taskboy 0.1.1__py3-none-any.whl

taskboy/dashboard/app.py

@@ -0,0 +1,78 @@
+"""fastapi application factory for mission control.
+
+serves the json api plus the built react spa. the alb terminates tls and runs auth0
+oidc; this app verifies the alb's identity header per request (auth.py). /healthz is
+the only unauthenticated data route — alb health checks hit the target directly.
+"""
+
+import logging
+from pathlib import Path
+
+from fastapi import FastAPI, HTTPException, Request
+from fastapi.responses import FileResponse, JSONResponse
+from starlette.staticfiles import StaticFiles
+
+from taskboy.dashboard.api import router
+from taskboy.dashboard.auth import NotAuthenticated, NotAuthorized
+from taskboy.dashboard.editors import EditorError
+
+logger = logging.getLogger("taskboy.dashboard")
+
+
+def create_app(store, config, notifier, secrets, orchestrator=None, ui_dist: str = "ui/dist") -> FastAPI:
+    app = FastAPI(title="agent dashboard", docs_url=None, redoc_url=None, openapi_url=None)
+    app.state.store = store
+    app.state.config = config
+    app.state.notifier = notifier
+    app.state.secrets = secrets
+    app.state.orchestrator = orchestrator
+    app.state.alb_key_cache = {}
+    dist = Path(ui_dist)
+
+    @app.middleware("http")
+    async def security_headers(request: Request, call_next):
+        response = await call_next(request)
+        response.headers["Content-Security-Policy"] = "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'"
+        response.headers["X-Frame-Options"] = "DENY"
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["Referrer-Policy"] = "no-referrer"
+        if request.url.path.startswith("/api/"):
+            response.headers["Cache-Control"] = "no-store"
+        return response
+
+    @app.exception_handler(NotAuthenticated)
+    async def unauthenticated(request: Request, e: NotAuthenticated):
+        return JSONResponse({"detail": str(e)}, status_code=401)
+
+    @app.exception_handler(NotAuthorized)
+    async def unauthorized(request: Request, e: NotAuthorized):
+        return JSONResponse({"detail": str(e)}, status_code=403)
+
+    @app.exception_handler(EditorError)
+    async def editor_missing(request: Request, e: EditorError):
+        return JSONResponse({"detail": str(e)}, status_code=404)
+
+    @app.get("/healthz")
+    async def healthz() -> dict:
+        return {"status": "ok"}
+
+    app.include_router(router)
+
+    if (dist / "assets").is_dir():
+        app.mount("/assets", StaticFiles(directory=dist / "assets"), name="assets")
+
+    @app.get("/{full_path:path}")
+    async def spa(full_path: str):
+        # client-side routing: any non-api path gets the app shell; real files in dist are served as-is
+        if full_path.startswith("api/"):
+            raise HTTPException(status_code=404, detail="not found")
+        if full_path and "/" not in full_path and ".." not in full_path:
+            candidate = dist / full_path
+            if candidate.is_file():
+                return FileResponse(candidate)
+        index = dist / "index.html"
+        if not index.is_file():
+            return JSONResponse({"detail": "ui build not found — run `npm run build` in ui/"}, status_code=503)
+        return FileResponse(index, headers={"Cache-Control": "no-cache"})
+
+    return app

