diff --git a/AGENTS.md b/AGENTS.md index e85fd288..7c744abf 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -9,11 +9,12 @@ Contributor workflow). A **self-hosted Linux daemon** (Node ESM, Express, `node:sqlite`) that runs coding agents inside team chat. Every conversation — a Slack DM, group or channel; Microsoft Teams and Google Chat in Beta — gets its **own work folder** (`~/ChannelGate///`), its **own rootless -Podman container**, its own persistent memory and one engine session per thread. Each message runs +Podman container**, its own persistent memory and one engine session per thread. Each ordinary message runs a **headless engine turn inside that container**: Claude Code (`claude -p`, the primary engine), OpenAI Codex (`codex exec`), or OpenCode (a proof adapter admitted only read-only and -network-off). The container is the confinement boundary; the folder's `.claude/settings.json` -carries the tool policy. A built-in admin web UI (same process) manages users, channels, engines, +network-off). An organization admin can explicitly turn one Slack thread into a direct-host +`/sudo` thread; only admins may then message it. The container is the default confinement boundary; +the folder's `.claude/settings.json` carries the tool policy. A built-in admin web UI (same process) manages users, channels, engines, MCP connections, skills, per-channel secrets, schedules, usage and the license. `src/ee/` is the proprietary licensing plane (see the rules). @@ -38,13 +39,14 @@ Gateway daemon │ license admission (src/ee/limits.js), then provision ~/ChannelGate/// │ (.claude/settings.json lockdown, managed CLAUDE.md block, gateway-usage + channel-memory skills, │ granted catalog skills) - │ ensure the channel's container is up (rootless Podman: HOME volume, work folder + clean workspace - │ + artifact dir at identical paths, control socket read-only, bridge network) + │ resolve runtime: normal → ensure the channel container; admin-authenticated `/sudo` thread → host + │ (container: HOME volume, work folder + clean workspace + artifact dir at identical paths, + │ control socket read-only, bridge network; host: daemon OS account and native HOME/toolchain) │ resolve session: thread key → engine session id (resume) | fresh (memory catalog prepended) │ build MCP config: gateway control (socket bridge) + composio-user (author) + composio-agent │ (channel → org token) + selected catalog/plugin servers → a 0600 file in the artifact dir ▼ -exec inside the container (Claude, cold): +exec in the resolved runtime (Claude, cold): claude -p --output-format stream-json --verbose --include-partial-messages --setting-sources "" --settings --append-system-prompt-file [--model M] [--effort E] (--session-id | -r ) --mcp-config --strict-mcp-config @@ -76,7 +78,7 @@ post/edit the reply in the thread (degraded to the surface's capabilities) → u the changed keys), `dead-fields.js` (retired fields stripped on every write). - `src/db/` — `index.js` (the one lazy `node:sqlite` connection: WAL, `busy_timeout`, `foreign_keys`, migrations on open, the one-time legacy JSON import behind `_meta` flags), - `migrations.js` (versioned on `PRAGMA user_version`, currently 25 — append, never edit), + `migrations.js` (versioned on `PRAGMA user_version`, currently 26 — append, never edit), `import-legacy.js`, `fts.js` (the optional FTS5 `channel_memory_fts` index; without FTS5 memory search degrades to a scan). - `src/gateway/run.js` — the run orchestrator: engine adapter selection and precedence (per-run @@ -201,8 +203,9 @@ post/edit the reply in the thread (degraded to the surface's capabilities) → u close a cycle through `config/settings.js`. - `src/runtimes/` — WHERE an engine process runs: `contract.js` (the RuntimeBackend contract), `resolve.js` (the one place that builds the RuntimeTarget a turn, a background job and the - memory reviewer each receive at their OWN spawn), `registry.js` (registers the container backend - and nothing else; `local.js` is the unregistered host spawner kept for direct-runner tests) and + memory reviewer each receive at their OWN spawn), `registry.js` (registers the default container + backend plus the admin-authenticated `/sudo` host backend; `local.js` remains an unregistered + daemon-internal spawner kept for direct-runner tests), `host.js` (direct daemon-account spawn) and `container/` — the rootless Podman backend: the CLI probe (`podman`, then `docker`), the image (expected version + digest over every file in `containers/` compared with the built image's labels; a missing or stale image fails the run closed with the `npm run build:image` remedy), @@ -308,7 +311,7 @@ through the control MCP. `thread_overrides`, `conversation_reply_sessions`, `active_runs`, `stopped_turns`, `inbound_events`, `teams_graph_subscriptions`); automation (`schedules`, `acks`, `followup_threads`, `followup_done`, `followup_digest_messages`, `bg_jobs`, `api_jobs`); - approvals (`approval_requests`, `approval_link_tokens`); skills (`skills`, `skill_revisions`, + approvals and questions (`approval_requests`, `approval_link_tokens`, `question_requests`); skills (`skills`, `skill_revisions`, `skill_revision_files`, `skill_sources`, `skill_templates`, `skill_usage`, `skill_proposals`, `skill_access_tokens`); Composio SDK (`composio_sessions`); licensing (`license_usage`); dashboard data (`usage`, `usage_components`, `usage_requests`, `usage_repair_batches`, @@ -327,14 +330,15 @@ Config that stays as **files** (read wholesale / bootstrap, hand-editable): - `~/.channelgate/config/gateway-usage/` — per-file overrides of the `gateway-usage` skill. - `~/.channelgate/channels///.claude/settings.json` — the per-channel lockdown contract Claude Code itself reads (must be a file): tool permissions, the MCP allowlist, - memory-off and the Stop hook. No `sandbox` block — the container is the boundary. + memory-off and the Stop hook. No `sandbox` block — the container is the ordinary-run boundary; + a sudo-host turn is explicitly outside it. - `containers/versions.json` — the image contract: the spec version and every toolchain pin (`docs/COMPATIBILITY.md`; the nightly canaries read the same file). ## Non-negotiable rules -- **Confinement is the product, and the container is the boundary.** Every turn — foreground, - background job, schedule, API run, memory review — runs inside the channel's own container +- **Confinement is the product, and the container is the default boundary.** Every ordinary turn — + foreground, background job, schedule, API run, memory review — runs inside the channel's own container (rootless Podman, image-shipped toolchain, `--cap-drop ALL`, no `sudo`): a per-channel HOME volume at `/home/agent` (engine sessions, CLI logins, installed tools) and, bind-mounted at their identical absolute paths, ONLY the channel's work folder, its clean workspace and its @@ -350,8 +354,14 @@ Config that stays as **files** (read wholesale / bootstrap, hand-editable): the planned follow-up. Every channel folder still gets the lockdown file (`autoMemoryEnabled:false`, `autoDreamEnabled:false`, curated `permissions.allow`, the MCP allowlist, the Stop hook) — it carries POLICY, never a `sandbox` block, and nothing a run can - do changes what its container mounts. Never exec an engine outside a container. Admin channels - run in containers too: the admin author's live turn adds the bypass flag, and the work folder is + do changes what its container mounts. The one process-boundary escape hatch is typed Slack + `/sudo`, scoped to exactly one thread: only a current organization admin can enable or disable it, + every sender and background launch is re-authorized as an admin, non-admin messages are rejected + before hydration or process spawn, and the resolved engine runs directly as the daemon OS user + with its host filesystem, processes, HOME, commands and network. The flag is a thread posture, + never reusable authority; stored channel metadata and run-API overrides cannot select the host. + Turning it off restores the container, and native session state is carried across the boundary + when possible. Admin channels otherwise run in containers too: the admin author's live turn adds the bypass flag, and the work folder is mounted read-write like any other's — so an admin channel whose work folder is a host directory (the gateway's own checkout, say) hands that directory, and only that directory, to its container, everything in it included. That is the intended trust model for admin channels; put diff --git a/CHANGELOG.md b/CHANGELOG.md index dc412399..473c6610 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,17 +1,105 @@ # Changelog — ChannelGate +ChannelGate was formerly *Claude Gateway for Slack*; entries below the rename keep their original +wording. All notable changes to the gateway, newest first. Dates are when the work landed. +This project brings Claude Code (and optionally OpenAI Codex) into Slack as a self-hosted, +per-channel-sandboxed agent. See `FEATURES.md` for the living catalog and `docs/WHY.md` for the +product overview. + +> **Publication dates.** Every public release entry below carries the date the Licensor published +> it. Entries for work that never left the private repository are not publications. No version is +> relicensed automatically (license v1.2 removed the former Change Date before first publication). +> +> | License version | Effective | Published | +> | --- | --- | --- | +> | Makeitfuture Sustainable Use License 1.2 | 2026-08-25 | 2026-09-06 (with ChannelGate 0.5.0) | +> | Makeitfuture Sustainable Use License 1.1 | 2026-08-20 | never published | +> | Makeitfuture Sustainable Use License 1.0 | 2026-08-06 | never published | + +## 0.5.1 — 2026-09-21 + +- Fix two release-smoke defects. A Qwen run with no model configured now asks QwenCloud for a + Qwen model instead of the CLI's Anthropic default (which failed every such turn with "Model not + exist"). A tool request from an HTTP run-API turn is now refused with a readable reason instead + of Claude Code's "invalid permission result" error; the request stays denied either way. + +- Stop an unusable Cloud MCP selection from failing a conversation. A selected optional MCP server + that is missing from the host configuration, needs a host credential, or no longer matches the + transport it was selected with is now dropped from that run — for Claude, Qwen and Codex, on the + primary and the failover engine alike — instead of ending the turn. The answer is prefixed with + which connections were skipped and why, and the drop is recorded as an event for admins. Host + credentials are still never relayed into a channel container, and a corrupt operator + configuration no longer blocks every channel that selected anything. + +- Add an optional **Qwen (Claude Code)** harness: the same Claude Code CLI driven against + QwenCloud's Anthropic-compatible endpoint, with its own gateway-level API key and base URL, and + a model list read live from the account. It is off until an admin turns it on, after which it + appears in the admin engine selectors, the Slack channel settings modal and `/model`. No + Anthropic credential ever reaches a Qwen run, it is outside the automatic failover in both + directions, and its turns are recorded with real tokens and no invented dollar cost. + - Run prepared channel VPNs with OpenVPN 3 Linux and refresh their protected supervisors on ON. Add channel-scoped, bounded read-only database operations for Claude and Codex, without granting ordinary agent containers VPN privileges or exposing database credentials. +- Provision the host-side `rclone` dependency during fresh deployments and repair it during an + update even when the checkout is already current. User services install it in `~/.local/bin`, + downloads are checksum-verified, and Google Drive connection tests retry an earlier missing-tool + result without requiring a daemon restart. + - Control a prepared channel VPN through the agent, the web channel Network controls, and Slack Settings → Network. Managers/admins can turn it on/off; status distinguishes connecting from connected and reports safe certificate/authentication errors. Stopping also cleans up manual starts. +- Move quiet-thread reminders from conversation settings to a personal user preference. Each + reminder now follows and mentions the requester across channels and DMs; users can turn it on or + off in Slack App Home, while admins can manage individual or organization-default choices. + - Add an optional operator-managed OpenVPN/MySQL service per channel, with dedicated tunnel privileges, database-only routing/firewall, protected channel-secret references, a persistent user service and read-only verification. Ordinary chat containers retain their existing rights. +- Fix Codex capacity refusals delivered as plain-text `turn.failed` events. They are now classified + as transient provider failures, retried in place, and automatically handed to the other enabled + harness when capacity remains unavailable. + +- Add an organization-admin-only `/sudo` posture for individual Slack threads. While enabled, + admin messages and their background work execute directly on the gateway host as the daemon OS + user; non-admin messages are rejected as sudo-thread traffic before work starts. `/sudo off` + restores the normal per-conversation container, with Claude/Codex session state carried across + the boundary when possible. The host runtime cannot be selected through channel metadata or the + run API, and every turn rechecks current admin authority. + +- Render up to five public images referenced in an agent's Slack answer as native Block Kit image + previews, while preserving clickable Markdown fallbacks and completed text delivery when Slack + rejects a preview. Images referenced from the channel workspace are now uploaded into the thread + as native Slack files instead, so they get the same inline thumbnail, download control and full + preview as a human attachment. + +- Highlight every conversation that shares its resolved working folder with another conversation + in red in the Admin UI, and warn in red while browsing a folder that is already assigned elsewhere. + +- Remove gateway-downloaded audio after a successful local or Slack-fallback transcript, while + retaining failed inputs for retry and refusing symlinks or paths outside managed uploads. Teach + the built-in video-understanding workflow to remove only successfully processed uploaded source + videos after all required re-sampling, never project files or failed inputs. + +- Correct Codex history repricing to honor OpenAI's effective date for GPT-5.6 Sol: retain the + original $5 / $0.50 cached / $30 rate before 2026-08-21 and apply $4 / $0.40 / $20 from that + date onward. Upgraded instances rerun the backup-first correction under a new pricing basis. + +- Refresh Codex Standard API-equivalent pricing from official OpenAI documentation: add + GPT-6 Astra at $10 / $1 cached / $50 per million tokens and reduce GPT-5.6 Sol (plus its + `gpt-5.6` alias) to $4 / $0.40 / $20. Keep the fallback picker aligned with the current Codex + CLI catalog, leave CLI-only Spark explicitly unpriced until an official rate exists, and + automatically back up and reprice component/request history since 2026-07-13 once on upgrade. + +- Fix Slack question-card posting by encoding channel membership checks as GET query parameters. + +- Let agents ask clarification questions with Slack cards and paged forms: custom option buttons, + Yes/No, multiple selections, and written answers. Save drafts until submission, retain pending + questions across restarts, and continue the requester's thread after they submit. + - Keep sidebar update messages inside the rail, wrapping long details and showing a short commit revision with the full hash on hover. @@ -59,24 +147,6 @@ - Fix one-time automation edits shifting by the browser/daemon timezone difference and potentially firing future tasks immediately. -ChannelGate was formerly *Claude Gateway for Slack*; entries below the rename keep their original -wording. All notable changes to the gateway, newest first. Dates are when the work landed. -This project brings Claude Code (and optionally OpenAI Codex) into Slack as a self-hosted, -per-channel-sandboxed agent. See `FEATURES.md` for the living catalog and `docs/WHY.md` for the -product overview. - -> **Publication dates.** Every public release entry below carries the date the Licensor published -> it. Entries for work that never left the private repository are not publications. No version is -> relicensed automatically (license v1.2 removed the former Change Date before first publication). -> -> | License version | Effective | Published | -> | --- | --- | --- | -> | Makeitfuture Sustainable Use License 1.2 | 2026-08-25 | 2026-09-06 (with ChannelGate 0.5.0) | -> | Makeitfuture Sustainable Use License 1.1 | 2026-08-20 | never published | -> | Makeitfuture Sustainable Use License 1.0 | 2026-08-06 | never published | - -## 0.5.1 — Unreleased - - Manage plugin packages through existing skill sources, review, templates and channel grants. Compile native Claude hooks as an inline event map so SessionStart hooks execute correctly; keep executable hooks restricted to authorized live admin turns. diff --git a/FEATURES.md b/FEATURES.md index 1eca515f..24c28d08 100644 --- a/FEATURES.md +++ b/FEATURES.md @@ -34,6 +34,49 @@ Regression: `test/channel-database.test.js`, `services/vpn-image/test_query.py`, `test/slack-vpn-settings.test.js`, `test/vpn-profile.test.js`, `test/vpn-service.test.js`, `services/vpn-image/test_checks.py`; live isolation: `services/vpn-image/live_acceptance.py`. +## Admin-only direct-host sudo threads + +- An organization admin can type `/sudo` (or `/sudo on`) in a Slack thread to make that thread's + subsequent turns execute directly on the gateway host as the daemon OS user. `/sudo status` + reports the posture and `/sudo off` returns future turns to the channel container. The command + refuses to cross the boundary while that thread has running or queued work. +- Sudo is scoped to one thread, not a channel setting. Only current organization admins may + activate, deactivate, message, or launch background work from it. Non-admin messages are rejected + before Slack hydration, queueing, attachment reads, or process spawn, and `runMessage` repeats the + admin check so alternate ingress, unattended work, stale rows and caller-supplied author IDs + cannot turn the stored flag into authority. +- The registered host runtime uses the daemon account's native filesystem, process namespace, + HOME, installed commands and network. It is intentionally outside the rootless container + boundary. Per-run engine environments remain allowlisted, secrets remain redacted, and channel + grants/MCP policy are still compiled normally. Stored channel metadata and run-API overrides + cannot select this runtime. +- Claude and Codex session files are carried container→host on enable and host→container on disable + when the backend supports it; an unavailable carry falls back to the existing transcript-healing + path. Idle warm processes from the previous boundary are retired when the flag changes. + +Regression: `test/sudo-thread.test.js`, `test/runtimes-core.test.js`, +`test/session-carry.test.js`, `test/engine-runtime-isolated.test.js`, +`test/codex-args.test.js`, and `test/runtime-access-facts.test.js`. + +## Interactive Slack clarification questions + +Claude and Codex can ask for missing information through the shared `ask_questions` gateway tool. +Short question sets appear in the thread; longer sets open a paged modal from **Answer questions**. +Each request accepts 1–20 questions: single choice with up to four custom-labeled options (including +Yes/No), multiple choice with up to ten options, or written text. Choice questions can also accept +custom answers. Required and custom-answer settings default to true. Automatic presentation uses +the message for at most four non-text questions and a modal launcher otherwise; the caller can +explicitly choose message (at most four questions) or modal presentation. + +Custom text replaces a single choice or supplements multiple choices. Choices remain drafts until +final submission. Only the requester can answer; stale forms and +duplicate submissions cannot replace a completed answer. Requests and saved drafts persist through +daemon restarts, while stop/clear cancels pending requests. Submission queues the answers into the +same author's thread for continuation. The tool itself returns promptly with the pending request, +so agents can finish independent work without occupying a waiting turn. Clarification never replaces +the existing approval mechanism. The bundled guide teaches both engines when to use the tool and +falls back to ordinary questions when it is unavailable. Live acceptance gates: `TEST-PLAN.md`. + ## System health The last admin navigation item, **System health** (`/system-health`), shows daemon-side Linux @@ -462,7 +505,9 @@ A categorized catalog of what's shipped. Cross-linked to `TEST-PLAN.md` checks. - Downloadable audio is transcribed locally with the shared Whisper setting and cancellation; the portable path never calls Slack transcript APIs. Raw audio paths are withheld from the engine, ordinary files remain available, failed audio alone produces an explanation without an - engine turn, and typed text can continue with a visible missing-transcript note. Progress starts + engine turn, and typed text can continue with a visible missing-transcript note. A successfully + transcribed gateway-downloaded audio source is removed immediately; failed sources remain for a + retry, and symlinks or paths outside the managed `uploads/` root are refused. Progress starts before download/transcription. Every attachment intake has a unique storage directory so simultaneous same-name files or later edits cannot overwrite bytes another turn is reading. - The branch's Slack parity inventory and remaining surface-specific work live in @@ -528,12 +573,16 @@ A categorized catalog of what's shipped. Cross-linked to `TEST-PLAN.md` checks. - Claude pooling and Codex execution/MCP policy run behind adapters; fallback routing is a directed registry graph, and every registered CLI receives a boot version/readiness probe. - Slack and Admin selectors consume registry manifests. Codex optional MCPs under - `--ignore-user-config` receive complete credential-safe definitions. + `--ignore-user-config` receive complete credential-safe definitions; a selection without one is + dropped from the launch with a reason, the same contract Claude's resolver uses. - OpenCode proves the third-engine contract without orchestrator or UI conditionals. Its adapter is deliberately restricted to workspace read/glob/grep/list with model-tool network off: shell, edits, external directories, plugins, MCP, and bypass modes fail closed because OpenCode permissions are not an OS sandbox. JSON streaming, session resume, cancellation, usage/cost, and health/version are supported. See `docs/OPENCODE-ADAPTER.md`. → TEST-PLAN: OpenCode proof adapter. +- **Qwen (Claude Code)** proves the kernel a second way: a full-capability harness that reuses the + `claude` CLI against QwenCloud's Anthropic-compatible endpoint, added as an adapter with no + orchestrator or UI conditionals. → TEST-PLAN: Qwen harness. ## Public website - The marketing / early-access site (and its lead-routing contract) lives in its own @@ -558,6 +607,13 @@ A categorized catalog of what's shipped. Cross-linked to `TEST-PLAN.md` checks. a sentence. A shared queue preserves creation order, each stream rolls independently before Slack's age limit, and answer footer/fallback behavior stays on the answer only. Text-only turns keep their single-message shape. → TEST-PLAN: Observability (Slice 6). +- Native Slack answer image previews: up to five unique image files referenced from the channel + workspace with standard Markdown image syntax are realpath-confined and uploaded into the thread + as native Slack files after the answer, giving them Slack's thumbnail, download and full-preview + UI. Public HTTP(S) references remain Block Kit image blocks. Fenced examples, missing/non-image + files, escaping symlinks and duplicates are ignored; upload/preview failure never costs the + completed text answer. Native streaming, classic recovery and unattended delivery use the same + bounded behavior. → TEST-PLAN: Observability (Slice 6). - Mention gating: DM = no mention; channel/group/private = require `@bot`. → TEST-PLAN: Slack gateway. - Thread-scoped Claude sessions — new thread = new session, replies resume. → TEST-PLAN: Foundation. - Subagent completion contract (mechanical) — every generated channel settings file installs a @@ -656,7 +712,9 @@ A categorized catalog of what's shipped. Cross-linked to `TEST-PLAN.md` checks. Slack's completed full VTT transcript; absent transcripts prompt the user to click **Generate transcript** and re-trigger. Fresh installers ask whether to provision Whisper, updates honor the stored setting, and disabled mode never downloads raw audio. Typed text remains instructions and - raw audio is excluded from Claude/Codex. → TEST-PLAN: Voice prompts. + raw audio is excluded from Claude/Codex. Successfully resolved downloaded audio is removed from + the channel's `uploads/` folder, including when Slack transcript fallback completes after a local + failure; unresolved audio is retained for retry. → TEST-PLAN: Voice prompts. - Native Slack **channel file explorer**: the 📂 reply button opens a Block Kit modal rooted at the channel's effective working folder. Its title identifies the authoritative stored Slack channel name, and its subtitle shows the full absolute current directory, refreshed on every navigation. The @@ -1081,11 +1139,12 @@ A categorized catalog of what's shipped. Cross-linked to `TEST-PLAN.md` checks. Pending acks persist in `config/acks.json` so the chain survives a daemon restart. The renderer owns the "⏰ *Reminder:*" label: one leading "Reminder:" the author already wrote is stripped from the posted message, the 2nd notice and the DM, so the line never stutters. -- Opt-in no-response nudge: a channel can have the bot post one gentle reminder in a thread that has - gone quiet past a window (default 24h). Strictly single-thread; never scans other channels. An - org-level default (Settings → Schedules & nudges, `defaultNudges`) decides whether NEW channels & - DMs start with it on; a "Apply to all existing channels & DMs" button pushes the current default - onto every existing conversation at once. +- Personal no-response nudge: each user chooses whether the bot posts one gentle reminder addressed + to them when their last agent reply has gone quiet past a window (default 24h). The live user + preference follows them across channels and DMs and is self-service in Slack App Home; admins can + also edit it in Users. Strictly single-thread; never scans other channels. An org-level default + (Settings → Schedules & nudges, `defaultNudges`) is captured for newly seen users, and an "Apply + to all existing users" button intentionally replaces every existing personal choice. - "AI is waiting on you" digests: the bot passively observes the channels it's in (every message, mention or not) and tracks, per thread, who took part and who spoke last. It reminds about **one thing only** — threads where the **AI is waiting for your decision**: a genuine AI thread (the bot @@ -1165,6 +1224,47 @@ A categorized catalog of what's shipped. Cross-linked to `TEST-PLAN.md` checks. or `mcp__composio-agent__*` for the agent's own account. Slack enforces the selected account's visibility. There is **no** separate hosted Slack MCP and no per-user `connect_slack` OAuth. +## Qwen harness (opt-in, Claude Code CLI against QwenCloud) + +- A third full-capability engine, **`qwen` — "Qwen (Claude Code)"**: the same `claude` binary the + image already ships, pointed at QwenCloud's Anthropic-compatible endpoint. It therefore keeps the + CLI's whole feature set — stream-json progress, the tool loop, Slack approval cards + (`--permission-prompt-tool`), `--mcp-config` connectors, `CLAUDE.md`, `.claude/skills`, plugin + dirs, cold session resume — while everything the PROVIDER owns is its own. +- **Opt-in, never implicit.** Unlike every other harness, a missing `engineEnabled` entry means + OFF: pulling this release does not add a harness to any picker, and the "never lock every + harness out" rescue restores the default harnesses only. Settings → Engine & runtime → *Harnesses + the gateway may use* turns it on; it then appears in the admin engine selectors, the Slack + channel Settings → *Change engine & model* modal, and the `/model` wizard, and `qwen` works as a + per-thread engine directive. Turning it off removes it from all of them. +- **Gateway-level credential, never a channel secret.** Settings → Engine & runtime holds the + QwenCloud API key (write-only: `has*`/`last4` on listings, the value only through the audited + `POST /api/secrets/reveal`) and the base URL (Token Plan or pay-as-you-go). `ANTHROPIC_*` stays a + reserved prefix for per-channel secrets, so a conversation can never redirect its own provider. +- **The Anthropic credential never leaves with it.** A Qwen spawn drops the whole Anthropic family + — an inherited `ANTHROPIC_API_KEY`/`ANTHROPIC_AUTH_TOKEN`/`ANTHROPIC_BASE_URL` and the relayed + `CLAUDE_CODE_OAUTH_TOKEN` — before applying the provider's own values last. With no key + configured, or a rejected one, the turn fails closed naming the remedy; it never falls back to + the operator's Anthropic account, and its errors say "Qwen", not "Claude". +- **Live model catalog.** The Anthropic-compatible path serves no `/v1/models`, so the discovery + hook reads the account's own list from the sibling `/compatible-mode/v1/models` endpoint derived + from the configured base URL, filtered to text/tool models (the image, video, audio and realtime + families cannot hold a conversation and are excluded). Settings and `/model` therefore offer what + the account can actually call, and a model QwenCloud adds needs no release. A shipped fallback + list covers a fresh install or an unreadable account, and the Settings card says which one is in + use. +- **No invented cost.** Claude Code prices every turn with Anthropic's table, which is fiction for + QwenCloud tokens, so the adapter drops that figure at the boundary and the harness declares no + rate of its own: Qwen turns are recorded with real tokens and NO dollar amount (never Codex's + configured rate either). +- **Outside the failover graph, both directions.** A Qwen limit must not spend the Anthropic quota, + and a Claude limit must not spend a QwenCloud balance. Cold runs only — a warm process holds the + environment it launched with, and the pool key carries no engine, so a rotated provider key or a + mid-thread harness switch could otherwise be served by a stale credential. +- One **Cloud MCP** selection serves Claude and Qwen (same CLI, same file transport, same catalog), + so switching a channel's harness between them never silently drops its connectors. + → TEST-PLAN: Qwen harness. + ## Engines (Claude + Codex) - Two CLI engines: **Claude** (default — warm sessions, exact cost, skills, `/compact`) and **Codex** (OpenAI Codex CLI — one-shot per message, MCP via `-c` overrides + an HTTP bridge). Selection @@ -1235,7 +1335,8 @@ A categorized catalog of what's shipped. Cross-linked to `TEST-PLAN.md` checks. failure like print mode does, so the retry covers the default Slack path. Which failure kinds an engine may replay is its adapter fact (`transientKinds`, `src/engines/adapters.js`): Codex's `transient` (`classifyCodexFailure` — status codes, the CLI's underscore error codes, or outage - wording in the error EVENT; never its stderr, which can quote a retry it recovered from), Claude's + wording in the error EVENT, including a plain-text `turn.failed` capacity refusal; never its + stderr, which can quote a retry it recovered from), Claude's `availability` / `connection` (an overload, a 5xx, a `server_error` label, a dropped connection — never the catch-all `provider` kind or the bare "API Error:" prefix a rejected request also carries). The knobs are read per turn, so `.env` / settings values count without a restart. @@ -1435,7 +1536,12 @@ A categorized catalog of what's shipped. Cross-linked to `TEST-PLAN.md` checks. operator configuration bytes at run admission. Its strict MCP payload contains only explicitly selected, credential-free definitions plus the scoped built-ins; user/project setting sources remain disabled. Missing, stale-URL, reserved-name, auth-dependent or unsupported definitions - fail closed with an admin remedy. Changes and revocations alter the warm-process fingerprint. + never reach the payload: each one is DROPPED from that run with a category reason instead of + ending the turn, on both the primary and the failover engine. The turn completes on its + remaining connections, the answer is prefixed with which selections were skipped and why, and a + `run_mcp_dropped` event records the names and reasons for the admin (never a path, config value + or definition). An unreadable operator configuration drops every selection rather than bricking + the channel. Changes and revocations alter the warm-process fingerprint. Codex queries the active app-server inventory and exposes each runtime app family (Boost.space, GitHub, Sites, Skill Library, etc.) plus each configured server as its own checkbox. Codex launches default-deny optional apps, explicitly enable only @@ -1481,7 +1587,10 @@ A categorized catalog of what's shipped. Cross-linked to `TEST-PLAN.md` checks. - Codex value is estimated, not billed spend: Settings exposes OpenAI Standard API-equivalent per-model `$/1M` rates. Root turns are priced from request-level rollout deltas and native child sessions are included without charging their copied fork prefix; Claude retains provider-reported - cost. The actual runtime model wins when a configured Claude model falls back to Codex. + cost. The actual runtime model wins when a configured Claude model falls back to Codex. The + fallback picker mirrors the current authenticated CLI catalog (`gpt-6-astra`, the GPT-5.6 + family, GPT-5.5 and CLI-only `gpt-5.3-codex-spark`); live discovery still wins. Spark remains + explicitly unpriced because OpenAI publishes no Standard API rate for that distinct model. - Session recovery: Codex auth/session state uses a stable, grant-free `CODEX_HOME` while private skills remain per-run under synthetic `HOME/.agents/skills`, so Codex 0.147+'s persisted rollout paths survive cleanup without leaking grants. Resuming a session that no longer exists (including @@ -2223,7 +2332,10 @@ are retired, bullet by bullet; everything else stands. image includes `ffmpeg`/`ffprobe`, pinned `opencv-python-headless` + `faster-whisper`, and a root-owned pre-cached Whisper `small` model. The always-present `gateway-usage` skill owns the video workflow, sampling guidance, dependency diagnostics, and analyzer script, so it can extract representative frames, build contact sheets and transcribe timestamped - speech without a per-channel install or first-use model download. `npm run setup` builds the + speech without a per-channel install or first-use model download. After successful analysis and + any needed re-sampling, the workflow removes only gateway-downloaded regular video files beneath + the channel's `uploads/` directory; failures and user-managed project files remain untouched. + `npm run setup` builds the image as part of a fresh install (`--skip-image` / `CG_BUILD_IMAGE=no` defers it and names `npm run build:image` as the remedy; a failed build never aborts the install), so a new gateway never reaches its first message without the toolchain. The former standalone catalog skill is @@ -2336,7 +2448,7 @@ are retired, bullet by bullet; everything else stands. admin-tagged; Custom reveals the raw flags), the two access dropdowns with live help, the network switch and the guest-user checklist; Tools holds filterable MCP/skills checklists with "N of M enabled" counts + channel tokens; Runtime holds engine/model/effort, working folder, - memory/nudges/org-token toggles. Edits are saved by ONE sticky dirty-state save bar + memory/org-token toggles. Edits are saved by ONE sticky dirty-state save bar (Discard / Save changes) — Instructions & Memory are visibly file editors with their own Save. → TEST-PLAN: Admin UI (redesign). - **Authoritative Admin save reconciliation**: successful channel saves merge the complete @@ -2560,10 +2672,12 @@ are retired, bullet by bullet; everything else stands. sync): master enable, pasted key / key-file path, impersonate subject, interval, conflict policy, rclone binary path (absolute path sidesteps the service unit's minimal PATH). Dormant unless enabled + a key exists + rclone is installed. A per-channel **Test** button verifies the service account can - see the folder before the first sync (`rclone lsf`). The update flow (`scripts/update.sh`, shared - by the CLI / `/update` / admin button) auto-installs rclone when Drive sync is enabled and it's - missing — the official installer (the Homebrew branch retired 2026-09-03 — Linux only) — gated on - the setting, best-effort, and never aborting the update. The per-channel folder link can also be + see the folder before the first sync (`rclone lsf`). Fresh service deployments provision the + host-side binary; foreground installs use `~/.local/bin`. The update flow (`scripts/update.sh`, + shared by the CLI / `/update` / admin button) repairs a missing binary when Drive sync is enabled, + even when the checkout is already current. Downloads are checksum-verified, Linux-only, + best-effort, and never abort the install/update. Failed availability probes are retried so a live + install takes effect without restarting the daemon. The per-channel folder link can also be wired up **by asking the agent** (not only the admin UI): gateway control MCP tools `get_channel_drive_folder` (anyone — shows the link + whether sync is globally armed), `set_channel_drive_folder` (admins — validates/parses the @@ -2874,15 +2988,21 @@ are retired, bullet by bullet; everything else stands. no manual command. - **Per-model Codex Standard API-equivalent rates** (Settings → Behavior): Codex reports no dollar cost, so the ledger and reply footer estimate attribution value from an editable $/1M table — - input / cached-input / output per model (gpt-5.6-sol / gpt-5.6 alias / gpt-5.6-terra / + input / cached-input / output per model (gpt-6-astra, gpt-5.6-sol / gpt-5.6 alias / gpt-5.6-terra / gpt-5.6-luna, gpt-5.5, gpt-5.4, gpt-5.4-mini, gpt-5.4-nano, gpt-5.3-codex; defaults = - OpenAI's Standard pricing verified 2026-08-16). Cached reads are a subset of input and never + OpenAI's Standard pricing verified 2026-09-13). Cached reads are a subset of input and never double-counted; cache writes use 1.25× input, and eligible requests above 272K input use 2× input/cache plus 1.5× output. The threshold is evaluated per request, never against a turn aggregate. Official aliases/snapshots match on model boundaries; an unresolved CLI model remains - unpriced instead of being guessed. Retired full-table Terra/Luna defaults migrate to current rates - while genuine admin overrides survive. Claude runs are never priced with OpenAI rates. Legacy - blended rate remains a hidden last-resort fallback for explicitly unknown models. + unpriced instead of being guessed. Retired full-table GPT-5.6/Terra/Luna defaults migrate to + current rates while genuine admin overrides survive. On the first boot after this pricing basis + ships, the daemon backs up SQLite and reprices every request/component and its parent run since + 2026-07-13, after legacy accounting repair, so upgraded instances do not retain stale dashboard + history. Historical pricing follows official effective dates: GPT-5.6 Sol retains + $5/$0.50/$30 before 2026-08-21 and uses $4/$0.40/$20 from that date. The basis marker makes later + boots no-ops. `npm run usage:reprice` previews the exact + rows/model deltas and `--apply` runs the same path manually. Claude runs are never priced with + OpenAI rates. Legacy blended rate remains a hidden last-resort fallback for explicitly unknown models. → TEST-PLAN: Observability. - Audit admin tab: monthly totals, per-channel rollups, and a recent-runs feed over the ledger + event log (`GET /api/audit`, `GET /api/audit/events`). No spend cap — visibility only. @@ -3067,6 +3187,11 @@ are retired, bullet by bullet; everything else stands. - Skills admin saves refresh existing workspaces immediately. Boot and a five-second daemon reconciliation pass refresh changed catalog/template/grant state, including MCP changes. Failed writes are reported and retried; conflicting selections for a shared folder are reported. +- The Admin UI makes shared-folder assignments visible before they break a run. Every channel or + DM whose effective working folder is assigned to another conversation gets a red warning row in + Conversations. The working-folder browser shows a red, named warning whenever the directory being + viewed is already assigned elsewhere, before **Use this folder** can create another shared + assignment. Both views use the runtime's resolved path logic rather than raw string comparison. - Runtime settings provide **Reset to default** beside **Browse**. It clears only the custom working folder through the normal Save/Discard flow; the default remains `~/ChannelGate///`. Existing files stay in their original location. diff --git a/INSTALL.md b/INSTALL.md index 978f99ca..88b21037 100644 --- a/INSTALL.md +++ b/INSTALL.md @@ -84,7 +84,10 @@ sudo bash scripts/install-systemd.sh # = npm run service:install, run as ro ``` It provisions the final service user's subordinate UID/GID ranges, user runtime and cgroup -delegation, then builds/probes the image in that user's own rootless Podman store. It writes +delegation, installs the host-side `rclone` binary used by Google Drive synchronization, then +builds/probes the image in that user's own rootless Podman store. A foreground `--no-service` +setup installs `rclone` into `~/.local/bin` instead. Downloads are checked against the release +checksum; a failed optional install leaves Drive sync dormant and prints a manual remedy. It writes `/etc/systemd/system/channelgate.service`, with `ProtectSystem=strict`, `ProtectHome=read-only` and private `/tmp`. The daemon must permit Podman's setuid namespace helpers; every channel container still uses no-new-privileges and dropped capabilities. API credentials belong in the diff --git a/README.md b/README.md index 02cfff69..9d8992d6 100644 --- a/README.md +++ b/README.md @@ -83,7 +83,7 @@ catalog, including edge cases and links to regression coverage. - **Threaded sessions:** start a fresh session in a new thread and resume context in replies. Choose an engine and model for a thread, channel or gateway default. - **Claude Code and OpenAI Codex:** use either engine with the same channel authorization, - container boundary and personal/shared connector separation. + default container boundary and personal/shared connector separation. - **Model and reasoning controls:** select models and effort using Codex's live model catalog and Claude's rolling aliases. Explicit thread/run pins are respected; a pinned engine failure reports its own error. @@ -102,8 +102,13 @@ catalog, including edge cases and links to regression coverage. ### Permissions, isolation and credentials -- **A container per conversation:** every engine run, including scheduled and background agents, - executes inside that conversation's rootless Podman container with its own persistent home. +- **A container per conversation:** ordinary engine runs, including scheduled and background agents, + execute inside that conversation's rootless Podman container with its own persistent home. +- **Admin-only sudo threads:** in Slack, an organization admin can send the typed in-thread command + `@agent /sudo` (`/sudo` in a DM message) to + run subsequent admin messages directly on the gateway host as the daemon OS user. The thread is + admin-only until `/sudo off`; other senders are rejected before work starts. This deliberately + removes the container boundary for that thread, so use it only for trusted host operations. - **Read-only, Worker and Admin modes:** choose the base permission level. Auto review and Lean context are separate options; permission bypass requires both an admin author and Admin mode. - **Approval controls:** interactive approvals and automatic review apply according to mode; diff --git a/TEST-PLAN.md b/TEST-PLAN.md index 8745d130..935fab00 100644 --- a/TEST-PLAN.md +++ b/TEST-PLAN.md @@ -97,6 +97,124 @@ Only metadata was queried. Host-reboot recovery remains a separate operator acce - [ ] Publish prepared private QA cases and engine-specific run evidence through the requester’s selected personal Airtable connection; account selection is pending. +## Admin-only sudo thread → direct host execution + +Automated regression: `test/sudo-thread.test.js`, `test/runtimes-core.test.js`, +`test/session-carry.test.js`, `test/engine-runtime-isolated.test.js`, +`test/codex-args.test.js`, `test/runtime-integration-run.test.js`, and +`test/runtime-access-facts.test.js`. + +- [x] An organization admin's typed `/sudo` or `/sudo on` enables only the current Slack thread; + `/sudo status` is read-only, `/sudo off` clears the row, and invalid arguments are rejected. +- [x] An approved non-admin cannot enable, disable, or query sudo. Once enabled, a non-admin + message is rejected with “This is a sudo thread” before hydration, attachment reads, + queueing, engine invocation, or process spawn. +- [x] The run orchestrator independently reloads the sticky flag and current organization-admin + status. An untrusted API principal, stale author ID, demoted admin, or stored/channel runtime + field cannot select the host backend. +- [x] Sudo resolves the registered host backend, uses the daemon OS account's native engine state, + scratch paths and helpers, and does not inject the container-only Codex Landlock setting. + Normal/admin-mode/clean runs continue to resolve the container backend. +- [x] Background shell and agent work inherit the source thread's sudo posture only after a fresh + admin check. The background agent's synthetic thread cannot lose or manufacture that posture. +- [x] Boundary changes are refused while work is running or queued and retire an idle warm process. + Session carry covers container→host and host→container; copy failure remains non-fatal and + uses the existing transcript-healing path. +- [x] Every posture change and rejected non-admin attempt is audit logged without secret values. +- [ ] Live: as an org admin, enable `/sudo` in a disposable Slack thread and verify `pwd`, `HOME`, + host process visibility and a harmless host command reflect the daemon account. Confirm an + ordinary thread still sees only its channel container, then disable sudo and verify return to + `/home/agent` plus native session continuity. +- [ ] Live: while sudo is enabled, have an approved non-admin reply in that exact thread. Require + the explicit sudo-thread rejection and prove no progress card, attachment download, runtime + startup, usage row, or engine process was created. + +## Browser acceptance runner + +Browser test files intentionally skip unless `CG_BROWSER_MODULE` points at a compatible Playwright +module. In the shipped ChannelGate container image, use the pinned global module and bundled browser +cache—not an arbitrary `~/.npm/_npx` copy: + +```sh +node -e 'const expected=require("./containers/versions.json").npm.playwright; const actual=require("/usr/local/lib/node_modules/playwright/package.json").version; if(actual!==expected) throw new Error(`Playwright mismatch: expected ${expected}, found ${actual}`)' +PLAYWRIGHT_BROWSERS_PATH=/opt/channelgate/browsers \ + CG_BROWSER_MODULE=/usr/local/lib/node_modules/playwright/index.mjs \ + node --test test/.test.js +``` + +A missing-browser-executable error normally means the selected Playwright module expects a different +browser revision; it is a fixture failure, not evidence that the product case failed. Re-select the +module pinned in `containers/versions.json` and rerun. Outside the shipped image, install that exact +Playwright version, point `CG_BROWSER_MODULE` at its `index.mjs`, and set +`PLAYWRIGHT_BROWSERS_PATH` to the matching installed browser cache. A browser case passes only when +it executes rather than skips, its assertions pass, and it records no page or console errors. + +## Interactive Slack clarification — Claude and Codex acceptance + +Automated regression: `test/questions.test.js`, `test/question-views.test.js`, +`test/question-interactions.test.js`, `test/question-continuation.test.js`, plus the gateway MCP +inventory/approval, folder settings, busy-thread and recovery suites. The four question suites +pass 40 tests using scratch SQLite, fake Slack interactions and fixture engines. They cover +fresh-process draft retrieval, atomic submission/rollback, stale-card repair, serialized rendering, +the Slack acknowledgement deadline, requester authorization, queue/restart recovery, and stop/clear. +Transport regression verifies GET-encoded membership queries (including pagination cursors), +JSON chat writes, authorization headers, and fail-closed API/HTTP errors. Live QST-01 must +post through the real MCP client so request-encoding failures cannot hide behind a fake client. + +Run each case separately with Claude and Codex on the exact candidate. Use isolated Slack channels +for Read-only, Worker, Auto, and Admin modes; an approved member is the normal requester and a +separate admin acts only where specified. Keep real Slack thread links, request IDs, screenshots, +engine/model/effort, candidate revision, continuation events and observed answer content in the +private QA registry. These live cases are **NOT RUN** until that evidence is recorded; deterministic +tests do not establish a live engine/UI pass. Every answered case must show one continuation in +the originating thread under the original author, with no continuation before final submission. + +- **QST-01 — choice cards and custom labels.** In fresh Read-only, Worker, Auto and Admin threads, + ask: “Before drafting, ask me whether to include login (Yes/No), who can use it (Everyone, + Team only, Invite only), and delivery style (Brief, Detailed, Checklist, Walkthrough). + Let me write my own answer too; draft only after I submit.” Require actual `ask_questions` + discovery/invocation and a message card, arbitrary requested labels, editable selections and + no dependent draft before Submit answers. Change an answer twice, then submit. Require exact + final values in the continuation and an answered card. Auto must not choose answers itself. +- **QST-02 — multiple selections and custom text.** Ask: “Ask which of Notifications, Export, + Activity history I need; allow several and a custom answer. Also ask my preferred access option.” + Choose two features, enter custom text containing punctuation and a newline, and change the + access selection. Close/reopen the custom editor before submitting. Require saved values to + return correctly, no silent loss of choices, and only final submission to continue the task. +- **QST-03 — paged modal and required fields.** Ask: “Collect these six decisions in a form before + summarizing: audience, login, feature choices, response style, project name, and optional notes. + Offer sensible choices for the first four and text for the last two.” Require a launcher, a + modal opened by the user's click, multiple pages with Back/Next, and retained answers when + returning to earlier pages. Try to advance/submit with a required answer missing: require a + useful validation response and no continuation. Leave optional notes empty, complete required + fields and submit; require all pages' answers, including the written project name. +- **QST-04 — requester and revision isolation.** With an approved member's pending card, have + another approved member and the admin try to choose, open custom text, and submit. Require + rejection without modifying the request. As requester, open two modal views, change a draft + through the newer view, then submit the stale view. Require stale-view protection, preservation + of the current draft, and successful submission from refreshed controls. Replay final Submit + and click an answered card: require no duplicate continuation. Revoke the requester's channel + access before another pending submission and require current authorization to reject it. +- **QST-05 — durable drafts and cancel.** Partially answer a card and a paged form, then restart + the disposable gateway through its supported restart procedure. Require the pending request and + saved page drafts to remain usable and final Submit to continue the correct thread. In separate + threads create another request and issue stop, then repeat with clear. Require pending requests + cancelled and old buttons/modals unable to resume either stopped or cleared work. +- **QST-06 — continuation while busy and ordinary replies.** Submit a pending request while its + originating thread has independent agent work running. Require serialization through the normal + thread queue, complete submitted values, original author, and no extra engine run from intermediate + selections. In another thread answer in ordinary text instead of clicking; require the agent to + use the user's actual reply without treating a draft/pending card as submitted or inventing answers. +- **QST-07 — presentation, bounds, permissions.