@ -2385,6 +2385,63 @@ function telegramConfigToml(projectId) {
   return path.join(CONFIG_DIR, `telegram-${projectId}.toml`);
 }
 
+// #383: path to a project's AgentChattr config.toml. The install
+// handler patches this file to declare the `telegram-bridge` agent
+// so AC's registry accepts the bridge's register call.
+function projectAgentchattrConfigPath(projectId) {
+  return path.join(CONFIG_DIR, projectId, "agentchattr", "config.toml");
+}
+
+// #383 Bug 1: prefer the per-project agentchattr_url. Every project
+// after the first uses a distinct port (8301, 8302, ...), so reading
+// the global default silently routed bridge traffic to the wrong AC
+// instance.
+function resolveProjectAgentchattrUrl(cfg, project) {
+  return (
+    (project && project.agentchattr_url) ||
+    (cfg && cfg.agentchattr_url) ||
+    "http://127.0.0.1:8300"
+  );
+}
+
+// #383 Bug 2: the upstream bridge only reads `agentchattr_url` from
+// inside `[telegram]`. A separate `[agentchattr]` section is silently
+// ignored and the bridge falls back to its hardcoded :8300 default.
+function buildTelegramBridgeToml(tg) {
+  return (
+    `[telegram]\n` +
+    `bot_token = "${tg.bot_token}"\n` +
+    `chat_id = "${tg.chat_id}"\n` +
+    `agentchattr_url = "${tg.agentchattr_url}"\n`
+  );
+}
+
+// #383 Bug 3: AC's registry rejects any base name not pre-declared
+// in config.toml with `400 unknown base`. The bridge registers as
+// `telegram-bridge`, so every per-project AC config must declare it.
+// Idempotent: only appends if the section is not already present.
+function patchAgentchattrConfigForTelegramBridge(tomlText) {
+  if (/^\[agents\.telegram-bridge\]\s*$/m.test(tomlText)) {
+    return { text: tomlText, changed: false };
+  }
+  const sep = tomlText.length === 0 || tomlText.endsWith("\n") ? "" : "\n";
+  const block = `\n[agents.telegram-bridge]\nlabel = "Telegram Bridge"\n`;
+  return { text: tomlText + sep + block, changed: true };
+}
+
+// #383 Bug 4: the upstream bridge treats env vars as higher
+// precedence than TOML values. If the parent shell exported
+// TELEGRAM_BOT_TOKEN for a different bot, the bridge silently ran
+// as the wrong identity. Scrub those keys from the child's env so
+// the TOML is the single source of truth.
+function buildTelegramBridgeSpawnEnv(parentEnv) {
+  const env = { ...parentEnv };
+  delete env.TELEGRAM_BOT_TOKEN;
+  delete env.TELEGRAM_CHAT_ID;
+  delete env.AGENTCHATTR_URL;
+  return env;
+}
+
 // #353: per-project log file for the bridge subprocess. The start
 // handler redirects stdout + stderr here so crashes (ImportError,
 // config parse, auth failure) are recoverable instead of
@@ -2502,7 +2559,8 @@ function getProjectTelegram(projectId) {
     return {
       bot_token: resolveToken(project.telegram.bot_token || ""),
       chat_id: project.telegram.chat_id || "",
-      agentchattr_url: cfg.agentchattr_url || "http://127.0.0.1:8300",
+      // #383 Bug 1: prefer per-project URL over the global default.
+      agentchattr_url: resolveProjectAgentchattrUrl(cfg, project),
     };
   } catch {
     return null;
@@ -2638,7 +2696,31 @@ router.post("/api/telegram", async (req, res) => {
             `pip output tail:\n${pipOutput.split("\n").slice(-10).join("\n")}`,
         });
       }
-      return res.json({ ok: true });
+      // #383 Bug 3: ensure every known project's AC config declares
+      // the `telegram-bridge` agent. Without this, AC's registry
+      // rejects the bridge's register call with `400 unknown base`