taskboy/dashboard/auth.py

@@ -0,0 +1,117 @@
+"""viewer identity from the alb's signed oidc header.
+
+the alb runs the auth0 sign-in flow at the edge; every forwarded request carries
+x-amzn-oidc-data, an ES256 jwt signed by the alb. the regional key endpoint serves
+signing keys for every alb in the region across all aws accounts, so a validly-signed
+token alone doesn't prove it came from our alb (sg misconfig, vpc pivot, ssrf) - pinning
+the header's signer claim to dashboard.expected_alb_arn is what makes it trustworthy.
+the app also enforces the email domain because auth0 cannot restrict it at the alb.
+
+read access: any account under dashboard.allowed_email_domain.
+write access: emails listed in dashboard.admin_emails (config.yaml).
+"""
+
+import base64
+import binascii
+import json
+import time
+from dataclasses import dataclass
+
+import jwt
+from fastapi import Request
+
+from taskboy import settings
+from taskboy.config import DashboardConfig
+
+OIDC_DATA_HEADER = "x-amzn-oidc-data"
+CSRF_HEADER = "x-harness-dashboard"  # custom header on mutating requests: cross-site forms can't set it, cross-site fetch fails preflight
+
+
+class NotAuthenticated(Exception):
+    pass
+
+
+class NotAuthorized(Exception):
+    pass
+
+
+@dataclass
+class Viewer:
+    email: str
+    admin: bool
+
+
+def _b64url_decode(segment: str) -> bytes:
+    return base64.urlsafe_b64decode(segment + "=" * (-len(segment) % 4))
+
+
+async def _public_key(request: Request, kid: str) -> str:
+    """alb signing keys are fetched per key id and cached on the app; they rotate rarely."""
+    cache: dict[str, str] = request.app.state.alb_key_cache
+    if kid not in cache:
+        import aiohttp
+
+        url = f"https://public-keys.auth.elb.{settings.REGION}.amazonaws.com/{kid}"
+        async with aiohttp.ClientSession(timeout=aiohttp.ClientTimeout(total=10)) as session:
+            async with session.get(url) as response:
+                response.raise_for_status()
+                cache[kid] = await response.text()
+    return cache[kid]
+
+
+async def viewer_from_request(request: Request) -> Viewer:
+    config: DashboardConfig = request.app.state.config.dashboard
+    token = request.headers.get(OIDC_DATA_HEADER, "").strip()
+    if not token:
+        # local dev runs without an alb; a configured dev identity stands in
+        if settings.ENVIRONMENT == "local" and config.dev_user_email:
+            return _authorize(config, config.dev_user_email)
+        raise NotAuthenticated("no identity header")
+    try:
+        header = json.loads(_b64url_decode(token.split(".")[0]))
+        kid = header["kid"]
+        # the regional key endpoint serves every alb in the region, so pin the signer
+        if header.get("signer") != config.expected_alb_arn:
+            raise NotAuthenticated("identity header signer does not match the expected alb")
+        key = await _public_key(request, kid)
+        claims = jwt.decode(token, key, algorithms=["ES256"])
+    except (jwt.PyJWTError, KeyError, ValueError, IndexError, binascii.Error, json.JSONDecodeError) as e:
+        raise NotAuthenticated(f"identity header rejected: {type(e).__name__}")
+    if int(claims.get("exp", 0)) < int(time.time()) - 60:
+        raise NotAuthenticated("identity expired")
+    email = str(claims.get("email") or "").lower()
+    if not email:
+        raise NotAuthenticated("identity has no email claim")
+    email_verified = claims.get("email_verified")
+    if "email_verified" in claims and (not email_verified or str(email_verified).lower() == "false"):
+        raise NotAuthorized("email is not verified")
+    return _authorize(config, email)
+
+
+def _authorize(config: DashboardConfig, email: str) -> Viewer:
+    email = email.lower()
+    if not email.endswith("@" + config.allowed_email_domain):
+        raise NotAuthorized(f"{email} is outside the allowed domain")
+    return Viewer(email=email, admin=email in config.admin_emails)
+
+
+async def require_viewer(request: Request) -> Viewer:
+    return await viewer_from_request(request)
+
+
+async def require_viewer_write(request: Request) -> Viewer:
+    # any workspace member may submit (e.g. task feedback), with the same csrf guard as admin writes
+    viewer = await viewer_from_request(request)
+    if request.method not in ("GET", "HEAD", "OPTIONS") and request.headers.get(CSRF_HEADER) != "1":
+        raise NotAuthorized("missing dashboard request header")
+    return viewer
+
+
+async def require_admin(request: Request) -> Viewer:
+    viewer = await viewer_from_request(request)
+    if not viewer.admin:
+        request.app.state.store.add_admin_event(viewer.email, "authorize", request.url.path, "denied", {"reason": "not in dashboard.admin_emails"})
+        raise NotAuthorized("management actions require an email listed in dashboard.admin_emails")
+    if request.method not in ("GET", "HEAD", "OPTIONS") and request.headers.get(CSRF_HEADER) != "1":
+        raise NotAuthorized("missing dashboard request header")
+    return viewer