** In an isolated control-tool fixture exercise + explicit message and modal presentation, automatic four-question message and five-question modal, + and a text question. Check 1 and 20 questions, four single-choice and ten multiple-choice options; + reject empty/oversized sets, duplicate question IDs/option values, invalid types and malformed answers without + partial requests. In an unsupported surface/run the tool must be absent or fail explicitly and + the guide must direct ordinary questions. Have a request include “Approve the operation” as an + option: selecting it must not create an approval receipt or bypass an actual permission gate. + +Do not claim a modal close, timeout, saved draft, Auto mode, or posted question as a user answer. + ## System health — engine-independent acceptance These cases exercise the daemon collector and authenticated browser, not an engine turn; @@ -223,12 +341,42 @@ observed tool/process/filesystem evidence, and verdict. A missing, skipped, or b is not a pass. Maintain the private QA registry alongside these reusable public instructions. -## Slack shared-folder conflict replies +## Shared-folder conflict detection and warnings -Automated regression: `node --test test/workspace-conflict-reply.test.js test/skills-workspace-sync.test.js`. +Automated regression: `node --test test/workspace-conflict-reply.test.js test/skills-workspace-sync.test.js +test/workspace-conflict-admin.test.js`. Exercises real registration and conflict detection for skill and memory mismatches, root/thread routing, mention and typed `/mode`, duplicate delivery, unauthorized authors, Slack delivery failure, -and preservation of a workspace sentinel. No engine starts; this behavior is engine-independent. +preservation of a workspace sentinel, API annotations for shared channels and DMs, and folder-browser +assignment discovery. It assigns one conversation through a directory symlink and requires the +resolved real folder to conflict, so equal strings alone cannot satisfy the regression. The UI +regression pins the red list-row and browser-message states. No engine starts; this behavior is +engine-independent. + +- [x] Browser (engine-independent, disposable Chromium fixture): + run the pinned-image procedure above with `test/workspace-conflict-browser.test.js`. The fixture + creates two conversations on one real folder, a control on a separate folder and one unused folder. + It requires exactly the duplicate rows to render red, requires the folder modal to name only other + assignments, verifies used/control/unused navigation, saves the unused folder and waits for every + stale red row to clear without reload. Require the PUT response to be HTTP 200 and the warning-row + count to reach zero; do not substitute a fixed delay for those waits. Browser errors fail the case; + no engine is spawned. The focused fixture returns an empty successful channel roster and disables + the unrelated long-lived active-runs EventSource before loading the app, so disconnected-Slack 503s + and SSE teardown noise cannot be mistaken for feature failures or silently allowlisted. +- [x] Airtable: active engine-independent live definition `UI-WORKDIR-CONFLICT-01` mirrors the + Admin UI shared-folder setup, navigation, immediate refresh and evidence requirements below. + +Admin UI live release gate — **UNEXECUTED** (engine-independent). On a disposable deployment, create +three conversations: `folder-warning-a` and `folder-warning-b` use the same real folder, while +`folder-warning-control` uses a separate folder. Reload Conversations. Require A and B—but not the +control—to have red rows, a visible warning mark and “Shared working folder”; hovering each warning +must name the other assignment. Open A → Runtime → Browse and navigate to the shared folder: require +a red message naming B before selection. Navigate to the control's folder and an unused folder: the +warning must update to name the control for the former and disappear for the latter. Open the control +and browse the shared folder: require both A and B named before **Use this folder**. Reset B to its +default folder, save and reload; A and B must return to normal rows and browsing A's folder must no +longer warn about B. Record candidate revision, screenshots at desktop and narrow widths, API payloads +with no secret values, and browser-console output in the private QA registry before marking passed. Live release gate — **UNEXECUTED** (engine-independent: registration fails before engine selection). On a disposable deployment, create two synthetic Slack test channels and register both. Assign both @@ -300,7 +448,8 @@ allowlisted drive identity, no `/shares` request, no bearer on the byte request, and bounded streams. Voice fixtures inject transcripts/failures, plus a cancellable local Node child; require no raw audio engine attachments, no engine on audio-only failure and preserved text/file fallback. Simultaneous flat messages named `audio.wav` plus a revision must retain -three different storage paths and each original byte sequence. +three different storage paths while processing; completed audio sources are then removed and a +failed source remains byte-for-byte available for retry. - [ ] UNEXECUTED live native-card gate, separately with Claude and Codex pinned: install the reviewed branch manifest in an owned personal chat, channel and external-member group. It must @@ -345,8 +494,9 @@ three different storage paths and each original byte sequence. `Reply TEXT_FALLBACK_OK` with unavailable audio: text must run and the failure remain visible. Stop a long local transcription and verify child exit and no later engine start. Send two simultaneous group messages each attaching `audio.wav` with distinct spoken markers, then - edit/retrigger one; require independent stored bytes, transcripts and group session roots. - Preserve ordinary attached files. There is no Slack transcript fallback on Teams. + edit/retrigger one; require independent transcripts and group session roots, successful audio + sources removed after processing, and the stopped/failed source retained for retry. Preserve + ordinary attached files. There is no Slack transcript fallback on Teams. Verification on 2026-09-09: full coverage suite passed (2,404 passed, 10 skipped); @@ -1226,6 +1376,11 @@ Automated: `test/channel-memory.test.js`, `test/memory-search.test.js`, - [x] The registered search and read MCP handlers return formatted content through their injected response helper (regression: neither can fail with `text is not defined`). - [x] Untrusted/API-spoofed principals cannot call memory retrieval tools. +- [x] Unit: an untrusted (API-key) principal's `permission_prompt` call is refused as + `{ "behavior": "deny", "message": … }` — the shape Claude Code parses — rather than plain text, + which the CLI reported as "The permission prompt tool returned an invalid permission result" + (`test/gateway-mcp-authz.test.js`). Live: an API run in a non-Auto channel that asks for Bash + gets a clean denial naming the trusted-principal reason. - [x] The channel editor exposes Access, MCP Connections, Cloud MCP, Environment tokens, Skills, Runtime, Instructions, and Memory as first-class pages in that order, with no nested Tools navigation or channel Grant Tier selector; enabled skills appear first and one shared save @@ -1459,6 +1614,75 @@ Google Workspace / Azure tenant and are unchecked until that drill runs. - [x] Verify complete safe Codex stdio/HTTP MCP serialization and reject credentials/userinfo. - [x] Run the full local suite and static parser/whitespace gate. +## Qwen harness (opt-in, Claude Code CLI against QwenCloud) + +Automated (`test/qwen-engine.test.js`, `test/engine-registry.test.js`, +`test/engine-adapter-contract.test.js`, `test/engine-failover.test.js`) — engine-independent +except where a case names a harness, because these guard the adapter layer itself: + +- [x] A provider spawn carries none of the Anthropic credential family: an inherited + `ANTHROPIC_API_KEY`/`ANTHROPIC_AUTH_TOKEN`/`ANTHROPIC_BASE_URL` and a relayed + `CLAUDE_CODE_OAUTH_TOKEN` are all removed, and neither value appears anywhere in the child + environment; a Claude spawn with no provider is byte-for-byte unchanged. +- [x] A channel environment secret cannot redirect a Qwen run (`ANTHROPIC_*` stays reserved) while + ordinary channel secrets still ride in. +- [x] With no key configured the run fails closed naming the remedy (`details.runtimeCredential`), + never falling through to the ambient Anthropic credential. +- [x] Opt-in enablement: off until switched on; the "never lock every harness out" rescue restores + the DEFAULT harnesses only; an explicit Qwen-only deployment survives and resolves as the + gateway default engine. +- [x] Terminal in the failover graph both ways (`fallbackTargets("qwen") === []`, and neither + Claude's nor Codex's targets include it). +- [x] Model families: QwenCloud text models belong to `qwen` and to no other harness; the image, + video, audio and realtime families are rejected; Claude/Codex ids never match `qwen`. +- [x] Model-list URL derivation from the configured base URL (Token Plan, pay-as-you-go, and a + non-standard proxy); discovery sends a bearer key, filters, sorts and labels the account's + list; an unconfigured account or an HTTP failure raises instead of blanking the picker. +- [x] Cost: a Qwen turn records real tokens and `costUSD === null`, even with + `codexRatePer1MTokens` configured; Codex's own estimate is unaffected. +- [x] Settings: the key is write-only (`hasQwenApiKey`/`qwenApiKeyLast4` only, value absent from + the API snapshot), is in the `POST /api/secrets/reveal` allowlist, and the per-engine default + model is keyed off the adapter rather than a hardcoded pair. +- [x] A provider failure names the harness that failed ("Qwen authentication failed"), not the CLI + it borrows. +- [x] Model default: with no Qwen model set on the thread, channel or gateway, the run passes + `--model qwen3.8-max` (the first shipped model) instead of leaving the CLI to request its + own Anthropic default, which QwenCloud rejects with `400 Model not exist` + (`test/qwen-engine.test.js`, a stub `claude` echoing its `--model`). Live: a `qwen` API run on + a gateway with no `defaultQwenModel` must answer rather than fail with "Model not exist". + +Live acceptance (executed 2026-09-21 against the QwenCloud Token Plan endpoint +`https://token-plan.maas.qwencloudapi.com/apps/anthropic`, Claude Code 2.1.258, model +`qwen3.8-max` unless stated). Qwen-specific by nature — these exercise the `qwen` adapter itself: + +- [x] Discovery returned the account's 11 text models (`auto`, `deepseek-v4-flash-0731`, + `deepseek-v4-pro`, `deepseek-v4.1-flash`, `glm-5.2`, `glm-5.3`, `qwen3.6-flash`, + `qwen3.7-max`, `qwen3.7-plus`, `qwen3.8-flash`, `qwen3.8-max`), with `wan2.7-image*` and + `qwen-audio-*` excluded. The Anthropic path's own `/v1/models` answered HTTP 404 + `InvalidParameter: Not support`, confirming why the sibling endpoint is used. +- [x] Each of those 11 answered HTTP 200 on `/v1/messages`; `wan2.7-image` answered 400. +- [x] A real turn through `adapterFor("qwen").run()` read a file with the `Read` tool and answered + correctly (`SILVER-KESTREL-12`); stream events `thinking`/`tool_use`/`tool_result` arrived; + `costUSD` was `null` while `usage` kept real token counts (in 12 / out 87 / cache_read + 21994); a session id was minted and `-r` resume recalled the earlier answer. +- [x] Raw-CLI conformance for the gateway's exact flag set: `--output-format stream-json --verbose + --include-partial-messages` produced the full `message_start` / `content_block_start` / + `content_block_delta` / `content_block_stop` / `message_delta` / `message_stop` / `result` + sequence `src/engines/stream.js` parses; `--effort high` was accepted; an injected + `--mcp-config` stdio server was called (`mcp__gateway__*`) and its result used; a tool + outside `--allowedTools` produced a `permission_denials` entry rather than an error. +- [x] Negative: with a daemon `ANTHROPIC_API_KEY` present and an INVALID QwenCloud key, the turn + failed closed with `Qwen authentication failed: … API Error: 401 Invalid API-key provided` + (`details.engine === "qwen"`, `providerKind === "authentication"`) instead of quietly + answering from the Anthropic account. +- [x] Enable/disable: with the switch on, `getEnabledEngines()` — the single list the admin + selectors, the Slack channel Settings modal and the `/model` wizard all read — offered + `claude, codex, qwen (Qwen (Claude Code))`; turning it off removed it from that list. +- [ ] Not executed: a full Slack foreground turn on a live container-backed channel pinned to + `qwen` (needs a deployment with the harness enabled). The adapter path, credential boundary, + MCP injection and resume above are all exercised; what remains unproven is only the + Slack-surface plumbing, which is engine-independent and shared with Claude. + ## Dynamic engine model catalog - [x] Automated: parse the machine-readable Codex catalog, expose only `visibility=list` entries, @@ -1468,6 +1692,10 @@ Google Workspace / Azure tenant and are unchecked until that drill runs. inside the refresh window, maps model-specific effort choices, and survives the next failed refresh with the last good snapshot; a cold failure retains the bundled fallback (`test/model-discovery.test.js`). +- [x] Automated: the bundled fallback matches the authenticated Codex CLI 0.153.4 catalog observed + 2026-09-13 (`gpt-6-astra`, GPT-5.6 Sol/Terra/Luna, GPT-5.5 and + `gpt-5.3-codex-spark`, plus the unresolved `codex` sentinel); retired picker entries and the + rejected `gpt-5.6` alias are absent (`test/engine-registry.test.js`). - [x] Automated: Claude's picker and browser fallback use rolling aliases (including `best`, `fable`, and `sonnet[1m]`); the Admin UI consumes the registry's model/effort manifests and keeps a valid saved same-engine custom ID available (`test/model-options.test.js`, @@ -1744,8 +1972,11 @@ structural invariants are automated; rendered navigation and feature claims also the assistant status reads `is downloading 1 attachment(s) (… MB)…` while it fetches, the file lands under `uploads//` with its full size, the daemon's RSS does not grow by the file size (`systemctl --user status` memory line before/after), and the `video-understanding` skill - analyzes it. Attach a >500 MB file → the reply says ` exceeds the 500 MB attachment - limit` and `events.attachment_failed` carries the same reason. Both engines (QA: ATT-01). + analyzes it. After the evidence pack and any targeted re-sampling are complete, the original + upload is gone while the evidence pack remains. A deliberately failed decode keeps its source, + and a project video outside `uploads/` is never deleted. Attach a >500 MB file → the reply + says ` exceeds the 500 MB attachment limit` and `events.attachment_failed` carries the + same reason. Both engines (QA: ATT-01). - [ ] Live attachment smoke: upload XLSX, PDF, image, and multiple files with an `@bot` mention in both a root and a reply; edit a file message to add the mention; and confirm each turn receives the local path under the same thread folder exactly once. Then read the thread with @@ -1774,8 +2005,10 @@ structural invariants are automated; rendered navigation and feature claims also by `test/whisper-transcribe.test.js`. - [x] Unit: an unmentioned channel voice clip stays inert; mentioned, 🤖-reaction, and DM voice messages follow existing trigger semantics; authorization precedes both paths; typed text + - voice compose one prompt; raw audio is omitted; and no-transcript guidance exits before an - engine run (`test/slack-voice-prompts.test.js`). + voice compose one prompt; raw audio is omitted; successfully resolved downloads are removed; + failed originals remain for retry; cleanup refuses out-of-root files and symlinks; and + no-transcript guidance exits before an engine run (`test/slack-voice-prompts.test.js`, + `test/whisper-transcribe.test.js`, `test/managed-write-symlinks.test.js`). - [x] Unit: the backward-compatible setting and Admin UI/API wiring are covered by `test/whisper-settings.test.js`; installer flags/env/prompt/default behavior, platform/checksum selection, archive safety, persisted skip, and conditional updates are covered by @@ -1784,7 +2017,9 @@ structural invariants are automated; rendered navigation and feature claims also clip runs after an `@mention` or 🤖 reaction, while a DM follows current no-mention behavior. - [ ] Live: an unauthorized author cannot cause an audio download/transcription in a channel or DM. - [ ] Live: English and Romanian clips transcribe accurately enough to execute the spoken request; - typed text acts as instructions, and two clips appear in their original order. + typed text acts as instructions, and two clips appear in their original order. A successful + local transcript removes its downloaded source from `uploads/`; local failure plus successful + Slack fallback also removes it; total failure retains it for retry. - [ ] Privacy: with local mode enabled, observe only local `ffmpeg`/`whisper-cli`; with it disabled, observe Slack metadata/VTT reads but no raw-audio download. In both modes, neither raw audio nor an audio path reaches Claude/Codex. @@ -1839,7 +2074,7 @@ structural invariants are automated; rendered navigation and feature claims also - [ ] **Who can manage** = *Custom*: only a listed manager (or an admin) can change safe settings; others refused. - [ ] Default `manageAccess:"admins"` is unchanged behavior — non-admins cannot manage until opted in. - [ ] Network toggle is hidden in Read-only/Lean; visible for Worker/Autonomous/Full. -- [ ] Advanced disclosure holds memory/nudges/refuse-org-tokens/work-dir/engine/model/effort; all still save. +- [ ] Advanced disclosure holds memory/refuse-org-tokens/work-dir/engine/model/effort; all still save. - [ ] Settings → **Reset all channels' access to default**: confirm dialog; resets use→org default + manage→admins, clears custom guest + manager lists on every channel, leaves capability/skills/tokens untouched; logs a `channels_access_reset` event. @@ -1910,6 +2145,28 @@ structural invariants are automated; rendered navigation and feature claims also - [ ] A small GFM pipe table written in the answer renders as a styled table in native `markdown_text` streaming (including inline code/bold cells); if streaming fails, the classic reply fallback preserves the same rows as an aligned monospace grid. +- [x] Unit: standard Markdown references to public HTTP(S) images produce at most five unique Slack + `image` blocks, use plain bounded alt/title text, preserve balanced URL parentheses, and ignore + fenced examples plus local/data URLs. Native finalization puts previews before the run footer; + classic and unattended delivery can place them beside the answer; and `invalid_blocks` + preserves the complete text answer while native streaming retries with its healthy footer + (`test/slack-answer-images.test.js`). +- [x] Unit: Markdown image references to files in the run's working folder resolve through the + no-escape realpath boundary, deduplicate, reject non-images/escaping symlinks, and upload only + after the completed answer as native Slack thread files. Streaming and unattended paths share + each eligible file once; upload failure remains cosmetic (`test/slack-answer-images.test.js`). +- [ ] Live (both engines): ask the agent to answer with + `![ChannelGate preview](https://avatars.githubusercontent.com/u/9919?s=200&v=4)` and one short + sentence. Require one completed answer whose final blocks contain a visible image preview + above the normal footer, with the Markdown link still usable. Repeat with a fenced image + example and require no preview; then run the same prompt through a background agent and + require the unattended reply to show the preview. An unreachable/non-image HTTP(S) URL may + omit the preview but must leave the text answer and link intact. +- [ ] Live (both engines): ask the agent to create `artifacts/slack-preview.png` and end its answer + with `![ChannelGate preview](artifacts/slack-preview.png)`. Require the text answer to finish, + followed by a native Slack file card in the same thread with an inline thumbnail, filename, + download control and full-size preview. Repeat through an unattended/background delivery; + then reference an escaping symlink and require no upload and no loss of the text answer. - [x] Unit: stream progress receives a tool event and uses native `chatStream` + `assistant.threads.setStatus` without calling `chat.postMessage`/`chat.update` for the custom activity log; `loading_messages` puts the resolved model in the prominent @@ -2105,7 +2362,7 @@ structural invariants are automated; rendered navigation and feature claims also channel to Full access and repoints its working folder logs exactly ONE `channel_meta_changed` carrying those three keys with before/after, actor `admin-ui`, source `admin-ui` — and nothing for the keys the save round-tripped unchanged (`test/channel-policy-audit.test.js`). -- [x] Unit: a save that moves no policy key (a nudges toggle, a re-submitted form) writes no event, +- [x] Unit: a save that moves no policy key (a memory toggle, a re-submitted form) writes no event, and a `PUT /channels/:id/env/:name` still writes only its own name-only `channel_env_set` — the value never reaches any audit row and the env change does not duplicate into `channel_meta_changed` (`test/channel-policy-audit.test.js`). @@ -2296,16 +2553,21 @@ structural invariants are automated; rendered navigation and feature claims also key produces a Drive auth error, not a spawn/ENOENT — confirming argv + service-account-file). - [x] `testChannelSync` creates its working dir before spawning (spawn ENOENTs on a missing cwd, so the Test button must not depend on the boot-time sweep having run first). -- [x] Update provisions rclone (`scripts/update.sh` → `ensure_rclone`), verified across all branches +- [x] Fresh setup/service deployment and update provision host-side rclone through one + checksum-verified installer. Foreground/user services use `~/.local/bin`; the hardened system + service installs globally and also includes its service user's `.local/bin` on PATH. Update + provisioning still gates installation on `driveSyncEnabled`, but now runs even when the + checkout is already current. Verified across all branches with the real functions: Drive sync off → skip; on + rclone on PATH → present; on + rclone off - PATH but a valid configured absolute path → present; on + missing → install (the official - installer, best-effort, never aborts the update; the brew/macOS branch retired 2026-09-03 — - Linux only); no settings file → skip. + PATH but a valid configured absolute path → present; on + missing → install (best-effort, + Linux only); no settings file → skip. Failed runtime probes are not cached, so installing + rclone after a Test-button miss takes effect without restarting the daemon. `read_setting` reads the right instance's `settings.json` (honors `CHANNELGATE_DIR`) via explicit-ESM node (stable under `"type":"module"`). -- [ ] Manual: on a host without rclone, enable Drive sync, run `/update` (or `npm run …` update), - and confirm rclone gets installed and the Test button then connects. On Linux without - passwordless sudo, confirm the update still completes and logs the manual-install hint. +- [ ] Manual (engine-independent): on a host without rclone, run fresh setup/service installation + and confirm the binary is installed. Remove it, enable Drive sync, run `/update` while the + checkout is already current, and confirm the daemon-user install succeeds without sudo and + the Test button retries the prior miss without a restart. - [x] Dormant by default: with the feature disabled / no key file / rclone missing, a sweep and the Test action no-op with a clear message and never throw (smoke-tested). - [ ] Manual (needs rclone + a Workspace service-account key): set the global key-file path + @@ -2485,6 +2747,8 @@ the bridge network and *Allow network* is only a switch the engines are told abo authentication, usage-limit, model-rejection, invalid-request and the catch-all `provider` kinds are never treated as transient; the Codex classifier: a 404 naming the model is `model_rejected`, the CLI's underscore codes (`internal_server_error`, …) are `transient`, a + plain-string `turn.failed` saying the selected model is at capacity is a provider verdict + that retries twice and then answers through Claude when automatic failover is enabled, a "Reconnecting… (unexpected status 429 …)" progress line is transient (never a limit), and from stderr (`source: "stderr"`) only the explicit limit/auth phrasings count; the knobs are read per turn (clamped, duration syntax, unparseable → default). @@ -3568,7 +3832,7 @@ release, no egress cut-off — so the network entry has no container equivalent capability radio-card selects it (Full access is red-treated + admin-tagged; Custom reveals the four raw flag checkboxes); the two access dropdowns show live per-option help; network is a switch row. Tools: MCP + skills checklists filter and show "N of M enabled"; offline servers - carry a badge. Runtime: engine/model/effort + working folder + memory/nudges/org-token toggles. + carry a badge. Runtime: engine/model/effort + working folder + memory/org-token toggles. - [ ] One sticky save bar per detail: any Access/Tools/Runtime edit shows "Unsaved changes"; Discard restores the saved state; Save PUTs the FULL meta payload (same fields as before the redesign), updates the header pill + list row, then hides. Instructions & Memory are editor @@ -3578,9 +3842,13 @@ release, no egress cut-off — so the network entry has no container equivalent conversation and back, and verify every returned selection remains checked without a browser reload. Disable Settings → Slack replies → footer cost, save, and verify the checkbox remains off immediately and after a hard reload; the next Slack reply omits only the dollar segment. -- [ ] Users: table rows show role chips, personal Skills counts and C/T token state; clicking a row opens - the edit drawer; Save from the drawer persists name/approved/admin/tokens (unchanged PUT) and +- [ ] Users: table rows show role chips, personal Skills counts, quiet-thread reminder state and C/T + token state; clicking a row opens the edit drawer; Save persists name/approved/admin/reminders/tokens and the drawer stays on that user; "+ Add user" reveals the add form; adding opens the new user. +- [x] Unit: the quiet-thread sweep checks the requesting user's live preference, addresses only that + user, and leaves opted-out users unnotified; App Home can toggle only the clicking user's row and + republishes their view; the bulk-default API preserves unrelated user fields and secret masking + (`test/nudges-ttl.test.js`, `test/home-nudges.test.js`, `test/default-nudges.test.js`). - [x] Browser (engine-independent, disposable Chromium fixture): `test/user-skills-browser.test.js` uses the real admin UI/API and disposable users U_EMPTY (no skills) and U_SKILLS (alpha + offline-skill), with alpha/beta and 30 long names in the available catalog. Run with `CG_BROWSER_MODULE=/path/to/playwright/index.mjs @@ -4302,9 +4570,10 @@ are the v0.8 production deployment gate and are executed in the QA loop that fol cache, passes every pin through the image builder, and bumps the daemon/image spec in lockstep (automated: `test/container-image.test.js`). - [x] Unit: `gateway-usage` materializes its video workflow, dependency reference, and analyzer - script into every surface; the former standalone slug is rejected at the grant boundary, - excluded from the catalog, removed from organization/template/channel/personal grants at - boot, and stale gateway-managed workspace copies are pruned (automated: + script into every surface, including the successful-analysis-only cleanup rule for regular + gateway downloads beneath `uploads/`; the former standalone slug is rejected at the grant + boundary, excluded from the catalog, removed from organization/template/channel/personal + grants at boot, and stale gateway-managed workspace copies are pruned (automated: `test/access-grants.test.js`, `test/managed-write-symlinks.test.js`, `test/skills-platform.test.js`). - [x] Unit: `npm run setup` builds the channel image as part of the install (`scripts/install.sh` @@ -5114,15 +5383,17 @@ Manual checks for the daemon-level behavior: ### Codex usage accounting and API-equivalent rates - [ ] Settings → Behavior shows the Codex/OpenAI rates table prefilled with the rates verified - 2026-08-16 against OpenAI Standard pricing + 2026-09-13 against OpenAI Standard pricing prices; editing a cell and saving persists it (reload shows the edited value; the others keep defaults). The old blended `$/1M` fallback input is not shown. - [ ] A Codex run's footer shows the estimated `$x.xx` API-equivalent value and Activity records the same figure with the estimated flag; a Claude run still shows the real `$` cost (never an OpenAI-rate estimate, even if total_cost_usd were missing). -- [x] Unit: Terra/Luna current defaults, retired-default migration with custom override preservation, - nested cache-read/cache-write pricing, official model-boundary matching, unresolved-model - behavior, and the 272K threshold applied per request (`test/codex-rates.test.js`). +- [x] Unit: GPT-6 Astra at $10/$1 cached/$50, GPT-5.6 Sol/alias at $4/$0.40/$20, + Terra/Luna current defaults, retired-default migration with custom override preservation, + nested cache-read/cache-write pricing, dated-snapshot-only inheritance, CLI-only Spark kept + unpriced, unresolved-model behavior, and the 272K threshold applied per request + (`test/codex-rates.test.js`). - [x] Unit: one provider session is serialized across gateway keys; aborted waiters do not strand the lock (`test/keyed-lock.test.js`). - [x] Unit: root rollout deltas, resumed baselines, actual runtime model/context metadata, child @@ -5139,6 +5410,24 @@ Manual checks for the daemon-level behavior: - [x] Unit: boot-time auto-repair triggers only when legacy codex rows exist past the last applied batch cutoff, applies the shared repair path with a backup, records a batch even when nothing matches, and never rescans settled history (`test/usage-repair.test.js`). +- [x] Unit: the 2026-09-13 pricing refresh selects only Codex usage at/after 2026-07-13, recomputes + request, component and parent-run values from stored cache/context/model evidence, preserves + older and Claude rows, leaves the internal `codex-auto-review` pseudo-model unpriced, writes + the new basis atomically, applies GPT-5.6 Sol's $5/$0.50/$30 rate before the official + 2026-08-21 cutover and $4/$0.40/$20 at/after it, backs up once at boot, and skips the applied basis thereafter + (`test/usage-pricing.test.js`). +- [x] Live dated-pricing correction (2026-09-14): apply the new basis to a production copy and the live ledger, + confirm every GPT-5.6 Sol component before 2026-08-21 uses $5/$0.50/$30 while every component + at/after the cutover uses $4/$0.40/$20, Astra remains $10/$1/$50, parent totals match their + priced components, non-Codex and pre-window rows are unchanged, both backups pass + `quick_check`, and a second dry run reports zero delta. +- [x] Live upgrade/history drill (Codex only, 2026-09-13): before upgrade run `npm run usage:reprice` and retain + its model/count/value summary; apply or restart the upgraded daemon, confirm the reported + backup opens, rerun the preview, and query the last-two-month ledger. Pass: every GPT-6 Astra + request/component is priced at $10/$1 cached/$50 with the per-request >272K uplift; every + GPT-5.6 Sol request/component uses $4/$0.40/$20; the parent run equals its priced component + sum; entries before 2026-07-13 and Claude/provider costs are byte-for-byte unchanged; only + `codex-auto-review` remains unpriced; a second boot changes no row. - [x] Unit: a DM resolves ONLY `composio-user` — the channel token and the organization default are both refused (`source: "none-dm"`) in Personal mode, and SDK mode mints no channel session at all; channels/mpims keep both identities (`test/composio-resolution.test.js`, @@ -5704,7 +5993,11 @@ acceptance gates; no production restart or external message was performed by the ignore capability nonces but change with selected definitions/revocation. Clean emits no MCPs; Codex fallback must not inherit Claude selections. Test local/project/user precedence, fresh configuration reads, reserved names, missing definitions, stale URL grants, malformed config, - credential maps/helpers, interpolation and credential flags; errors must not disclose config. + credential maps/helpers, interpolation and credential flags; rejections must not disclose config. + Each unusable shape must be DROPPED with its own category reason while a healthy sibling in the + same selection still reaches the payload, and the run must complete: assert the delivered + content names the skipped selection and its reason, carries no config value, and that a + `run_mcp_dropped` event was recorded. - Live release gate, Claude and Codex: separate disposable Auto channels, approved test author, ordinary mode and a harmless credential-free stdio echo server whose script already exists in each container's permitted work folder. Configure the server in the operator engine catalog; @@ -5716,11 +6009,18 @@ acceptance gates; no production restart or external message was performed by the PASS requires real initialization/tools-call and exact returned nonce after the grant, absence after removal, no unrelated server or cross-engine selection exposure, and preserved isolation flags; self-reported availability alone is insufficient. Restore exact original selections. -- Negative live variant: select a server with no safe current transport definition; require a - named configuration remedy and no unselected or credential-bearing MCP startup. Do not copy - operator tokens into a channel to make the fixture pass. Selected HTTP/SSE transports must use - literal credential-free URLs without userinfo, query or fragment; explicit auth headers, env, - helpers, interpolation, unknown transport options and literal credential flags are refused. +- Negative live variant (2026-09-21, both engines): in the same channel select BOTH the healthy + echo server and a second server with no safe current transport definition (an HTTP server + carrying an `Authorization` header is the realistic shape). Ask the echo question again. PASS + requires a delivered answer in that exact thread that still calls the echo server and returns + the nonce, a prefix naming the skipped server and its category reason, no credential-bearing or + unselected MCP startup in the fixture server events, no header/env value anywhere in the reply, + and a `run_mcp_dropped` event for the channel in admin observability. The turn must NOT fail and + must NOT fail over to the other engine. Repeat with the channel's engine switched so each + harness drops its own selection set. Do not copy operator tokens into a channel to make the + fixture pass. Selected HTTP/SSE transports must use literal credential-free URLs without + userinfo, query or fragment; explicit auth headers, env, helpers, interpolation, unknown + transport options and literal credential flags are refused. - Local regression passes are candidate evidence. These live gates remain pending until the reviewed change is deployed and both engines have real delivered exact-thread retests. diff --git a/docs/ENGINE-CAPABILITIES.md b/docs/ENGINE-CAPABILITIES.md index 98c4d05e..6dcb6071 100644 --- a/docs/ENGINE-CAPABILITIES.md +++ b/docs/ENGINE-CAPABILITIES.md @@ -3,18 +3,25 @@ The executable source of truth is the validated manifest in `src/engines/adapters.js`; Slack and the Admin API/UI consume that registry. -| Capability | Claude | Codex | -| --- | --- | --- | -| Filesystem confinement | Per-conversation container mounts; Claude permissions control tools | Same container boundary; Read-only mode adds a CLI read-only sandbox | -| Network policy | Advisory off/on; container bridge networking, no domain filtering or egress firewall | Same container network boundary; CLI Read-only mode also restricts its own network access | -| Warm process / steer | yes | no; one-shot resume | -| Session identity | gateway-minted UUID | CLI-minted thread ID, persisted after the turn | -| Permission prompts | Interactive Slack tool approvals; automatic approval with Auto | Headless deny or eligible automatic review with Auto | -| MCP transport | Protected per-run configuration; HTTP/stdio servers and the gateway socket bridge | Per-run `-c` definitions; native HTTP with a credential helper for managed remote connections, stdio bridges for gateway/SDK | -| Optional MCPs | Explicitly selected server definitions | Selected runtime apps and complete credential-free stdio/HTTP definitions; managed credentialed integrations use separate protected paths | -| Skills | Organization/channel repository skills plus per-author grants | Native organization/channel repository skills plus a per-run personal skill catalog; personal delivery does not register slash commands | -| Usage/cost | provider-reported cost | token usage with configured rate estimate | -| Health | adapter-owned `--version` boot probe | adapter-owned `--version` boot probe | +| Capability | Claude | Codex | Qwen (Claude Code) | +| --- | --- | --- | --- | +| Filesystem confinement | Per-conversation container mounts by default; Claude permissions control tools. Admin-only Slack `/sudo` threads deliberately run on the host | Same default container boundary; Read-only mode adds a CLI read-only sandbox. `/sudo` deliberately runs on the host | Identical to Claude — same CLI, same lockdown file, same resolved runtime | +| Network policy | Advisory off/on; container bridge networking by default, direct daemon-account network in `/sudo`; no domain filtering or egress firewall | Same resolved-runtime policy; CLI Read-only mode also restricts its own network access outside bypass | Same advisory off/on as Claude | +| Warm process / steer | yes | no; one-shot resume | no; cold runs only, so a rotated provider key can never be served by a warm process | +| Session identity | gateway-minted UUID | CLI-minted thread ID, persisted after the turn | gateway-minted UUID (same CLI, same transcript layout, so session carry works unchanged) | +| Permission prompts | Interactive Slack tool approvals; automatic approval with Auto | Headless deny or eligible automatic review with Auto | Interactive Slack tool approvals, as Claude | +| MCP transport | Protected per-run configuration; HTTP/stdio servers and the gateway socket bridge | Per-run `-c` definitions; native HTTP with a credential helper for managed remote connections, stdio bridges for gateway/SDK | Identical to Claude, and shares Claude's per-channel selection key | +| Optional MCPs | Explicitly selected server definitions | Selected runtime apps and complete credential-free stdio/HTTP definitions; managed credentialed integrations use separate protected paths | Explicitly selected server definitions (the same selection Claude uses) | +| Skills | Organization/channel repository skills plus per-author grants | Native organization/channel repository skills plus a per-run personal skill catalog; personal delivery does not register slash commands | Same as Claude (`CLAUDE.md`, `.claude/skills`, plugin dirs) | +| Usage/cost | provider-reported cost | token usage with configured rate estimate | token usage only — the CLI's Anthropic-priced figure is dropped and no rate is inferred | +| Health | adapter-owned `--version` boot probe | adapter-owned `--version` boot probe | adapter-owned `--version` boot probe plus "is a QwenCloud key configured" | + +Qwen is **opt-in**: a missing `engineEnabled` entry means OFF, it is terminal in the failover +graph in both directions, and its provider credential (`qwenApiKey` / `qwenBaseUrl`) is gateway +configuration — never a per-channel environment secret, because `ANTHROPIC_*` is reserved there +precisely so a conversation cannot redirect its own provider. A Qwen spawn removes the whole +Anthropic credential family before applying its own, so the operator's login never leaves with it. +OpenCode is omitted from the table above; see `docs/OPENCODE-ADAPTER.md`. ## Engine-literal exceptions diff --git a/docs/OPERATIONS.md b/docs/OPERATIONS.md index 13bf120a..0517dafd 100644 --- a/docs/OPERATIONS.md +++ b/docs/OPERATIONS.md @@ -466,14 +466,30 @@ in a venv); `pipx` handles this for itself. If a CLI installs but the shell cann container is running an image built before spec 1.1.0 widened the PATH — rebuild with `npm run build:image`; the daemon logs that mismatch at boot. -**One runtime, one home for a thread's history.** A thread's engine-native history (Claude's -`projects//.jsonl` plus its `/` subagent directory, Codex's -`sessions/YYYY/MM/DD/rollout-*-.jsonl`) lives in the channel's HOME volume and is never moved: -stopping, starting or recreating the container loses nothing, and there is no other backend for a -thread to change to. A thread whose last turn ran on the host before the container-only switch has -no session on the container side, so its next message falls back to the existing heal — a fresh -engine session with the chat transcript replayed, which keeps the conversation readable but not the -engine's own working state (compaction summaries, tool results, subagent transcripts). +**Thread `/sudo`: deliberate direct-host execution.** An organization admin may send the typed +message `@agent /sudo` or `@agent /sudo on` in a Slack channel thread (`/sudo` as message text in a +DM). This is an in-thread bot control, not the conversation-top-level Slack slash-command surface. +Subsequent messages in that thread run the selected engine directly +as the daemon OS user, with its host filesystem, process namespace, native HOME, installed commands +and network—not inside the channel container. Only current organization admins can change or use +the thread while sudo is enabled; other senders receive an explicit rejection before work starts. +Use `/sudo status` to inspect it and `/sudo off` to return to the normal container. Boundary changes +are refused while the thread has running or queued work. This is intentionally more powerful than +Admin channel mode or the operator-home mount: it removes the container process/filesystem boundary. +Treat it as root-equivalent to the daemon account and use it only in trusted operational threads. + +The stored sudo flag is not authority. Slack ingress, the run orchestrator, and background launches +recheck current admin status; the run API and channel metadata cannot select the host runtime. +Host child environments still use ChannelGate's reviewed allowlist rather than blindly copying all +daemon secrets, but a process running as the daemon user can access anything that OS account can. + +**A thread's history follows `/sudo` boundary changes.** Claude history +(`projects//.jsonl` plus its `/` subagent directory) and Codex rollouts +(`sessions/YYYY/MM/DD/rollout-*-.jsonl`) normally live in the channel HOME volume. When sudo is +enabled, ChannelGate carries the active session container→host; when disabled, it carries it back. +If a copy is unavailable or fails, the existing transcript-healing path starts a fresh native +session while replaying the visible conversation. Stopping, starting or recreating a container +still preserves its HOME volume. **Inspect and debug.** diff --git a/docs/RELEASE-ACCEPTANCE.md b/docs/RELEASE-ACCEPTANCE.md index 750d8fab..2374ab51 100644 --- a/docs/RELEASE-ACCEPTANCE.md +++ b/docs/RELEASE-ACCEPTANCE.md @@ -1,5 +1,12 @@ # Release acceptance packet +0.5.1 live evidence (2026-09-21, owner-approved release without the full campaign): on the exact +candidate tree, a live Claude turn used the Read tool and returned the probe file's bytes; a live +Qwen turn with no model configured answered from QwenCloud with real tokens and no dollar cost. +The live smoke found and fixed two defects before release (Qwen's CLI-default model, the +run-API permission refusal shape). Codex live acceptance was NOT run (account usage-limited until +2026-09-24) and the RR rows below remain unexecuted for this version. + Status: **prepared; full live QA deferred to the planned campaign** (owner instruction, 2026-09-08). Next release: **0.5.1** (development on `beta`). These are reproducible definitions, not claimed passes. Use disposable private fixtures only. Record the actual channel IDs, host/image revision, diff --git a/docs/RELEASE-CHECKLIST.md b/docs/RELEASE-CHECKLIST.md index 29fb548d..880ece63 100644 --- a/docs/RELEASE-CHECKLIST.md +++ b/docs/RELEASE-CHECKLIST.md @@ -2,9 +2,10 @@ > 0.5.0 was published on 2026-09-06 by decision of the Licensor. Items still unticked below stay > tracked for the next release. -> Next release: **0.5.1**, draft in development on `beta`, pending full testing and explicit -> owner approval of the exact candidate before promotion to `main`. -> The deferred QA gate is not waived. +> 0.5.1 was published on 2026-09-21 by explicit owner decision after the full automated gate and +> CI passed on the exact candidate and a live smoke ran for Claude and Qwen. The owner released it +> without Codex live acceptance (the Codex account was usage-limited until 2026-09-24) and without +> the full live campaign; both remain open for the next release, see RELEASE-ACCEPTANCE.md. - [x] Authorized owner selected and documented the Makeitfuture Sustainable Use License; the bundled Poppins OFL notice is present and third-party components retain upstream terms. diff --git a/docs/WHY.md b/docs/WHY.md index ee20a8aa..75bfd7a5 100644 --- a/docs/WHY.md +++ b/docs/WHY.md @@ -12,8 +12,8 @@ **Bring Claude into Slack — isolated per channel, governed by you.** -Mention the bot in a channel or just DM it. It runs a real, headless Claude Code session inside a -per-conversation container, with each teammate's own tools and tokens, and posts back in the thread. +Mention the bot in a channel or just DM it. It normally runs a real, headless Claude Code session +inside a per-conversation container, with each teammate's own tools and tokens, and posts back in the thread. Self-hosted. No data leaves your machine except the model calls you already make. A local daemon that turns Claude Code (and optionally OpenAI Codex) into a Slack agent — with the @@ -23,9 +23,11 @@ isolation, observability, and governance a team actually needs. Most "AI in Slack" bots are a thin proxy to a hosted assistant. ChannelGate runs **the real Claude Code agent** — tools, skills, MCP, multi-step work, background jobs — on **your own -infrastructure**, with a hard **confinement boundary around every conversation**. Confinement is -the product: each channel is its own container with its own folder and an explicit tool allowlist, -so what happens in one channel can't read or write another. +infrastructure**, with a hard **default confinement boundary around every conversation**. +Confinement is the product: each channel is its own container with its own folder and an explicit +tool allowlist, so ordinary work in one channel cannot read or write another. A current organization +admin can deliberately waive that boundary for one Slack thread with `/sudo`; the thread then runs +as the daemon account and rejects every non-admin sender until `/sudo off`. ### The one-sentence pitch @@ -41,7 +43,7 @@ context-aware suggested prompts. Replies stream into the thread and land as clea messages with a time · tokens · cost footer. **Real work, not just chat.** It uses tools and skills, reads attached images and files, edits -code, and runs shell commands — all inside the channel's container. **Background jobs** hand +code, and runs shell commands — normally inside the channel's container. **Background jobs** hand long-running work (builds, transcriptions, test suites) to the daemon, which continues the thread automatically when the job finishes — and **survives a restart**: an interrupted job still reports back instead of vanishing. @@ -158,7 +160,7 @@ team already uses — no new tool to adopt, no context lost to a separate app. ### 3.2 Confinement is the product, not a feature -Every Slack conversation runs inside its **own container** with only its own folder mounted, an +Every Slack conversation normally runs inside its **own container** with only its own folder mounted, an explicit MCP tool allowlist, and the harness's global persistent memory switched off. What happens in a client channel physically cannot read or write the finance channel's files. Channel memory exists (`MEMORY.md`), but it is folder-scoped by design — no cross-channel bleed. @@ -166,7 +168,8 @@ Channel memory exists (`MEMORY.md`), but it is folder-scoped by design — no cr **Benefit to the organization:** you can safely give an autonomous agent to *many teams and clients at once*. The blast radius of any one conversation — a bad prompt, a confused agent, a malicious message — is one folder. This is the property that makes org-wide rollout defensible to -a security review. +a security review. The explicit exception is an admin-only `/sudo` thread: it trades that isolation +for direct daemon-account host execution, is isolated to one thread, and refuses non-admin replies. ### 3.3 Credentials are personal, access is governed @@ -431,11 +434,12 @@ terse catalog of what exists lives in `FEATURES.md`; this is the argument for it - **Reason:** running a full agent session to say "submit your timesheet" was pure waste; and a reminder nobody acknowledges is indistinguishable from no reminder at all. -#### Opt-in no-response nudges -- **What:** per-channel opt-in: the bot posts one gentle follow-up in a thread quiet past a - window (default 24h). Strictly single-thread. +#### Personal no-response nudges +- **What:** each user can opt in or out in Slack App Home; the bot posts one gentle follow-up that + mentions that user when their agent thread is quiet past a window (default 24h). The preference + follows the person across channels and DMs. Strictly single-thread. - **Value:** dropped threads resurface themselves instead of dying in scrollback. -- **Reason:** deliberately narrow (opt-in, one nudge, no cross-channel scanning) because an +- **Reason:** deliberately narrow (personal opt-in, one nudge, no cross-channel scanning) because an over-eager nagging bot is worse than none. #### Personal pending-response digests diff --git a/package.json b/package.json index 110ba25f..ec761f40 100644 --- a/package.json +++ b/package.json @@ -39,6 +39,7 @@ "restore:drill": "bash scripts/restore-drill.sh", "maintenance": "node scripts/runtime-maintenance.mjs", "usage:repair": "node scripts/repair-codex-usage-history.mjs", + "usage:reprice": "node scripts/refresh-codex-pricing.mjs", "release:artifacts": "node scripts/release-artifacts.mjs", "with-landing-lock": "node scripts/with-landing-lock.mjs --", "whisper:install": "node scripts/install-whisper.mjs", diff --git a/public/admin-events.js b/public/admin-events.js index 99829f49..ab438053 100644 --- a/public/admin-events.js +++ b/public/admin-events.js @@ -13,7 +13,8 @@ export const EVENT_LABELS = Object.freeze({ channel_env_set: "Channel secret set", channel_env_removed: "Channel secret removed", channels_access_reset: "All channel access reset", - channels_nudges_reset: "All channel reminders reset", + users_nudges_reset: "All user reminders reset", + user_nudges_changed: "User reminder preference changed", channels_runtime_reset: "All channel runtimes reset", secret_revealed: "Secret revealed", secret_reveal_denied: "Secret reveal refused (wrong password)", diff --git a/public/app.js b/public/app.js index 96c22bb5..b01c8d3b 100644 --- a/public/app.js +++ b/public/app.js @@ -159,7 +159,11 @@ const MODEL_OPTIONS = { // isn't in the curated list (hand-edited config, a full id like claude-opus-4-8) should survive as // an extra option (same engine: keep so Save round-trips it) or be dropped (other engine). function modelMatchesEngine(model, engine) { - return engine === "codex" ? /^(?:gpt-|o[0-9]|codex)/i.test(model) : /^(?:best|fable|haiku|opusplan|opus|sonnet|(?:opus|sonnet)\[1m\])$|^claude-/i.test(model); + if (engine === "codex") return /^(?:gpt-|o[0-9]|codex)/i.test(model); + // Mirrors isQwenTextModel (src/engines/qwen.js): the QwenCloud families, minus the image/audio + // ones that cannot hold a conversation. + if (engine === "qwen") return /^(?:auto|qwen[0-9][\w.-]*|qwen-[\w.-]+|glm-[\w.-]+|deepseek-[\w.-]+|kimi-[\w.-]+|minimax-[\w.-]+)$/i.test(model) && !/(?:^wan|image|video|audio|tts|realtime|t2v|i2v|speech)/i.test(model); + return /^(?:best|fable|haiku|opusplan|opus|sonnet|(?:opus|sonnet)\[1m\])$|^claude-/i.test(model); } // Fill a model The effective run gets the live union of all three tiers.`; @@ -2688,6 +2719,7 @@ function openUserDrawer(id) { name: drawer.querySelector(".ud-name").value, isAdmin: drawer.querySelector(".ud-admin").checked, approved: drawer.querySelector(".ud-approved").checked, + nudges: drawer.querySelector(".ud-nudges").checked, ...(token ? { composioToken: token } : {}), ...(toolboxToken ? { toolboxToken } : {}), composioTokenLabel, @@ -3007,6 +3039,11 @@ function addChipValues(container, text) { if (added) { serializeChips(container); markSettingsDirty(); } } +// Whether an opt-in harness's own provider credential is configured, by engine id. Filled from the +// settings payload; used only to annotate the toggle, never to gate it (an admin may legitimately +// switch a harness on and paste its key in the same save). +const SETTINGS_HAVE_PROVIDER_KEY = {}; + // One checkbox per known harness. Re-rendered (not patched) on every change so the engine pickers // and the "last one standing" lock stay derived from a single source: ENGINE_ENABLED. function paintEngineToggles() { @@ -3038,6 +3075,15 @@ function paintEngineToggles() { markSettingsDirty(); }); label.append(input, document.createTextNode(` ${m.label}`)); + // An OPT-IN harness needs a provider credential of its own, so say where that lives. Without + // this the checkbox reads like every other one and the admin only discovers the missing key + // when a run fails in Slack. + if (m.optIn && !SETTINGS_HAVE_PROVIDER_KEY[m.id]) { + const hint = document.createElement("em"); + hint.className = "state"; + hint.textContent = " · needs an API key below"; + label.append(hint); + } return label; })); } @@ -3092,6 +3138,10 @@ function readSettingsForm() { engine: document.getElementById("set-engine").value, defaultClaudeModel: document.getElementById("set-default-claude-model").value, defaultCodexModel: document.getElementById("set-default-codex-model").value, + defaultQwenModel: document.getElementById("set-default-qwen-model").value, + qwenBaseUrl: document.getElementById("set-qwen-base-url").value, + ...(tokenValue(document.getElementById("set-qwen-api-key")) ? { qwenApiKey: tokenValue(document.getElementById("set-qwen-api-key")) } : {}), + ...(document.getElementById("clear-qwen-api-key").classList.contains("armed") ? { clearQwenApiKey: true } : {}), modelChangeAccess: document.getElementById("set-model-change-access").value, engineEnabled: { ...ENGINE_ENABLED }, engineFallback: document.getElementById("set-engine-fallback").checked, @@ -3145,6 +3195,8 @@ function readSettingsForm() { function paintSettings(s) { applyEngineManifests(s.engines); ENGINE_ENABLED = { ...(s.engineEnabled || {}) }; + // Before the toggles paint: they annotate an opt-in harness whose provider key is still missing. + SETTINGS_HAVE_PROVIDER_KEY.qwen = s.hasQwenApiKey === true; paintEngineToggles(); const orgGrantsHost = document.getElementById("org-grants-editor"); orgGrantsEditor = buildAccessGrantsEditor(s.accessGrants || {}, { tier: "organization" }); @@ -3214,6 +3266,23 @@ function paintSettings(s) { GLOBAL_ENGINE = s.engine || "claude"; syncModelOptions({ modelSelect: document.getElementById("set-default-claude-model"), engine: "claude", value: s.defaultClaudeModel || "", blankLabel: "CLI default" }); syncModelOptions({ modelSelect: document.getElementById("set-default-codex-model"), engine: "codex", value: s.defaultCodexModel || "", blankLabel: "CLI default" }); + syncModelOptions({ modelSelect: document.getElementById("set-default-qwen-model"), engine: "qwen", value: s.defaultQwenModel || "", blankLabel: "provider default" }); + document.getElementById("set-qwen-base-url").value = s.qwenBaseUrl || ""; + document.getElementById("qwen-key-state").textContent = tokenState(s.hasQwenApiKey, s.qwenApiKeyLast4); + attachReveal(document.getElementById("set-qwen-api-key"), { has: s.hasQwenApiKey, last4: s.qwenApiKeyLast4 || "", fetch: revealSecret("settings", "qwenApiKey") }); + // Say WHERE the Qwen list came from: a stale fallback list and a live one look identical in a + // +
+