+      // and the bridge enters an infinite re-register loop.
+      // Idempotent — append-only, skips configs that already have
+      // the section. Does NOT restart AC servers; the operator
+      // must click SERVER → Restart to load the new agent slug.
+      const patched = [];
+      try {
+        const cfgAll = JSON.parse(fs.readFileSync(CONFIG_PATH, "utf-8"));
+        for (const proj of cfgAll.projects || []) {
+          if (!proj || !proj.id) continue;
+          const acPath = projectAgentchattrConfigPath(proj.id);
+          if (!fs.existsSync(acPath)) continue;
+          try {
+            const before = fs.readFileSync(acPath, "utf-8");
+            const { text, changed } = patchAgentchattrConfigForTelegramBridge(before);
+            if (changed) {
+              fs.writeFileSync(acPath, text);
+              patched.push(proj.id);
+            }
+          } catch {}
+        }
+      } catch {}
+      return res.json({ ok: true, patched_projects: patched });
     }
     case "start": {
       const projectId = body.project_id;
@@ -2661,7 +2743,9 @@ router.post("/api/telegram", async (req, res) => {
       const tg = getProjectTelegram(projectId);
       if (!tg || !tg.bot_token || !tg.chat_id) return res.json({ ok: false, error: "Save bot_token and chat_id in project settings first." });
       const tomlPath = telegramConfigToml(projectId);
-      const tomlContent = `[telegram]\nbot_token = "${tg.bot_token}"\nchat_id = "${tg.chat_id}"\n\n[agentchattr]\nurl = "${tg.agentchattr_url}"\n`;
+      // #383 Bug 2: write agentchattr_url inside [telegram]; the
+      // bridge's load_config only reads from that section.
+      const tomlContent = buildTelegramBridgeToml(tg);
       fs.writeFileSync(tomlPath, tomlContent, { mode: 0o600 });
       fs.chmodSync(tomlPath, 0o600);
       // #353: pre-flight import check so a fresh install with no
@@ -2710,9 +2794,15 @@ router.post("/api/telegram", async (req, res) => {
       }
       let child;
       try {
+        // #383 Bug 4: scrub TELEGRAM_*/AGENTCHATTR_URL from the child
+        // env so an operator shell that exports a different bot's
+        // token (common on machines running AC2) can't silently
+        // override the TOML. Makes the TOML the single source of
+        // truth for the bridge's identity.
         child = spawn(venvPython, [bridgeScript, "--config", tomlPath], {
           detached: true,
           stdio: ["ignore", outFd, errFd],
+          env: buildTelegramBridgeSpawnEnv(process.env),
         });
         child.unref();
         if (child.pid) fs.writeFileSync(telegramPidFile(projectId), String(child.pid));
@@ -2898,6 +2988,13 @@ module.exports.readLastLines = readLastLines;
 // #380: expose checkTelegramBridgePythonDeps so the bridge test can
 // exercise the venv-path interpreter argument round trip.
 module.exports.checkTelegramBridgePythonDeps = checkTelegramBridgePythonDeps;
+// #383: pure helpers exposed for unit tests in
+// routes.telegramBridge.test.js. No production callers outside
+// this file.
+module.exports.resolveProjectAgentchattrUrl = resolveProjectAgentchattrUrl;
+module.exports.buildTelegramBridgeToml = buildTelegramBridgeToml;
+module.exports.patchAgentchattrConfigForTelegramBridge = patchAgentchattrConfigForTelegramBridge;
+module.exports.buildTelegramBridgeSpawnEnv = buildTelegramBridgeSpawnEnv;
 // #236: expose sendViaWebSocket so the chat-ws-send regression test
 // can verify the ack/body/error paths against a fake AC ws server.
 module.exports.sendViaWebSocket = sendViaWebSocket;