taskboy/dashboard/editors.py

@@ -0,0 +1,140 @@
+"""the management edit engine: resolve targets, validate, diff, and write atomically.
+
+each editable kind maps to one live file (what the service reads) and one repo path (what
+gitops commits). validation runs the same loader the service uses, so a save that
+passes here cannot brick the service.
+"""
+
+import difflib
+import hashlib
+import os
+import shutil
+import stat
+import tempfile
+from pathlib import Path
+
+import yaml
+
+from taskboy import personality, settings, skills, started_messages
+from taskboy.config import KNOWN_SERVICES, Config, load_config
+from taskboy.dashboard.render import SECRET_KEY
+from taskboy.redact import redactor
+
+EDITABLE_KINDS = ("config", "service", "personality", "reviewer_personality", "help", "started", "skill", "conventions")
+
+
+class EditorError(Exception):
+    pass
+
+
+def content_hash(content: str) -> str:
+    return hashlib.sha256(content.encode()).hexdigest()
+
+
+def target_for(config: Config, kind: str, name: str | None) -> tuple[Path, str, str]:
+    """returns (live_path, repo_path, title). repo layout keeps config files under config/ and skills under skills/."""
+    if kind == "config":
+        return Path(settings.CONFIG_PATH), "config/config.yaml", "System configuration"
+    if kind == "service" and name in KNOWN_SERVICES:
+        live = Path(settings.CONFIG_PATH).parent / "services" / f"{name}.yaml"
+        if live.is_file():  # legacy configs keep service sections inline in config.yaml and get no per-service editor
+            return live, f"config/services/{name}.yaml", f"{name} service"
+    if kind == "personality" and config.personality_path:
+        return Path(config.personality_path), f"config/{Path(config.personality_path).name}", "Personality"
+    if kind == "reviewer_personality" and config.reviewer.personality_path:
+        return Path(config.reviewer.personality_path), f"config/{Path(config.reviewer.personality_path).name}", "Reviewer personality"
+    if kind == "help" and config.help_path:
+        return Path(config.help_path), f"config/{Path(config.help_path).name}", "Help"
+    if kind == "started" and config.slack.task_started_messages_path:
+        return Path(config.slack.task_started_messages_path), f"config/{Path(config.slack.task_started_messages_path).name}", "Task Started messages"
+    if kind == "conventions" and config.conventions_path:
+        return Path(config.conventions_path), f"config/{Path(config.conventions_path).name}", "Engineering conventions"
+    if kind == "skill" and name and name in skills.available(settings.SKILLS_ROOT):
+        return Path(settings.SKILLS_ROOT) / name / "SKILL.md", f"skills/{name}/SKILL.md", f"Skill /{name}"
+    raise EditorError("editable target not found")
+
+
+def contains_secret_submission(kind: str, content: str) -> bool:
+    if redactor.redact(content) != content:
+        return True
+    if kind not in ("config", "service"):
+        return False
+    try:
+        value = yaml.safe_load(content)
+    except yaml.YAMLError:
+        return False
+
+    def has_secret(item: object, key: str = "") -> bool:
+        # only a non-empty string under a secret-named key is a real secret; numeric config like