Qwen (Claude Code)

+

An optional third harness: the same Claude Code CLI, pointed at QwenCloud’s Anthropic-compatible endpoint, so it keeps the CLI’s tool loop, approval cards, connectors and skills. It is off until you switch it on under Engine & runtime → Harnesses the gateway may use. Your Anthropic login is never sent to QwenCloud, this harness is never used as an automatic failover target in either direction, and because QwenCloud reports no usable dollar cost its turns are recorded with tokens only.

+ + + +

Slack replies

Replies use Slack native streaming with native assistant status for thinking and tool progress.

@@ -618,12 +638,12 @@

Schedules & nudges

- +
- Apply the default to all existing channels & DMsOverwrites every existing conversation's no-response nudge with the default above. Per-channel overrides are lost. Can't be undone. + Apply the default to all existing usersOverwrites every user's quiet-thread reminder preference with the default above. Personal choices are lost. Can't be undone.
@@ -964,6 +984,7 @@

Danger zone

Choose a working folder

Current:
+
@@ -1250,7 +1271,6 @@

Environment secrets

-
@@ -1312,6 +1332,7 @@

+
diff --git a/public/styles.css b/public/styles.css index 80864b1c..eadd15c7 100644 --- a/public/styles.css +++ b/public/styles.css @@ -332,6 +332,8 @@ button.clear-tok.armed { background: rgba(229, 96, 77, .14); border-color: rgba( .modal-card { background: var(--panel); border: 1px solid var(--line); border-radius: 12px; padding: 18px; width: min(640px, 92vw); max-height: 80vh; display: flex; flex-direction: column; } .modal-card h3 { margin: 0 0 10px; font-size: 15px; font-weight: 600; } .fs-path { margin-bottom: 8px; font-size: 12px; color: var(--faint); word-break: break-all; } +.fs-conflict { margin: 0 0 10px; padding: 9px 11px; border: 1px solid rgba(229, 96, 77, .55); border-radius: 8px; background: rgba(229, 96, 77, .12); color: var(--danger); font-size: 12px; font-weight: 600; line-height: 1.45; } +.fs-conflict[hidden] { display: none; } .fs-list { flex: 1; overflow: auto; border: 1px solid var(--line); border-radius: 8px; background: var(--panel-dark); min-height: 200px; } .fs-item { display: flex; align-items: center; gap: 8px; padding: 7px 12px; cursor: pointer; border-bottom: 1px solid var(--line-soft); font-size: 13px; } .fs-item:hover { background: var(--panel-2); } @@ -552,6 +554,12 @@ button.clear-tok.armed { background: rgba(229, 96, 77, .14); border-color: rgba( .conv-item .conv-nm b { font-weight: 500; font-size: 13px; color: var(--ink); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; } .conv-item .conv-nm small { font-size: 10.5px; color: var(--faint); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; } .conv-item .conv-cost { font-size: 10.5px; color: var(--faint); font-variant-numeric: tabular-nums; flex: none; } +.conv-item.workdir-conflict { background: rgba(229, 96, 77, .1); border: 1px solid rgba(229, 96, 77, .48); } +.conv-item.workdir-conflict:hover, .conv-item.workdir-conflict.active { background: rgba(229, 96, 77, .16); } +.conv-item.workdir-conflict.active::before { background: var(--danger); } +.conv-item.workdir-conflict .capdot { background: var(--danger) !important; box-shadow: 0 0 0 3px rgba(229, 96, 77, .14); } +.conv-item.workdir-conflict .conv-nm b, .conv-item.workdir-conflict .conv-conflict-text { color: var(--danger); } +.conv-conflict-mark { display: inline-flex; align-items: center; justify-content: center; width: 17px; height: 17px; border-radius: 50%; flex: none; background: var(--danger); color: #fff; font-size: 11px; font-weight: 700; } /* Conversation detail header. */ .dhead { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; margin-bottom: 6px; } diff --git a/scripts/install-rclone.sh b/scripts/install-rclone.sh new file mode 100755 index 00000000..5663813b --- /dev/null +++ b/scripts/install-rclone.sh @@ -0,0 +1,62 @@ +#!/usr/bin/env bash +# Install the host-side rclone binary used by the daemon's Google Drive sync. Root installs use +# /usr/local/bin; ordinary daemon users get a durable ~/.local/bin copy. The downloaded archive is +# checked against rclone's release checksum before anything is installed. +set -euo pipefail + +if command -v rclone >/dev/null 2>&1; then + echo "→ rclone present ($(rclone version 2>/dev/null | head -1 || true))." + exit 0 +fi + +[ "$(uname -s)" = "Linux" ] || { echo "⚠ rclone auto-install is supported on Linux only."; exit 1; } +for command in curl sha256sum unzip; do + command -v "$command" >/dev/null 2>&1 || { + echo "⚠ $command is required to install rclone. Install rclone manually: https://rclone.org/install/" + exit 1 + } +done + +case "$(uname -m)" in + x86_64|amd64) RCLONE_ARCH="amd64" ;; + aarch64|arm64) RCLONE_ARCH="arm64" ;; + armv7l) RCLONE_ARCH="arm-v7" ;; + armv6l) RCLONE_ARCH="arm-v6" ;; + i386|i486|i586|i686) RCLONE_ARCH="386" ;; + *) echo "⚠ Unsupported rclone architecture: $(uname -m). Install it manually: https://rclone.org/install/"; exit 1 ;; +esac + +RCLONE_VERSION="$(curl -fsSL https://downloads.rclone.org/version.txt | tr -d '\r\n' | sed 's/^rclone //')" +[[ "$RCLONE_VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || { + echo "⚠ Could not resolve a valid rclone release version." + exit 1 +} + +RCLONE_ARCHIVE="rclone-${RCLONE_VERSION}-linux-${RCLONE_ARCH}.zip" +RCLONE_URL="https://downloads.rclone.org/${RCLONE_VERSION}" +RCLONE_TMP="$(mktemp -d)" +trap 'rm -rf "$RCLONE_TMP"' EXIT + +curl -fsSL "$RCLONE_URL/$RCLONE_ARCHIVE" -o "$RCLONE_TMP/$RCLONE_ARCHIVE" +curl -fsSL "$RCLONE_URL/SHA256SUMS" -o "$RCLONE_TMP/SHA256SUMS" +RCLONE_SUM="$(grep -F " $RCLONE_ARCHIVE" "$RCLONE_TMP/SHA256SUMS" | head -1)" +[ -n "$RCLONE_SUM" ] || { echo "⚠ The rclone release checksum is missing $RCLONE_ARCHIVE."; exit 1; } +printf '%s\n' "$RCLONE_SUM" | (cd "$RCLONE_TMP" && sha256sum -c -) +unzip -q "$RCLONE_TMP/$RCLONE_ARCHIVE" -d "$RCLONE_TMP" + +if [ -n "${CG_RCLONE_INSTALL_DIR:-}" ]; then + RCLONE_INSTALL_DIR="$CG_RCLONE_INSTALL_DIR" +elif [ "$(id -u)" = "0" ]; then + RCLONE_INSTALL_DIR="/usr/local/bin" +else + RCLONE_INSTALL_DIR="${HOME:?HOME is required}/.local/bin" +fi +case "$RCLONE_INSTALL_DIR" in + /*) ;; + *) echo "⚠ The rclone install directory must be absolute: $RCLONE_INSTALL_DIR"; exit 1 ;; +esac + +install -d -m 0755 "$RCLONE_INSTALL_DIR" +install -m 0755 "$RCLONE_TMP/rclone-${RCLONE_VERSION}-linux-${RCLONE_ARCH}/rclone" "$RCLONE_INSTALL_DIR/rclone" +"$RCLONE_INSTALL_DIR/rclone" version >/dev/null +echo "→ rclone installed at $RCLONE_INSTALL_DIR/rclone ($RCLONE_VERSION)." diff --git a/scripts/install-systemd.sh b/scripts/install-systemd.sh index b1e9b411..5c834ae4 100755 --- a/scripts/install-systemd.sh +++ b/scripts/install-systemd.sh @@ -34,12 +34,13 @@ UNIT_NAME="channelgate.service" NODE_BIN="$(command -v node)" # Engines run from the image. Only the daemon's Node/Podman tools need a host PATH. -SERVICE_PATH="$(dirname "$NODE_BIN"):/usr/local/bin:/usr/bin:/bin" +SERVICE_PATH="$SERVICE_HOME/.local/bin:$(dirname "$NODE_BIN"):/usr/local/bin:/usr/bin:/bin" # Values are embedded in a systemd unit, whose quoting/expansion rules differ from shell. case "$SERVICE_USER" in *[!a-zA-Z0-9_-]*|"") echo "Invalid service account name"; exit 1;; esac for value in "$APP_DIR" "$SERVICE_HOME" "$NODE_BIN"; do case "$value" in *[[:space:]%\"\\]*|[!/]*) echo "Service paths must be absolute and contain no whitespace, percent, quote or backslash"; exit 1;; esac done + # Before provisioning an account or changing checkout ownership, prove the parent directories # are traversable. Do not widen an operator's private home ACL to make a service install work. relocation_remedy() { @@ -127,6 +128,15 @@ run_as_service() ( XDG_RUNTIME_DIR="$SERVICE_RUNTIME_DIR" DBUS_SESSION_BUS_ADDRESS="unix:path=$SERVICE_RUNTIME_DIR/bus" \ PATH="$SERVICE_PATH" "$@" ) + +# Drive synchronization is daemon-side, so rclone belongs on the host rather than in the channel +# image. Provision it during a fresh service deployment; updates can later repair it in the service +# user's ~/.local/bin without requiring passwordless sudo. +echo "→ Checking rclone (Google Drive sync)…" +if ! CG_RCLONE_INSTALL_DIR=/usr/local/bin bash "$APP_DIR/scripts/install-rclone.sh"; then + echo "⚠ rclone setup failed — the gateway can start, but Google Drive sync stays dormant." + echo " Install it manually and set its absolute path under Settings → Google Drive sync." +fi run_as_service podman info --format '{{.Host.Security.Rootless}}' | grep -qx true || { echo "Rootless Podman is not usable as $SERVICE_USER"; exit 1; } diff --git a/scripts/install.sh b/scripts/install.sh index 9cf72333..2b9d4644 100755 --- a/scripts/install.sh +++ b/scripts/install.sh @@ -72,7 +72,18 @@ if [ -f package-lock.json ]; then npm ci || npm install; else npm install; fi say "Voice transcription" node scripts/configure-whisper.mjs "${WHISPER_ARGS[@]}" -# 7. channel container image --------------------------------------------------------- +# 7. host-side Google Drive sync ----------------------------------------------------- +say "Google Drive sync" +if [ "$NO_SERVICE" -eq 1 ]; then + if ! bash scripts/install-rclone.sh; then + echo "⚠️ rclone setup failed. The gateway still works, but Google Drive sync stays dormant." + echo " Install it manually: https://rclone.org/install/" + fi +else + echo "The system service installer provisions rclone for the host daemon." +fi + +# 8. channel container image --------------------------------------------------------- # Every conversation runs inside this image, and the daemon fails a run closed without it. The # image is where the shared toolchain lives (engine CLIs, ffmpeg/ffprobe, OpenCV, faster-whisper and # its pre-cached speech model) — so building it IS part of the install, not a step to remember later. @@ -98,7 +109,7 @@ else fi fi -# 8. .env scaffold ---------------------------------------------------------------- +# 9. .env scaffold ---------------------------------------------------------------- if [ ! -f .env ]; then cp .env.example .env echo "✅ created .env (tokens are optional here — you can set them in the admin UI)" @@ -106,7 +117,7 @@ else echo "✅ .env already present" fi -# 9. systemd service (needs root, so it is a separate step) ---------------------------- +# 10. systemd service (needs root, so it is a separate step) --------------------------- if [ "$NO_SERVICE" -eq 0 ]; then echo "ℹ️ Install the systemd service (starts at boot, restarts on failure):" echo " sudo bash scripts/install-systemd.sh" diff --git a/scripts/refresh-codex-pricing.mjs b/scripts/refresh-codex-pricing.mjs new file mode 100644 index 00000000..abac9b8a --- /dev/null +++ b/scripts/refresh-codex-pricing.mjs @@ -0,0 +1,29 @@ +#!/usr/bin/env node +// Dry-run by default. `--apply` backs up the gateway database and installs the current Codex +// Standard API-equivalent pricing basis over the declared historical window. Daemon boot runs the +// same idempotent refresh once after an upgraded instance repairs any legacy Codex accounting. +import { DatabaseSync } from "node:sqlite"; +import { dbFile } from "../src/config/paths.js"; +import { getDb } from "../src/db/index.js"; +import { backupGatewayDb } from "../src/gateway/usage-repair.js"; +import { + applyCodexPricingRefresh, + buildCodexPricingRefresh, + summarizeCodexPricingRefresh, +} from "../src/gateway/usage-pricing.js"; + +const apply = process.argv.includes("--apply"); +const sourcePath = dbFile(); +const source = new DatabaseSync(sourcePath, { readOnly: true }); +const plan = buildCodexPricingRefresh({ db: source }); +source.close(); +const summary = { mode: apply ? "apply" : "dry-run", database: sourcePath, ...summarizeCodexPricingRefresh(plan) }; + +if (!apply) { + console.log(JSON.stringify(summary, null, 2)); + process.exit(0); +} + +const backupPath = plan.usageRows ? await backupGatewayDb() : ""; +applyCodexPricingRefresh(getDb(), plan); +console.log(JSON.stringify({ ...summary, backupPath }, null, 2)); diff --git a/scripts/update-provision.sh b/scripts/update-provision.sh index c7707f75..2563d57c 100755 --- a/scripts/update-provision.sh +++ b/scripts/update-provision.sh @@ -16,14 +16,7 @@ read_setting() { } install_rclone() { - case "$(uname -s)" in - Linux) - if ! command -v curl >/dev/null 2>&1; then echo "⚠ curl not found — install rclone manually: https://rclone.org/install/"; return 1; fi - if [ "$(id -u)" = "0" ]; then curl -fsSL https://rclone.org/install.sh | bash - elif command -v sudo >/dev/null 2>&1 && sudo -n true 2>/dev/null; then curl -fsSL https://rclone.org/install.sh | sudo bash - else echo "⚠ Need root to install rclone — run: curl https://rclone.org/install.sh | sudo bash"; return 1; fi ;; - *) echo "⚠ Auto-install unsupported on $(uname -s) — see https://rclone.org/install/"; return 1 ;; - esac + bash "$APP_DIR/scripts/install-rclone.sh" } ensure_rclone() { diff --git a/scripts/update-runner.mjs b/scripts/update-runner.mjs index 838bb6b7..c6941506 100755 --- a/scripts/update-runner.mjs +++ b/scripts/update-runner.mjs @@ -606,6 +606,11 @@ export async function executeUpdateTransaction({ }, }); if (context.oldRevision === context.targetRevision) { + // Provisioning is also a repair operation. In particular, an operator may enable Drive sync + // after the last code update and then run Update to install rclone; an up-to-date checkout + // must not skip that repair path. + phase(root, owner, "provisioning"); + await ops.provision?.({ context, owner }); let imageResult; try { imageResult = await ops.image?.({ context, owner }); diff --git a/src/config/settings.js b/src/config/settings.js index 2b9798da..44d3b2af 100644 --- a/src/config/settings.js +++ b/src/config/settings.js @@ -8,6 +8,9 @@ import { settingsFile } from "./paths.js"; import { writeSecretFile } from "./harden.js"; import { getDb } from "../db/index.js"; import { ENGINE_IDS, adapterOr } from "../engines/registry.js"; +// Value-only import (the default endpoint constant). qwen.js reads settings LAZILY, so this +// direction carries no cycle. +import { QWEN_DEFAULT_BASE_URL } from "../engines/qwen.js"; // The default container image ref lives with the image module (a dependency-free leaf) so the // transactional updater can name the same image without importing this file's database layer. import { CONTAINER_DEFAULT_IMAGE } from "../runtimes/container/image.js"; @@ -260,13 +263,22 @@ export const ENGINES = ENGINE_IDS; // later) keeps working without a migration. // Fails OPEN: a stored map that disables everything would brick the gateway, so the getter treats // "all engines off" as "all engines on" (the API route also refuses to save that state). +// An OPT-IN harness (adapter fact `optIn`) inverts the default: it is available only where the +// admin explicitly switched it on. Qwen is the first — it needs a QwenCloud key nobody has by +// default, so inheriting "missing key means enabled" would put a harness in every picker whose +// every turn fails, and would make `git pull` change which provider a deployment can reach. +const engineIsOptIn = (id) => Boolean(adapterOr(id).optIn); export function isEngineEnabled(engine) { const id = String(engine || ""); if (!ENGINES.includes(id)) return false; const map = getSettings().engineEnabled; - if (!map || typeof map !== "object") return true; - if (!ENGINES.some((e) => map[e] !== false)) return true; // never lock every harness out - return map[id] !== false; + if (!map || typeof map !== "object") return !engineIsOptIn(id); + const on = (e) => (engineIsOptIn(e) ? map[e] === true : map[e] !== false); + // Never lock every harness out — but the rescue restores the DEFAULT harnesses only. An opt-in + // engine must never be switched on by a fallback, and a deployment that deliberately runs ONLY + // an opt-in harness must not have the others silently restored underneath it. + if (!ENGINES.some(on)) return !engineIsOptIn(id); + return on(id); } export function getEnabledEngines() { return ENGINES.filter(isEngineEnabled); @@ -376,6 +388,22 @@ export function getContainerRuntime() { fullAccessHome: s.containerFullAccessHome === true, }; } +// ── Qwen provider (the `qwen` engine — src/engines/qwen.js) ─────────────────────────────────── +// A gateway-level credential, deliberately NOT a per-channel environment secret: `ANTHROPIC_*` is +// a reserved prefix in channel-env.js because redirecting a run's provider is identity hijack. +// Write-only from the API like every other token here — has*/last4 on listings, the value only +// through POST /api/secrets/reveal. +export function getQwenConfig() { + const s = getSettings(); + return { + apiKey: typeof s.qwenApiKey === "string" ? s.qwenApiKey.trim() : "", + baseUrl: typeof s.qwenBaseUrl === "string" && s.qwenBaseUrl.trim() ? s.qwenBaseUrl.trim() : QWEN_DEFAULT_BASE_URL, + }; +} +export function hasQwenApiKey() { + return Boolean(getQwenConfig().apiKey); +} + // The long-lived subscription token from `claude setup-token`, injected as CLAUDE_CODE_OAUTH_TOKEN // into container runs (plan §11 item 1). Never listed; write-only from the API like the other tokens. export function getContainerClaudeOauthToken() { @@ -487,13 +515,14 @@ export function getCodexRatePer1MTokens() { } // Per-model Codex $/1M-token rates for the cost ESTIMATE (input / cached-input / output). -// Defaults verified against OpenAI's STANDARD API pricing table on 2026-08-16; admins can adjust +// Defaults verified against OpenAI's STANDARD API pricing table on 2026-09-13; admins can adjust // them in Settings → Integrations. `cachedInput` prices the cached_input_tokens subset of input. // Editable values are merged OVER these defaults, so a pricing change only needs the changed cell; // the model list itself is fixed and intentionally small. export const DEFAULT_CODEX_RATES = { - "gpt-5.6-sol": { input: 5, cachedInput: 0.5, output: 30 }, - "gpt-5.6": { input: 5, cachedInput: 0.5, output: 30 }, // alias for gpt-5.6-sol + "gpt-6-astra": { input: 10, cachedInput: 1, output: 50 }, + "gpt-5.6-sol": { input: 4, cachedInput: 0.4, output: 20 }, + "gpt-5.6": { input: 4, cachedInput: 0.4, output: 20 }, // alias for gpt-5.6-sol "gpt-5.6-terra": { input: 2, cachedInput: 0.2, output: 12 }, "gpt-5.6-luna": { input: 0.2, cachedInput: 0.02, output: 1.2 }, "gpt-5.5": { input: 5, cachedInput: 0.5, output: 30 }, @@ -505,9 +534,11 @@ export const DEFAULT_CODEX_RATES = { // The admin UI historically saved the complete displayed table, including untouched defaults. // When OpenAI changes a default, an old full snapshot would therefore shadow the corrected code -// forever. Treat only the two exact retired defaults as inherited values; genuinely customized +// forever. Treat only the exact retired defaults as inherited values; genuinely customized // cells (anything else) remain authoritative. A subsequent Settings save persists the new table. const RETIRED_CODEX_DEFAULTS = { + "gpt-5.6-sol": { input: 5, cachedInput: 0.5, output: 30 }, + "gpt-5.6": { input: 5, cachedInput: 0.5, output: 30 }, "gpt-5.6-terra": { input: 2.5, cachedInput: 0.25, output: 15 }, "gpt-5.6-luna": { input: 1, cachedInput: 0.1, output: 6 }, }; @@ -666,20 +697,26 @@ export function getScheduleMaxPerChannel() { return Number.isFinite(v) && v >= 1 ? Math.floor(v) : 20; } -// Hours of silence before an opt-in channel's thread gets a single "no-response" nudge. Default 24. +// Hours of silence before an opted-in user's thread gets a single "no-response" nudge. Default 24. export function getNoResponseReminderHours() { const v = Number(getSettings().noResponseReminderHours); return Number.isFinite(v) && v >= 1 ? v : 24; } -// Org-level default for the no-response nudge, captured onto a channel's/DM's meta.nudges when the -// bot first registers it (so changing this later only affects conversations added afterward; the -// "reset all" button pushes it onto existing ones). Default off — nudges stay opt-in unless an -// admin turns this on. +// Org-level default for the no-response nudge, captured onto a user's record when the bot first +// sees them (so changing this later only affects new users; the "apply to all" button pushes it +// onto existing ones). Default off — nudges stay opt-in unless an admin turns this on. export function getDefaultNudges() { return Boolean(getSettings().defaultNudges); } +// Old user rows predate the personal preference. Until first sight/backfill, interpret an absent +// value through the current organization default instead of silently opting somebody in or out. +export function userNudgesEnabled(user) { + if (!user || typeof user !== "object") return false; + return typeof user?.nudges === "boolean" ? user.nudges : getDefaultNudges(); +} + // Personal "pending-response" follow-up digests. When on (default), each approved user gets a DM // at the configured hours listing the threads (in channels the bot is in) that are awaiting their // reply — a thread they took part in where someone else spoke last and they haven't ✅'d it. @@ -854,6 +891,12 @@ export function settingsForApi() { engine: getEngine(), defaultClaudeModel: getDefaultModel("claude"), defaultCodexModel: getDefaultModel("codex"), + defaultQwenModel: getDefaultModel("qwen"), + // The Qwen provider: presence and endpoint only. The key itself is fetched one at a time from + // POST /api/secrets/reveal, like every other credential on this snapshot. + hasQwenApiKey: hasQwenApiKey(), + qwenApiKeyLast4: last4(getQwenConfig().apiKey), + qwenBaseUrl: getQwenConfig().baseUrl, modelChangeAccess: getModelChangeAccess(), engineEnabled: getEngineEnabledMap(), engineFallback: getEngineFallback(), diff --git a/src/config/store.js b/src/config/store.js index c3c896ed..3819ee6c 100644 --- a/src/config/store.js +++ b/src/config/store.js @@ -20,6 +20,17 @@ import { stripDeadFields } from "./dead-fields.js"; import { DEFAULT_PLATFORM, isPlatformId, platformFolderNames } from "../platforms/registry.js"; const PLATFORM_FOLDER_NAMES = new Set(platformFolderNames()); +// `nudges` moved from conversation metadata to user records. Retire this shape-specific key only +// at the channel boundary; unlike stripDeadFields(), this is also safe on internal reads because it +// is not a secret-retirement policy (some tests intentionally prove old secrets survive until a +// write while listing maskers still hide them). +function stripRetiredChannelFields(meta) { + const record = meta; + if (!record || !Object.hasOwn(record, "nudges")) return record; + const { nudges: _retired, ...rest } = record; + return rest; +} + // ── Bootstrap ─────────────────────────────────────────────────────────────── // Create the runtime dirs and open/migrate the database. Idempotent: safe every boot. export async function ensureRoot() { @@ -31,8 +42,8 @@ export async function ensureRoot() { } // ── Users (global) ──────────────────────────────────────────────────────────── -// Shape: { "": { name, composioToken, toolboxToken, isAdmin, approved, -// skills[], allowedMcps[], allowedCodexMcps[] } } +// Shape: { "": { name, composioToken, toolboxToken, isAdmin, approved, +// nudges, skills[], allowedMcps[], allowedCodexMcps[] } } export async function getUsers() { const rows = getDb().prepare("SELECT user_id, data FROM users").all(); const out = {}; @@ -196,7 +207,6 @@ export function defaultChannelMeta({ channelId, name, type, isDM, platform }) { autoMode: false, // autonomous: auto-approve permission prompts (no Slack buttons); still sandboxed cleanMode: false, // run bare: no MCP servers (gateway/composio/skills), no skills, no favorites block noDefaultTokens: false, // refuse the org-default token fallback here (channel/user tokens still apply) - nudges: false, // opt-in: stall + 24h no-response thread reminders memory: undefined, // folder-scoped MEMORY.md: undefined = use the gateway default; true/false to override engine: "", // per-channel engine: "" = use the global default, or "claude" / "codex" approvedTools: [], // tool names "approved forever" here — auto-approved without a prompt @@ -215,11 +225,11 @@ export function defaultChannelMeta({ channelId, name, type, isDM, platform }) { export async function getChannelMeta(slug) { const row = getDb().prepare("SELECT data FROM channel_meta WHERE slug = ?").get(slug); - return row ? fromJson(row.data, null) : null; + return row ? stripRetiredChannelFields(fromJson(row.data, null)) : null; } export async function saveChannelMeta(slug, meta) { - const record = stripDeadFields(meta); + const record = stripDeadFields(stripRetiredChannelFields(meta)); getDb() .prepare("INSERT INTO channel_meta(slug, data) VALUES(?, ?) ON CONFLICT(slug) DO UPDATE SET data = excluded.data") .run(slug, toJson(record)); @@ -240,13 +250,13 @@ export async function patchChannelMeta(slug, patch) { db.exec("BEGIN IMMEDIATE"); try { const row = db.prepare("SELECT data FROM channel_meta WHERE slug = ?").get(slug); - const current = row ? fromJson(row.data, {}) : null; + const current = row ? stripRetiredChannelFields(fromJson(row.data, {})) : null; const partial = typeof patch === "function" ? patch(current) : patch; if (partial == null) { db.exec("ROLLBACK"); return null; } - const next = stripDeadFields({ ...(current || {}), ...partial }); + const next = stripDeadFields(stripRetiredChannelFields({ ...(current || {}), ...partial })); db.prepare("INSERT INTO channel_meta(slug, data) VALUES(?, ?) ON CONFLICT(slug) DO UPDATE SET data = excluded.data").run(slug, toJson(next)); db.exec("COMMIT"); return next; diff --git a/src/db/migrations.js b/src/db/migrations.js index 9564268e..18c92088 100644 --- a/src/db/migrations.js +++ b/src/db/migrations.js @@ -811,4 +811,23 @@ export const migrations = [ `); }, }, + { + version: 26, + up(db) { + db.exec(` + CREATE TABLE question_requests ( + id TEXT PRIMARY KEY, + channel_id TEXT NOT NULL, + thread_key TEXT NOT NULL, + author_id TEXT NOT NULL, + status TEXT NOT NULL, + revision INTEGER NOT NULL, + updated_ms INTEGER NOT NULL, + data TEXT NOT NULL + ); + CREATE INDEX idx_question_requests_pending ON question_requests(channel_id, thread_key, author_id, status); + CREATE UNIQUE INDEX idx_question_requests_one_pending ON question_requests(channel_id, thread_key, author_id) WHERE status = 'pending'; + `); + }, + }, ]; diff --git a/src/engines/adapters.js b/src/engines/adapters.js index 84dee860..5c62dcd0 100644 --- a/src/engines/adapters.js +++ b/src/engines/adapters.js @@ -3,13 +3,15 @@ import { resolveClaudeMcpConfig } from "./claude-mcp.js"; import { runClaude, buildClaudeEnv, buildPersistentArgs, canUseClaudeWarmPool } from "./claude.js"; import { runCodex } from "./codex.js"; import { runOpenCode } from "./opencode.js"; +import { discoverQwenModels, qwenCredentialState, qwenProviderEnv, QWEN_FALLBACK_MODELS, QWEN_DEFAULT_MODEL, isQwenTextModel, resolveQwenProvider } from "./qwen.js"; import { runPooled, abortPooled } from "./session-pool.js"; import { compileNetworkPolicy } from "./network-policy.js"; import { listEngineMcps, codexMcpPolicyFor } from "../gateway/mcp-discovery.js"; import { commandHealth, validateEngineAdapter } from "./contract.js"; import { runtimeTargetOr } from "./runtime-target.js"; import { readCodexAuthState } from "./codex-auth.js"; -import { claudeEngineHome, codexEngineHome } from "../config/paths.js"; +import { codexEngineHome } from "../config/paths.js"; +import { hostClaudeStateDir, hostCodexStateDir } from "./host-state.js"; import { discoverCodexModels } from "./model-discovery.js"; import { requirePluginRuntime } from "../gateway/plugin-runtime.js"; @@ -46,6 +48,9 @@ function claudeProjectKey(cwd) { // declared modes into the compiler, so supports.networkModes is the single source of truth. const FULL_NETWORK_MODES = Object.freeze(["off", "on"]); +// Category-only, like claude-mcp.js REJECTION: this text is posted into the channel. +const CODEX_MCP_UNSAFE_REASON = "has no complete credential-free launch definition in the host Codex configuration"; + const baseCompile = (engine, request = {}, supportedModes = ["off"]) => { const network = compileNetworkPolicy({ engine, allowNetwork: Boolean(request.allowNetwork), supportedModes }); return { supported: network.supported, reason: network.reason || "", network, writable: Boolean(request.writable), bypass: Boolean(request.dangerouslySkip) }; @@ -75,10 +80,8 @@ const claude = validateEngineAdapter({ modelBelongs: (m) => /^(?:best|fable|haiku|opusplan|opus|sonnet|(?:opus|sonnet)\[1m\])$|^claude-/.test(m), resumeCommand: (id) => `claude --resume ${id}`, sessionState: Object.freeze({ - // CLAUDE_CONFIG_DIR on the host is the gateway's stable synthetic one (run-grant-artifacts.js - // plants `projects` in it as a symlink to the operator's real directory, which the copy - // follows as an ancestor). - hostDir: () => path.join(claudeEngineHome(), ".claude"), + // A direct `/sudo` turn uses the daemon account's native Claude config/state directory. + hostDir: () => hostClaudeStateDir(), containerDirKey: "claudeConfigDir", files: ({ cwd, sessionId }) => { const key = claudeProjectKey(cwd); @@ -124,12 +127,12 @@ const claude = validateEngineAdapter({ }); // The warm process never learns the model it was started with; a provider failure it reports // still needs `requestedModel` for the same-engine model retry (see gateway/run.js). - return runPooled({ key: r.poolKey, cwd: ctx.cwd, args, env: buildClaudeEnv({ extraEnv: r.channelEnv, browserNamespace: r.browserNamespace, target, oauthToken: claudeOauthToken }), idleMs, target, mcpConfigJson: r.mcpConfigFingerprint || r.mcpConfigJson, dangerouslySkip: r.dangerouslySkip, fingerprintExtra: `${r.model}|${r.effort}|${r.permissionPromptTool}|${isolationFingerprint}`, text: ctx.prompt, turnTimeoutMs: r.timeoutMs, maxSilenceMs: r.maxSilenceMs, signal: r.signal, onDelta: r.onDelta, onEvent: r.onEvent }).catch((error) => { + return runPooled({ key: r.poolKey, cwd: ctx.cwd, args, env: buildClaudeEnv({ home: r.claudeHome, configDir: r.claudeConfigDir, extraEnv: r.channelEnv, browserNamespace: r.browserNamespace, target, oauthToken: claudeOauthToken }), idleMs, target, mcpConfigJson: r.mcpConfigFingerprint || r.mcpConfigJson, dangerouslySkip: r.dangerouslySkip, fingerprintExtra: `${r.model}|${r.effort}|${r.permissionPromptTool}|${isolationFingerprint}`, text: ctx.prompt, turnTimeoutMs: r.timeoutMs, maxSilenceMs: r.maxSilenceMs, signal: r.signal, onDelta: r.onDelta, onEvent: r.onEvent }).catch((error) => { if (error?.details?.providerError === true && error.details.requestedModel === undefined) error.details.requestedModel = r.model; throw error; }); } - return runClaude({ cwd: ctx.cwd, prompt: ctx.prompt, sessionId: ctx.session.id, isNewSession: ctx.session.fresh, mcpConfig: r.mcpConfigFile, strictMcp: r.strictMcp, dangerouslySkip: r.dangerouslySkip, settingsFile: r.settingsFile, model: r.model, effort: r.effort, timeoutMs: r.timeoutMs, maxSilenceMs: r.maxSilenceMs, signal: r.signal, onDelta: r.onDelta, onEvent: r.onEvent, permissionPromptTool: r.permissionPromptTool, pluginDirs: r.claudePluginDirs, instructionFile: r.instructionFile, extraEnv: r.channelEnv, browserNamespace: r.browserNamespace, target, claudeOauthToken }); + return runClaude({ cwd: ctx.cwd, prompt: ctx.prompt, sessionId: ctx.session.id, isNewSession: ctx.session.fresh, mcpConfig: r.mcpConfigFile, strictMcp: r.strictMcp, dangerouslySkip: r.dangerouslySkip, settingsFile: r.settingsFile, model: r.model, effort: r.effort, timeoutMs: r.timeoutMs, maxSilenceMs: r.maxSilenceMs, signal: r.signal, onDelta: r.onDelta, onEvent: r.onEvent, permissionPromptTool: r.permissionPromptTool, pluginDirs: r.claudePluginDirs, instructionFile: r.instructionFile, home: r.claudeHome, configDir: r.claudeConfigDir, extraEnv: r.channelEnv, browserNamespace: r.browserNamespace, target, claudeOauthToken }); }, interrupt: ({ poolKey }) => abortPooled(poolKey), discoverMcps: () => listEngineMcps("claude"), @@ -185,21 +188,130 @@ const claude = validateEngineAdapter({ }, }); +// Qwen, driven through the SAME `claude` binary against QwenCloud's Anthropic-compatible endpoint +// (src/engines/qwen.js explains why this is an engine and not a per-channel env override). +// Everything the CLI owns — stream protocol, tool loop, permission prompt, MCP file transport, +// CLAUDE.md, `.claude/skills`, cold resume — is therefore literally Claude's. Everything the +// PROVIDER owns is different and is declared here rather than inherited: +// • `optIn` — never enabled implicitly. A gateway that pulls this release must not suddenly +// offer a harness nobody configured (and whose every turn would fail for want of a key). +// • no fallback edge (see FALLBACK_GRAPH) — a Qwen usage limit must not silently spend the +// operator's Anthropic quota, and Claude's must not silently spend their QwenCloud one. +// • `realCost: false` + the cost the CLI reports is DROPPED. Claude Code prices every turn with +// Anthropic's own table: a trivial qwen3.8-flash turn came back as $0.0286 with +// `costBasis: "unknown"`. Recording that would put fiction in the usage ledger. +// • `warmPool: false` — a warm process holds the environment it launched with, and the pool key +// (slug::threadKey) carries no engine, so a rotated provider key or a mid-thread harness +// switch would be served by a process still holding the old credential. Cold runs only, which +// is how Codex has always run. +const qwen = validateEngineAdapter({ + pluginCapabilities: { manifest: "claude", components: ["skills", "commands", "agents", "hooks", "mcpServers"] }, + resolveOptionalMcpConfig: resolveClaudeMcpConfig, + id: "qwen", label: "Qwen (Claude Code)", cli: "claude", defaultModelKey: "defaultQwenModel", + // Deliberately the SAME channel-meta key as Claude: same CLI, same file transport, same catalog + // entries. One "Cloud MCP" selection serves both, so switching a channel's harness never + // silently drops its connectors. + mcpMetaKey: "allowedMcps", + instructionFile: "CLAUDE.md", skillsDir: ".claude/skills", mcpTransport: "file", contextWindow: 200_000, + efforts: ["low", "medium", "high", "xhigh"], + models: QWEN_FALLBACK_MODELS, + // Shipped list until the account's own is read; `discoverModels` below replaces it with the live + // one, so a model QwenCloud adds tomorrow is selectable without a release. + modelCatalogSource: "fallback", + mintsOwnSessionId: false, + optIn: true, + transientKinds: Object.freeze(["availability", "connection"]), + supports: { warmPool: false, interruptSteer: false, permissionPrompt: true, compact: true, realCost: false, usageLimitFallback: false, userSkillOverlay: true, settingsFile: true, networkModes: FULL_NETWORK_MODES }, + modelBelongs: (m) => isQwenTextModel(m), + resumeCommand: (id) => `claude --resume ${id}`, + // Identical to Claude's: the same binary, writing the same transcripts, keyed by the same + // project-directory rule into the same config dir. + sessionState: Object.freeze({ + hostDir: () => hostClaudeStateDir(), + containerDirKey: "claudeConfigDir", + files: ({ cwd, sessionId }) => { + const key = claudeProjectKey(cwd); + return [ + { rel: `projects/${key}/${sessionId}.jsonl`, kind: "file" }, + { rel: `projects/${key}/${sessionId}`, kind: "dir" }, + ]; + }, + }), + compileConfinement: (request) => baseCompile("qwen", request, FULL_NETWORK_MODES), + async run(ctx) { + const r = ctx.runtime; + requirePluginRuntime(r.pluginRuntime, this.id); + const target = runtimeTargetOr(ctx.target, ctx.cwd); + const provider = await resolveQwenProvider(); + // Fail closed and name the remedy. Never fall through to the ambient Anthropic credential: + // that would answer a Qwen-pinned thread with Claude, on the operator's Anthropic quota. + if (!provider.configured) { + throw Object.assign(new Error(`The Qwen harness is selected, but ${provider.error}.