package/server/routes.telegramBridge.test.js

@@ -11,7 +11,14 @@ const fs = require("node:fs");
 const os = require("node:os");
 const path = require("node:path");
 const { execFileSync } = require("node:child_process");
-const { readLastLines, checkTelegramBridgePythonDeps } = require("./routes");
+const {
+  readLastLines,
+  checkTelegramBridgePythonDeps,
+  resolveProjectAgentchattrUrl,
+  buildTelegramBridgeToml,
+  patchAgentchattrConfigForTelegramBridge,
+  buildTelegramBridgeSpawnEnv,
+} = require("./routes");
 
 const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "qw-bridge-log-"));
 function write(name, content) {
@@ -133,8 +140,96 @@ try {
     venvSkipped = true;
   }
 
+  // 12) #383 Bug 1: resolveProjectAgentchattrUrl prefers the
+  //     per-project URL over the global default. Every project
+  //     after the first uses a distinct port, so silently reading
+  //     the global default routed bridge traffic to the wrong AC
+  //     instance.
+  assert.equal(
+    resolveProjectAgentchattrUrl(
+      { agentchattr_url: "http://127.0.0.1:8300" },
+      { id: "quadwork", agentchattr_url: "http://127.0.0.1:8301" },
+    ),
+    "http://127.0.0.1:8301",
+  );
+  // Falls back to global default when the project has no URL of
+  // its own (legacy single-project installs).
+  assert.equal(
+    resolveProjectAgentchattrUrl(
+      { agentchattr_url: "http://127.0.0.1:8300" },
+      { id: "legacy" },
+    ),
+    "http://127.0.0.1:8300",
+  );
+  // Hard-coded fallback when neither is set.
+  assert.equal(
+    resolveProjectAgentchattrUrl({}, {}),
+    "http://127.0.0.1:8300",
+  );
+
+  // 13) #383 Bug 2: buildTelegramBridgeToml writes agentchattr_url
+  //     inside [telegram]. The upstream bridge's load_config only
+  //     reads from that section — a separate [agentchattr] section
+  //     is silently ignored and the bridge falls back to its
+  //     hardcoded :8300 default.
+  const toml13 = buildTelegramBridgeToml({
+    bot_token: "123:abc",
+    chat_id: "-42",
+    agentchattr_url: "http://127.0.0.1:8301",
+  });
+  assert.match(toml13, /^\[telegram\]/);
+  assert.match(toml13, /bot_token = "123:abc"/);
+  assert.match(toml13, /chat_id = "-42"/);
+  assert.match(toml13, /agentchattr_url = "http:\/\/127\.0\.0\.1:8301"/);
+  // Must NOT emit a separate [agentchattr] section — the bridge
+  // would silently ignore it.
+  assert.equal(toml13.includes("\n[agentchattr]\n"), false);
+
+  // 14) #383 Bug 3: patchAgentchattrConfigForTelegramBridge is
+  //     idempotent. The Install Bridge migration may run multiple
+  //     times; it must not duplicate the section or corrupt the
+  //     file.
+  const baseConfig =
+    "[agents.head]\nlabel = \"Head\"\n\n[agents.dev]\nlabel = \"Dev\"\n";
+  const first = patchAgentchattrConfigForTelegramBridge(baseConfig);
+  assert.equal(first.changed, true);
+  assert.match(first.text, /^\[agents\.telegram-bridge\]$/m);
+  assert.match(first.text, /label = "Telegram Bridge"/);
+  // Running a second time is a no-op.
+  const second = patchAgentchattrConfigForTelegramBridge(first.text);
+  assert.equal(second.changed, false);
+  assert.equal(second.text, first.text);
+  // A config that was hand-patched during diagnosis is recognized
+  // as already-correct — do not clobber the operator's edit.
+  const handPatched =
+    baseConfig + "\n[agents.telegram-bridge]\nlabel = \"Telegram Bridge\"\n";
+  const third = patchAgentchattrConfigForTelegramBridge(handPatched);
+  assert.equal(third.changed, false);
+  assert.equal(third.text, handPatched);
+
+  // 15) #383 Bug 4: buildTelegramBridgeSpawnEnv strips the three
+  //     env vars the upstream bridge treats as higher-precedence
+  //     than TOML. Without this, an operator shell that exported a
+  //     different bot's token (common on machines running AC2)
+  //     silently overrode the QuadWork-written TOML and the bridge
+  //     ran as the wrong identity.
+  const scrubbed = buildTelegramBridgeSpawnEnv({
+    PATH: "/usr/bin",
+    HOME: "/home/op",
+    TELEGRAM_BOT_TOKEN: "wrong-token",
+    TELEGRAM_CHAT_ID: "-999",
+    AGENTCHATTR_URL: "http://127.0.0.1:9999",
+  });
+  assert.equal(scrubbed.TELEGRAM_BOT_TOKEN, undefined);
+  assert.equal(scrubbed.TELEGRAM_CHAT_ID, undefined);
+  assert.equal(scrubbed.AGENTCHATTR_URL, undefined);
+  // Non-telegram keys must pass through untouched — the bridge
+  // still needs PATH/HOME/etc. to find python and open files.
+  assert.equal(scrubbed.PATH, "/usr/bin");
+  assert.equal(scrubbed.HOME, "/home/op");
+
   console.log(
-    "routes.telegramBridge.test.js: all assertions passed (11 cases" +
+    "routes.telegramBridge.test.js: all assertions passed (15 cases" +
       (venvSkipped ? ", case 11 pip step skipped" : "") +
       ")",
   );

package/templates/config.toml

@@ -37,6 +37,14 @@ cwd = "{{dev_cwd}}"
 color = "#da7756"
 label = "Dev Builder"
 
+# #383: AC's registry rejects bases not declared in config.toml.
+# The Telegram bridge registers as `telegram-bridge`, so every
+# per-project AC config must declare it. The bridge has no
+# command/cwd of its own — it is a long-running external client
+# that posts to AC's HTTP API.
+[agents.telegram-bridge]
+label = "Telegram Bridge"
+
 [routing]
 default = "none"
 max_agent_hops = 30