+        # usage_limits.*_tokens matches the "token" name but is a count, not a credential
+        if SECRET_KEY.search(key) and isinstance(item, str) and item:
+            return True
+        if isinstance(item, dict):
+            return any(has_secret(child, str(child_key)) for child_key, child in item.items())
+        if isinstance(item, list):
+            return any(has_secret(child, key) for child in item)
+        return False
+
+    return has_secret(value)
+
+
+def validate(kind: str, name: str | None, content: str, target: Path) -> None:
+    if contains_secret_submission(kind, content):
+        raise ValueError("secret-looking values are not accepted here; use the configured secrets store")
+    if kind == "config":
+        handle, temp_name = tempfile.mkstemp(prefix=".dashboard-validate-", suffix=".yaml", dir=target.parent)
+        os.close(handle)
+        try:
+            Path(temp_name).write_text(content)
+            load_config(temp_name)
+        finally:
+            Path(temp_name).unlink(missing_ok=True)
+    elif kind == "service" and name:
+        # a service file only validates in context, so run the full loader over a scratch copy of the config dir
+        config_path = Path(settings.CONFIG_PATH)
+        with tempfile.TemporaryDirectory() as root:
+            scratch = Path(root) / "config"
+            shutil.copytree(config_path.parent, scratch)
+            (scratch / "services").mkdir(exist_ok=True)
+            (scratch / "services" / f"{name}.yaml").write_text(content)
+            load_config(str(scratch / config_path.name))
+    elif kind in ("personality", "reviewer_personality", "help"):
+        handle, temp_name = tempfile.mkstemp(prefix=".dashboard-validate-", suffix=".md", dir=target.parent)
+        os.close(handle)
+        try:
+            Path(temp_name).write_text(content)
+            if personality.load(temp_name) is None:
+                raise ValueError(f"{kind} must contain non-whitespace text")
+        finally:
+            Path(temp_name).unlink(missing_ok=True)
+    elif kind == "started":
+        started_messages.validate_content(content)
+    elif kind == "conventions":
+        if not content.strip():
+            raise ValueError("conventions must contain non-whitespace text")
+    elif kind == "skill" and name:
+        with tempfile.TemporaryDirectory() as root:
+            path = Path(root) / name / "SKILL.md"
+            path.parent.mkdir()
+            path.write_text(content)
+            skills.load(root, name)
+    else:
+        raise ValueError("unsupported editor")
+
+
+def unified_diff(previous: str, content: str, title: str) -> str:
+    return "".join(difflib.unified_diff(previous.splitlines(keepends=True), content.splitlines(keepends=True), fromfile=f"{title} (current)", tofile=f"{title} (proposed)"))
+
+
+def atomic_write(path: Path, content: str) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    existing_mode = stat.S_IMODE(path.stat().st_mode) if path.exists() else 0o640
+    handle, temp_name = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
+    os.close(handle)
+    temp_path = Path(temp_name)
+    try:
+        temp_path.write_text(content)
+        temp_path.chmod(existing_mode)
+        os.replace(temp_path, path)
+    finally:
+        temp_path.unlink(missing_ok=True)