`), { + details: { runtimeCredential: true, runtime: target.backend, engine: this.id }, + }); + } + const result = await runClaude({ + cwd: ctx.cwd, prompt: ctx.prompt, sessionId: ctx.session.id, isNewSession: ctx.session.fresh, + mcpConfig: r.mcpConfigFile, strictMcp: r.strictMcp, dangerouslySkip: r.dangerouslySkip, + settingsFile: r.settingsFile, model: r.model || QWEN_DEFAULT_MODEL, effort: r.effort, timeoutMs: r.timeoutMs, + maxSilenceMs: r.maxSilenceMs, signal: r.signal, onDelta: r.onDelta, onEvent: r.onEvent, + permissionPromptTool: r.permissionPromptTool, pluginDirs: r.claudePluginDirs, + instructionFile: r.instructionFile, extraEnv: r.channelEnv, browserNamespace: r.browserNamespace, + target, engineId: this.id, + // No Anthropic login of any kind reaches this child — buildClaudeEnv strips the family. + claudeOauthToken: "", providerEnv: qwenProviderEnv(provider), + }); + // The CLI's `total_cost_usd` is Anthropic pricing applied to QwenCloud tokens. Tokens are real + // and are kept; the dollar figure is not this provider's and is dropped at the boundary rather + // than filtered later, so nothing downstream can mistake it for a reported cost. + return { ...result, costUSD: null }; + }, + interrupt: () => false, + // The same catalog Claude sees: identical CLI, identical MCP transport. + discoverMcps: () => listEngineMcps("claude"), + discoverModels: () => discoverQwenModels(), + credentialState: () => qwenCredentialState(), + // `claude --version` answers "is the CLI installed" — true even with no QwenCloud key at all — + // so the configured provider is reported beside it. Like the other adapters it never flips + // `ready`: the run path fails closed with the remedy, and the admin rail says "not configured" + // instead of leaving that to be inferred from turns that die. + async health(options) { + const base = await commandHealth("claude", options); + const auth = await qwenCredentialState().catch((error) => ({ + known: false, authenticated: false, method: "", detail: String(error?.message || error), source: "", + })); + return { ...base, auth: { known: auth.known, authenticated: auth.authenticated, method: auth.method, detail: auth.detail } }; + }, +}); + const codex = validateEngineAdapter({ pluginCapabilities: { sourceManifest: "codex", manifest: "", components: ["skills", "mcpServers"] }, + // Same contract as Claude's resolver: { servers, rejected }. A selected server the runtime can + // only launch with host credentials is dropped with a reason, never fatal — see claude-mcp.js. async resolveOptionalMcpConfig(allowed) { - if (!Array.isArray(allowed) || !allowed.length) return {}; + const servers = {}; + const rejected = []; + if (!Array.isArray(allowed) || !allowed.length) return { servers, rejected }; const policy = codexMcpPolicyFor(await listEngineMcps("codex"), allowed); - return Object.fromEntries(policy.servers.filter((server) => server.enabled).map((server) => { - const definition = server.definition; - if (!definition) throw new Error(`Optional MCP ${server.name} has no complete credential-safe definition; refusing Codex run`); - return [server.name, definition.transport === "http" ? { type: "http", url: definition.url } : { command: definition.command, args: definition.args || [] }]; - })); + for (const server of policy.servers) { + if (!server.enabled) continue; + if (!server.definition) { + rejected.push({ name: server.name, reason: CODEX_MCP_UNSAFE_REASON }); + continue; + } + servers[server.name] = server.definition.transport === "http" + ? { type: "http", url: server.definition.url } + : { command: server.definition.command, args: server.definition.args || [] }; + } + return { servers, rejected }; }, id: "codex", label: "Codex", cli: "codex", defaultModelKey: "defaultCodexModel", mcpMetaKey: "allowedCodexMcps", + // Codex reports no dollar cost, so the ledger prices it from this configured rate (Settings → + // Audit). Declared here so no other engine inherits OpenAI's rates by falling through. + costRateKey: "codexRatePer1MTokens", instructionFile: "AGENTS.md", skillsDir: ".agents/skills", mcpTransport: "argv", contextWindow: 272_000, efforts: ["none", "low", "medium", "high", "xhigh", "max", "ultra"], models: [ - ...["codex", "gpt-5.6-sol", "gpt-5.6", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.5", "gpt-5.4", "gpt-5.4-mini", "gpt-5.4-nano"].map((value) => ({ label: value === "codex" ? "Codex" : value.toUpperCase().replace("GPT-", "GPT-"), value, description: `${value} model.` })), + ...["codex", "gpt-6-astra", "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.5", "gpt-5.3-codex-spark"].map((value) => ({ label: value === "codex" ? "Codex" : value.toUpperCase().replace("GPT-", "GPT-"), value, description: `${value} model.` })), ], mintsOwnSessionId: true, // The runner's own "the provider did not answer" kind (classifyCodexFailure), replayable in place. transientKinds: Object.freeze(["transient"]), @@ -207,8 +319,8 @@ const codex = validateEngineAdapter({ modelBelongs: (m) => /^(?:gpt-|o[0-9]|codex)/.test(m), resumeCommand: (id) => `codex exec resume ${id}`, sessionState: Object.freeze({ - // codexEngineHome() already ends in `.codex`, and IS $CODEX_HOME for every gateway run. - hostDir: () => codexEngineHome(), + // A direct `/sudo` turn uses the daemon account's native CODEX_HOME. + hostDir: () => hostCodexStateDir(), containerDirKey: "codexHome", // A rollout is `sessions/YYYY/MM/DD/rollout--.jsonl`. The timestamp cannot be // recomputed, so the location is a PATTERN — and the date directories must survive the copy, @@ -223,8 +335,12 @@ const codex = validateEngineAdapter({ const catalog = await listEngineMcps("codex").catch(() => []); const codexMcpPolicy = codexMcpPolicyFor(catalog, r.allowedMcps || []); codexMcpPolicy.servers.push(...(r.pluginMcpServers || [])); - const unsafe = codexMcpPolicy.servers.find((server) => server.enabled && !server.definition); - if (unsafe) throw new Error(`Optional MCP ${unsafe.name} has no complete credential-safe definition; refusing Codex run`); + // Mirrors the drop resolveOptionalMcpConfig already recorded for the payload: a selected server + // with no credential-safe definition is disabled for this launch instead of failing the turn. + // Plugin-provided servers arrive with their definition already proven by run-engine-mcp.js. + for (const server of codexMcpPolicy.servers) { + if (server.enabled && !server.definition) server.enabled = false; + } return runCodex({ cwd: ctx.cwd, prompt: ctx.prompt, extraEnv: r.channelEnv, browserNamespace: r.browserNamespace, sessionId: ctx.session.id, isNewSession: ctx.session.fresh, dangerouslySkip: r.dangerouslySkip, writable: r.writable, networkMode: ctx.policy.network.mode, clean: r.clean, autoApprove: r.autoApprove, composioUserEndpoint: r.composioUserEndpoint, composioEndpoint: r.composioEndpoint, composioUserToken: r.composioUserToken, composioToken: r.composioToken, toolboxToken: r.toolboxToken, makeToolboxUrl: r.makeToolboxUrl, makeToolboxKey: r.makeToolboxKey, codexMcpPolicy, gatewayCapability: r.gatewayCapability, gatewayFsRoot: r.gatewayFsRoot, gatewayWorkspaceRoot: r.gatewayWorkspaceRoot, progressReport: r.progressReport, model: r.model, effort: r.effort, codexStateDir: r.codexStateDir, personalSkills: r.personalSkillCatalog, pluginSkills: requirePluginRuntime(r.pluginRuntime, this.id).skills, attachments: r.attachments, target, artifactDir: ctx.artifactDir ?? target.artifactDir ?? null, signal: r.signal, timeoutMs: r.timeoutMs, maxSilenceMs: r.maxSilenceMs, onDelta: r.onDelta, onEvent: r.onEvent, onSessionResolved: r.onSessionResolved }); }, interrupt: () => false, @@ -290,4 +406,4 @@ const opencode = validateEngineAdapter({ health: (options) => commandHealth("opencode", options), }); -export const BUILTIN_ENGINE_ADAPTERS = Object.freeze([claude, codex, opencode]); +export const BUILTIN_ENGINE_ADAPTERS = Object.freeze([claude, codex, qwen, opencode]); diff --git a/src/engines/claude-mcp.js b/src/engines/claude-mcp.js index 9605a584..65a44fd3 100644 --- a/src/engines/claude-mcp.js +++ b/src/engines/claude-mcp.js @@ -2,6 +2,9 @@ // therefore carry explicit transport definitions; enabling ambient config would also import // unrelated MCPs, hooks and credentials. Resolve fresh bytes at admission, never a UI cache or a // shell-split `mcp list` display string. Only transport data leaves this module. +// A selection that fails any of those checks is DROPPED from the payload with a category +// reason, not thrown: refusing to relay the host credential is the security property, and the +// turn itself never depended on an optional connector. import { readFile } from "node:fs/promises"; import os from "node:os"; import path from "node:path"; @@ -46,40 +49,82 @@ async function readConfig(file) { } catch (error) { if (error.code === "ENOENT") return {}; // Never include raw parser errors, file contents, or private config paths in a chat error. - throw new Error("Selected Claude MCP configuration could not be read safely. Ask an admin to check the configured server."); + throw new Error("unreadable"); } } +// Why a selection was not admitted. Category only — never a path, a parser error, a config value +// or the offending definition, because this text is posted into the channel. +const REJECTION = { + unreadable: "could not be read from the gateway host's Claude MCP configuration", + missing: "is not defined in the gateway host's Claude MCP configuration", + unsafe: "needs host credentials (env/headers/auth helper) or uses an unsupported transport", + stale: "no longer matches the transport it was selected with", + namespace: "does not match its own tool namespace", + name: "uses a reserved or invalid server name", +}; + +function namespaceOf(name) { + return "mcp__" + name.replace(/[^a-zA-Z0-9]+/g, "_"); +} + +// Returns { servers, rejected }. An optional connector that cannot be admitted is DROPPED with a +// reason, never fatal: refusing to relay a host credential into the container is the security +// property, and dropping the server keeps it whole — failing the whole turn only adds downtime for +// a conversation that may not even use the connector. The caller reports `rejected` in the thread +// so a dropped server is loud without being terminal. export async function resolveClaudeMcpConfig(allowedMcps = [], { configFile = process.env.CLAUDE_CONFIG_DIR ? path.join(process.env.CLAUDE_CONFIG_DIR, ".claude.json") : path.join(os.homedir(), ".claude.json"), discoveryCwd = process.cwd(), } = {}) { - if (!Array.isArray(allowedMcps) || !allowedMcps.length) return {}; - const selected = allowedMcps.map((entry) => { + const servers = {}; + const rejected = []; + if (!Array.isArray(allowedMcps) || !allowedMcps.length) return { servers, rejected }; + const selected = []; + for (const entry of allowedMcps) { const name = entry?.name; + // A reserved or malformed name cannot come from the picker (sanitizeMcps + + // persistedSelectionForEngine), so it means the stored record was hand-edited or tampered + // with. It is still only dropped — never injected, so it can never shadow a built-in identity + // — and the caller's event/notice is what makes it visible. if (typeof name !== "string" || !NAME.test(name) || RESERVED.has(name) || /composio/i.test(name)) { - throw new Error("Selected Claude MCP server name is invalid or reserved."); + rejected.push({ name: typeof name === "string" ? name.slice(0, 160) : "(unnamed)", reason: REJECTION.name }); + continue; } - return entry; - }); + selected.push(entry); + } + if (!selected.length) return { servers, rejected }; // These are the same scopes `claude mcp list` in the daemon cwd discovers. Local project // overrides beat project .mcp.json, which beats user scope. The channel workdir is never a // config source: its members cannot replace an operator-selected definition with their own. - const user = await readConfig(configFile); - const project = await readConfig(path.join(discoveryCwd, ".mcp.json")); + let user; + let project; + try { + user = await readConfig(configFile); + project = await readConfig(path.join(discoveryCwd, ".mcp.json")); + } catch { + // A corrupt or unreadable operator config must not brick every channel that selected anything. + for (const entry of selected) rejected.push({ name: entry.name, reason: REJECTION.unreadable }); + return { servers, rejected }; + } const localServers = own(own(own(user, "projects"), path.resolve(discoveryCwd)), "mcpServers"); - const servers = {}; for (const entry of selected) { const scope = [localServers, own(project, "mcpServers"), own(user, "mcpServers")].find((servers) => OBJECT(servers) && Object.hasOwn(servers, entry.name)); const source = own(scope, entry.name); const definition = safeClaudeMcpDefinition(source); const expectedMatch = definition?.type === "stdio" ? entry.match?.serverName === entry.name : entry.match?.serverUrl === definition?.url; - if (!definition || !expectedMatch || entry.namespace !== "mcp__" + entry.name.replace(/[^a-zA-Z0-9]+/g, "_")) { - throw new Error(`Selected Claude MCP server "${entry.name}" has no safe matching transport definition. Ask an admin to configure a credential-free server reachable inside the channel container and select it again.`); + const reason = source === undefined ? REJECTION.missing + : !definition ? REJECTION.unsafe + : !expectedMatch ? REJECTION.stale + : entry.namespace !== namespaceOf(entry.name) ? REJECTION.namespace + : ""; + if (reason) { + rejected.push({ name: entry.name, reason }); + continue; } servers[entry.name] = definition; } - return servers; + return { servers, rejected }; } diff --git a/src/engines/claude.js b/src/engines/claude.js index 40531e2f..cb303080 100644 --- a/src/engines/claude.js +++ b/src/engines/claude.js @@ -19,6 +19,11 @@ import { createStallWatchdog, describeSilence, DEFAULT_SILENCE_WINDOWS } from ". const MAX_LOG_CHARS = 8_000; const MAX_RETAINED = 64_000; // stdout/stderr kept for error context — tail only, never unbounded +// Harness id → the name its provider failures use. Kept here rather than read from the engine +// registry: this module sits BELOW the registry in the import graph (the registry imports the +// adapters, which import this file), so a registry lookup would close a cycle. +const HARNESS_LABELS = { qwen: "Qwen" }; + // Plugin skill bodies may be loaded lazily after process startup. A run-private plugin directory // is deleted when the turn settles, so such a process must be cold (and therefore gone before // cleanup) rather than retained in the warm pool with dangling plugin paths. @@ -26,6 +31,25 @@ export function canUseClaudeWarmPool(runtime = {}) { return !runtime.preferCold && !runtime.claudePluginEphemeral; } +// Every name that authenticates this CLI against ANTHROPIC. A run pointed at a different provider +// (the Qwen adapter — src/engines/qwen.js) must carry NONE of them: an inherited ANTHROPIC_API_KEY +// would race the provider's own token for precedence, and a relayed CLAUDE_CODE_OAUTH_TOKEN would +// send the OPERATOR's Anthropic credential to a third-party host. +const ANTHROPIC_CREDENTIAL_NAMES = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL", "CLAUDE_CODE_OAUTH_TOKEN"]; + +// `providerEnv` redirects this CLI at an Anthropic-COMPATIBLE endpoint. Gateway-owned and applied +// dead last — after the channel secrets, after HOME, after the login relay — and it clears the +// whole Anthropic credential family first, so the redirect can never be half-applied. +function applyProviderEnv(env, providerEnv) { + if (!providerEnv) return env; + for (const name of ANTHROPIC_CREDENTIAL_NAMES) delete env[name]; + for (const [name, value] of Object.entries(providerEnv)) { + if (value === undefined || value === null || value === "") continue; + env[name] = String(value); + } + return env; +} + // `extraEnv` is the channel's own environment secrets (config/channel-env.js). Two independent // guards, because `extra` beats everything inherited in buildChildEnv: it is re-filtered through // safeSpawnEnv HERE rather than trusting the caller to have done it (PATH is inherited, so @@ -33,7 +57,7 @@ export function canUseClaudeWarmPool(runtime = {}) { // so they win outright. `browserNamespace` is gateway-owned for the same reason and sits in the // same last group: it decides which channel's browser daemon a browser MCP child attaches to // (gateway/browser-env.js), so a channel secret must not be able to name it. -export function buildClaudeEnv({ home = "", configDir = "", extraEnv = {}, browserNamespace = "", target = null, oauthToken = "" } = {}, source = process.env) { +export function buildClaudeEnv({ home = "", configDir = "", extraEnv = {}, browserNamespace = "", target = null, oauthToken = "", providerEnv = null } = {}, source = process.env) { // Apply at every spawn (cold, warm, background and reviewer), preserving an operator override. // Channel secrets cannot override this reserved name; never mutate the shared source object. source = { ...source, MCP_TIMEOUT: source.MCP_TIMEOUT || String(MCP_STARTUP_TIMEOUT_SECONDS * 1000) }; @@ -46,16 +70,16 @@ export function buildClaudeEnv({ home = "", configDir = "", extraEnv = {}, brows if (isIsolatedTarget(target)) { const image = containerPaths(target); const base = buildChildEnv({ ...safeSpawnEnv(extraEnv), ...browserSpawnEnv(browserNamespace) }, source); - return { + return applyProviderEnv({ ...dropHostLocationEnv(base), HOME: image.home, CLAUDE_CONFIG_DIR: image.claudeConfigDir, PATH: image.path, TMPDIR: image.tmpDir, ...(oauthToken ? { CLAUDE_CODE_OAUTH_TOKEN: oauthToken } : {}), - }; + }, providerEnv); } - return buildChildEnv({ + return applyProviderEnv(buildChildEnv({ ...safeSpawnEnv(extraEnv), ...browserSpawnEnv(browserNamespace), ...(home ? { HOME: home } : {}), @@ -64,7 +88,7 @@ export function buildClaudeEnv({ home = "", configDir = "", extraEnv = {}, brows // the resolved login the same way. Same last group as HOME — gateway-owned, so a channel // secret can never displace it — and absent when there is nothing to relay. ...(oauthToken ? { CLAUDE_CODE_OAUTH_TOKEN: oauthToken } : {}), - }, source); + }, source), providerEnv); } function truncate(v) { @@ -196,6 +220,13 @@ export async function runClaude({ // claude-token-relay.js). Used on BOTH backends: a container has no login of its own, and a host // child no longer has a credentials file planted in its synthetic config dir. claudeOauthToken = "", + // Present only for an adapter that drives this CLI against an Anthropic-COMPATIBLE provider + // (src/engines/qwen.js). See applyProviderEnv. + providerEnv = null, + // Which ADAPTER is driving this CLI. Only labels (process registry, error details): the Qwen + // adapter runs the same binary, and a hard-coded "claude" here would file its turns and its + // failures under the wrong harness in /status and in the audit trail. + engineId = "claude", runId = "", timeoutMs = 10 * 60 * 1000, maxSilenceMs = null, @@ -205,6 +236,10 @@ export async function runClaude({ }) { const args = buildClaudeArgs({ prompt, sessionId, isNewSession, mcpConfig, strictMcp, dangerouslySkip, settingsFile, model, effort, permissionPromptTool, pluginDirs, instructionFile, disallowedTools }); const runtime = runtimeTargetOr(target, cwd); + // What a provider failure calls itself in the thread. "Claude" is the CLI; the harness may be + // another provider driving it (src/engines/qwen.js), and the person reading the error has to + // know which account to go and look at. + const harnessLabel = engineId === "claude" ? "Claude" : HARNESS_LABELS[engineId] || engineId; return new Promise((resolve, reject) => { // Minimal allowlisted env — the sandbox can't hide the child's own environment (see child-env.js). @@ -213,12 +248,12 @@ export async function runClaude({ cmd: "claude", args, cwd, - env: buildClaudeEnv({ home, configDir, extraEnv, browserNamespace, target: runtime, oauthToken: claudeOauthToken }), + env: buildClaudeEnv({ home, configDir, extraEnv, browserNamespace, target: runtime, oauthToken: claudeOauthToken, providerEnv }), stdio: ["ignore", "pipe", "pipe"], detached: true, runId: runId || newRunId("run"), kind: "turn", - }), { engine: "claude", kind: "cold" }); + }), { engine: engineId, kind: "cold" }); let stdout = ""; let stderr = ""; @@ -281,7 +316,7 @@ export async function runClaude({ if (!p) return; // The LAST provider error wins: an earlier one the CLI recovered from must not label the // failure that actually ended the turn. - providerError = claudeProviderError(p) || providerError; + providerError = claudeProviderError(p, harnessLabel) || providerError; stream.consume(p); if (p.type === "result") result = p; }; @@ -320,7 +355,7 @@ export async function runClaude({ if (trailing) handleLine(trailing); if (aborted) { - reject(commandError("Claude run was stopped before it finished.", { stdout: truncate(stdout), stderr: truncate(stderr), exitCode: code, signal: exitSignal || null, engine: "claude", runtime: runtime.backend, explicitStop: true })); + reject(commandError("Claude run was stopped before it finished.", { stdout: truncate(stdout), stderr: truncate(stderr), exitCode: code, signal: exitSignal || null, engine: engineId, runtime: runtime.backend, explicitStop: true })); return; } if (timedOut) { @@ -333,7 +368,7 @@ export async function runClaude({ stderr: truncate(stderr), exitCode: code, signal: exitSignal || null, - engine: "claude", + engine: engineId, runtime: runtime.backend, processEnded: true, providerError: Boolean(providerError), diff --git a/src/engines/codex-usage.js b/src/engines/codex-usage.js index 008c5fcd..94862435 100644 --- a/src/engines/codex-usage.js +++ b/src/engines/codex-usage.js @@ -405,7 +405,9 @@ export const codexFirstOwnTaskIndex = firstOwnTaskIndex; let reducerSource; export function createCodexUsageReader(target, stateDir = "") { const read = async (operation, args = {}) => { - if (!target) return reduceCodexUsage({ operation, ...args, stateDir }); + if (!target || target.backend === "host") { + return reduceCodexUsage({ operation, ...args, stateDir }); + } if (typeof target.runtime?.inspectUsage !== "function") throw new Error("runtime cannot inspect Codex usage"); reducerSource ||= readFile(new URL("./codex-usage.js", import.meta.url), "utf8"); return target.runtime.inspectUsage(target, { diff --git a/src/engines/codex.js b/src/engines/codex.js index 6ca132de..da12e942 100644 --- a/src/engines/codex.js +++ b/src/engines/codex.js @@ -39,6 +39,8 @@ import { conciseProcessDiagnostic, embeddedJsonObject, plainFailureText, process import { acquireKeyedLock } from "../util/keyed-lock.js"; import { createCodexUsageReader, subtractCodexTokenUsage } from "./codex-usage.js"; import { MCP_STARTUP_TIMEOUT_SECONDS } from "./mcp-timeouts.js"; +import { gatewayRoot, runTmpDir } from "../config/paths.js"; +import { readCodexAuthState, describeCodexAuth } from "./codex-auth.js"; const IMAGE_RE = /\.(png|jpe?g|gif|webp|bmp|heic|heif)$/i; const MAX_RETAINED = 64_000; // stdout/stderr/delta kept for error context — tail only, never unbounded @@ -226,7 +228,14 @@ export function codexTurnError(event) { const message = plainFailureText(reported, 600) || reported; const providerType = String(raw?.type || raw?.code || nested?.type || nested?.code || body?.type || "").trim(); const status = Number(event?.status ?? raw?.status ?? body?.status ?? nested?.status ?? 0) || 0; - const providerError = Boolean(raw && typeof raw === "object") || event?.type === "error" || Boolean(body); + // Recent Codex builds sometimes report a provider refusal as + // `{ type: "turn.failed", error: "Selected model is at capacity…" }`: the error is a plain + // string rather than the object older builds emitted. `turn.failed` is still the CLI's terminal + // provider verdict. Treat the event shape as authoritative so the message reaches the normal + // classifier; an unrecognized sentence remains unclassified and therefore cannot authorize a + // replay on its own. + const providerError = event?.type === "turn.failed" || event?.type === "error" + || Boolean(raw && typeof raw === "object") || Boolean(body); return { message, details: { @@ -614,9 +623,7 @@ export function codexPluginSkillPrefix(skills) { // Build `codex exec` argv. `outFile` receives the final agent message (authoritative content). export function buildCodexArgs({ prompt, sessionId, isNewSession, cwd, dangerouslySkip, writable = false, networkMode = "off", clean = false, autoApprove = false, composioUserEndpoint = null, composioEndpoint = null, composioUserToken = "", composioToken = "", toolboxToken = "", makeToolboxUrl = "", makeToolboxKey = "", secretBundlePath = "", codexMcpPolicy = null, gatewayCapability = "", gatewayFsRoot = "", gatewayWorkspaceRoot = "", progressReport = false, model = "", effort = "", personalSkills = null, pluginSkills = null, attachments = [], target = null, outFile, headerHelpers = [] }) { const runtimeTarget = runtimeTargetOr(target, cwd); - // The CONTAINER is the confinement boundary, so Codex's own sandbox is switched off: no - // permission profiles, no network_proxy — egress is the container's network mode. - if (!isIsolatedTarget(runtimeTarget)) throw new Error("Codex runs only inside a channel container"); + const isolated = isIsolatedTarget(runtimeTarget); const helper = (name) => runtimeTarget.runtime.helperCommand(runtimeTarget, name); if (!["off", "on"].includes(networkMode)) throw new Error(`Unknown Codex network mode: ${networkMode}`); const resuming = !isNewSession; @@ -656,16 +663,16 @@ export function buildCodexArgs({ prompt, sessionId, isNewSession, cwd, dangerous const sandbox = writable ? "danger-full-access" : "read-only"; if (resuming) args.push("-c", `sandbox_mode=${tomlString(sandbox)}`); else args.push("--sandbox", sandbox); - // The sandbox also has to be a MECHANISM that can start in here. Codex's default is + // Inside the container the sandbox also has to be a MECHANISM that can start in here. Codex's default is // bubblewrap, which refuses under the container's `--cap-drop ALL` + no-new-privileges // ("bwrap: Unexpected capabilities but not setuid") and fails EVERY command — which left Read // mode inoperative, reads included. Landlock is the mechanism that works under those caps: - // reads succeed, writes get "Permission denied". Codex runs only inside a container (asserted - // above), so this is unconditional wherever Codex's own sandbox is in use — never on the admin + // reads succeed, writes get "Permission denied". Select it only for isolated container runs; + // a sudo-host turn uses the host CLI's native sandbox mechanism. It never applies to the admin // bypass, which has no sandbox to pick a mechanism for. `use_legacy_landlock` is // DEPRECATED-but-functional in the pinned CLI (containers/versions.json): re-check it on every // Codex CLI bump. - args.push("-c", "features.use_legacy_landlock=true"); + if (isolated) args.push("-c", "features.use_legacy_landlock=true"); } // Optional host/runtime MCP policy. OpenAI injects `codex_apps` AFTER config parsing, so treating @@ -721,6 +728,12 @@ export function buildCodexArgs({ prompt, sessionId, isNewSession, cwd, dangerous args.push("-c", `mcp_servers.gateway.command=${JSON.stringify(bridge.command)}`); args.push("-c", `mcp_servers.gateway.args=${JSON.stringify([...(bridge.args || []), secretBundlePath, "gatewayCapability", "CG_GATEWAY_CAPABILITY", ...helperScriptArgv(helper("gateway-mcp"))])}`); args.push("-c", `mcp_servers.gateway.env.CG_ENGINE="codex"`); + if (!isolated) { + args.push("-c", `mcp_servers.gateway.env.CG_FS_ROOT=${tomlString(gatewayFsRoot || cwd)}`); + args.push("-c", `mcp_servers.gateway.env.CG_WORKSPACE_DIR=${tomlString(gatewayWorkspaceRoot || cwd)}`); + args.push("-c", `mcp_servers.gateway.env.CHANNELGATE_DIR=${tomlString(gatewayRoot())}`); + args.push("-c", `mcp_servers.gateway.env.PATH=${tomlString(process.env.PATH || "")}`); + } if (progressReport) args.push("-c", `mcp_servers.gateway.env.CG_PROGRESS_REPORT="1"`); // This server is the gateway's own control plane (schedules/reminders/background/channel admin). // It already enforces channel/admin policy inside the tool handlers, so Codex should not add an @@ -759,6 +772,7 @@ export function buildCodexArgs({ prompt, sessionId, isNewSession, cwd, dangerous const sdk = helper("composio-sdk-bridge"); args.push("-c", `mcp_servers.${name}.command=${JSON.stringify(sdk.command)}`); args.push("-c", `mcp_servers.${name}.args=${JSON.stringify([...(sdk.args || []), endpoint.url])}`); + if (!isolated) args.push("-c", `mcp_servers.${name}.env.CHANNELGATE_DIR=${tomlString(gatewayRoot())}`); args.push("-c", `mcp_servers.${name}.default_tools_approval_mode="approve"`); args.push("-c", `mcp_servers.${name}.startup_timeout_sec=${MCP_STARTUP_TIMEOUT_SECONDS}`); return; @@ -818,7 +832,11 @@ export function buildCodexEnv({ extraEnv = {}, browserNamespace = "", target = n PATH: image.path, }; } - throw new Error("Codex runs only inside a channel container"); + return buildChildEnv({ + ...safeSpawnEnv(extraEnv), + ...browserSpawnEnv(browserNamespace), + NODE_USE_ENV_PROXY: "1", + }, source); } function commandError(message, details = {}) { @@ -858,7 +876,7 @@ export async function runCodex({ personalSkills = null, pluginSkills = null, attachments = [], - // Where this turn runs (src/runtimes/): the channel's container. + // Where this turn runs (src/runtimes/): normally the channel container; a sudo thread uses host. target = null, // Per-run ENGINE-FACING files (the -o answer file, the secret bundle) for an isolated target: // a host directory bind-mounted at the IDENTICAL absolute path, so both sides name it the same @@ -879,12 +897,19 @@ export async function runCodex({ // before any work exists to lose, so the orchestrator diverts it to the other harness with a // visible reason. The probe fails OPEN: only a positively absent/empty credential lands here. const runtime = runtimeTargetOr(target, cwd); - if (!isIsolatedTarget(runtime) || !artifactDir) { - throw commandError("Codex runs only inside a channel container", { engine: "codex", providerError: false }); + const isolated = isIsolatedTarget(runtime); + if (isolated && !artifactDir) { + throw commandError("Codex container runs require an artifact directory", { engine: "codex", providerError: false }); + } + // The container backend owns its copied login. A direct host run reads the exact CODEX_HOME the + // CLI will use, preserving the same fail-open credential semantics as every other probe. + let credentialFailure = null; + if (isolated && typeof runtime.runtime.credentialError === "function") { + credentialFailure = await runtime.runtime.credentialError(runtime, "codex"); + } else if (!isolated) { + const state = await readCodexAuthState({ codexHome: codexStateDir }); + if (state.known && !state.authenticated) credentialFailure = describeCodexAuth(state); } - // The BACKEND answers "is this runtime's Codex signed in?" (it owns the container's codex home). - // An optional hook — a backend that cannot tell says nothing and the turn proceeds. - const credentialFailure = typeof runtime.runtime.credentialError === "function" ? await runtime.runtime.credentialError(runtime, "codex") : null; // A backend may answer with an Error or with the sentence itself; both mean the same thing here. const authDetail = typeof credentialFailure === "string" ? credentialFailure : String(credentialFailure?.message || ""); if (authDetail) { @@ -905,7 +930,7 @@ export async function runCodex({ // branches. Fresh locally minted ids are already stable within their gateway thread. const releaseSession = await acquireKeyedLock("codex-session", sessionId || `fresh:${cwd}`, { signal }); const accountingStartedAt = Date.now(); - const usageReader = createCodexUsageReader(runtime); + const usageReader = createCodexUsageReader(runtime, codexStateDir); try { const usageSnapshot = isNewSession ? { file: "", offset: 0, total: {}, model: "" } @@ -914,11 +939,11 @@ export async function runCodex({ // writes the answer to the -o file and the secret bridges read the bundle, so both live in the // run's artifact dir — bind-mounted at the identical absolute path — never under the gateway // root, which a container is deliberately denied. - const scratchBase = path.join(artifactDir, "tmp"); + const scratchBase = artifactDir ? path.join(artifactDir, "tmp") : path.join(gatewayRoot(), "tmp"); await mkdir(scratchBase, { recursive: true, mode: 0o700 }); const scratchDir = await mkdtemp(path.join(scratchBase, "run-")); const outFile = path.join(scratchDir, `cg-codex-${randomUUID()}.txt`); - const secretDir = path.join(artifactDir, "run"); + const secretDir = artifactDir ? path.join(artifactDir, "run") : runTmpDir(); const secretBundlePath = !clean && [gatewayCapability, composioUserToken, composioToken, toolboxToken, makeToolboxKey].some(Boolean) ? path.join(secretDir, `cg-codex-secrets-${randomUUID()}.json`) : ""; diff --git a/src/engines/host-state.js b/src/engines/host-state.js new file mode 100644 index 00000000..b9400d5d --- /dev/null +++ b/src/engines/host-state.js @@ -0,0 +1,13 @@ +// The engine state used by a direct-host `/sudo` turn. These are the CLI's native host locations, +// not ChannelGate's container relay homes: direct host execution deliberately uses the daemon +// account's real environment and must resume the sessions that its real CLIs write there. +import os from "node:os"; +import path from "node:path"; + +export function hostClaudeStateDir(env = process.env) { + return path.resolve(env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude")); +} + +export function hostCodexStateDir(env = process.env) { + return path.resolve(env.CODEX_HOME || path.join(os.homedir(), ".codex")); +} diff --git a/src/engines/qwen.js b/src/engines/qwen.js new file mode 100644 index 00000000..a6e2334a --- /dev/null +++ b/src/engines/qwen.js @@ -0,0 +1,159 @@ +// Qwen driven through the Claude Code CLI. +// +// QwenCloud publishes an ANTHROPIC-COMPATIBLE endpoint (`/v1/messages`), so the `claude` +// binary the image already ships is the harness: same stream-json protocol, same tool loop, same +// `--mcp-config` / `--resume` / permission-prompt flags. This module owns the one thing that +// differs — WHICH provider the CLI talks to and WITH WHAT credential — so that the Claude adapter +// keeps its single meaning ("the operator's Anthropic login") and never learns about a second one. +// +// Why this is a separate ENGINE and not a per-channel environment override: +// • `ANTHROPIC_*` is a reserved prefix in config/channel-env.js precisely because a base-URL +// override is identity hijack. A channel secret must never be able to redirect a run. +// • The gateway relays the operator's Anthropic OAuth access token into every Claude run +// (gateway/claude-token-relay.js). Pointing that run at a third-party host would ship the +// operator's Anthropic credential to it. `qwenProviderEnv()` is applied through +// buildClaudeEnv's `providerEnv` channel, which DELETES every inherited Anthropic credential +// before setting the provider's own — see claude.js applyProviderEnv. +// • Model ids, cost semantics and failover all differ, and the runtime-identity preamble tells +// the model to quote its configured model exactly. Smuggling `qwen3.8-max` in under the +// `opus` alias would make that preamble lie. +// +// Settings live on the gateway (admin UI), never in a channel folder: `qwenApiKey` (write-only, +// has*/last4 like every other credential) and `qwenBaseUrl`. + +// The Token Plan endpoint. Pay-as-you-go deployments override it in Settings. +export const QWEN_DEFAULT_BASE_URL = "https://token-plan.maas.qwencloudapi.com/apps/anthropic"; + +// The Anthropic-compatible path answers `/v1/messages` and NOTHING else — `/v1/models` is a +// documented 404 ("Not support"). The OpenAI-compatible sibling on the same host does serve a +// model list, and it is the only way to discover what an account may actually call, so the +// discovery hook derives it from the configured base URL rather than asking for a second setting. +export function qwenModelsUrl(baseUrl = QWEN_DEFAULT_BASE_URL) { + const base = String(baseUrl || QWEN_DEFAULT_BASE_URL).trim().replace(/\/+$/, ""); + if (!base) return ""; + const swapped = base.replace(/\/apps\/anthropic$/, "/compatible-mode/v1"); + // A base URL that does not follow the documented `/apps/anthropic` shape (a proxy, a gateway of + // the operator's own) gets the sibling appended rather than guessed at. + return `${swapped === base ? `${base}/compatible-mode/v1` : swapped}/models`; +} + +// settings.js imports the engine registry, which imports the adapters, which import this file — a +// static settings import would close that cycle. Same lazy pattern claude-login.js is read with. +async function qwenSettings() { + const { getQwenConfig } = await import("../config/settings.js"); + return getQwenConfig(); +} + +/** + * The resolved provider: `{ apiKey, baseUrl, configured, error }`. `configured` is the only thing + * callers should branch on; `apiKey` never appears in a log, a reply or a health payload. + */ +export async function resolveQwenProvider() { + const { apiKey = "", baseUrl = "" } = (await qwenSettings()) || {}; + const url = String(baseUrl || QWEN_DEFAULT_BASE_URL).trim().replace(/\/+$/, ""); + if (!apiKey) { + return { apiKey: "", baseUrl: url, configured: false, error: "no QwenCloud API key is configured (Settings → Engines → Qwen)" }; + } + return { apiKey: String(apiKey), baseUrl: url, configured: true, error: "" }; +} + +/** + * The environment that redirects the `claude` CLI at QwenCloud. Applied LAST and gateway-owned + * (claude.js), after every inherited Anthropic credential has been removed. + */ +export function qwenProviderEnv({ apiKey, baseUrl }) { + return { + ANTHROPIC_BASE_URL: String(baseUrl || QWEN_DEFAULT_BASE_URL), + // The CLI sends this verbatim as the bearer credential. QwenCloud keys start with `sk-sp-`. + ANTHROPIC_AUTH_TOKEN: String(apiKey || ""), + }; +} + +// Opaque, non-reversible, and stable for one (key, endpoint) pair: the warm pool retires a process +// whose provider changed, and the orchestrator only ever COMPARES a credential fingerprint. +export function qwenProviderFingerprint({ apiKey = "", baseUrl = "" } = {}) { + if (!apiKey) return ""; + let h = 0x811c9dc5; + for (const ch of `${baseUrl}\u0000${apiKey}`) { + h ^= ch.codePointAt(0); + h = Math.imul(h, 0x01000193) >>> 0; + } + return `qwen:${h.toString(16)}`; +} + +// ── Model discovery ─────────────────────────────────────────────────────────────────────────── +// Text/tool models only. The same account also exposes image, video, audio and realtime families +// (`wan2.7-image`, `qwen-audio-3.0-tts-plus`, …) which answer 400 on `/v1/messages` — offering one +// in `/model` would pin a channel to a model that cannot hold a conversation. +const NON_TEXT_RE = /(?:^wan|image|video|audio|tts|realtime|t2v|i2v|speech)/i; +export const QWEN_MODEL_RE = /^(?:auto|qwen[0-9][a-z0-9._-]*|qwen-[a-z0-9._-]+|glm-[a-z0-9._-]+|deepseek-[a-z0-9._-]+|kimi-[a-z0-9._-]+|minimax-[a-z0-9._-]+)$/; + +export function isQwenTextModel(id) { + const value = String(id || "").trim().toLowerCase(); + return Boolean(value) && QWEN_MODEL_RE.test(value) && !NON_TEXT_RE.test(value); +} + +const VENDOR_LABELS = [[/^qwen/, "Qwen"], [/^glm-/, "GLM"], [/^deepseek-/, "DeepSeek"], [/^kimi-/, "Kimi"], [/^minimax-/, "MiniMax"]]; + +export function qwenModelLabel(id) { + const value = String(id || "").trim(); + if (value === "auto") return "Auto (provider routing)"; + const vendor = VENDOR_LABELS.find(([re]) => re.test(value)); + if (!vendor) return value; + const rest = value.slice(value.match(vendor[0])[0].length).replace(/^[-.]