taskboy/dashboard/gitops.py

@@ -0,0 +1,60 @@
+"""auto-commit dashboard edits back to the repo via the github contents api.
+
+edits apply to the live host files immediately; this pushes the same change to git so
+the repo stays the source of truth and the next deploy re-ships what is already live.
+dashboard commits go straight to main; the agent's app tokens are for task sessions, which
+are blocked from pushing to protected branches, so the dashboard uses its own contents-only pat.
+"""
+
+import base64
+import json
+import logging
+
+logger = logging.getLogger("taskboy.dashboard")
+
+API_BASE = "https://api.github.com"
+
+
+class GitOpsError(Exception):
+    pass
+
+
+async def _request(method: str, url: str, token: str, payload: dict | None = None) -> tuple[int, dict]:
+    """the network seam — patched in unit tests."""
+    import aiohttp
+
+    headers = {"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json", "X-GitHub-Api-Version": "2022-11-28"}
+    async with aiohttp.ClientSession(timeout=aiohttp.ClientTimeout(total=20)) as session:
+        async with session.request(method, url, headers=headers, data=json.dumps(payload) if payload is not None else None) as response:
+            body = await response.text()
+            try:
+                data = json.loads(body) if body else {}
+            except json.JSONDecodeError:
+                data = {}
+            return response.status, data
+
+
+async def commit_file(token: str, repo: str, branch: str, repo_path: str, content: str, message: str, actor: str, committer_name: str = "Dashboard", committer_email: str = "") -> dict:
+    """create or update one file on the branch; returns {'commit_sha', 'html_url'}."""
+    url = f"{API_BASE}/repos/{repo}/contents/{repo_path}"
+    status, existing = await _request("GET", f"{url}?ref={branch}", token)
+    if status == 200 and existing.get("content") is not None:
+        current = base64.b64decode(existing["content"]).decode()
+        if current == content:
+            return {"commit_sha": "", "html_url": "", "unchanged": True}
+    if status not in (200, 404):
+        raise GitOpsError(f"github read of {repo_path} failed with status {status}")
+    payload = {
+        "message": message,
+        "content": base64.b64encode(content.encode()).decode(),
+        "branch": branch,
+        "committer": {"name": committer_name, "email": committer_email},
+    }
+    if status == 200 and existing.get("sha"):
+        payload["sha"] = existing["sha"]
+    status, data = await _request("PUT", url, token, payload)
+    if status not in (200, 201):
+        raise GitOpsError(f"github commit of {repo_path} failed with status {status}: {str(data.get('message') or '')[:200]}")
+    commit = data.get("commit") or {}
+    logger.info("committed %s to %s@%s (%s, by %s)", repo_path, repo, branch, commit.get("sha", ""), actor)
+    return {"commit_sha": commit.get("sha", ""), "html_url": commit.get("html_url", ""), "unchanged": False}

taskboy/dashboard/render.py

@@ -0,0 +1,48 @@
+"""redacted presentation helpers: everything leaving the api passes through the shared redactor."""
+
+import json
+import re
+from dataclasses import asdict, is_dataclass
+from typing import Any, cast
+
+from taskboy.redact import redactor
+
+SECRET_KEY = re.compile(r"(?i)(secret|password|passwd|token|credential|private[_-]?key|api[_-]?key)")
+
+
+def safe_text(value: object) -> str:
+    if value is None:
+        return ""
+    if not isinstance(value, str):
+        value = json.dumps(value, default=str, sort_keys=True)
+    return redactor.redact(value)
+
+
+def bounded_text(value: object, limit: int = 10000) -> str:
+    text = safe_text(value)
+    return text if len(text) <= limit else text[:limit] + "\n[… truncated in dashboard …]"
+
+
+def redact_value(value: object, key: str = "") -> object:
+    # mask only string values under a secret-named key; numeric config (e.g. usage_limits.*_tokens) is not a secret
+    if SECRET_KEY.search(key) and isinstance(value, str):
+        return "••••••••" if value else "not configured"
+    if is_dataclass(value):
+        value = asdict(cast(Any, value))
+    if isinstance(value, dict):
+        return {str(item_key): redact_value(item_value, str(item_key)) for item_key, item_value in value.items()}
+    if isinstance(value, (list, tuple)):
+        return [redact_value(item) for item in value]
+    return safe_text(value) if isinstance(value, str) else value
+
+
+def redact_bounded_value(value: object, key: str = "") -> object:
+    if SECRET_KEY.search(key) and isinstance(value, str):
+        return "••••••••" if value else "not configured"
+    if is_dataclass(value):
+        value = asdict(cast(Any, value))
+    if isinstance(value, dict):
+        return {str(item_key): redact_bounded_value(item_value, str(item_key)) for item_key, item_value in value.items()}
+    if isinstance(value, (list, tuple)):
+        return [redact_bounded_value(item) for item in value]
+    return bounded_text(value) if isinstance(value, str) else value

taskboy/debug_feed.py

@@ -0,0 +1,170 @@
+"""best-effort, token-free Slack debug threads built only from stored text."""
+
+import json
+import logging
+import time
+import traceback
+
+from taskboy.models import Task
+from taskboy.mrkdwn import to_mrkdwn
+from taskboy.redact import redactor
+from taskboy.store import Store
+
+logger = logging.getLogger("taskboy.debug_feed")
+
+SNIPPET_THRESHOLD = 3500
+
+# repeats of the same (component, message) are suppressed this long; in-memory, resets on restart
+SYSTEM_ERROR_COOLDOWN_SECONDS = 900
+
+
+def _now() -> float:
+    return time.monotonic()
+
+
+class DebugFeed:
+    def __init__(self, client, store: Store, channel_id: str, dashboard_url: str = ""):
+        self.client = client
+        self.store = store
+        self.channel_id = channel_id
+        self.dashboard_url = dashboard_url.rstrip("/")
+        # (component, message) -> last_posted_monotonic
+        self._system_error_state: dict[tuple[str, str], float] = {}
+
+    def _record_failure(self, operation: str, error: Exception, task_id: str | None = None) -> None:
+        logger.warning("debug feed %s failed", operation, exc_info=True)
+        try:
+            self.store.add_error("debug_feed", type(error).__name__, str(error), task_id=task_id, traceback=traceback.format_exc(), context={"operation": operation})
+        except Exception:
+            logger.exception("could not record debug feed failure")
+
+    async def open_thread(self, *, user_id: str, channel_id: str, request_text: str, user_profile: dict | None = None) -> tuple[str, str] | None:
+        profile = user_profile or {}
+        name = profile.get("real_name") or profile.get("display_name") or profile.get("username")
+        requester = f"<@{user_id}>" + (f" ({name})" if name else "")
+        source_channel = f"<#{channel_id}>" if channel_id else "n/a"
+        text = f"Requester: {requester}\nSource channel: {source_channel}\nRequest:\n{request_text}"
+        try:
+            response = await self.client.chat_postMessage(channel=self.channel_id, text=redactor.redact(to_mrkdwn(text)), unfurl_links=False, unfurl_media=False)
+            thread_ts = str(response.get("ts") or "")
+            if not thread_ts:
+                raise RuntimeError("debug root post returned no timestamp")
+            link = await self.client.chat_getPermalink(channel=self.channel_id, message_ts=thread_ts)
+            permalink = str(link.get("permalink") or "")
+            return thread_ts, permalink
+        except Exception as e:
+            self._record_failure("open_thread", e)
+            return None
+
+    async def post(self, thread_ts: str | None, text: str, task_id: str | None = None) -> None:
+        if not thread_ts:
+            return
+        try:
+            await self.client.chat_postMessage(channel=self.channel_id, thread_ts=thread_ts, text=redactor.redact(to_mrkdwn(text))[:39000], unfurl_links=False, unfurl_media=False)
+        except Exception as e:
+            self._record_failure("post", e, task_id)
+
+    async def post_file(self, thread_ts: str | None, filename: str, title: str, content: str, initial_comment: str = "", task_id: str | None = None) -> None:
+        if not thread_ts:
+            return
+        try:
+            await self.client.files_upload_v2(
+                channel=self.channel_id,
+                thread_ts=thread_ts,
+                filename=filename,
+                title=title,
+                content=redactor.redact(content),
+                initial_comment=redactor.redact(to_mrkdwn(initial_comment)),
+            )
+        except Exception as e:
+            self._record_failure("post_file", e, task_id)
+            await self.post(thread_ts, f"{initial_comment}\n\n{content[:SNIPPET_THRESHOLD]}", task_id)
+
+    async def classified(self, task: Task) -> None:
+        await self.post(task.debug_thread_ts, f"Classification: {task.classification_json or '{}'}\nRouting: model={task.model_alias or 'n/a'} ({task.model_id or 'n/a'}), profile={task.profile or 'n/a'}\nRationale: {task.routing_rationale or 'n/a'}", task.task_id)
+
+    async def started(self, task: Task) -> None:
+        await self.post(task.debug_thread_ts, f"Started task `{task.task_id}`\nModel: {task.model_alias or 'n/a'} ({task.model_id or 'n/a'})\nProfile: {task.profile or 'n/a'}\nAttempt: {task.attempt}", task.task_id)
+
+    async def progress(self, task: Task, message: str) -> None:
+        await self.post(task.debug_thread_ts, f"Progress: {message}", task.task_id)
+
+    async def prompt_file(self, task: Task, prompt_text: str) -> None:
+        await self.post_file(task.debug_thread_ts, f"{task.task_id}-prompt.md", f"Task {task.task_id} sub-agent prompt", prompt_text, "Full sub-agent prompt attached.", task.task_id)