/, ""); + const pretty = rest.split("-").filter(Boolean).map((part) => (/^[a-z]/.test(part) ? part[0].toUpperCase() + part.slice(1) : part)).join(" "); + return pretty ? `${vendor[1]} ${pretty}` : vendor[1]; +} + +// Shipped catalog: what a fresh install offers before (or when) discovery is unavailable. The live +// list always wins — the registry's model catalog marks this one "fallback". +export const QWEN_FALLBACK_MODELS = Object.freeze([ + "qwen3.8-max", "qwen3.8-flash", "qwen3.7-max", "qwen3.7-plus", "qwen3.6-flash", + "glm-5.3", "deepseek-v4-pro", "deepseek-v4.1-flash", "auto", +].map((value) => Object.freeze({ label: qwenModelLabel(value), value, description: `QwenCloud ${value}.` }))); + +// The model a Qwen run uses when neither the thread, the channel nor the gateway names one. The +// `claude` CLI's own default is an Anthropic model id, which QwenCloud rejects ("Model not exist"), +// so the adapter must never leave the choice to the CLI. +export const QWEN_DEFAULT_MODEL = QWEN_FALLBACK_MODELS[0].value; + +/** + * The account's live model list, from the OpenAI-compatible `/models` endpoint. Returns the same + * `{ label, value, description }` shape every adapter's `models` uses; the registry normalizes it, + * keeps the previous catalog on failure, and never lets an empty result blank the picker. + */ +export async function discoverQwenModels({ fetchImpl = fetch, timeoutMs = 15_000 } = {}) { + const provider = await resolveQwenProvider(); + if (!provider.configured) throw new Error(provider.error); + const url = qwenModelsUrl(provider.baseUrl); + if (!url) throw new Error("no QwenCloud model list URL could be derived from the configured base URL"); + const response = await fetchImpl(url, { + headers: { Authorization: `Bearer ${provider.apiKey}`, accept: "application/json" }, + signal: AbortSignal.timeout(timeoutMs), + }); + if (!response.ok) throw new Error(`QwenCloud model list returned HTTP ${response.status}`); + const payload = await response.json(); + const rows = Array.isArray(payload?.data) ? payload.data : []; + return rows + .map((row) => String(row?.id || "").trim()) + .filter(isQwenTextModel) + .sort() + .map((value) => ({ label: qwenModelLabel(value), value, description: `QwenCloud ${value}.` })); +} + +/** + * "Is this harness's credential usable right now, and is it the SAME one that failed?" — the + * optional adapter hook the orchestrator only ever compares. No network call: a reachability probe + * on every turn would bill the operator for asking whether they are signed in. + */ +export async function qwenCredentialState() { + const provider = await resolveQwenProvider(); + return { + known: true, + authenticated: provider.configured, + method: provider.configured ? "api-key" : "none", + detail: provider.configured ? `QwenCloud API key · ${provider.baseUrl}` : provider.error, + source: provider.baseUrl, + fingerprint: qwenProviderFingerprint(provider), + }; +} diff --git a/src/engines/registry.js b/src/engines/registry.js index 4bd9d064..e62ecf0b 100644 --- a/src/engines/registry.js +++ b/src/engines/registry.js @@ -16,6 +16,11 @@ export function engineLabel(engine) { return adapterFor(engine)?.label ?? String // only kinds the orchestrator replays in place (src/gateway/run.js withTransientRetry). An engine // that declares none is simply never retried that way. export function engineTransientKinds(engine) { return adapterFor(engine)?.transientKinds || []; } +// The SETTINGS key holding this engine's configured $/1M token rate, for harnesses that report no +// real dollar cost and can therefore only be estimated. An engine that declares none is recorded +// with tokens and NO cost: inventing one from another provider's rate table would put a number in +// the ledger that no invoice will ever match. +export function engineCostRateKey(engine) { return adapterFor(engine)?.costRateKey || ""; } // The command a human types to pick this session up by hand. The engine owns the command itself; // the RUNTIME owns how you reach the engine — a container run has to be entered first, so the // backend wraps the base command (` exec -it -w `). Called without diff --git a/src/engines/stream.js b/src/engines/stream.js index fa281bd8..46467615 100644 --- a/src/engines/stream.js +++ b/src/engines/stream.js @@ -30,7 +30,10 @@ function claudeEventText(event) { // line. Preserve that actionable provider message so the runner does not collapse it into the // opaque numeric process failure. A normal assistant answer never has the top-level error // marker, so merely discussing limits in prose cannot be mistaken for an engine failure. -export function claudeProviderError(event) { +// The HARNESS name in a user-facing provider error. The Qwen adapter drives this same CLI and the +// same stream, so a hard-coded "Claude" here would tell a Slack thread that Claude hit a limit +// when QwenCloud did — and would send someone to check the wrong account. +export function claudeProviderError(event, harnessLabel = "Claude") { const raw = event?.error ?? event?.message?.error; const code = typeof raw === "string" ? raw.trim() @@ -66,16 +69,17 @@ export function claudeProviderError(event) { : /network|connection|timeout/i.test(combined) ? "connection" : "provider"; + const who = String(harnessLabel || "Claude"); const label = { - usage_limit: "Claude usage limit reached", - model_rejected: "Claude provider rejected the model", - authentication: "Claude authentication failed", - permission: "Claude provider denied the request", - invalid_request: "Claude provider rejected the request", - availability: "Claude provider is temporarily unavailable", - billing: "Claude billing or credit issue", - connection: "Claude provider connection failed", - provider: "Claude provider returned an error", + usage_limit: `${who} usage limit reached`, + model_rejected: `${who} provider rejected the model`, + authentication: `${who} authentication failed`, + permission: `${who} provider denied the request`, + invalid_request: `${who} provider rejected the request`, + availability: `${who} provider is temporarily unavailable`, + billing: `${who} billing or credit issue`, + connection: `${who} provider connection failed`, + provider: `${who} provider returned an error`, }[kind]; return { code, kind, detail, message: detail ? `${label}: ${detail}` : label }; } diff --git a/src/gateway/active-runs.js b/src/gateway/active-runs.js index 167bfbe7..3edaeaa6 100644 --- a/src/gateway/active-runs.js +++ b/src/gateway/active-runs.js @@ -22,6 +22,7 @@ import { modelLabel } from "./model-info.js"; import { runQueue } from "../slack/message-lifecycle.js"; import { isForceStopping } from "./shutdown.js"; import { postNotice } from "../platforms/notify.js"; +import { assertQuestionAccess } from "./question-access.js"; // In-process change signal for the admin dashboard's SSE feed. The database remains the source of @@ -60,6 +61,35 @@ export function recordActiveRun(id, rec) { } } +// A typed reply can answer pending questions too. Preserve their exact context in the durable +// continuation before retiring the forms, in one transaction rather than a best-effort write +// followed by cancellation. Failure leaves every form available and refuses the new launch. +export function acceptQuestionReply(records, runId, rec) { + const db = getDb(); + db.exec("BEGIN IMMEDIATE"); + try { + const retired = records.map((snapshot) => { + const row = db.prepare("SELECT data FROM question_requests WHERE id = ?").get(snapshot.id); + const current = row ? fromJson(row.data, null) : null; + if (!current || current.status !== "pending" || current.revision !== snapshot.revision) throw new Error("The pending questions changed before your reply was accepted. Please reply again."); + if (current.authorId !== rec.authorId || current.channelId !== rec.channelId || current.slug !== rec.slug || current.threadKey !== rec.threadKey) throw new Error("Question reply identity mismatch."); + const next = { ...current, status: "cancelled", answeredInThread: true, runId, + revision: current.revision + 1, updatedAt: Date.now() }; + db.prepare("UPDATE question_requests SET status=?,revision=?,updated_ms=?,data=? WHERE id=?") + .run(next.status, next.revision, next.updatedAt, toJson(next), next.id); + return next; + }); + db.prepare("INSERT INTO active_runs(id,data) VALUES(?,?) ON CONFLICT(id) DO UPDATE SET data=excluded.data") + .run(runId, toJson({ ...rec, id: runId })); + db.exec("COMMIT"); + announceChange(); + return retired; + } catch (error) { + try { db.exec("ROLLBACK"); } catch { /* transaction already closed */ } + throw error; + } +} + // Enrich an already-persisted turn once runMessage has resolved the runtime that will actually // spawn. Merge instead of replacing so restart recovery keeps the original prompt/attachments. // Called again if Claude falls back to Codex, keeping the dashboard truthful mid-turn. @@ -431,6 +461,21 @@ export async function recoverRuns(stale, { status?.onEvent?.({ kind: "engine_note", text: "waiting to resume after gateway restart" }); const queueError = await acquired; if (queueError) throw queueError; + // Submitting a form authenticates the requester at that instant. A restart (or its queue + // wait) can outlive that grant, so never replay their answers under stale access rights. + if (rec.questionSubmissionId) { + try { + await assertQuestionAccess(rec, client); + } catch { + markTerminal(); + await postNotice(client, { + conversationId: rec.channelId, + threadKey: rec.threadKey, + text: "The submitted answers were not resumed because the requester no longer has access or access could not be verified.", + }).catch(() => {}); + return; + } + } if (handle.aborted) { markTerminal(); return; } if (handle.controller.signal.aborted) { markTerminal(); return; } if (forceStopping()) return; diff --git a/src/gateway/background.js b/src/gateway/background.js index 236e1ab3..3c13ae54 100644 --- a/src/gateway/background.js +++ b/src/gateway/background.js @@ -31,13 +31,16 @@ import { resolveChannelEnv, safeSpawnEnv } from "../config/channel-env.js"; import { browserNamespaceFor, browserSpawnEnv } from "./browser-env.js"; import { createSecretRedactor, redactSecretValues, redactSecretFields } from "../util/redact.js"; import { containerJobScript } from "./background-shell-log.js"; +import { getThreadSudo } from "./thread-engine.js"; +import { sudoModeMeta } from "./modes.js"; export { containerJobScript } from "./background-shell-log.js"; const MAX_TAIL = 6_000; // chars of combined stdout/stderr fed back to the agent // Runtime caps are a runaway backstop, NOT a budget — the same philosophy as the turn watchdog -// (a run is never killed for being quiet or merely long). Agent jobs are confined engine runs, so -// they get a week; shell jobs run unsandboxed on the daemon, so they keep a short default unless -// the caller explicitly asks for more. Everything is clamped to the one-week ceiling. +// (a run is never killed for being quiet or merely long). Agent jobs get a week; raw shell jobs +// bypass the engine's own sandbox (normally inside the channel container, directly on the daemon +// only for `/sudo`), so they keep a short default unless explicitly extended. Everything is +// clamped to the one-week ceiling. const SHELL_DEFAULT_MAX_MS = 60 * 60 * 1000; // unsandboxed shell default (60 min) const AGENT_DEFAULT_MAX_MS = 7 * 24 * 60 * 60 * 1000; // confined agent default (1 week) const HARD_MAX_MS = 7 * 24 * 60 * 60 * 1000; // absolute ceiling for any background job @@ -252,9 +255,9 @@ export class BackgroundJobs { // and it is gated by the selected trust tier: Auto mode requires a gateway admin to approve // the exact command via Slack buttons; Admin mode skips that second click only for an admin // author, matching the foreground sandbox-off contract they explicitly selected. The Auto - // approval exists because a shell job runs OUTSIDE every engine sandbox — plain bash on the - // daemon account with unrestricted filesystem/network — so prompt-injected Auto turns must - // never reach it on channel mode alone. + // approval exists because a shell job runs OUTSIDE every engine sandbox — normally as plain + // bash inside the resolved channel container, or on the daemon account for `/sudo` — so + // prompt-injected Auto turns must never reach it on channel mode alone. // - "agent": a full engine run (Claude or Codex via runMessage) on a FRESH session in this // channel's folder — the durable form of a subagent. No extra gate: the run enforces the // channel's own mode exactly like a foreground turn (permission prompts still surface as @@ -291,10 +294,17 @@ export class BackgroundJobs { const entry = await getChannelEntry(channelId); if (!entry) return { ok: false, error: "This channel isn't registered." }; - const meta = effectiveMeta( + let meta = effectiveMeta( (await getChannelMeta(entry.slug)) ?? defaultChannelMeta({ channelId, name: entry.name, type: entry.type, isDM: entry.isDM }) ); + const sudoThread = await getThreadSudo(entry.slug, threadKey); + if (sudoThread) { + if (!(await isAdmin(authorId))) { + return { ok: false, error: "This is a sudo thread. Only organization admins can run background work here." }; + } + meta = sudoModeMeta(meta); + } // WHERE this shell job runs. Agent jobs go through runMessage, which resolves its own target // per turn, so only the shell branch needs one here. Resolved BEFORE the approval gate because @@ -584,6 +594,7 @@ export class BackgroundJobs { authorId: rec.authorId, text: prompt, threadKey: `${rec.threadKey}::agent-${rec.id}`, + sudoSourceThreadKey: rec.threadKey, origin: "background_agent", // daemon-triggered: structurally never escalates preferCold: true, // one-shot: don't leave a warm process idling after the agent finishes signal: controller.signal, diff --git a/src/gateway/drivesync.js b/src/gateway/drivesync.js index e22ca02f..18f82fb0 100644 --- a/src/gateway/drivesync.js +++ b/src/gateway/drivesync.js @@ -174,12 +174,12 @@ export function resolveDriveSyncKeyFile() { return file && existsSync(file) ? file : ""; } -// Is the rclone binary runnable? Probed once PER BINARY PATH — a single global boolean meant that -// correcting a wrong path in Settings had no effect until the daemon restarted. An absolute path -// from settings sidesteps the service unit's minimal PATH. +// Is the rclone binary runnable? Successful probes are cached per binary path. Misses are retried: +// setup/update may install rclone while the daemon is already running, and that repair must take +// effect without requiring a restart. An absolute path still sidesteps a minimal service PATH. export function rcloneAvailable(bin) { const key = String(bin || ""); - if (rcloneChecked.has(key)) return rcloneChecked.get(key); + if (rcloneChecked.get(key) === true) return true; let ok; try { const r = spawnSync(key, ["version"], { env: buildChildEnv(), stdio: "ignore" }); @@ -187,7 +187,8 @@ export function rcloneAvailable(bin) { } catch { ok = false; } - rcloneChecked.set(key, ok); + if (ok) rcloneChecked.set(key, true); + else rcloneChecked.delete(key); return ok; } diff --git a/src/gateway/folders.js b/src/gateway/folders.js index eb655d95..fded4543 100644 --- a/src/gateway/folders.js +++ b/src/gateway/folders.js @@ -185,6 +185,7 @@ export function channelSwitchesNote(meta = {}) { // the predicate behind it live in src/gateway/mcp.js, beside the code that names those servers. const HARD_RULES = `**Hard rules (not optional)** — they apply wherever the named tools exist; the reasoning and the tool shapes are in the \`gateway-usage\` skill: +- Use \`ask_questions\` for clarification. - **Two Composio identities.** \`composio-user\` = the REQUESTER's own accounts; \`composio-agent\` = the shared agent's own (either may appear with \`_\` for \`-\`). Reads and searches may use either or both identities without asking which account unless the user restricts the account or scope. diff --git a/src/gateway/gateway-usage/SKILL.md b/src/gateway/gateway-usage/SKILL.md index 30b7cbe8..b2b4abdb 100644 --- a/src/gateway/gateway-usage/SKILL.md +++ b/src/gateway/gateway-usage/SKILL.md @@ -6,7 +6,7 @@ description: >- conversation. Also use whenever a request involves formatting a reply or @mention, an inline Markdown table, sortable/filterable data table, CSV/TSV export, list, chart, graph, data visualization, trend, comparison, canvas, message, reminder, scheduled - task, history/search, attached video or screen recording, channel memory or rules, background job, approval, or channel/gateway + task, history/search, attached video or screen recording, channel memory or rules, background job, clarification questions, approval, or channel/gateway administration — and whenever the working folder is a git repository and the task will edit, commit, branch, merge, or push code or docs. Open the matching reference before acting. --- @@ -22,11 +22,11 @@ which gateway tools exist on them — tables, headings, images, threads, private charts and lists are all platform-dependent. That file states exactly what this surface does, and it is the authority whenever another reference is more general. -You run inside **this channel's own container**, in a **gated working folder**. Host visibility -depends on its resolved mounts, including an optional operator-home grant for Admin/Full-access -channels. Read **Admin access & the container** in `references/administration.md` before claiming -what host paths this channel can see. Most tools are on an allowlist, and persistent global memory -is off. +You normally run inside **this channel's own container**, in a **gated working folder**. Host +visibility depends on the resolved runtime: ordinary turns see only their mounts, while an +admin-only Slack `/sudo` thread runs directly as the gateway daemon OS user. Read **Admin access, +the container, and `/sudo`** in `references/administration.md` before claiming what host paths this +turn can see. Most tools are on an allowlist, and persistent global memory is off. {{CONTAINER_ACCESS}} @@ -34,7 +34,8 @@ The channel's *Allow network* switch says whether you are meant to use the network; there is no per-domain allow-list. **Its current value is stated in the gateway-managed block at the top of this conversation's instruction file** — read it rather than guessing, and never claim you were told nothing either way. The switch is -*advisory*: the container is not cut off, so a request may still succeed while the switch is off. +*advisory*: the resolved runtime is not cut off at the OS level (ordinary turns use the container +bridge; `/sudo` uses the host), so a request may still succeed while the switch is off. That is not permission — when it is off, say so instead of going out. The gateway gives you a set of **control tools** (an MCP server named `gateway`, always available, acting as the bot). Other connected apps (Gmail, Slack, HubSpot, Drive, ClickUp, …) come from two Composio @@ -44,6 +45,13 @@ the tool that does it. ## Discover access before requesting a connection +When you need clarification and `gateway` → `ask_questions` is available, prefer its interactive +question card or form. Read `references/questions.md` first. Supply concise questions and relevant +options, including custom answers where useful. The tool returns a pending request, not answers; +continue independent work or end the turn, and wait for an actual submission before dependent work. +When the tool is unavailable, ask in the conversation. Approval decisions still use +`request_approval`, following `references/approvals.md`. + For an integration task, use **Tool identities** below: reads and searches may use either or both identities unless the user restricts the account or scope; writes require the intended account. Then check the relevant granted @@ -148,6 +156,7 @@ credential or connection is needed, without exposing its value. | Edit code/docs in a git repository | `references/git-repos.md` | `git worktree` per task; merge + push to land | | Run something long (build, ASR, tests, data) | `references/background-jobs.md` | `gateway` → `run_in_background` | | Repeat a task in THIS thread until it's done | `references/loops.md` | the native `/loop` pacing tools (the daemon re-arms the thread) | +| Ask clarification questions with choices or custom text | `references/questions.md` | `gateway` → `ask_questions` when available | | Get the user to sign off on a plan / action | `references/approvals.md` | `gateway` → `request_approval` | | Handle Claude/Codex authentication failures | `references/administration.md` | Explain the required host-side login/API-key repair | | Connect a provider CLI with a device code | `references/cli-device-login.md` | Live TTY/session + interim code/link + same-turn polling + identity verification | diff --git a/src/gateway/gateway-usage/platforms/slack/platform.md b/src/gateway/gateway-usage/platforms/slack/platform.md index 1a02ff83..97b276b1 100644 --- a/src/gateway/gateway-usage/platforms/slack/platform.md +++ b/src/gateway/gateway-usage/platforms/slack/platform.md @@ -6,7 +6,9 @@ way out. ## Replies - Your answer streams into the thread with Slack's **native Markdown renderer** — the reader sees it appear token by token. Bold, italics, links, lists, code blocks and **small GFM pipe tables** - all render. Headings do not (they come out bold), and inline images do not. + all render. Headings come out bold. A Markdown image reference to an image you created in the + working folder becomes a native Slack file preview when the answer finishes. Public HTTP(S) + images still become Block Kit previews; the Markdown reference remains as the fallback. - Threads are real: every reply lands in the thread the message came from. - Long answers are split across several messages automatically; write naturally and don't pre-chunk. @@ -21,5 +23,7 @@ Write `@Name` and the gateway turns it into a real ping. `@channel`, `@here` and real Slack broadcasts — use them sparingly. Full rules: `references/mentions.md`. ## Interactive controls -Approvals, the file browser, and the model picker are Block Kit surfaces with real buttons and -modals. You do not build these — the gateway posts them. +Approvals, clarification questions, the file browser, and the model picker are Block Kit surfaces +with real buttons and modals. The gateway posts them. For clarification, use `ask_questions` when +available: short sets can appear in the thread, and longer forms open from an **Answer questions** +button. Choices and custom text remain drafts until submission. See `references/questions.md`. diff --git a/src/gateway/gateway-usage/platforms/slack/writing-replies.md b/src/gateway/gateway-usage/platforms/slack/writing-replies.md index a58e8ae4..2c939dc6 100644 --- a/src/gateway/gateway-usage/platforms/slack/writing-replies.md +++ b/src/gateway/gateway-usage/platforms/slack/writing-replies.md @@ -19,6 +19,15 @@ answer to Slack mrkdwn and posts it normally, so simple Markdown degrades safely - `- ` bullets and `1.` numbered lists. - `> ` blockquote. - Links: `[label](https://example.com)`. +- Images you create: save the image inside the working folder and write + `![descriptive alt text](reports/chart.png)`. When the answer finishes, the gateway uploads up to + five unique referenced images into the thread as native Slack files, giving the reader Slack's + inline thumbnail, download control, and full preview. Paths with spaces use angle brackets, for + example `![Revenue]()`. Only regular image files contained by the + working folder are eligible; escaping symlinks, missing files, and fenced examples are ignored. +- Public image previews: `![descriptive alt text](https://example.com/image.png)`. The URL must be a + publicly reachable HTTP(S) image. The gateway appends it as a Block Kit image preview and keeps + the Markdown reference as a clickable fallback. - Small GFM pipe tables when the rows belong directly in the explanation. See `references/tables.md` before choosing a table shape. @@ -60,7 +69,8 @@ Practical rules: ## Avoid these - Long heading hierarchies. Use a short bold label for compact Slack answers. -- HTML and images-by-Markdown. +- HTML, data-URI images, local image paths, and private/non-public image URLs. Use standard Markdown + image syntax only with a public HTTP(S) asset that Slack can fetch. - Markdown links whose target is a local filesystem path; use the inline-code form above. - Wide pipe tables or hand-aligned fenced-code tables; both wrap badly on narrow Slack clients. Use `slack_post_table` for a sortable/filterable dataset and `slack_upload_snippet` for a large diff --git a/src/gateway/gateway-usage/references/administration.md b/src/gateway/gateway-usage/references/administration.md index f95015f3..42bb514e 100644 --- a/src/gateway/gateway-usage/references/administration.md +++ b/src/gateway/gateway-usage/references/administration.md @@ -95,7 +95,8 @@ options beside the mode picker in the web editor and under the Slack reply's Set Auto approves tool requests for every authorized author. Lean runs without optional skills and connectors; in Admin mode it applies to non-admins while admins keep full context. Switching Worker/Admin preserves these options. Choosing Read-only clears Auto; enabling Auto selects Worker. -Every run remains inside its channel container. +These channel modes do not leave the container. The separate organization-admin-only Slack +`/sudo` thread control described below deliberately does. - `set_channel_bash` (managers) — Bash + file-edit tools in the working folder. - `set_channel_auto_mode` (managers) — autonomous: permission prompts auto-approved, folder writable. Needed for `run_in_background`. @@ -125,7 +126,16 @@ Every run remains inside its channel container. working around it. The current value is in the gateway-managed block at the top of this conversation's instruction file. -## Admin access & the container (read this before diagnosing "file not found") +## Admin access, the container, and `/sudo` (read this before diagnosing "file not found") + +**First read this attempt's resolved access note.** An ordinary turn runs in the channel container. +A Slack thread whose current organization admin enabled `/sudo` runs directly as the gateway +daemon OS user instead: host filesystem, process namespace, native HOME, installed commands and +network are available, and there is no channel-container boundary. Only current organization +admins may message that thread; a non-admin receives an explicit sudo-thread rejection. `/sudo +status` reports the state and `/sudo off` restores the container for later turns. Treat host mode +as full authority of the daemon account, not as a broader mount. Never infer sudo from Admin mode, +the operator-home grant, a prior turn, or the existence of a host-looking path. **Verify the actual target before claiming host access.** Parent directories can exist solely to hold a permitted nested mount: seeing `/home/management` or a gateway-root-shaped directory @@ -136,7 +146,7 @@ is not evidence that the gateway's database is exposed. Compare the exact target attempt's resolved mount facts; if its location is unknown, report that uncertainty instead of identifying an unrelated file as runtime data. Do not save an unverified access claim as memory. -**Every turn runs inside this channel's container — Admin/Full-access mode included.** By default, +**Every non-sudo turn runs inside this channel's container — Admin/Full-access mode included.** By default, the host directory mounts are this channel's working folder, clean workspace and artifact folder (also backing `/tmp` and `/var/tmp`). The container also has its own home volume (`/home/agent`), the image's toolchain and a read-only control socket. A host directory chosen as the working folder @@ -160,10 +170,10 @@ runtime's operator-home mount. If that note has no resolved target, verify curre before asserting access. Diagnose only paths this runtime actually mounts: an absent host path does not prove that it was deleted, and a mounted path must not be described as impossible. -**`$HOME` is this channel's home, not the operator's account home.** `~` is `/home/agent` inside +**On non-sudo turns, `$HOME` is this channel's home, not the operator's account home.** `~` is `/home/agent` inside the container and belongs to this channel alone: a login you make there (`gh auth login`, `vercel login`) or a tool you install stays for this channel's next turns and is invisible to -every other channel. +every other channel. In a `/sudo` turn, HOME is the daemon user's native host HOME instead. **Never copy secrets into the working folder.** The folder is often a git checkout and may sync elsewhere; a credential pasted there can end up committed. A credential this channel should have diff --git a/src/gateway/gateway-usage/references/background-jobs.md b/src/gateway/gateway-usage/references/background-jobs.md index 3bb5a1fc..c41a1475 100644 --- a/src/gateway/gateway-usage/references/background-jobs.md +++ b/src/gateway/gateway-usage/references/background-jobs.md @@ -49,8 +49,9 @@ Use for long-running commands — builds, transcription/ASR, test suites, data j The channel must be in **auto mode**, or in **admin mode with an admin author**. In Auto mode the daemon posts a durable approval with the exact command, and a gateway **admin** must click **Run -it** before the job starts (anyone may Deny) — the job runs inside this channel's container, in -this folder, like everything else. In Admin mode, an admin author's job starts directly without +it** before the job starts (anyone may Deny) — the job runs inside this channel's resolved runtime, +normally its container. In a `/sudo` thread it instead runs directly as the daemon OS user and is +available only to current organization admins. In Admin mode, an admin author's job starts directly without that second approval because the live turn already runs with the admin bypass. Non-admin authors never inherit that bypass. The Auto-mode approval is single-use, remains valid across daemon/engine restarts, and starts only the displayed command. diff --git a/src/gateway/gateway-usage/references/questions.md b/src/gateway/gateway-usage/references/questions.md new file mode 100644 index 00000000..596c1616 --- /dev/null +++ b/src/gateway/gateway-usage/references/questions.md @@ -0,0 +1,83 @@ +# Clarification questions + +Use `gateway` → `ask_questions` when you need information from the requester and the tool is +available in this turn. It renders real Slack controls; writing button labels in a normal reply +does not create buttons. On a surface or run without this tool, ask a concise ordinary question. +Do not add questions when existing instructions or a reasonable assumption already resolve them. + +## Input + +Supply `title` (up to 120 characters), `questions`, and optionally `presentation` (`auto`, +`message`, or `modal`). `questions` contains 1–20 items. Each `id` must be unique, start with a +letter, and contain at most 40 letters, digits, underscores or hyphens: + +- `prompt`: the question the user sees (up to 300 characters). +- `type`: `single` for one option, `multi` for several options, or `text` for a written answer. +- `options`: `{label, value}` entries for choice questions. Single choice supports up to four + options and multiple choice up to ten, with at least one option in either case. Labels and + values can have up to 60 characters; values must be unique within the question. Text questions + have no options. Labels and values are your own meaningful choices; + Yes/No is simply a single-choice question with those two options. +- `required`: defaults to `true`; use `false` only when an answer is optional. +- `allowCustom`: defaults to `true`; choice questions then also accept a custom written answer + of up to 2,000 characters. Custom text replaces a single selection, or supplements multiple + selections. Written text is trimmed of leading/trailing whitespace. + +Example: + +```json +{ + "title": "A few project decisions", + "presentation": "auto", + "questions": [ + { + "id": "audience", + "prompt": "Who should have access?", + "type": "single", + "options": [ + {"label": "Everyone", "value": "public"}, + {"label": "Team only", "value": "team"}, + {"label": "Invite only", "value": "invite"} + ] + }, + { + "id": "features", + "prompt": "Which features do you need?", + "type": "multi", + "options": [ + {"label": "Notifications", "value": "notifications"}, + {"label": "Export", "value": "export"}, + {"label": "Activity history", "value": "history"} + ], + "required": false + } + ] +} +``` + +## What the requester sees + +`auto` puts up to four questions directly in a thread message when none is a text question. +Larger sets or sets containing text use an **Answer questions** button that opens a paged modal. +An explicit `message` (at most four questions) or `modal` chooses that presentation. Slack requires the requester's click +before a modal can open. Message cards provide choice buttons, multiple-choice controls, and a +custom-answer modal. Longer forms retain draft answers as the requester moves between pages. +Selections remain drafts until **Submit answers** (or the modal's final **Submit**). + +Only the requesting user can answer. The card and any submitted summary are in the conversation, +so do not ask for passwords, tokens, or other secrets here; use the existing secret-entry flow. +The gateway validates required answers and rejects stale form revisions or already-closed controls. +Pending requests and saved drafts survive daemon restarts. Stop/clear cancels the pending request. + +## Continuing work + +The tool returns a pending request ID immediately; it does **not** block until the user answers. +Continue useful independent work, or end the turn with a short note that the questions are ready. +Only one request per requester/thread can be pending at a time. Do not poll, sleep waiting for +answers, post repeated copies, or interpret the pending result as an +answer. Submission queues the answers into the same author's thread so the agent can continue. +Wait for that submitted answer before doing work that depends on it. A closed modal, elapsed time, +or an unsubmitted choice supplies no answer. + +This tool gathers information. It does not grant tool permissions, replace `request_approval`, +or turn channel Auto mode into human consent. Follow `references/approvals.md` for authorization. diff --git a/src/gateway/gateway-usage/references/video-understanding.md b/src/gateway/gateway-usage/references/video-understanding.md index 3c83cbe7..697e7d9f 100644 --- a/src/gateway/gateway-usage/references/video-understanding.md +++ b/src/gateway/gateway-usage/references/video-understanding.md @@ -23,6 +23,18 @@ workflow from the transcript alone or from a few evenly spaced screenshots. evidence streams disagree. Prefer targeted extra frames over dense whole-video extraction. 6. Answer while distinguishing directly visible facts, spoken statements, combined inferences, and unresolved ambiguity. +7. After the evidence pack is complete and no more re-sampling is needed, remove the original only + when it is a gateway-downloaded regular file beneath the current channel's `uploads/` directory. + Use the bundled constrained cleanup helper, which resolves both paths and refuses symlinks or + paths outside `uploads/`: + + ```bash + python3 .claude/skills/gateway-usage/scripts/cleanup_uploaded_media.py VIDEO_PATH + ``` + + Delete only the source video—not the evidence pack. Keep the original when decoding, + transcription, or analysis failed so the user can retry. Never auto-delete a video supplied + from a project or user-managed path. For screen recordings, prioritize UI labels, selected cells, cursor focus, typed values, before/after state, and exact errors. Repeated table rows usually represent duplicates unless the diff --git a/src/gateway/gateway-usage/scripts/cleanup_uploaded_media.py b/src/gateway/gateway-usage/scripts/cleanup_uploaded_media.py new file mode 100755 index 00000000..4f77bdcf --- /dev/null +++ b/src/gateway/gateway-usage/scripts/cleanup_uploaded_media.py @@ -0,0 +1,52 @@ +#!/usr/bin/env python3 +"""Delete one successfully processed media upload without escaping the channel uploads folder.""" + +from __future__ import annotations + +import argparse +import json +import stat +import sys +from pathlib import Path + + +def fail(message: str) -> None: + print(message, file=sys.stderr) + raise SystemExit(2) + + +def main() -> None: + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument("source", type=Path) + args = parser.parse_args() + + channel_root = Path.cwd().resolve() + try: + uploads_root = (channel_root / "uploads").resolve(strict=True) + except OSError as exc: + fail(f"Managed uploads directory is unavailable: {exc}") + + source = args.source if args.source.is_absolute() else channel_root / args.source + try: + source_info = source.lstat() + except OSError as exc: + fail(f"Media source is unavailable: {exc}") + if stat.S_ISLNK(source_info.st_mode) or not stat.S_ISREG(source_info.st_mode): + fail("Refusing to remove a source that is not a regular file.") + + try: + resolved_source = source.resolve(strict=True) + resolved_source.relative_to(uploads_root) + except (OSError, ValueError): + fail("Refusing to remove a source outside the current channel's managed uploads directory.") + + try: + source.unlink() + except OSError as exc: + fail(f"Could not remove processed media source: {exc}") + + print(json.dumps({"removed": str(resolved_source)}, ensure_ascii=False)) + + +if __name__ == "__main__": + main() diff --git a/src/gateway/mcp-catalog.js b/src/gateway/mcp-catalog.js index 84c0359c..b4a3f6cf 100644 --- a/src/gateway/mcp-catalog.js +++ b/src/gateway/mcp-catalog.js @@ -72,6 +72,7 @@ export const GATEWAY_TOOL_NAMES = [ "run_in_background", "run_agent_in_background", "request_approval", + "ask_questions", "list_available_mcps", "list_channel_mcps", "add_channel_mcps", diff --git a/src/gateway/modes.js b/src/gateway/modes.js index 9b1fd715..79119696 100644 --- a/src/gateway/modes.js +++ b/src/gateway/modes.js @@ -1,5 +1,6 @@ import { adapterFor } from "../engines/registry.js"; import { NETWORK_ADVISORY_NOTE, NETWORK_POLICY_ENFORCED } from "../engines/network-policy.js"; +import { authorizeSudoRuntime } from "../runtimes/sudo-authority.js"; // A channel's capability "mode" is a friendly name over the underlying flags (adminMode, // allowBash, autoMode). One mode = one canonical flag combination. `allowNetwork` is orthogonal @@ -39,6 +40,21 @@ export function authorModeMeta(meta, { isAdminAuthor = false, untrustedPrincipal : normalized; } +// Transient per-run posture for an admin-authenticated `/sudo` thread. This is never persisted in +// channel metadata: the sticky thread bit is only a request, and run.js must re-establish current +// admin authority before adding this capability bundle on every turn. +export function sudoModeMeta(meta = {}) { + return authorizeSudoRuntime({ + ...meta, + sudoMode: true, + adminMode: true, + allowBash: true, + autoMode: true, + cleanMode: false, + allowNetwork: true, + }); +} + // Called inside the atomic settings update; changing a base mode preserves Lean and Auto. // Read-only clears Auto; enabling Auto on Read-only promotes it to Worker. export function modeSettingsPatch(current = {}, { mode, autoMode, cleanMode } = {}, { isAdminUser = false, canEnableAdmin = isAdminUser } = {}) { diff --git a/src/gateway/nudges.js b/src/gateway/nudges.js index 61b7b883..b140db7c 100644 --- a/src/gateway/nudges.js +++ b/src/gateway/nudges.js @@ -1,19 +1,18 @@ // Opt-in, single-thread "no-response" nudges. The only state is a per-thread timestamp + a couple -// of flags held in memory (lost on restart, which is fine for a best-effort nudge). When a channel -// opts in (meta.nudges), and the bot's last message in a thread has gone unanswered past the -// threshold (default 24h), the daemon posts ONE gentle reminder in that same thread — never -// scanning other channels, never persisting cross-conversation state. This is the confinement-safe -// sliver of Claude Tag's ambient "tag you when a thread stalls". -import { getChannelMeta } from "../config/store.js"; -import { getNoResponseReminderHours } from "../config/settings.js"; +// of flags held in memory (lost on restart, which is fine for a best-effort nudge). When the user +// who requested the bot's last reply has reminders enabled, and that reply has gone unanswered +// past the threshold (default 24h), the daemon posts ONE gentle reminder addressed to that user in +// the same thread — never scanning other channels, never persisting cross-conversation state. +import { getUser } from "../config/store.js"; +import { getNoResponseReminderHours, userNudgesEnabled } from "../config/settings.js"; import { logEvent } from "../util/logger.js"; import { postNotice } from "../platforms/notify.js"; -const threads = new Map(); // "::" -> { channelId, slug, threadKey, lastBotTs, awaitingUser, reminded } +const threads = new Map(); // "::" -> { channelId, slug, threadKey, userId, lastBotTs, awaitingUser, reminded } const key = (slug, threadKey) => `${slug}::${threadKey}`; // How long a tracked thread may live before it's forgotten. Entries only leave the map when the -// user replies — reminded threads (and never-answered ones in channels that never opt in) would +// user replies — reminded threads (and never-answered ones owned by users who never opt in) would // otherwise accumulate forever. Well past the nudge threshold (default 24h), so nothing expires // before its reminder is due. const TTL_MS = 7 * 24 * 60 * 60 * 1000; @@ -26,9 +25,9 @@ export function pruneExpired(map, nowMs, ttlMs = TTL_MS) { } // The bot just replied in a thread → it's now (potentially) awaiting the user. -export function noteBotReply(channelId, slug, threadKey) { - if (!slug || !threadKey) return; - threads.set(key(slug, threadKey), { channelId, slug, threadKey, lastBotTs: Date.now(), awaitingUser: true, reminded: false }); +export function noteBotReply(channelId, slug, threadKey, userId, { map = threads, nowMs = Date.now() } = {}) { + if (!slug || !threadKey || !userId) return; + map.set(key(slug, threadKey), { channelId, slug, threadKey, userId, lastBotTs: nowMs, awaitingUser: true, reminded: false }); } // The user posted in a thread → any pending reminder is answered; stop tracking it. @@ -41,31 +40,36 @@ function client(slack) { return slack?.snapshot?.().connected ? slack.getClient?.() ?? null : null; } -async function sweep(slack) { - const now = Date.now(); - pruneExpired(threads, now); // TTL first, even when Slack is disconnected +export async function sweepNudges(slack, { + map = threads, + nowMs = Date.now(), + thresholdMs = getNoResponseReminderHours() * 60 * 60 * 1000, + loadUser = getUser, + post = postNotice, + log = logEvent, +} = {}) { + pruneExpired(map, nowMs); // TTL first, even when Slack is disconnected const c = client(slack); if (!c) return; - const thresholdMs = getNoResponseReminderHours() * 60 * 60 * 1000; - for (const rec of threads.values()) { + for (const rec of map.values()) { if (!rec.awaitingUser || rec.reminded) continue; - if (now - rec.lastBotTs < thresholdMs) continue; - let meta; + if (nowMs - rec.lastBotTs < thresholdMs) continue; + let user; try { - meta = await getChannelMeta(rec.slug); + user = await loadUser(rec.userId); } catch { - meta = null; + user = null; } - if (!meta?.nudges) continue; // channel hasn't opted in + if (!userNudgesEnabled(user)) continue; rec.reminded = true; rec.awaitingUser = false; try { - await postNotice(c, { + await post(c, { conversationId: rec.channelId, threadKey: rec.threadKey, - text: "👋 Just checking in — this thread's been quiet for a while. Reply here if you'd like me to keep going, or ignore this and I'll stand down.", + text: `👋 <@${rec.userId}> Just checking in — this thread's been quiet for a while. Reply here if you'd like me to keep going, or ignore this and I'll stand down.`, }); - await logEvent("nudge_sent", { slug: rec.slug, channel: rec.channelId }); + await log("nudge_sent", { slug: rec.slug, channel: rec.channelId, author: rec.userId }); } catch { /* couldn't post — leave it reminded so we don't retry-spam */ } @@ -75,7 +79,7 @@ async function sweep(slack) { // Start the periodic sweep (default every 30 min). Returns the timer. export function startNudgeSweep({ slack, intervalMs = 30 * 60 * 1000 } = {}) { const timer = setInterval(() => { - sweep(slack).catch((e) => console.error("[nudges] sweep error:", e?.message || e)); + sweepNudges(slack).catch((e) => console.error("[nudges] sweep error:", e?.message || e)); }, intervalMs); timer.unref?.(); console.log("[nudges] no-response reminder sweep started"); diff --git a/src/gateway/question-access.js b/src/gateway/question-access.js new file mode 100644 index 00000000..c72ba29c --- /dev/null +++ b/src/gateway/question-access.js @@ -0,0 +1,27 @@ +import { getChannelEntry, getChannelMeta, isAdmin, isApproved } from "../config/store.js"; +import { isAuthorized } from "./modes.js"; +import { platformSupports } from "../platforms/registry.js"; +import { listConversationMemberIds } from "../slack/members.js"; + +// Rechecked on opening, saving, submitting, queue promotion and restart recovery. A Slack +// interaction proves who clicked, but an old card does not prove current conversation access. +export async function assertQuestionAccess(record, client, { timeoutMs = 0 } = {}) { + if (timeoutMs > 0) { + let timer; + try { + return await Promise.race([ + assertQuestionAccess(record, client), + new Promise((_, reject) => { timer = setTimeout(() => reject(new Error("Access verification took too long. Please try again.")), timeoutMs); }), + ]); + } finally { clearTimeout(timer); } + } + const entry = await getChannelEntry(record.channelId); + if (!entry || entry.slug !== record.slug || !record.authorId) throw new Error("This question's conversation is no longer available."); + const meta = await getChannelMeta(record.slug); + if (platformSupports(meta?.platform, "richCards") !== "block-kit" || !platformSupports(meta?.platform, "modals")) throw new Error("Question forms are not supported on this surface."); + const [admin, approved] = await Promise.all([isAdmin(record.authorId), isApproved(record.authorId)]); + if (!isAuthorized(meta, record.authorId, Boolean(entry.isDM), { isAdminUser: admin, isApprovedUser: approved })) throw new Error("You no longer have access to answer questions in this conversation."); + const members = await listConversationMemberIds(client, record.channelId); + if (!members.includes(record.authorId)) throw new Error("Only current conversation members can answer these questions."); + return meta; +} diff --git a/src/gateway/questions.js b/src/gateway/questions.js new file mode 100644 index 00000000..7fd4370b --- /dev/null +++ b/src/gateway/questions.js @@ -0,0 +1,142 @@ +// Durable question drafts. Submission and the accepted continuation share one SQLite transaction: +// an acknowledged answer can never be lost between a Slack click and queue ownership. +import { randomUUID } from "node:crypto"; +import { z } from "zod"; +import { getDb, toJson, fromJson } from "../db/index.js"; + +const identifier = z.string().regex(/^[a-zA-Z][a-zA-Z0-9_-]{0,39}$/); +const option = z.object({ label: z.string().trim().min(1).max(60), value: z.string().trim().min(1).max(60) }).strict(); +export const questionInput = { + title: z.string().trim().min(1).max(120), + presentation: z.enum(["auto", "message", "modal"]).default("auto"), + questions: z.array(z.object({ + id: identifier, + prompt: z.string().trim().min(1).max(300), + type: z.enum(["single", "multi", "text"]), + options: z.array(option).max(10).default([]), + required: z.boolean().default(true), + allowCustom: z.boolean().default(true), + }).strict()).min(1).max(20), +}; + +export function normalizeQuestions(input) { + const value = z.object(questionInput).strict().parse(input); + if (new Set(value.questions.map((q) => q.id)).size !== value.questions.length) throw new Error("Question IDs must be unique."); + for (const q of value.questions) { + if (q.type !== "text" && !q.options.length) throw new Error("Choice questions need options."); + if (q.type === "single" && q.options.length > 4) throw new Error("Single-choice questions support up to four options."); + if (q.type === "text" && q.options.length) throw new Error("Text questions cannot have options."); + if (new Set(q.options.map((o) => o.value)).size !== q.options.length) throw new Error("Option values must be unique within each question."); + if (q.type === "text") q.allowCustom = true; + } + if (value.presentation === "message" && value.questions.length > 4) throw new Error("Message cards support up to four questions. Use auto or modal for longer forms."); + return value; +} + +export function getQuestion(id) { + const row = getDb().prepare("SELECT data FROM question_requests WHERE id = ?").get(id); + return row ? fromJson(row.data, null) : null; +} + +export function listPendingQuestions({ channelId, threadKey = null, authorId = null } = {}) { + return getDb().prepare("SELECT data FROM question_requests WHERE channel_id = ? AND status = 'pending' ORDER BY updated_ms") + .all(channelId).map((r) => fromJson(r.data, null)) + .filter((r) => r && (threadKey == null || r.threadKey === threadKey) && (authorId == null || r.authorId === authorId)); +} + +export function createQuestion(context, input) { + const spec = normalizeQuestions(input); + const existing = listPendingQuestions(context); + if (existing.length) { + const current = existing[0]; + if (JSON.stringify({ title: current.title, presentation: current.presentation, questions: current.questions }) === JSON.stringify(spec)) return current; + throw new Error("This user already has pending questions in this thread. Wait for their answers or have them cancel the existing card."); + } + const record = { ...spec, id: randomUUID(), channelId: context.channelId, threadKey: context.threadKey, + authorId: context.authorId, slug: context.slug, isDM: Boolean(context.isDM), + status: "pending", revision: 0, answers: {}, messageTs: "", createdAt: Date.now(), updatedAt: Date.now() }; + getDb().prepare("INSERT INTO question_requests(id,channel_id,thread_key,author_id,status,revision,updated_ms,data) VALUES(?,?,?,?,?,?,?,?)") + .run(record.id, record.channelId, record.threadKey, record.authorId, record.status, record.revision, record.updatedAt, toJson(record)); + return record; +} + +export function updateQuestion(id, revision, patch) { + const current = getQuestion(id); + if (!current || current.status !== "pending") throw new Error("These questions have already been submitted or cancelled."); + if (current.revision !== revision) throw new Error("These answers changed in another view. Reopen the form from the latest card."); + const next = { ...current, ...patch, id: current.id, revision: revision + 1, updatedAt: Date.now() }; + const result = getDb().prepare("UPDATE question_requests SET status=?,revision=?,updated_ms=?,data=? WHERE id=? AND revision=? AND status='pending'") + .run(next.status, next.revision, next.updatedAt, toJson(next), id, revision); + if (!result.changes) throw new Error("These questions changed. Use the latest card."); + return next; +} + +// Attaching delivery metadata does not change the answers/version embedded in the posted card. +export function bindQuestionMessage(id, messageTs) { + const record = getQuestion(id); + if (!record) throw new Error("These questions are no longer available."); + const next = { ...record, messageTs }; + getDb().prepare("UPDATE question_requests SET data=? WHERE id=? AND revision=?") + .run(toJson(next), id, record.revision); + return getQuestion(id); +} + +export function validateAnswer(question, answer = {}) { + const values = answer.values ?? []; + const custom = answer.custom ?? ""; + if (!Array.isArray(values) || values.some((v) => typeof v !== "string") || new Set(values).size !== values.length || + values.some((v) => !question.options.some((o) => o.value === v))) throw new Error("Invalid answer option."); + if (typeof custom !== "string" || custom.length > 2000 || (custom && !question.allowCustom)) throw new Error("Invalid custom answer (maximum 2000 characters)."); + if ((question.type === "single" && values.length > 1) || (question.type === "text" && values.length)) throw new Error("Invalid answer selection."); + // A written answer replaces a single choice; on multi-choice questions it supplements it. + return { values: question.type === "single" && custom.trim() ? [] : values, custom: custom.trim() }; +} + +export function saveQuestionAnswers(id, revision, patch) { + const current = getQuestion(id); + if (!current) throw new Error("These questions are no longer available."); + const answers = { ...current.answers }; + for (const [qid, answer] of Object.entries(patch)) { + const question = current.questions.find((q) => q.id === qid); + if (!question) throw new Error("Unknown question."); + Object.defineProperty(answers, qid, { value: validateAnswer(question, answer), enumerable: true, configurable: true, writable: true }); + } + return updateQuestion(id, revision, { answers }); +} + +export function missingQuestionAnswers(record, questions = record.questions) { + return questions.filter((q) => q.required && !(record.answers[q.id]?.values?.length || record.answers[q.id]?.custom?.trim())); +} + +export function acceptQuestionSubmission(id, revision, runId, rec) { + const db = getDb(); + db.exec("BEGIN IMMEDIATE"); + try { + const current = getQuestion(id); + if (!current || current.status !== "pending" || current.revision !== revision || missingQuestionAnswers(current).length) { + db.exec("ROLLBACK"); + return false; + } + if (rec.authorId !== current.authorId || rec.channelId !== current.channelId || rec.threadKey !== current.threadKey || rec.slug !== current.slug) throw new Error("Question continuation identity mismatch."); + updateQuestion(id, revision, { status: "submitted", submittedAt: Date.now(), runId }); + db.prepare("INSERT INTO active_runs(id,data) VALUES(?,?)").run(runId, toJson({ ...rec, id: runId, questionSubmissionId: id })); + db.exec("COMMIT"); + return true; + } catch (error) { + db.exec("ROLLBACK"); + throw error; + } +} + +export function cancelPendingQuestions(context) { + return listPendingQuestions(context).map((r) => updateQuestion(r.id, r.revision, { status: "cancelled" })); +} + +export function formatQuestionAnswers(record) { + return `Answers submitted to the agent's questions (${record.title}):\n${record.questions.map((q, i) => { + const answer = record.answers[q.id] || {}; + const labels = (answer.values || []).map((v) => q.options.find((o) => o.value === v)?.label || v); + if (answer.custom) labels.push(answer.custom); + return `${i + 1}. ${q.prompt}\nAnswer: ${labels.join("; ") || "Skipped (optional)"}`; + }).join("\n\n")}\n\nContinue the task using these user-provided answers.`; +} diff --git a/src/gateway/run-engine-mcp.js b/src/gateway/run-engine-mcp.js index 8b8f2e3d..3ec75c45 100644 --- a/src/gateway/run-engine-mcp.js +++ b/src/gateway/run-engine-mcp.js @@ -18,18 +18,23 @@ const CAPABILITY_FINGERPRINT_BUCKET_MS = 5 * 60 * 60 * 1000; export async function buildEngineMcpRuntime({ clean = false, engine = "claude", target = null, allowedMcps = [], pluginRuntime = null, fingerprintNow = Date.now(), ...identity } = {}) { if (clean) { const mcpConfigJson = JSON.stringify({ mcpServers: {} }); - return { mcpConfigJson, mcpConfigFingerprint: mcpConfigJson, gatewayCapability: "" }; + return { mcpConfigJson, mcpConfigFingerprint: mcpConfigJson, gatewayCapability: "", rejectedMcps: [] }; } + // Every engine's resolver answers { servers, rejected }: an optional selection it cannot admit + // safely is dropped here rather than ending the turn, and `rejectedMcps` is what the caller + // reports in the thread so the drop is visible to the admin who has to fix the selection. const optional = await requireAdapter(engine).resolveOptionalMcpConfig?.(allowedMcps) || {}; + const optionalServers = optional.servers || {}; + const rejectedMcps = Array.isArray(optional.rejected) ? optional.rejected : []; const parsed = JSON.parse(await buildMcpConfig({ ...identity, engine, target })); - for (const [name, definition] of Object.entries(optional)) { + for (const [name, definition] of Object.entries(optionalServers)) { if (Object.hasOwn(parsed.mcpServers, name)) throw new Error("Selected MCP server conflicts with a built-in identity."); parsed.mcpServers[name] = definition; } const pluginServers = []; for (const server of requirePluginRuntime(pluginRuntime, engine).servers) { if (Object.hasOwn(parsed.mcpServers, server.name)) throw new Error("Plugin MCP server conflicts with a selected connection"); - const definition = server.definition || safeCodexMcpDefinition(optional[server.sourceName]); + const definition = server.definition || safeCodexMcpDefinition(optionalServers[server.sourceName]); if (!definition) throw new Error(`Plugin ${server.plugin}: MCP ${server.sourceName} needs a separately selected, supported connection; source credentials are not imported`); parsed.mcpServers[server.name] = definition.transport === "http" ? { type: "http", url: definition.url } @@ -59,5 +64,6 @@ export async function buildEngineMcpRuntime({ clean = false, engine = "claude", mcpConfigFingerprint: JSON.stringify(fingerprintView), gatewayCapability, pluginServers, + rejectedMcps, }; } diff --git a/src/gateway/run-grant-artifacts.js b/src/gateway/run-grant-artifacts.js index d3f7e9d4..b2705445 100644 --- a/src/gateway/run-grant-artifacts.js +++ b/src/gateway/run-grant-artifacts.js @@ -3,6 +3,7 @@ // to preserve safe warm sessions; user/library overlays and every Codex HOME are private per run. import { createHash, randomUUID } from "node:crypto"; import { access, cp, lstat, mkdir, mkdtemp, readFile, readdir, readlink, rename, rm, writeFile } from "node:fs/promises"; +import os from "node:os"; import path from "node:path"; import { buildSettings, enableSkills } from "./folders.js"; import { ensureRealDir } from "./safe-fs.js"; @@ -12,6 +13,8 @@ import { ENGINE_IDS, requireAdapter } from "../engines/registry.js"; import { materializeSkill } from "./skills/materialize.js"; import { hashSkillFiles, normalizeSkillFiles } from "./skills/files.js"; import { openWorkspaceDirectory } from "./skills/workspace-backup.js"; +import { hostClaudeStateDir, hostCodexStateDir } from "../engines/host-state.js"; +import { channelArtifactDir } from "../config/paths.js"; // ── Isolated-runtime engine homes ───────────────────────────────────────────────────────────── // Inside a container the engine's HOME is the channel's own persistent volume (plan §5/§8), so @@ -24,6 +27,19 @@ export const CONTAINER_AGENT_HOME = "/home/agent"; export function engineHomesFor(target = null) { if (!target) return null; + if (target.backend === "host") { + const home = os.homedir(); + const claudeConfigDir = hostClaudeStateDir(); + const codexHome = hostCodexStateDir(); + return { + claudeHome: home, + claudeConfigDir, + claudeStateDir: claudeConfigDir, + codexUserHome: home, + codexHome, + codexStateDir: codexHome, + }; + } const home = target?.container?.home || CONTAINER_AGENT_HOME; const claudeConfigDir = target?.container?.claudeConfigDir || path.posix.join(home, ".claude"); const codexHome = target?.container?.codexHome || path.posix.join(home, ".codex"); @@ -44,7 +60,7 @@ export function engineHomesFor(target = null) { // Compatibility for callers refreshing artifacts after ensureUp: never publish a rootless // volume path as readable state. Usage inspection now follows the resolved RuntimeTarget. export function refreshRuntimeReadPaths(artifacts = {}, target = null) { - if (target) artifacts.codexStateDir = ""; + if (target && target.backend !== "host") artifacts.codexStateDir = ""; return artifacts; } @@ -182,17 +198,18 @@ export async function createRunGrantArtifacts({ // content-addressed layout, same cleanup. Fail loudly rather than quietly writing under the // gateway root: a containerized engine cannot open a path there, so falling back would produce // a run whose settings and MCP config silently do not exist on the side that has to read them. - if (!target?.artifactDir) { + const host = target?.backend === "host"; + if (!host && !target?.artifactDir) { throw new Error("a runtime target must carry an artifactDir — a containerized engine has nowhere else to read this run's files from"); } const containerHomes = engineHomesFor(target); - const artifactRoot = target.artifactDir; + const artifactRoot = host ? (target.artifactDir || channelArtifactDir(slug, meta?.platform)) : target.artifactDir; const runsRoot = path.join(artifactRoot, "runs"); await mkdir(runsRoot, { recursive: true, mode: 0o700 }); const root = await mkdtemp(path.join(runsRoot, "grants-")); try { - // The engines' homes are the channel's own HOME volume inside the container; the daemon only - // names them in the child's environment and never creates or reads them (engineHomesFor). + // Container engines use the channel HOME volume, which the daemon only names. A direct host + // target uses the daemon account's native engine homes (engineHomesFor). const { claudeHome, claudeConfigDir, claudeStateDir, codexUserHome, codexHome, codexStateDir } = containerHomes; // Codex keeps its persistent HOME/auth/session roots. Personal grants use an explicit // per-turn catalog pointing at the same ephemeral skill files Claude receives as a plugin; diff --git a/src/gateway/run.js b/src/gateway/run.js index 29f3909a..844de549 100644 --- a/src/gateway/run.js +++ b/src/gateway/run.js @@ -29,8 +29,8 @@ import { getEngine, getDefaultModel, getDmTemplate, getEngineFallback, isEngineE import { claudeTokenFingerprint, resolveContainerClaudeToken } from "./claude-token-relay.js"; import { resolveRuntime } from "../runtimes/resolve.js"; import { newRunId, runtimeSupports } from "../runtimes/contract.js"; -import { getThreadEngine, getThreadClean, getThreadModel, getThreadEffort } from "./thread-engine.js"; -import { PROFILE_FLAGS, canManage, normalizeModeMeta, authorModeMeta } from "./modes.js"; +import { getThreadEngine, getThreadClean, getThreadModel, getThreadEffort, getThreadSudo } from "./thread-engine.js"; +import { PROFILE_FLAGS, canManage, normalizeModeMeta, authorModeMeta, sudoModeMeta } from "./modes.js"; import { NETWORK_POLICY_ENFORCED } from "../engines/network-policy.js"; import { resolveSdkSession } from "../ee/composio-sdk.js"; import { requireComposioSdkEntitlement } from "../ee/composio-entitlement.js"; @@ -722,7 +722,7 @@ function assertRuntimeCanStart() { } } -export async function runMessage({ channelId, authorId, workspaceId = "", text, threadKey, attachments = [], signal = null, onDelta, onEvent, onRuntimeResolved, sessionId: presetSessionId = "", overrides = null, getFallbackContext = null, preferCold = false, progressReport = false, untrustedPrincipal = false, origin = "", fallbackPolicy = "" }) { +export async function runMessage({ channelId, authorId, workspaceId = "", text, threadKey, attachments = [], signal = null, onDelta, onEvent, onRuntimeResolved, sessionId: presetSessionId = "", overrides = null, getFallbackContext = null, preferCold = false, progressReport = false, untrustedPrincipal = false, origin = "", fallbackPolicy = "", sudoSourceThreadKey = "" }) { // Fail closed before anything else: a run with no declared origin is a programming error, not a // default-to-interactive. if (!RUN_ORIGINS.includes(origin)) throw new Error(`runMessage requires a valid origin (got ${JSON.stringify(origin)}); one of: ${RUN_ORIGINS.join(", ")}`); @@ -766,7 +766,8 @@ export async function runMessage({ channelId, authorId, workspaceId = "", text, // admin credential (web/auth.js), and `authorId` on that path is caller-supplied, so allowing // `mode:"full"` to set adminMode would let any key holder name an admin and get an unsandboxed // --dangerously-skip-permissions run. The channel's own stored adminMode still stands. - meta = authorModeMeta(meta, { isAdminAuthor: !untrustedPrincipal && await isAdmin(authorId), untrustedPrincipal }); + const trustedAdminAuthor = !untrustedPrincipal && await isAdmin(authorId); + meta = authorModeMeta(meta, { isAdminAuthor: trustedAdminAuthor, untrustedPrincipal }); meta = applyRunOverrides(meta, overrides); // Per-thread clean override (the "/clean" directive): this thread runs with channel-cleanMode @@ -775,6 +776,13 @@ export async function runMessage({ channelId, authorId, workspaceId = "", text, // scheduler/background/recovery turns that land in a clean thread stay clean too. if (!meta.cleanMode && (await getThreadClean(entry.slug, threadKey))) meta = { ...meta, cleanMode: true }; + // `/sudo` is sticky to one thread but authority is deliberately NOT sticky: an organization + // admin must still be an admin on every turn. Background agents may inherit the launching + // thread's flag through sudoSourceThreadKey, but the same author check applies. + const sudoKey = sudoSourceThreadKey || threadKey; + const sudoThread = Boolean(sudoKey && await getThreadSudo(entry.slug, sudoKey)); + if (sudoThread && trustedAdminAuthor) meta = sudoModeMeta(meta); + // Engine: an explicit per-run API override is the most specific ask and beats everything // (matching the model/effort override precedence below); otherwise the per-thread override (a // "claude"/"codex" directive or the /model wizard's thread scope) wins, then the channel's @@ -793,6 +801,29 @@ export async function runMessage({ channelId, authorId, workspaceId = "", text, // automatic cross-engine failover is allowed to answer as the other harness (see below). const enginePinnedByUser = engineExplicit; + // A sudo thread is admin-only even if the channel itself admits this author. Return a normal + // result instead of throwing: unattended delivery and non-Slack surfaces can present the same + // explicit denial without starting diagnosis or provisioning any runtime state. + if (sudoThread && !trustedAdminAuthor) { + await logEvent("sudo_thread_message_rejected", { + channel: channelId, slug: entry.slug, author: authorId, threadKey: sudoKey, origin, + }); + return { + slug: entry.slug, + cwd: "", + model: "", + engine, + content: "⛔ This is a sudo thread. Only organization admins can send messages or run work here.", + accessRefused: true, + sudoThread: true, + sessionId: null, + isNew: false, + usage: {}, + costUSD: 0, + durationMs: 0, + }; + } + // An admin turned this harness OFF in Settings. Every stored pointer to it — the global default, // a channel override, a thread's own "/codex" directive — becomes stale the moment that switch // flips, so substitute the first enabled engine rather than spawning a CLI that must not run. @@ -879,7 +910,7 @@ export async function runMessage({ channelId, authorId, workspaceId = "", text, // Fail closed: inside a container there is no other way in, so no token is a configuration // error the operator must see. const claudeCredentialFor = async (forEngine) => { - if (forEngine !== "claude") return null; + if (forEngine !== "claude" || !isolatedRuntime) return null; const relay = await claudeRelayOnce(); if (relay.token || relay.source === "api-key") return relay; throw Object.assign(new Error(`This channel runs in a container, but ${relay.error}.`), { @@ -1192,8 +1223,32 @@ export async function runMessage({ channelId, authorId, workspaceId = "", text, let mcpConfigFingerprint = ""; let gatewayCapability = ""; let pluginMcpServers = []; + // A selected optional MCP the engine cannot admit safely (missing from the host config, needs a + // host credential, stale transport) is DROPPED from the payload by the engine's resolver instead + // of failing the run — an optional connector is never worth the turn, and refusing to relay the + // credential is the property that actually matters. The drop is announced, not silent: it is + // logged as an event for the admin and prefixed to the answer the author is already getting. + let mcpDropNote = ""; + const reportRejectedMcps = async (rejected, forEngine) => { + if (!Array.isArray(rejected) || !rejected.length) return ""; + await logEvent("run_mcp_dropped", { + channel: channelId, + slug: entry.slug, + author: authorId, + threadKey, + origin, + engine: forEngine, + // Names and category reasons only — the resolvers never emit a path, a config value or a + // definition, and this payload is readable in the admin observability view. + dropped: rejected.map(({ name, reason }) => ({ name: String(name || ""), reason: String(reason || "") })), + }); + const list = rejected.map(({ name, reason }) => `\`${String(name || "")}\` — ${String(reason || "unavailable")}`).join("; "); + return `⚠️ _Skipped ${rejected.length === 1 ? "MCP connection" : "MCP connections"}: ${list}. The rest of this turn ran normally; an admin can fix the selection in the channel's Cloud MCP settings._\n\n`; + }; const mintGatewayMcpRuntime = async () => { - ({ mcpConfigJson, mcpConfigFingerprint, gatewayCapability, pluginServers: pluginMcpServers = [] } = await buildEngineMcpRuntime({ ...mcpRuntimeInput, pluginRuntime: grantArtifacts.pluginRuntime, engine, target, allowedMcps: meta[adapter.mcpMetaKey] || [] })); + let rejectedMcps = []; + ({ mcpConfigJson, mcpConfigFingerprint, gatewayCapability, pluginServers: pluginMcpServers = [], rejectedMcps = [] } = await buildEngineMcpRuntime({ ...mcpRuntimeInput, pluginRuntime: grantArtifacts.pluginRuntime, engine, target, allowedMcps: meta[adapter.mcpMetaKey] || [] })); + mcpDropNote = await reportRejectedMcps(rejectedMcps, engine); }; // Every granted definition is explicit in the per-run payload. Keep ambient MCPs disabled @@ -1277,6 +1332,7 @@ export async function runMessage({ channelId, authorId, workspaceId = "", text, isNewSession: isNew, clean, adminMode: Boolean(meta.adminMode), + sudoThread, autoMode: Boolean(meta.autoMode), allowBash: Boolean(meta.allowBash), allowNetwork: Boolean(meta.allowNetwork), @@ -1367,8 +1423,8 @@ export async function runMessage({ channelId, authorId, workspaceId = "", text, principal: { kind: untrustedPrincipal ? "daemon" : PRINCIPAL_KIND_BY_ORIGIN[origin] || "daemon", id: authorId }, origin, cwd, prompt, session: { id: sid, fresh }, policy: confinement, // WHERE the runner spawns: it calls target.runtime.spawn/probe/signal instead of - // child_process + kill(pid), and reads the container-only credential/artifact facts beside - // it. Mirrored into the runtime bag below so an adapter can read either shape. + // child_process + kill(pid), and reads that runtime's credential/artifact facts beside it. + // Mirrored into the runtime bag below so an adapter can read either shape. target, claudeOauthToken, artifactDir: target.artifactDir, runtime: { target, claudeOauthToken, claudeTokenFingerprint: claudeTokenFp, artifactDir: target.artifactDir, @@ -1544,6 +1600,9 @@ export async function runMessage({ channelId, authorId, workspaceId = "", text, // claim to choose allowedCodexMcps vs allowedMcps for mutations; reusing the failed engine's // token would cross that authority boundary even though a different runner executes. const fallbackMcpRuntime = await buildEngineMcpRuntime({ ...mcpRuntimeInput, pluginRuntime: grantArtifacts.pluginRuntime, engine: fallbackEngine, target, allowedMcps: meta[fallbackAdapter.mcpMetaKey] || [] }); + // The fallback resolves the OTHER engine's own selections, so it reports its own drops. The + // primary engine's note is not carried over: this answer came from the fallback. + const fbMcpDropNote = await reportRejectedMcps(fallbackMcpRuntime.rejectedMcps, fallbackEngine); const fbKey = `${threadKey}::${fallbackEngine}-fallback`; const prior = await getSession(entry.slug, fbKey); // A FRESH fallback session can't resume the failed engine's conversation, so without help it @@ -1665,7 +1724,7 @@ export async function runMessage({ channelId, authorId, workspaceId = "", text, // Claude→Codex-only flag, still emitted so existing consumers keep working. const fallbackResult = { ...baseMeta, ...cx, - content: redactSecretValues(licenseWarning + (note || "") + fallbackModelNote + (cx.content || ""), outputSecrets), + content: redactSecretValues(licenseWarning + (note || "") + fbMcpDropNote + fallbackModelNote + (cx.content || ""), outputSecrets), sessionId: cx.sessionId ?? null, engine: fallbackEngine, isNew: !prior, @@ -1768,8 +1827,10 @@ export async function runMessage({ channelId, authorId, workspaceId = "", text, // not at the head of a queue this turn may have sat in for hours) and materialize the // token-bearing config file built around it (see above). From here on the session row is the // engine's: a later failure keeps it (resume-heal, failover and /clear own that story). - engineStarted = true; + // Minted BEFORE `engineStarted` flips: a failure in here is still a turn whose engine never + // spawned, so the session row this turn minted must not survive it (see dropUnusedSession). await mintGatewayMcpRuntime(); + engineStarted = true; if (mcpConfigFile) { await mkdir(path.dirname(mcpConfigFile), { recursive: true, mode: 0o700 }); await writeFile(mcpConfigFile, mcpConfigJson, { mode: 0o600 }); @@ -2019,7 +2080,7 @@ export async function runMessage({ channelId, authorId, workspaceId = "", text, // `runtimeModel` keeps the CLI-reported truth for context-window math and Codex cost rates. return { ...redactSecretFields(finalResult, outputSecrets), - content: redactSecretValues(licenseWarning + (finalResult.content || ""), outputSecrets), + content: redactSecretValues(licenseWarning + mcpDropNote + (finalResult.content || ""), outputSecrets), loopWakeup, runtimeModel: resolveCurrentModel(finalResult), model: model || resolveCurrentModel(finalResult), diff --git a/src/gateway/runtime-access.js b/src/gateway/runtime-access.js index 9b721457..a2efb47b 100644 --- a/src/gateway/runtime-access.js +++ b/src/gateway/runtime-access.js @@ -28,6 +28,9 @@ function hostPathMounted(mounts, hostPath) { } export function gatewayStoreAccessNote(target) { + if (target?.backend === "host") { + return "Host gateway runtime directory: **directly accessible**. Host gateway database: **directly accessible**. This is a sudo-host run under the daemon OS account, not a container mount. Never print credentials or database contents as proof."; + } const mounts = target?.container?.mounts; const state = Array.isArray(mounts) ? `Host gateway runtime directory: **${hostPathMounted(mounts, gatewayRoot()) ? "mounted" : "not mounted"}**. Host gateway database: **${hostPathMounted(mounts, dbFile()) ? "mounted" : "not mounted"}**.