+
+    async def completed(self, task: Task) -> None:
+        report = task.result_summary or ""
+        if len(report) > SNIPPET_THRESHOLD:
+            await self.post_file(task.debug_thread_ts, f"{task.task_id}-report.md", f"Task {task.task_id} Final Report", report, "Task completed. Full Final Report attached.", task.task_id)
+        else:
+            await self.post(task.debug_thread_ts, f"Task completed.\n\n{report}", task.task_id)
+        footer = self._metrics(task)
+        if self.dashboard_url:
+            footer += f"\n[Rate this task]({self.dashboard_url}/tasks/{task.task_id}/feedback)"
+        await self.post(task.debug_thread_ts, footer, task.task_id)
+
+    async def failed(self, task: Task, error: str) -> None:
+        await self.post(task.debug_thread_ts, f"Task failed: {error}\n\n{self._metrics(task)}", task.task_id)
+
+    async def blocked(self, task: Task) -> None:
+        await self.post(task.debug_thread_ts, f"Task blocked: {task.blocked_reason or ''}\n\n{self._metrics(task)}", task.task_id)
+
+    async def questions(self, task: Task, questions: str) -> None:
+        await self.post(task.debug_thread_ts, f"Task waiting on requester answers:\n{questions}\n\n{self._metrics(task)}", task.task_id)
+
+    async def recovered(self, task: Task) -> None:
+        await self.post(task.debug_thread_ts, f"Task recovered and requeued (attempt {task.attempt}).", task.task_id)
+
+    async def refused(self, task: Task, reason: str) -> None:
+        await self.post(task.debug_thread_ts, f"Task refused: {reason}", task.task_id)
+
+    async def quick_answer(self, task: Task, latency: float | None = None, usage: dict | None = None) -> None:
+        if latency is None:
+            for event in self.store.events_for(task.task_id):
+                if event["kind"] != "quick_answer":
+                    continue
+                try:
+                    latency = float(json.loads(event["detail_json"]).get("latency_s") or 0)
+                except (TypeError, ValueError, json.JSONDecodeError):
+                    latency = 0.0
+        detail = f"Quick answer selected.\nLatency: {latency if latency is not None else 0:.3f}s\nAnswer:\n{task.reply or task.result_summary or ''}"
+        await self.post(task.debug_thread_ts, detail, task.task_id)
+        await self.post(task.debug_thread_ts, self._metrics(task), task.task_id)
+
+    async def intake_refusal(self, thread_ts: str | None, reason: str) -> None:
+        await self.post(thread_ts, f"Intake refused: {reason}")
+
+    async def system_error(self, component: str, message: str) -> bool:
+        """returns False when the repeat was suppressed, so callers don't mark it as delivered."""
+        key = (component, message)
+        now = _now()
+        last_posted = self._system_error_state.get(key)
+        if last_posted is not None and now - last_posted < SYSTEM_ERROR_COOLDOWN_SECONDS:
+            return False
+        # evict entries whose cooldown has fully elapsed, to keep the dict from growing unbounded
+        self._system_error_state = {k: v for k, v in self._system_error_state.items() if now - v < SYSTEM_ERROR_COOLDOWN_SECONDS}
+        # claim the window before the post so concurrent calls suppress instead of all posting
+        self._system_error_state[key] = now
+        try:
+            await self.client.chat_postMessage(channel=self.channel_id, text=redactor.redact(to_mrkdwn(f"System error ({component}): {message}")), unfurl_links=False, unfurl_media=False)
+        except Exception as e:
+            self._record_failure("system_error", e)
+            # the claim didn't hold, and restoring an expired last_posted is the same as having no entry
+            self._system_error_state.pop(key, None)
+            return False
+        return True
+
+    def _metrics(self, task: Task) -> str:
+        usage_lines = []
+        for row in self.store.usage_for(task.task_id):
+            usage_lines.append(f"- {row['source']} ({row['model']}): input={row['input_tokens'] or 0}, output={row['output_tokens'] or 0}, cache_read={row['cache_read_tokens'] or 0}, cache_write={row['cache_write_tokens'] or 0}, cost=${float(row['cost_usd'] or 0):.6f}")
+        timing_lines = []
+        for event in self.store.events_for(task.task_id):
+            if event["kind"] != "timing":
+                continue
+            try:
+                detail = json.loads(event["detail_json"])
+            except (TypeError, json.JSONDecodeError):
+                continue
+            timing_lines.append(f"- {detail.get('stage', 'unknown')}: {float(detail.get('seconds') or 0):.3f}s")
+        return "Usage:\n" + ("\n".join(usage_lines) or "- none recorded") + "\nTiming:\n" + ("\n".join(timing_lines) or "- none recorded")