` @@ -45,17 +48,23 @@ function cleanModeNote(clean) { return "Clean mode for this attempt is unknown because the resolved run mode was not supplied. Do not infer it from missing tools alone."; } -function networkPolicyNote(allowNetwork) { +function networkPolicyNote(allowNetwork, { host = false } = {}) { if (typeof allowNetwork !== "boolean") { return "Network policy for this attempt is unknown because the resolved policy was not supplied. Do not infer network permission from earlier turns or successful requests."; } const policy = allowNetwork ? "Outbound requests are permitted by the channel network switch, subject to this attempt's other tool permissions and the user's requested scope. There is no per-domain allow-list." : "Do not make outbound requests. When a request needs the network, explain that the current policy is off and that no fresh request was made. Do not present an earlier response as a fresh network result."; - return `Network policy for THIS attempt: **${allowNetwork ? "on" : "off"}**. This current network policy supersedes earlier turns and cached results. ${policy} The switch is advisory, not container egress enforcement: the container remains on the bridge network, and an engine may impose its own additional restrictions. An off policy does not prove that a connection is technically blocked.`; + const enforcement = host + ? "This direct host process has the daemon account's ordinary network reachability; the switch is an instruction to the engine, not an OS-level egress filter." + : "The switch is advisory, not container egress enforcement: the container remains on the bridge network, and an engine may impose its own additional restrictions."; + return `Network policy for THIS attempt: **${allowNetwork ? "on" : "off"}**. This current network policy supersedes earlier turns and cached results. ${policy} ${enforcement} An off policy does not prove that a connection is technically blocked.`; } export function containerAccessNote(target) { + if (target?.backend === "host") { + return "**Direct host access for this run:** **enabled by `/sudo`**. The engine process runs as the gateway daemon's OS user with the host filesystem, processes, HOME, installed commands, and network directly available. There is no channel-container boundary for this attempt. Only organization-admin messages are admitted to this sudo thread."; + } if (!Array.isArray(target?.container?.mounts)) { return "**Container access:** no resolved runtime target was supplied at prompt/guide construction. Do not infer host access from the author's role; check the current runtime before claiming a path is mounted or absent."; } @@ -75,7 +84,7 @@ export function runtimeAccessPreamble(target, { clean, allowNetwork } = {}) { + gatewayStoreAccessNote(target) + "\n" + "Respect the user's requested scope when checking access. For requests limited to existence, metadata or permission checks, use resolved mount facts and non-mutating metadata checks only. Do not read file contents or create, modify, or delete probe files, even temporarily. If metadata cannot establish write access, report it as unverified; do not upgrade an access-check request into a write test.\n" + cleanModeNote(clean) + "\n" - + networkPolicyNote(allowNetwork) + "\n" + + networkPolicyNote(allowNetwork, { host: target?.backend === "host" }) + "\n" + "Environment secrets, when injected into a run, are usable by its process and CLI. Write-only means masked listing/reveal surfaces and redacted outputs; it does not mean the process cannot read its environment. Do not print secret values.\n" + "[End gateway container access]\n\n"; } diff --git a/src/gateway/safe-fs.js b/src/gateway/safe-fs.js index cebbf09d..37b64365 100644 --- a/src/gateway/safe-fs.js +++ b/src/gateway/safe-fs.js @@ -153,6 +153,32 @@ export async function createExclusive(file, content, { mode = 0o644 } = {}) { } } +// Remove one gateway-managed regular file only when its resolved path remains beneath a trusted +// root. Attachment folders are agent-writable between turns, so a path that has been replaced by +// a symlink or moved outside the upload root is refused instead of followed. Missing files are +// already clean and therefore return false without failing the completed media operation. +export async function removeRegularFileWithin(root, file) { + try { + const resolvedRoot = await realpath(root); + const candidate = path.resolve(String(file || "")); + const resolvedParent = await realpath(path.dirname(candidate)); + const parentRelative = path.relative(resolvedRoot, resolvedParent); + if (parentRelative === ".." || parentRelative.startsWith(`..${path.sep}`) || path.isAbsolute(parentRelative)) return false; + + const info = await lstat(candidate); + if (!info.isFile() || info.isSymbolicLink()) return false; + const resolvedCandidate = await realpath(candidate); + const fileRelative = path.relative(resolvedRoot, resolvedCandidate); + if (fileRelative === ".." || fileRelative.startsWith(`..${path.sep}`) || path.isAbsolute(fileRelative)) return false; + + await rm(candidate); + return true; + } catch (error) { + if (error?.code === "ENOENT") return false; + throw error; + } +} + // A symlink is tolerable at a managed path ONLY when it points at a real directory that still // lives inside the trusted root. Returns that resolved directory, or null for a dangling link, a // link to a non-directory, or one that escapes the root — all of which the caller removes. diff --git a/src/gateway/session-carry.js b/src/gateway/session-carry.js index 6e359652..ae94ec16 100644 --- a/src/gateway/session-carry.js +++ b/src/gateway/session-carry.js @@ -1,23 +1,23 @@ -// Carrying a thread's ENGINE-NATIVE history into the container that is about to run it. +// Carrying a thread's ENGINE-NATIVE history across the container ↔ sudo-host boundary. // // A session row remembers WHERE it last ran (`runtime`, migration 13 — `''` means the pre-v0.8 // host runtime, and rows written while the host backend still existed say "host"). Every channel -// runs in a container now, but a thread that last ran on the host still has its engine session -// files in the daemon's own engine state dir: resuming it from the container would find no session, +// Ordinary runs use a container, while `/sudo` deliberately crosses to the host. A thread that +// last ran on either side keeps its engine session files there; resuming on the other side would +// find no session, // and run.js would fall back to HEALING the thread — a fresh engine session with the chat transcript // replayed, which throws away everything the transcript never held (compaction summaries, tool // results, subagent transcripts, the model's working state). // -// So before the first resume attempt, and only when the row names the host, the session's files are -// copied from the host state dir into the channel's container. Lazily (one thread, at its next -// message), overwriting the older copy and deleting nothing. The heal stays exactly where it was: -// every failure here is logged and swallowed, and the turn continues into it. A container→host -// direction no longer exists: there is no host runtime to carry to. +// So before the first resume attempt, and only when the backend changed, the session's files are +// copied to the side about to run. This preserves compactions and native tool/subagent state when +// an admin turns `/sudo` on or off. Every failure remains non-fatal and falls back to healing. import path from "node:path"; import { engineSessionFiles, engineSessionState, engineStateDir } from "../engines/registry.js"; import { newRunId, runtimeCanCarry } from "../runtimes/contract.js"; +import { resolveRuntime } from "../runtimes/resolve.js"; -export const CARRY_DIRECTIONS = Object.freeze({ IN: "host→container" }); +export const CARRY_DIRECTIONS = Object.freeze({ IN: "host→container", OUT: "container→host" }); // The backend a session row names. A row with no stamp, an unparseable one, or one from before // migration 13 is a HOST row — that is what every session predating multi-runtime was. @@ -46,7 +46,7 @@ export function buildCarryEntries({ engine, cwd, sessionId, fromDir, toDir }) { } /** - * Carry a thread's engine session files from the host state dir into the container about to run it. + * Carry a thread's engine session files to the backend about to run it. * * @param {object} options * @param {string} options.engine the harness the resume will use @@ -57,6 +57,7 @@ export function buildCarryEntries({ engine, cwd, sessionId, fromDir, toDir }) { * @param {object} options.target the RuntimeTarget this turn resolved to (a container) * @param {string} [options.slug] for the log line * @param {string} [options.threadKey] for the log line + * @param {Function} [options.resolveFor] resolveRuntime, injectable for tests * @param {Function} [options.log] console.log, injectable for tests * @returns {Promise<{direction: string, files: number}|null>} null when nothing was carried */ @@ -68,49 +69,52 @@ export async function carrySession({ target, slug = "", threadKey = "", + resolveFor = resolveRuntime, log = console.log, } = {}) { const where = `${slug}/${threadKey}`; + const to = String(target?.backend || "host"); const from = storedRuntimeBackend(storedRuntime); - // Only a host row has anything to carry. A RECREATED container is still the same backend on - // purpose: it shares the channel's HOME volume, which is never deleted, so its history is there. - if (!sessionId || from !== "host" || !target) return null; + // A recreated container is the same backend on purpose: its persistent HOME already has state. + if (!sessionId || !target || from === to) return null; try { if (!engineSessionState(engine)) { - log(`[gateway] ${where}: ${engine} does not declare where it keeps a session, so its history stays on the host — the resume falls back to the existing heal`); + log(`[gateway] ${where}: ${engine} does not declare where it keeps a session, so its history stays on ${from} — the resume falls back to the existing heal`); return null; } - // The SOURCE is the daemon's own engine state dir (no target = the host view); the DESTINATION - // is this turn's container. + const direction = to === "host" ? CARRY_DIRECTIONS.OUT : CARRY_DIRECTIONS.IN; + const source = resolveFor(target.slug, target.meta || {}, { backend: from }); + const destination = target; const entries = buildCarryEntries({ engine, cwd, sessionId, - fromDir: engineStateDir(engine, null), - toDir: engineStateDir(engine, target), + fromDir: engineStateDir(engine, source), + toDir: engineStateDir(engine, destination), }); if (!entries.length) return null; - // The container side owns the copy: it is the only one that can reach its own HOME volume. - // `copyIn` is an optional contract method, so a backend that lacks it skips instead of throwing. - if (!runtimeCanCarry(target)) { - log(`[gateway] ${where}: the ${target.backend} runtime cannot move session state, so ${engine} session ${sessionId} stays on the host — the resume falls back to the existing heal`); + // The container side owns the copy in both directions because only it can reach its HOME + // volume. copyIn/copyOut remain optional backend capabilities. + const mover = to === "host" ? source : destination; + if (!runtimeCanCarry(mover)) { + log(`[gateway] ${where}: the ${mover.backend} runtime cannot move session state, so ${engine} session ${sessionId} stays on ${from} — the resume falls back to the existing heal`); return null; } - // Hold a lease for the whole copy so the idle reaper cannot stop the container we are writing - // into halfway through. - const lease = target.runtime.acquireLease(target, { kind: "run", id: newRunId("run") }); + const lease = mover.runtime.acquireLease(mover, { kind: "run", id: newRunId("run") }); let result; try { - result = await target.runtime.copyIn(target, entries); + result = to === "host" + ? await mover.runtime.copyOut(mover, entries) + : await mover.runtime.copyIn(mover, entries); } finally { lease.release(); } const files = Number(result?.copied) || 0; if (!files) return null; - log(`[gateway] ${where}: carried ${engine} session ${sessionId} ${CARRY_DIRECTIONS.IN} (${files} file${files === 1 ? "" : "s"})`); - return { direction: CARRY_DIRECTIONS.IN, files }; + log(`[gateway] ${where}: carried ${engine} session ${sessionId} ${direction} (${files} file${files === 1 ? "" : "s"})`); + return { direction, files }; } catch (error) { log(`[gateway] ${where}: session carry-over failed (${error?.message || error}) — the resume falls back to the existing heal`); return null; diff --git a/src/gateway/skills/bundled/channelgate/SKILL.md b/src/gateway/skills/bundled/channelgate/SKILL.md index eb04a46d..939ae9f3 100644 --- a/src/gateway/skills/bundled/channelgate/SKILL.md +++ b/src/gateway/skills/bundled/channelgate/SKILL.md @@ -2,7 +2,7 @@ name: "channelgate" description: >- Configure, secure, explain, or troubleshoot ChannelGate conversations and deployments. Use for - channel containers and work folders, permissions/network access, Claude or Codex runtime and + channel containers, direct-host `/sudo` threads and work folders, permissions/network access, Claude or Codex runtime and login recovery, per-channel CLI credentials and device-login links, MCP identities, skill grants/templates/sources, channel memory, background work, schedules, attachments, or strict headless MCP configuration. Do not use for ordinary work merely performed through ChannelGate. @@ -45,12 +45,14 @@ the product contracts and decision points; it does not replace either source. ## Invariants that apply everywhere -- Every foreground turn, background agent, shell job, scheduled run, and memory review executes - inside that conversation's own rootless Podman container. Admin mode grants an admin author's +- Every ordinary foreground turn, background agent, shell job, scheduled run, and memory review + executes inside that conversation's own rootless Podman container. Admin mode grants an admin author's tool bypass; it also qualifies the channel for the optional operator-home mount ONLY while the gateway-wide `containerFullAccessHome` switch is on. See the architecture/security reference and - the injected `gateway-usage` runtime note for the exact grant. Never run an engine on the host. -- The container is the filesystem/process boundary. Its persistent HOME belongs to one + the injected `gateway-usage` runtime note for the exact grant. The only host-engine path is a + current organization admin's per-thread Slack `/sudo`, which rejects non-admin messages and must + be treated as direct daemon-account access. +- The container is the default filesystem/process boundary. Its persistent HOME belongs to one conversation. Host visibility follows the resolved mounts: normally just this conversation's directories, or the operator's whole home when the explicit Full-access grant applies. The current bridge network has no domain filtering or enforced egress cut-off, so never claim diff --git a/src/gateway/skills/bundled/channelgate/references/architecture-security.md b/src/gateway/skills/bundled/channelgate/references/architecture-security.md index 60b5b9da..2f7d7f6a 100644 --- a/src/gateway/skills/bundled/channelgate/references/architecture-security.md +++ b/src/gateway/skills/bundled/channelgate/references/architecture-security.md @@ -14,6 +14,13 @@ The operator HOME, gateway runtime root/database, daemon checkout, sibling conve credential stores are normally not mounted. An admin conversation may deliberately point its work folder at a host repository; that one directory is then visible read-write, but nothing beside it. +The explicit boundary exception is a Slack thread whose current organization admin enabled typed +`/sudo`. That thread resolves the registered host backend: engine and inherited background work +run directly as the daemon OS user with the host filesystem, processes, native HOME, commands and +network. It is not Admin channel mode and not a mount. Only current admins can toggle or message +it; every ingress/run rechecks authority, non-admin messages are rejected before work starts, and +stored channel metadata or run-API overrides cannot select it. `/sudo off` restores the container. + One operator-chosen exception: with the gateway-wide **Full-access channels see the gateway home** switch on (`containerFullAccessHome`, Settings → Container runtime, off by default), every Full-access conversation's container also mounts the gateway user's whole home read-write at its identical path — every diff --git a/src/gateway/thread-engine.js b/src/gateway/thread-engine.js index 134f4486..530e7d15 100644 --- a/src/gateway/thread-engine.js +++ b/src/gateway/thread-engine.js @@ -106,3 +106,18 @@ export async function getThreadClean(slug, threadKey) { export async function setThreadClean(slug, threadKey, on) { setOverride(slug, threadKey, "clean", on ? "1" : ""); } + +// ── Per-thread SUDO override (typed `/sudo`) ──────────────────────────────────────────────── +// A sudo thread is the one explicit escape hatch from the per-channel container boundary. The +// flag only records the thread's requested posture; every ingress and run still re-checks that the +// current author is an organization admin before it may resolve the host backend. Keeping the +// authorization decision out of this generic store prevents an old row from becoming authority +// after an admin is demoted. + +export async function getThreadSudo(slug, threadKey) { + return Boolean(getOverride(slug, threadKey, "sudo")); +} + +export async function setThreadSudo(slug, threadKey, on) { + setOverride(slug, threadKey, "sudo", on ? "1" : ""); +} diff --git a/src/gateway/transcribe.js b/src/gateway/transcribe.js index 07112a1a..9e0046fb 100644 --- a/src/gateway/transcribe.js +++ b/src/gateway/transcribe.js @@ -188,6 +188,7 @@ export async function transcribeSlackAudioFiles(files, { export async function resolveAudioTranscripts(files, { localEnabled = true, downloadLocal = async () => { throw new Error("Local audio download is unavailable."); }, + removeProcessed = null, localTranscriber = transcribeAudioFiles, localOptions = {}, slackTranscriber = transcribeSlackAudioFiles, @@ -196,31 +197,46 @@ export async function resolveAudioTranscripts(files, { const transcripts = []; const failed = []; const localFailed = []; + const cleanupFailed = []; for (const source of files || []) { const name = safeLabel(source?.name); + let saved = null; + let complete = false; if (localEnabled) { try { - const saved = await downloadLocal(source); + saved = await downloadLocal(source); if (!saved?.path) throw new Error(saved?.skipped || "Local audio download failed."); const local = await localTranscriber([saved], localOptions); if (local.transcripts?.[0]?.text) { transcripts.push({ name, text: local.transcripts[0].text }); - continue; + complete = true; + } else { + throw new Error(local.failed?.[0]?.reason || "Local Whisper produced no transcript."); } - throw new Error(local.failed?.[0]?.reason || "Local Whisper produced no transcript."); } catch (error) { localFailed.push({ name, reason: boundedReason(error) }); } } - const slack = await slackTranscriber([source], slackOptions); - if (slack.transcripts?.[0]?.text) { - transcripts.push({ name, text: slack.transcripts[0].text }); - } else { - failed.push({ name, reason: boundedReason(slack.failed?.[0]?.reason || "Slack transcript is not ready — click Generate transcript, then re-trigger the bot.") }); + if (!complete) { + const slack = await slackTranscriber([source], slackOptions); + if (slack.transcripts?.[0]?.text) { + transcripts.push({ name, text: slack.transcripts[0].text }); + complete = true; + } else { + failed.push({ name, reason: boundedReason(slack.failed?.[0]?.reason || "Slack transcript is not ready — click Generate transcript, then re-trigger the bot.") }); + } + } + if (complete && saved?.path && typeof removeProcessed === "function") { + try { + const removed = await removeProcessed(saved); + if (removed === false) throw new Error("downloaded source was no longer a managed regular upload"); + } catch (error) { + cleanupFailed.push({ name, reason: boundedReason(error) }); + } } } - return { transcripts, failed, localFailed }; + return { transcripts, failed, localFailed, cleanupFailed }; } export function composeVoicePrompt({ text = "", transcripts = [], failed = [] } = {}) { @@ -348,6 +364,7 @@ export async function transcribeAudioFile(filePath, options = {}) { export async function transcribeAudioFiles(files, options = {}) { const transcripts = []; const failed = []; + const cleanupFailed = []; const custom = typeof options.transcribe === "function" ? options.transcribe : null; for (const file of files || []) { options.signal?.throwIfAborted(); @@ -360,9 +377,17 @@ export async function transcribeAudioFiles(files, options = {}) { text = await transcribeAudioFile(file.path, options); } transcripts.push({ name: safeLabel(file.name), text }); + if (typeof options.removeProcessed === "function") { + try { + const removed = await options.removeProcessed(file); + if (removed === false) throw new Error("downloaded source was no longer a managed regular upload"); + } catch (error) { + cleanupFailed.push({ name: safeLabel(file?.name), reason: boundedReason(error) }); + } + } } catch (error) { failed.push({ name: safeLabel(file?.name), reason: boundedReason(error) }); } } - return { transcripts, failed }; + return { transcripts, failed, cleanupFailed }; } diff --git a/src/gateway/usage-pricing.js b/src/gateway/usage-pricing.js new file mode 100644 index 00000000..f3798e5f --- /dev/null +++ b/src/gateway/usage-pricing.js @@ -0,0 +1,225 @@ +// One-time Codex pricing refreshes. The usage ledger stores token evidence and an estimated +// Standard API-equivalent dollar value; when OpenAI changes a published rate, updating only the +// forward estimator leaves the dashboard's existing period internally inconsistent. This module +// reprices the requested historical window from the stored component/request evidence, backs up +// the database first, and records a basis marker so every upgraded gateway applies it once. +import { CODEX_PRICING_BASIS, estimateCodexCost } from "./usage.js"; +import { backupGatewayDb } from "./usage-repair.js"; +import { DEFAULT_CODEX_RATES, getCodexModelRates } from "../config/settings.js"; + +export const CODEX_PRICING_HISTORY_SINCE = "2026-07-13T00:00:00.000Z"; +export const CODEX_SOL_PRICE_CUTOVER = "2026-08-21T00:00:00.000Z"; +export const CODEX_PRICING_META_KEY = "codex_usage_pricing_basis"; + +const RETIRED_SOL_RATES = Object.freeze({ input: 5, cachedInput: 0.5, output: 30 }); +const SOL_RATE_KEYS = Object.freeze(["gpt-5.6-sol", "gpt-5.6"]); + +const tokenUsage = (row = {}) => ({ + input_tokens: Number(row.tokens_in) || 0, + cached_input_tokens: Number(row.tokens_cached) || 0, + cache_write_input_tokens: Number(row.tokens_cache_write) || 0, + output_tokens: Number(row.tokens_out) || 0, + reasoning_output_tokens: Number(row.reasoning_tokens) || 0, +}); + +const fixed = (value) => Number(Number(value || 0).toFixed(6)); + +const sameRate = (left, right) => ( + left?.input === right?.input + && left?.cachedInput === right?.cachedInput + && left?.output === right?.output +); + +function codexRatesAt(ts) { + const current = getCodexModelRates(); + if (String(ts || "") >= CODEX_SOL_PRICE_CUTOVER) return current; + const historical = { ...current }; + for (const key of SOL_RATE_KEYS) { + // Respect genuine admin overrides. Only replace the shipped current default with the official + // rate that preceded OpenAI's August 21 reduction. + if (sameRate(current[key], DEFAULT_CODEX_RATES[key])) historical[key] = RETIRED_SOL_RATES; + } + return historical; +} + +export function pendingCodexPricingRefresh(db, { basis = CODEX_PRICING_BASIS } = {}) { + const appliedBasis = String(db.prepare("SELECT value FROM _meta WHERE key = ?").get(CODEX_PRICING_META_KEY)?.value || ""); + if (appliedBasis !== basis) return { pending: true, appliedBasis, basis }; + // A manual refresh can race an older daemon that is still recording turns. Once the marker is + // current, cheaply inspect only components written with another basis and refresh again if one + // of their models is now priceable. Permanently-unpriced internal pseudo-models stay ignored. + const stale = db.prepare( + `SELECT c.model, c.tokens_in, c.tokens_cached, c.tokens_cache_write, c.tokens_out, c.reasoning_tokens, + u.ts AS usage_ts + FROM usage_components c + JOIN usage u ON u.id = c.usage_id + WHERE u.engine = 'codex' AND u.ts >= ? AND c.pricing_basis != ?` + ).all(CODEX_PRICING_HISTORY_SINCE, basis); + const rateableStaleComponent = stale.some((component) => ( + estimateCodexCost(tokenUsage(component), component.model, [], { + rates: codexRatesAt(component.usage_ts), + }).costUSD != null + )); + return { pending: rateableStaleComponent, appliedBasis, basis }; +} + +export function buildCodexPricingRefresh({ + db, + since = CODEX_PRICING_HISTORY_SINCE, + basis = CODEX_PRICING_BASIS, +} = {}) { + const components = db.prepare( + `SELECT c.*, u.ts AS usage_ts + FROM usage_components c + JOIN usage u ON u.id = c.usage_id + WHERE u.engine = 'codex' AND u.ts >= ? + ORDER BY c.id` + ).all(since); + const requests = db.prepare( + `SELECT r.* + FROM usage_requests r + JOIN usage_components c ON c.id = r.component_id + JOIN usage u ON u.id = c.usage_id + WHERE u.engine = 'codex' AND u.ts >= ? + ORDER BY r.component_id, r.request_index` + ).all(since); + const requestsByComponent = new Map(); + for (const request of requests) { + const list = requestsByComponent.get(Number(request.component_id)) || []; + list.push(request); + requestsByComponent.set(Number(request.component_id), list); + } + + const componentUpdates = []; + const usageCosts = new Map(); + const models = new Map(); + let storedEstimatedValue = 0; + let repricedEstimatedValue = 0; + let unpricedComponents = 0; + for (const component of components) { + const rates = codexRatesAt(component.usage_ts); + const detail = requestsByComponent.get(Number(component.id)) || []; + const requestEvidence = detail.map((request) => ({ + model: request.model || component.model, + usage: tokenUsage(request), + })); + const estimate = estimateCodexCost(tokenUsage(component), component.model, requestEvidence, { rates }); + const requestUpdates = detail.map((request) => ({ + id: Number(request.id), + costUSD: estimateCodexCost(tokenUsage(request), request.model || component.model, [{ + model: request.model || component.model, + usage: tokenUsage(request), + }], { rates }).costUSD, + })); + const update = { + id: Number(component.id), + usageId: Number(component.usage_id), + model: String(component.model || ""), + costUSD: estimate.costUSD, + costEstimated: estimate.estimated, + pricingBasis: estimate.estimated ? basis : "unpriced", + requestUpdates, + }; + componentUpdates.push(update); + + const usage = usageCosts.get(update.usageId) || { costUSD: 0, pricedComponents: 0 }; + if (update.costUSD != null) { + usage.costUSD += update.costUSD; + usage.pricedComponents += 1; + repricedEstimatedValue += update.costUSD; + } else { + unpricedComponents += 1; + } + usageCosts.set(update.usageId, usage); + + const model = models.get(update.model) || { components: 0, storedValue: 0, repricedValue: 0, unpricedComponents: 0 }; + model.components += 1; + if (component.cost_usd != null) { + const old = Number(component.cost_usd) || 0; + storedEstimatedValue += old; + model.storedValue += old; + } + if (update.costUSD == null) model.unpricedComponents += 1; + else model.repricedValue += update.costUSD; + models.set(update.model, model); + } + + const usageUpdates = [...usageCosts].map(([id, value]) => ({ + id, + costUSD: value.pricedComponents ? fixed(value.costUSD) : null, + costEstimated: value.pricedComponents > 0, + })); + const modelSummary = Object.fromEntries([...models].map(([model, value]) => [model, { + components: value.components, + storedValue: fixed(value.storedValue), + repricedValue: fixed(value.repricedValue), + delta: fixed(value.repricedValue - value.storedValue), + unpricedComponents: value.unpricedComponents, + }])); + + return { + basis, + since, + usageRows: usageUpdates.length, + components: componentUpdates.length, + requests: requests.length, + unpricedComponents, + storedEstimatedValue: fixed(storedEstimatedValue), + repricedEstimatedValue: fixed(repricedEstimatedValue), + delta: fixed(repricedEstimatedValue - storedEstimatedValue), + models: modelSummary, + componentUpdates, + usageUpdates, + }; +} + +export function summarizeCodexPricingRefresh(plan = {}) { + const { + basis = CODEX_PRICING_BASIS, + since = CODEX_PRICING_HISTORY_SINCE, + usageRows = 0, + components = 0, + requests = 0, + unpricedComponents = 0, + storedEstimatedValue = 0, + repricedEstimatedValue = 0, + delta = 0, + models = {}, + } = plan; + return { basis, since, usageRows, components, requests, unpricedComponents, storedEstimatedValue, repricedEstimatedValue, delta, models }; +} + +export function applyCodexPricingRefresh(db, plan) { + const updateRequest = db.prepare("UPDATE usage_requests SET cost_usd = ? WHERE id = ?"); + const updateComponent = db.prepare( + "UPDATE usage_components SET cost_usd = ?, cost_estimated = ?, pricing_basis = ? WHERE id = ?" + ); + const updateUsage = db.prepare("UPDATE usage SET cost_usd = ?, cost_estimated = ? WHERE id = ?"); + db.exec("BEGIN IMMEDIATE"); + try { + for (const component of plan.componentUpdates || []) { + for (const request of component.requestUpdates || []) updateRequest.run(request.costUSD, request.id); + updateComponent.run(component.costUSD, component.costEstimated ? 1 : 0, component.pricingBasis, component.id); + } + for (const usage of plan.usageUpdates || []) updateUsage.run(usage.costUSD, usage.costEstimated ? 1 : 0, usage.id); + db.prepare( + "INSERT INTO _meta(key, value) VALUES(?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value" + ).run(CODEX_PRICING_META_KEY, plan.basis || CODEX_PRICING_BASIS); + db.exec("COMMIT"); + } catch (error) { + try { db.exec("ROLLBACK"); } catch { /* already rolled back */ } + throw error; + } + return summarizeCodexPricingRefresh(plan); +} + +export async function autoRefreshCodexPricing({ db, makeBackup, log = console } = {}) { + const handle = db || (await import("../db/index.js")).getDb(); + const state = pendingCodexPricingRefresh(handle); + if (!state.pending) return { applied: false, basis: state.basis }; + const plan = buildCodexPricingRefresh({ db: handle }); + const backupPath = plan.usageRows ? await (makeBackup || backupGatewayDb)() : ""; + const summary = applyCodexPricingRefresh(handle, plan); + log.log?.(`[usage] Codex pricing refresh ${summary.basis}: ${summary.usageRows} run(s), ${summary.components} component(s), ${summary.requests} request(s); value ${summary.storedEstimatedValue} → ${summary.repricedEstimatedValue}${backupPath ? `; backup ${backupPath}` : ""}`); + return { applied: true, backupPath, ...summary }; +} diff --git a/src/gateway/usage.js b/src/gateway/usage.js index 47f142ac..7fd9b234 100644 --- a/src/gateway/usage.js +++ b/src/gateway/usage.js @@ -9,7 +9,7 @@ import { getDb } from "../db/index.js"; import { getSettings, getCodexModelRates } from "../config/settings.js"; import { countDrop } from "../util/drops.js"; import { resolveCurrentModel } from "./model-info.js"; -import { engineSupports } from "../engines/registry.js"; +import { engineSupports, engineCostRateKey } from "../engines/registry.js"; import { normalizeCodexTokenUsage } from "../engines/codex-usage.js"; // Codex reports no dollar cost — derive an ESTIMATE from the per-model $/1M rates in Settings @@ -18,13 +18,16 @@ import { normalizeCodexTokenUsage } from "../engines/codex-usage.js"; // exact key → official dated-snapshot prefix. Empty/`codex` is a CLI sentinel, not an official API // model id, so it stays unpriced until the runtime model is resolved. The legacy blended rate is // retained only as an explicit admin fallback for an unknown non-empty runtime model. -const LONG_CONTEXT_RATE_KEYS = new Set(["gpt-5.6-sol", "gpt-5.6", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.5", "gpt-5.4"]); +export const CODEX_PRICING_BASIS = "openai-standard-effective-dates-2026-09-14"; +const LONG_CONTEXT_RATE_KEYS = new Set(["gpt-6-astra", "gpt-5.6-sol", "gpt-5.6", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.5", "gpt-5.4"]); function codexRateKey(rates, model) { const m = String(model || "").toLowerCase(); if (!m || m === "codex") return ""; if (rates[m]) return m; return Object.keys(rates) - .filter((key) => m.startsWith(`${key}-`)) + // Only inherit a base rate for an official dated snapshot. A named sibling such as + // gpt-5.3-codex-spark is a different model and stays unpriced until OpenAI publishes its rate. + .filter((key) => m.startsWith(`${key}-`) && /^\d{4}(?:-\d{2}){1,2}$/.test(m.slice(key.length + 1))) .sort((a, b) => b.length - a.length)[0] || ""; } @@ -47,8 +50,7 @@ function priceCodexRequest(rawUsage, model, rates, { allowLongContext = true } = ) / 1_000_000; } -export function estimateCodexCost(u = {}, model = "", requests = []) { - const rates = getCodexModelRates(); +export function estimateCodexCost(u = {}, model = "", requests = [], { rates = getCodexModelRates() } = {}) { const detailed = Array.isArray(requests) ? requests.filter((request) => request?.usage) : []; if (detailed.length) { let cost = 0; @@ -89,6 +91,10 @@ export function normalizeUsage(result = {}) { // Engines that report a real dollar cost use it as-is; only estimate for those that do not. // A `!== "codex"` test here would have handed a third engine Claude's cost semantics silently. if (engineSupports(result.engine, "realCost")) return { inTok, outTok, cachedTok, cacheWriteTok, costUSD: null, estimated: false }; + // Neither a real cost NOR a configured rate of its own (the Qwen harness, whose adapter drops + // the Anthropic-priced figure its CLI reports): record the tokens and no dollar figure. Falling + // through to the Codex estimator here would price QwenCloud usage with OpenAI's rate table. + if (!engineCostRateKey(result.engine)) return { inTok, outTok, cachedTok, cacheWriteTok, costUSD: null, estimated: false }; const est = estimateCodexCost(u, resolveCurrentModel(result), result.usageRequests); return { inTok, outTok, cachedTok, cacheWriteTok, costUSD: est.costUSD, estimated: est.estimated }; } @@ -132,7 +138,7 @@ export function componentRow(accounting, { sourceKind = "root", parentSourceId = requests, costUSD: estimate.costUSD, costEstimated: estimate.estimated, - pricingBasis: estimate.estimated ? "openai-standard-2026-08-16" : "unpriced", + pricingBasis: estimate.estimated ? CODEX_PRICING_BASIS : "unpriced", provenance: accounting?.provenance || (sourceKind === "root" ? "codex-rollout-root-delta" : "codex-rollout-fork-delta"), confidence: accounting?.exactRequests === false ? "verified-total" : "verified-requests", durationMs: accounting?.durationMs ?? durationMs, diff --git a/src/gateway/workspace-assignments.js b/src/gateway/workspace-assignments.js new file mode 100644 index 00000000..e5f67ca3 --- /dev/null +++ b/src/gateway/workspace-assignments.js @@ -0,0 +1,43 @@ +// Read-only workspace ownership view shared by the admin conversation list and folder picker. +// Use effectiveWorkDir rather than comparing stored strings: it applies the same containment, +// realpath and missing-folder fallback rules as an actual engine run. +import { effectiveWorkDir } from "./folders.js"; + +function conversationSummary(channel) { + return { + channelId: String(channel.channelId || channel.meta?.channelId || ""), + slug: String(channel.slug || ""), + name: String(channel.name || channel.meta?.name || channel.slug || ""), + type: String(channel.type || channel.meta?.type || ""), + isDM: Boolean(channel.isDM || channel.meta?.isDM), + }; +} + +export function workspaceAssignmentGroups(channels = []) { + const groups = new Map(); + for (const channel of channels) { + if (!channel?.meta || !channel.slug) continue; + const workDir = effectiveWorkDir(channel.slug, { ...channel.meta, cleanMode: false }); + if (!groups.has(workDir)) groups.set(workDir, []); + groups.get(workDir).push(conversationSummary(channel)); + } + return groups; +} + +export function workspaceConflictsBySlug(channels = []) { + const conflicts = new Map(); + for (const [workDir, conversations] of workspaceAssignmentGroups(channels)) { + if (conversations.length < 2) continue; + for (const conversation of conversations) { + conflicts.set(conversation.slug, { + path: workDir, + conversations: conversations.filter((other) => other.slug !