taskboy/deploy/env.example

@@ -0,0 +1,17 @@
+# /etc/taskboy/env — non-secret deployment settings (EnvironmentFile for the systemd unit).
+# secrets normally come from aws secrets manager (TASKBOY_SECRETS_{ENV}) via the instance role.
+# for a no-aws single-box install you can instead put the secret env vars here directly
+# (SLACK_BOT_TOKEN, GITHUB_APP_ID, REVIEWER_GITHUB_APP_ID, ... — see taskboy/secrets.py);
+# this file is root-owned mode 640 so only root and the service user can read it.
+ENVIRONMENT=staging
+TASKBOY_DB_PATH=/var/lib/taskboy/taskboy.db
+TASKBOY_CONFIG_PATH=/etc/taskboy/config.yaml
+TASKBOY_WORKSPACES_ROOT=/var/lib/taskboy/workspaces
+TASKBOY_REPOS_ROOT=/var/lib/taskboy/repos
+TASKBOY_MEMORY_ROOT=/var/lib/taskboy/memory
+TASKBOY_SKILLS_ROOT=/opt/taskboy/skills
+TASKBOY_BROKER_SOCKET=/run/taskboy/broker.sock
+TASKBOY_REVIEWER_BROKER_SOCKET=/run/taskboy/broker-reviewer.sock
+# the dashboard ui and git credential helper ship inside the installed package; override
+# TASKBOY_UI_DIST / TASKBOY_GIT_CRED_HELPER here only to point elsewhere
+AWS_REGION=us-east-1

taskboy/deploy/git-cred-helper.py

@@ -0,0 +1,36 @@
+#!/usr/bin/env python3
+"""git credential helper: fetches a fresh installation token from the taskboy broker at use-time.
+
+wired into each task session via GIT_CONFIG_* env vars — tokens never touch disk, git config,
+or argv. stdlib only; runs under the task's (non-privileged) user.
+"""
+
+import json
+import os
+import socket
+import sys
+
+
+def main() -> None:
+    if len(sys.argv) < 2 or sys.argv[1] != "get":
+        return  # store/erase are no-ops
+    sys.stdin.read()  # drain the credential description git sends
+    with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as sock:
+        sock.connect(os.environ["TASKBOY_BROKER_SOCKET"])
+        sock.sendall((json.dumps({"op": "git-credentials", "nonce": os.environ["TASKBOY_TASK_NONCE"]}) + "\n").encode())
+        data = b""
+        while not data.endswith(b"\n"):
+            chunk = sock.recv(4096)
+            if not chunk:
+                break
+            data += chunk
+    response = json.loads(data)
+    if "error" in response:
+        print(f"taskboy credential helper: {response['error']}", file=sys.stderr)
+        sys.exit(1)
+    print(f"username={response['username']}")
+    print(f"password={response['password']}")
+
+
+if __name__ == "__main__":
+    main()