== conversation.slug), + }); + } + } + return conflicts; +} + +export function workspaceAssignmentsAtPath(channels = [], workDir = "") { + return workspaceAssignmentGroups(channels).get(workDir) || []; +} diff --git a/src/mcp/gateway-server.js b/src/mcp/gateway-server.js index 3dff7d2b..e1bb6beb 100644 --- a/src/mcp/gateway-server.js +++ b/src/mcp/gateway-server.js @@ -33,6 +33,7 @@ import { register as registerLicense } from "./tools/license.js"; import { register as registerChannelDatabase } from "./tools/channel-database.js"; import { register as registerWorkspaceRead } from "./tools/workspace-read.js"; import { register as registerSkills } from "./tools/skills.js"; +import { register as registerQuestions } from "./tools/questions.js"; import { prepareInstructionApproval } from "../gateway/instruction-approvals.js"; export const text = (t) => ({ content: [{ type: "text", text: t }] }); @@ -322,15 +323,18 @@ export function createGatewayMcpServer(ctx) { server.registerTool = (name, def, handler) => { const gate = CONTROL_PLANE.get(name); return realRegisterTool(name, def, async (args, extra) => { + // Claude Code parses permission_prompt's reply as an allow/deny decision, so a refusal + // there must keep that shape — plain text reads as "invalid permission result" to the CLI. + const refuse = (message) => name === "permission_prompt" ? text(JSON.stringify({ behavior: "deny", message })) : text(message); const capability = ctx.verifyCapability(); if (!capability.ok) { - return text(`🚫 Gateway capability rejected (${capability.reason}). Start a fresh run and try again.`); + return refuse(`🚫 Gateway capability rejected (${capability.reason}). Start a fresh run and try again.`); } // The HTTP run API authenticates a daemon key, not the caller-supplied Slack author id. Its // signed capability deliberately retains that id only for attribution; it must never become // authority inside this user/channel control plane (including read-only admin tools). if (capability.claims.principalTrusted !== true) { - return text("🚫 Gateway tools require a trusted Slack principal; this run was authenticated only as a daemon/API caller."); + return refuse("🚫 Gateway tools require a trusted Slack principal; this run was authenticated only as a daemon/API caller."); } let humanApproved = false; if (gate) { @@ -396,6 +400,7 @@ export function createGatewayMcpServer(ctx) { registerSlackNative(server, ctx); registerLicense(server, ctx); registerSkills(server, ctx); + registerQuestions(server, ctx); } else { registerMemoryTool(server, ctx); } diff --git a/src/mcp/tools/questions.js b/src/mcp/tools/questions.js new file mode 100644 index 00000000..7955a8d4 --- /dev/null +++ b/src/mcp/tools/questions.js @@ -0,0 +1,21 @@ +import { questionInput } from "../../gateway/questions.js"; +import { postQuestions } from "../../slack/questions.js"; +import { isSlackTs } from "../../slack/thread-keys.js"; + +export function register(server, ctx, { post = postQuestions } = {}) { + // Only interactive, authenticated Slack turns can ask a human. No forms from unattended + // schedules, helper agents, untrusted API authors, or reduced memory-review connections. + if (ctx.origin !== "slack_foreground" || !ctx.principalTrusted || !isSlackTs(ctx.threadKey)) return; + server.registerTool("ask_questions", { + description: "Ask the requesting user clarification questions in this Slack thread using interactive cards or a paginated form. " + + "Supply custom option labels/values; single (up to 4 options), multi (up to 10), or text questions; custom text answers are enabled by default. " + + "Returns a saved pending request, NOT user answers. Continue only independent work or end this turn; the gateway queues a continuation with answers after the user clicks Submit. " + + "Do not poll or assume a selected/default answer. Use request_approval for permission to execute actions, not this tool.", + inputSchema: questionInput, + }, async (args) => { + try { + const record = await post({ channelId: ctx.channelId, threadKey: ctx.threadKey, authorId: ctx.createdBy, slug: ctx.slug }, args); + return ctx.text(`Questions posted (request ${record.id}). Awaiting the requesting user's Submit. Drafts survive restarts; the gateway will continue this thread with the answers. Continue independent work or end this turn. Do not poll, invent answers, or perform work that depends on them.`); + } catch (error) { return { ...ctx.text(`Could not post questions: ${error.message}`), isError: true }; } + }); +} diff --git a/src/platforms/ingest.js b/src/platforms/ingest.js index 812649bc..65f93f12 100644 --- a/src/platforms/ingest.js +++ b/src/platforms/ingest.js @@ -3,7 +3,7 @@ // policy/stores as Slack. Interactive approval escalation remains deliberately unavailable here. import { upsertChannelEntry, getChannelMeta, saveChannelMeta, defaultChannelMeta, getUser, setUser, isAdmin, isApproved } from "../config/store.js"; import { getDefaultChannelAccess, applyChannelTemplate, getDefaultNudges } from "../config/settings.js"; -import { ensureChannelFolder } from "../gateway/folders.js"; +import { effectiveWorkDir, ensureChannelFolder } from "../gateway/folders.js"; import { isAuthorized } from "../gateway/modes.js"; import { runMessage } from "../gateway/run.js"; import { createUsageBank } from "../gateway/usage.js"; @@ -12,6 +12,9 @@ import { platformOr, platformSupports } from "./registry.js"; import { postFormatted } from "./connector.js"; import { sessionKeyForMessage, rememberReplySession } from "./reply-sessions.js"; import { saveInboundAttachments } from "./attachments.js"; +import path from "node:path"; +import { removeRegularFileWithin } from "../gateway/safe-fs.js"; +import { getThreadSudo } from "../gateway/thread-engine.js"; // Conversation kinds as the channel store spells them. The store's vocabulary is Slack's, and it is // a SECURITY value there (it decides whether a private channel's name may appear in App Home), so @@ -36,7 +39,6 @@ export async function ensureConversation(message) { if (!meta) { meta = applyChannelTemplate(defaultChannelMeta({ channelId: message.conversationId, ...info })); if (!info.isDM) meta.access = getDefaultChannelAccess(); - meta.nudges = getDefaultNudges(); if (info.isDM) meta.dmUserId = message.userId; await saveChannelMeta(entry.slug, meta); } @@ -47,8 +49,15 @@ export async function ensureConversation(message) { // First sighting of an author: record them so an admin has someone to approve in the Users page. // Unlike Slack there is no directory call to make — the display name rides the message. async function ensureUserKnown(message) { - if (await getUser(message.userId)) return; - await setUser(message.userId, { name: message.userName || message.userEmail || message.userId }); + const existing = await getUser(message.userId); + if (existing) { + if (typeof existing.nudges !== "boolean") await setUser(message.userId, { nudges: getDefaultNudges() }); + return; + } + await setUser(message.userId, { + name: message.userName || message.userEmail || message.userId, + nudges: getDefaultNudges(), + }); } export function createIngest({ connector, log = console, run = runMessage, onCommand = null, voice = prepareVoiceAttachments } = {}) { @@ -86,6 +95,15 @@ export function createIngest({ connector, log = console, run = runMessage, onCom } const sessionKey = sessionKeyForMessage(message); + if (await getThreadSudo(entry.slug, sessionKey) && !authorIsAdmin) { + await connector.post({ + conversationId: message.rawConversationId, + threadKey: message.threadKey, + text: "⛔ This is a sudo thread. Only organization admins can send messages or run work here.", + }).catch(() => {}); + await logEvent("sudo_thread_message_rejected", { channel: message.conversationId, author: message.userId, slug: entry.slug, threadKey: sessionKey, platform: adapter.id }); + return { skipped: "sudo-admin-only" }; + } const rememberReply = (sent) => { if (message.kind === "group" && !message.threadKey && sent?.messageId) { rememberReplySession(message.conversationId, sent.messageId, sessionKey); @@ -121,7 +139,22 @@ export function createIngest({ connector, log = console, run = runMessage, onCom skipped = saved.skipped; signal.throwIfAborted(); if (hasVoiceAttachments(message)) progress.phase('Transcribing voice locally'); - prepared = await voice(message, saved.paths, { signal }); + prepared = await voice(message, saved.paths, { + signal, + removeProcessed: (file) => removeRegularFileWithin( + path.join(effectiveWorkDir(entry.slug, meta), "uploads"), + file.path, + ), + }); + if (prepared.cleanupFailed?.length) { + await logEvent("attachment_cleanup_failed", { + channel: message.conversationId, + author: message.userId, + slug: entry.slug, + platform: adapter.id, + reasons: prepared.cleanupFailed.map((item) => `${item.name}: ${item.reason}`).join("; ").slice(0, 1000), + }); + } if (prepared.hasVoice && !prepared.hasPrompt && !prepared.paths.length) { await progress.stop(); await deliver(connector, message, placeholder, prepared.failureNotice || 'Could not transcribe this audio. Please send text or ask an administrator to check local Whisper.', rememberReply); diff --git a/src/platforms/voice.js b/src/platforms/voice.js index 38de13b4..bd6c092d 100644 --- a/src/platforms/voice.js +++ b/src/platforms/voice.js @@ -9,7 +9,7 @@ export function hasVoiceAttachments(message) { } export async function prepareVoiceAttachments(message, paths, { - signal, enabled = getWhisperEnabled(), transcribe = transcribeAudioFiles, + signal, enabled = getWhisperEnabled(), transcribe = transcribeAudioFiles, removeProcessed = null, } = {}) { signal?.throwIfAborted(); const pending = new Map(paths.map((file) => [path.basename(file), file])); @@ -30,11 +30,13 @@ export async function prepareVoiceAttachments(message, paths, { else audio.push({ name, path: saved }); } let transcripts = []; + let cleanupFailed = []; if (audio.length) { try { - const result = await transcribe(audio, { signal }); + const result = await transcribe(audio, { signal, removeProcessed }); transcripts = (result.transcripts || []).filter((item) => String(item.text || '').trim()); failed.push(...(result.failed || [])); + cleanupFailed = result.cleanupFailed || []; for (const file of audio) if (!transcripts.some((item) => item.name === file.name) && !failed.some((item) => item.name === file.name)) failed.push({ name: file.name, reason: 'Local Whisper detected no speech.' }); } catch (error) { signal?.throwIfAborted(); @@ -49,5 +51,6 @@ export async function prepareVoiceAttachments(message, paths, { hasPrompt: Boolean(String(message.text || '').trim() || transcripts.length), failed, failureNotice: failed.length ? composeVoicePrompt({ failed }) : '', + cleanupFailed, }; } diff --git a/src/runtimes/contract.js b/src/runtimes/contract.js index 2b2db1db..a60260c2 100644 --- a/src/runtimes/contract.js +++ b/src/runtimes/contract.js @@ -16,14 +16,14 @@ // capability key does not load, and readers must never assume a capability that is not declared. import { randomBytes } from "node:crypto"; -export const RUNTIME_BACKEND_IDS = Object.freeze(["container"]); +export const RUNTIME_BACKEND_IDS = Object.freeze(["host", "container"]); export const DEFAULT_RUNTIME_BACKEND = "container"; // Capability keys every backend MUST declare. The default is the least capable value. export const RUNTIME_CAPABILITY_SPEC = Object.freeze({ // The engine runs behind an OS boundary the daemon owns, with its own sandbox switched off - // inside it (plan §6). The container backend is the only registered backend; the daemon-internal - // local runtime (update smoke, direct probes) declares false and never runs a channel turn. + // inside it. Container turns declare true; the explicit admin-only sudo host backend and the + // daemon-internal local runtime declare false. isolated: { default: false }, // signal() reaches the run's whole process tree, not just the direct child. processGroups: { default: false }, diff --git a/src/runtimes/host.js b/src/runtimes/host.js new file mode 100644 index 00000000..9e3fb865 --- /dev/null +++ b/src/runtimes/host.js @@ -0,0 +1,87 @@ +// Direct host runtime, reachable only through an admin-authenticated thread `/sudo` decision. +// The engine is a child of the daemon account: there is no container filesystem or process +// boundary, and the backend intentionally preserves the host cwd, HOME, PATH and process tree. +import { spawn } from "node:child_process"; +import path from "node:path"; +import { fileURLToPath } from "node:url"; +import { killTree } from "../util/proc.js"; +import { pidAlive } from "../engines/watchdog.js"; +import { attachRuntime } from "./contract.js"; +import { copyCarryEntries } from "./copy.js"; + +const SRC_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), ".."); +const HOST_HELPERS = Object.freeze({ + "gateway-mcp": () => ({ command: process.execPath, args: [path.join(SRC_ROOT, "mcp", "gateway-server.js")] }), + "secret-env-bridge": () => ({ command: process.execPath, args: [path.join(SRC_ROOT, "mcp", "secret-env-bridge.js")] }), + "composio-sdk-bridge": () => ({ command: process.execPath, args: [path.join(SRC_ROOT, "ee", "composio-sdk-bridge.js")] }), + "stop-subagents-hook": () => ({ command: process.execPath, args: [path.join(SRC_ROOT, "gateway", "hooks", "stop-subagents.mjs")] }), + "mcp-remote": () => ({ command: process.execPath, args: [path.join(SRC_ROOT, "mcp", "remote-secret-bridge.js")] }), +}); + +export const hostBackend = Object.freeze({ + id: "host", + capabilities: Object.freeze({ + isolated: false, + processGroups: true, + detachedSurvivesDaemon: true, + persistentHome: true, + }), + + prepareTarget(base) { + return { ...base, backend: "host", runtime: hostBackend, container: null, artifactDir: null }; + }, + + async ensureUp() { + return { created: false, started: false, warmupMs: 0 }; + }, + + spawn(target, spec) { + const child = spawn(spec.cmd, spec.args || [], { + cwd: spec.cwd || target.cwd, + env: spec.env, + stdio: spec.stdio || ["ignore", "pipe", "pipe"], + detached: spec.detached !== false, + }); + return attachRuntime(child, { backend: hostBackend, runId: spec.runId, target, kind: spec.kind }); + }, + + async probe(child) { + return pidAlive(child?.pid); + }, + + async signal(child, signal = "SIGTERM") { + return killTree(child, signal); + }, + + acquireLease() { + return { id: "", release() {} }; + }, + + async destroy() {}, + + fingerprint() { + return "host"; + }, + + async describe() { + return { backend: "host", state: "direct host", reason: "sudo thread" }; + }, + + resumeCommand(target, { baseCommand }) { + return baseCommand; + }, + + helperCommand(target, name) { + const make = HOST_HELPERS[name]; + if (!make) throw new TypeError(`unknown runtime helper "${name}"`); + return make(); + }, + + async copyIn(target, entries = []) { + return { copied: copyCarryEntries(entries) }; + }, + + async copyOut(target, entries = []) { + return { copied: copyCarryEntries(entries) }; + }, +}); diff --git a/src/runtimes/local.js b/src/runtimes/local.js index 29d1f85a..416d2949 100644 --- a/src/runtimes/local.js +++ b/src/runtimes/local.js @@ -1,9 +1,6 @@ -// The daemon's OWN process spawner. NOT a channel runtime backend: since 2026-09-03 every channel -// turn runs in the container backend (src/runtimes/container/), and this module exists only for the -// few processes the daemon itself runs on its own host — the transactional updater's Claude smoke -// probe and the direct-runner tests. It is deliberately not registered in ./registry.js, so no -// channel can ever resolve to it, and it declares `isolated: false` so a runner that receives it -// knows there is no container boundary around the child. +// The daemon's internal process spawner. This is NOT the registered `/sudo` host backend: it exists +// for the transactional updater's Claude smoke probe and direct-runner tests, has no engine helper +// catalog, and cannot be selected by a channel turn. Direct host turns use ./host.js instead. import { spawn } from "node:child_process"; import { killTree } from "../util/proc.js"; import { pidAlive } from "../engines/watchdog.js"; @@ -62,7 +59,7 @@ export const localRuntime = Object.freeze({ }, helperCommand(target, name) { - throw new TypeError(`runtime helper "${name}" is only available inside a channel container`); + throw new TypeError(`runtime helper "${name}" is unavailable in the daemon-internal local runtime`); }, // Both carry directions are a copy on the daemon's own filesystem here; they exist so a caller diff --git a/src/runtimes/registry.js b/src/runtimes/registry.js index 414b79fe..7b5ac7ed 100644 --- a/src/runtimes/registry.js +++ b/src/runtimes/registry.js @@ -1,12 +1,12 @@ // Runtime backend registry — mirrors src/engines/registry.js and src/platforms/registry.js. Every -// backend is validated against the contract at load time (fail closed). Since 2026-09-03 the -// container backend is the ONLY channel runtime: the host OS-sandbox backend is gone, and the -// daemon's own process spawner (./local.js) is deliberately not registered here. +// backend is validated against the contract at load time (fail closed). Container is the default; +// host is reachable only from the admin-authenticated per-thread `/sudo` decision in run.js. import { DEFAULT_RUNTIME_BACKEND, RUNTIME_BACKEND_IDS, validateRuntimeBackend } from "./contract.js"; +import { hostBackend } from "./host.js"; import { containerBackend } from "./container/index.js"; const BACKENDS = new Map(); -for (const backend of [containerBackend]) { +for (const backend of [hostBackend, containerBackend]) { validateRuntimeBackend(backend); BACKENDS.set(backend.id, backend); } @@ -23,8 +23,8 @@ export function runtimeBackend(id) { return backend; } -// Stored records written before v0.8 name no backend at all, and rows written while the host -// backend still existed name "host"; both resolve to the one backend there is. +// Stored records written before v0.8 name no backend at all; the default remains container even +// though old session rows may name host for carry-over. export function runtimeBackendOr(id, fallback = DEFAULT_RUNTIME_BACKEND) { return BACKENDS.get(id) || BACKENDS.get(fallback); } diff --git a/src/runtimes/resolve.js b/src/runtimes/resolve.js index 42427b94..4e9641c3 100644 --- a/src/runtimes/resolve.js +++ b/src/runtimes/resolve.js @@ -1,9 +1,7 @@ // resolveRuntime(): the ONE place that builds the RuntimeTarget every backend call receives. -// -// Since 2026-09-03 there is exactly one channel runtime — the container backend — so there is no -// precedence table any more: no gateway kill switch, no per-channel pin, and admin-mode channels -// run in containers like every other channel (their work folder is bind-mounted read-write, which -// is the trust the admin mode carries; the container is still the boundary around everything else). +// Container is the universal default. The only channel-turn exception is `meta.sudoMode`, a +// transient fact run.js adds after it verifies BOTH the sticky thread flag and the current author's +// admin status. It is never a stored channel setting or API override. // Clean mode keeps the same backend: the bare clean workspace is mounted next to the workdir. // Background jobs, memory-review runs and scheduled runs resolve through here at THEIR OWN spawn // time — they outlive the turn that created them. @@ -11,12 +9,15 @@ import { effectiveWorkDir } from "../gateway/folders.js"; import { channelArtifactDir, cleanWorkspaceFolder } from "../config/paths.js"; import { getContainerRuntime } from "../config/settings.js"; import { platformOr } from "../platforms/registry.js"; -import { DEFAULT_RUNTIME_BACKEND, runtimeBackend } from "./registry.js"; +import { DEFAULT_RUNTIME_BACKEND, isRuntimeBackendId, runtimeBackend } from "./registry.js"; +import { hasSudoRuntimeAuthority } from "./sudo-authority.js"; -// Kept as a function so the admin API and the MCP tools can keep asking "where does this channel -// run?" through one door; the answer is always the container backend now. -export function decideRuntimeBackend() { - return { backend: DEFAULT_RUNTIME_BACKEND, reason: "only-runtime" }; +// Kept as a function so every caller asks "where does this turn run?" through one door. Stored +// channel metadata always resolves to the container; only run.js may add the transient sudo fact. +export function decideRuntimeBackend(meta = {}) { + return hasSudoRuntimeAuthority(meta) + ? { backend: "host", reason: "thread-sudo" } + : { backend: DEFAULT_RUNTIME_BACKEND, reason: "default" }; } /** @@ -25,9 +26,12 @@ export function decideRuntimeBackend() { * @param {object} [options] * @param {object} [options.settings] the container-runtime settings snapshot */ -export function resolveRuntime(slug, meta = {}, { settings = getContainerRuntime() } = {}) { +export function resolveRuntime(slug, meta = {}, { settings = getContainerRuntime(), backend: forced = "" } = {}) { const platform = platformOr(meta?.platform).id; - const { backend: id, reason } = decideRuntimeBackend(); + const decided = decideRuntimeBackend(meta); + const { backend: id, reason } = isRuntimeBackendId(forced) + ? { backend: forced, reason: "session-carry" } + : decided; const backend = runtimeBackend(id); const cwd = effectiveWorkDir(slug, meta); const workDir = meta?.cleanMode ? effectiveWorkDir(slug, { ...meta, cleanMode: false }) : cwd; @@ -41,7 +45,7 @@ export function resolveRuntime(slug, meta = {}, { settings = getContainerRuntime cwd, workDir, cleanWorkDir: cleanWorkspaceFolder(slug, platform), - artifactDir: channelArtifactDir(slug, platform), + artifactDir: id === "container" ? channelArtifactDir(slug, platform) : null, settings, container: null, }; diff --git a/src/runtimes/sudo-authority.js b/src/runtimes/sudo-authority.js new file mode 100644 index 00000000..522e7fbe --- /dev/null +++ b/src/runtimes/sudo-authority.js @@ -0,0 +1,12 @@ +// Non-serializable proof that this turn passed the live `/sudo` admin check. A stored channel row, +// JSON API override, plugin payload, or stale database field can spell `sudoMode: true`, but none +// can recreate this process-local Symbol. Only sudoModeMeta() mints it after authorization. +const SUDO_RUNTIME_AUTHORITY = Symbol("channelgate.sudo-runtime-authority"); + +export function authorizeSudoRuntime(meta = {}) { + return { ...meta, [SUDO_RUNTIME_AUTHORITY]: true }; +} + +export function hasSudoRuntimeAuthority(meta = {}) { + return meta?.[SUDO_RUNTIME_AUTHORITY] === true; +} diff --git a/src/server.js b/src/server.js index ae607484..57254a7e 100644 --- a/src/server.js +++ b/src/server.js @@ -45,6 +45,7 @@ import { mkdirSync, rmSync, writeFileSync } from "node:fs"; import path from "node:path"; import { installConsoleRedaction } from "./util/redact.js"; import { autoRepairCodexUsageHistory } from "./gateway/usage-repair.js"; +import { autoRefreshCodexPricing } from "./gateway/usage-pricing.js"; import { postNotice } from "./platforms/notify.js"; import { startLicenseVerification } from "./ee/license.js"; import { startUsageReporting } from "./ee/limits.js"; @@ -333,7 +334,7 @@ async function main() { // Git skill sources: periodic sync (settings: skillsSyncIntervalMinutes; 0 = off). startSkillsSync({ log: (m) => console.log(m) }); - // Opt-in no-response thread nudges (per-channel meta.nudges). + // Opt-in no-response thread nudges (per-user preference). startNudgeSweep({ slack }); // Hourly watch on the Claude login the gateway authenticates with: it hard-expires every few @@ -347,14 +348,18 @@ async function main() { // Scheduled two-way Google Drive ↔ channel-folder sync (dormant unless enabled + configured). startDriveSync(); - // One-shot Codex usage-history repair. After an update introduces accounting schema v10 (which + // One-shot Codex usage-history maintenance. After an update introduces accounting schema v10 (which // marks pre-existing codex rows legacy-unverified), reconstruct per-turn + subagent usage from // surviving rollouts — the same idempotent path as `npm run usage:repair -- --apply`, with a DB // backup first. Fire-and-forget: rollout scanning can take a while and must not delay Slack. // Records a batch even when nothing matches, so later boots see nothing pending and skip. autoRepairCodexUsageHistory() - .then((r) => { if (!r.applied) return; console.log(`[gateway] usage history auto-repair done (batch ${r.batchId})`); }) - .catch((e) => console.error("[gateway] usage auto-repair failed:", e?.message || e)); + .then((r) => { + if (r.applied) console.log(`[gateway] usage history auto-repair done (batch ${r.batchId})`); + return autoRefreshCodexPricing(); + }) + .then((r) => { if (r.applied) console.log(`[gateway] Codex pricing history refresh done (${r.basis})`); }) + .catch((e) => console.error("[gateway] usage maintenance failed:", e?.message || e)); } for (const sig of ["SIGINT", "SIGTERM"]) { diff --git a/src/slack/app.js b/src/slack/app.js index 5a2441e5..daa47e24 100644 --- a/src/slack/app.js +++ b/src/slack/app.js @@ -29,7 +29,7 @@ import { recordActivity, markDone, clearDone, applyDigestDoneReaction, removeDig import { getActiveBackgroundJobs } from "../gateway/background.js"; import { findAckByMessage, deleteAck } from "../config/acks.js"; -import { resolveSlackConfig, getContextWindow, getEngine, getDefaultModel, getEnabledEngines, getMentionReactions, getDefaultChannelAccess, applyChannelTemplate, getDefaultNudges, getFollowupDoneReactions, getFollowupRemindersEnabled, getComposioMode, getComposioSdkApiKey, getDefaultComposioToken, getDefaultToolboxToken, getOrgAccessGrants, canChangeChannelRuntime, getPublicUrl } from "../config/settings.js"; +import { resolveSlackConfig, getContextWindow, getEngine, getDefaultModel, getEnabledEngines, getMentionReactions, getDefaultChannelAccess, applyChannelTemplate, userNudgesEnabled, getFollowupDoneReactions, getFollowupRemindersEnabled, getComposioMode, getComposioSdkApiKey, getDefaultComposioToken, getDefaultToolboxToken, getOrgAccessGrants, canChangeChannelRuntime, getPublicUrl } from "../config/settings.js"; import { resolveAccessGrants } from "../gateway/access-grants.js"; import { assignTemplateToChannel, channelScopedSkills, channelSkillGrants, listTemplateSummaries, templateOfMeta } from "../gateway/skills/templates.js"; import { canSeeSkill, grantSkillsToChannel, revokeSkillsFromChannel } from "../gateway/skills/authoring.js"; @@ -94,10 +94,12 @@ import { setAssistantStatus, startProgress } from "./progress.js"; export { buildResumeCommand, resumeButton, filesButton, secretsButton, settingsButton, footerButtons, footerText, footerBlocks }; export { setAssistantStatus, startProgress }; import { processMessageEvent, runQueue, stopRunsInChannel, mentionsBot, stripMentions, isIgnorable, fetchThreadContext, deleteThreadMessages, ensureRegistered, ensureUserKnown, syncAllowedFromMembers, resolveConversation } from "./message-pipeline.js"; +import { registerQuestionActions } from "./questions.js"; import { appContextForMessage, appContextObservedAt, appContextUserId, createAppContextStore } from "./app-context.js"; import { registerBusyThreadChoiceActions } from "./busy-thread-choice.js"; import { registerEngineSwitchChoiceActions } from "./engine-switch-choice.js"; import { composioHomeButtons, registerComposioHomeActions } from "./home-composio.js"; +import { nudgeHomeBlocks, registerNudgeHomeActions } from "./home-nudges.js"; import { buildMenuCard, buildMenuResumeView, MENU_RESUME_ACTION_ID } from "./menu.js"; import { buildStatusReport } from "./status-controller.js"; // Re-exported for existing importers (tests) — moved to slack/message-pipeline.js. @@ -1706,6 +1708,7 @@ async function connectAndWire(app) { }); for (const a of APPROVAL_ACTIONS) app.action(a, handleApprovalClick); registerBusyThreadChoiceActions(app, processMessageEvent); + registerQuestionActions(app, processMessageEvent, { botUserId, teamId }); registerEngineSwitchChoiceActions(app, processMessageEvent); // Indexed ids (`cg_model_pick_2`) are the per-choice buttons; the bare id is the retired // static_select, still clickable in Slack history. One pattern covers both. @@ -2127,6 +2130,7 @@ async function connectAndWire(app) { const admin = await isAdmin(userId); const approved = await isApproved(userId); const role = admin ? "an *admin*" : approved ? "an *approved* user" : "*not yet approved* (an admin can approve you)"; + const homeUser = (await getUsers())[userId] || {}; // Connection status distinguishes personal Composio from the shared org fallback. Only // ✅/⚪/❌ is ever rendered — never a token value. A channel token may replace the org source @@ -2165,7 +2169,6 @@ async function connectAndWire(app) { // Your skills: the personal tier of the grant union (skills only your own runs carry) plus the // organization tier everyone gets. Channel grants are per conversation and not knowable here. - const homeUser = (await getUsers())[userId] || {}; const personalSkills = Array.isArray(homeUser.skills) ? homeUser.skills : []; const orgSkills = Array.isArray(getOrgAccessGrants().skills) ? getOrgAccessGrants().skills : []; let favLines = personalSkills.length @@ -2174,7 +2177,7 @@ async function connectAndWire(app) { if (orgSkills.length) favLines += `\n_Organization-wide: ${orgSkills.length} skill(s) every conversation gets._`; // In-thread commands + the active engine / how to switch models. - const commands = "`/menu` · `/help` · `/status` · `/clear` · `/context` · `/mode` · `/model` · `/compact` · `/stop` · `/update` _(admin)_"; + const commands = "`/menu` · `/help` · `/status` · `/clear` · `/context` · `/mode` · `/model` · `/compact` · `/stop` · `/sudo` _(admin, typed in-thread)_ · `/update` _(admin)_"; const engineInfo = `• Default engine: *${getEngine()}* · context window ~${Math.round(getContextWindow() / 1000)}k tokens\n` + "• Switch runtime: `/model` — channel or one thread → harness (Claude/Codex) → model → effort _(channel access set in Settings)_"; @@ -2203,6 +2206,7 @@ async function connectAndWire(app) { { type: "header", text: { type: "plain_text", text: "ChannelGate", emoji: true } }, { type: "section", text: { type: "mrkdwn", text: `Hi <@${userId}> — you're ${role} on this gateway.` } }, { type: "section", text: { type: "mrkdwn", text: "I'm Claude, running self-hosted in per-channel sandboxes. *DM me* (no mention needed) or *@mention me* in a channel. Use `/status` to see what a channel is working on, `/pending` for the threads I'm waiting on you for, or `/help` for all commands." } }, + ...nudgeHomeBlocks({ enabled: userNudgesEnabled(homeUser) }), { type: "divider" }, { type: "section", text: { type: "mrkdwn", text: `*Your connections* — the MCP tools you get when you run me\n${conns}` } }, // Personal Composio key, set from a modal — the value never becomes a Slack message. Absent @@ -2249,6 +2253,7 @@ async function connectAndWire(app) { }); registerComposioHomeActions(app, { publishHome: publishHomeTab }); + registerNudgeHomeActions(app, { publishHome: publishHomeTab }); // Removing a ✅ re-opens that thread in the reactor's follow-up digest (the inverse of marking // it done). Other removed reactions are acknowledged as no-ops. @@ -2343,7 +2348,6 @@ async function connectAndWire(app) { if (current) return {}; const fresh = applyChannelTemplate(defaultChannelMeta({ channelId: event.channel, ...info })); if (!fresh.isDM) fresh.access = getDefaultChannelAccess(); - fresh.nudges = getDefaultNudges(); // capture the org-default nudge at join return fresh; }); await ensureChannelFolder(entry.slug, meta); diff --git a/src/slack/deliver.js b/src/slack/deliver.js index 9ac4a570..79013525 100644 --- a/src/slack/deliver.js +++ b/src/slack/deliver.js @@ -11,10 +11,11 @@ import { formatOutboundFor } from "../platforms/registry.js"; import { postFormatted } from "../platforms/connector.js"; import { getDirectory } from "./directory.js"; import { mdToMrkdwn, resolveMentions } from "./format.js"; +import { answerImageBlocks, shareAnswerImageFiles } from "./images.js"; import { postChunkedReply } from "./util.js"; import { footerText, resumeButton } from "./footer.js"; -export async function deliverResult(client, { channel, threadKey, result, dir, footer = false, trustedPrefix = "" } = {}) { +export async function deliverResult(client, { channel, threadKey, result, dir, footer = false, trustedPrefix = "", uploadFile } = {}) { if (client?.platform && typeof client.post === "function") { const directory = dir !== undefined ? dir : await client.directory(channel).catch(() => null); const formatted = formatOutboundFor(client.platform, result?.content || "", { directory }); @@ -29,9 +30,19 @@ export async function deliverResult(client, { channel, threadKey, result, dir, f // The prefix is gateway-authored control markup. Add it only after hostile model content has // passed through the normal control-sequence defanging pipeline. const md = `${trustedPrefix}${resolveMentions(mdToMrkdwn(result?.content || ""), directory).trim()}`.trim(); + const answerBlocks = answerImageBlocks(result?.content || ""); if (footer) { - await postChunkedReply(client, channel, threadKey, md, footerText(result), resumeButton(result.cwd, result.sessionId, result.engine)); + await postChunkedReply( + client, + channel, + threadKey, + md, + footerText(result), + resumeButton(result.cwd, result.sessionId, result.engine), + { answerBlocks }, + ); } else { - await postChunkedReply(client, channel, threadKey, md); + await postChunkedReply(client, channel, threadKey, md, "", null, { answerBlocks }); } + await shareAnswerImageFiles({ markdown: result?.content || "", cwd: result?.cwd, channel, threadTs: threadKey, uploadFile }); } diff --git a/src/slack/help.js b/src/slack/help.js index dfc000da..de4e4a37 100644 --- a/src/slack/help.js +++ b/src/slack/help.js @@ -13,6 +13,7 @@ export const HELP_TEXT = "• *Gateway skills:* `gateway-usage` is installed automatically and teaches me chat tools, formatting, reminders, files, video understanding, and administration. `channel-memory` is automatic when channel memory is enabled—there is nothing to install.\n" + "• *Reminders and schedules:* ask naturally, for example `remind me in 2 hours to call the client` or `every Monday at 09:00 summarize new messages`. Reminders only post a nudge; scheduled tasks wake the agent to do work. Ask `list schedules` or `delete schedule ` to manage them.\n" + "• *Long-running work:* ask me to run it in the background. In an Auto/Full-access channel, the gateway keeps the job alive after the current turn and reports back in this thread when it finishes.\n" + + "• *Direct host work:* an organization admin can enable `/sudo` for one thread. Its admin messages run directly as the gateway daemon OS user, outside the channel container; non-admin messages to that thread are rejected. Use `/sudo off` to restore the normal container.\n" + "• *Useful checks:* `/status` shows active runs, background jobs, and schedules; `/pending` shows threads waiting on your decision; `/model` changes Claude/Codex, model, and effort; `/mode` shows the channel's tool-access mode.\n\n" + "*Commands* (this thread/channel)\n" + "• `/menu` — show only the Resume, Files, Secrets, and Settings buttons; use `@agent /menu` inside a channel thread\n" + @@ -26,6 +27,7 @@ export const HELP_TEXT = "• `/model` — choose channel/thread scope, Claude or Codex, model, and effort (access policy is set in Settings)\n" + "• `/compact` — compact this thread's history (Claude; Codex → use `/clear`)\n" + "• `/mode [read|bash|auto|admin]` — show or set this channel's mode (admin/manager permission required to change it)\n" + + "• `/sudo [on|off|status]` — typed in-thread, organization-admin-only direct host execution; use `@agent /sudo` in channels; `/sudo` means on\n" + "• `/next ` — queue after the current run without showing the steer-or-queue choice\n" + "• `/status` — show active work and schedules in this conversation (top-level Slack command)\n" + "• `/stop` — stop every active run in this conversation (top-level; for one thread use `@agent stop`, `stop` in a DM, or 🛑)\n" + diff --git a/src/slack/home-nudges.js b/src/slack/home-nudges.js new file mode 100644 index 00000000..bd8c8ef3 --- /dev/null +++ b/src/slack/home-nudges.js @@ -0,0 +1,43 @@ +// Self-service quiet-thread reminder preference from Slack App Home. This is a personal setting: +// clicking it can only update body.user.id, and the Home view is republished immediately so the +// visible state always matches what the nudge sweep will read. +import { setUser } from "../config/store.js"; +import { logEvent } from "../util/logger.js"; + +export const NUDGE_HOME_TOGGLE_ACTION = "cg_home_nudges_toggle"; + +export function nudgeHomeBlocks({ enabled = false } = {}) { + return [ + { + type: "section", + text: { + type: "mrkdwn", + text: `*Quiet-thread reminders* — ${enabled ? "on" : "off"}\nWhen I answer you and the thread stays quiet, I can mention you there once after the configured reminder window. This preference follows you across channels and DMs.`, + }, + accessory: { + type: "button", + action_id: NUDGE_HOME_TOGGLE_ACTION, + value: enabled ? "off" : "on", + text: { type: "plain_text", text: enabled ? "Turn off" : "Turn on", emoji: false }, + ...(enabled ? {} : { style: "primary" }), + }, + }, + ]; +} + +export function registerNudgeHomeActions(app, { publishHome } = {}) { + app.action(NUDGE_HOME_TOGGLE_ACTION, async ({ ack, body, action, client }) => { + await ack(); + const userId = body?.user?.id; + const value = action?.value; + if (!userId || !["on", "off"].includes(value)) return; + const enabled = value === "on"; + try { + await setUser(userId, { nudges: enabled }); + await logEvent("user_nudges_changed", { author: userId, enabled, via: "app_home" }); + if (typeof publishHome === "function") await publishHome(client, userId); + } catch (error) { + console.error("[slack] nudge preference error:", error.message); + } + }); +} diff --git a/src/slack/images.js b/src/slack/images.js new file mode 100644 index 00000000..b68692ee --- /dev/null +++ b/src/slack/images.js @@ -0,0 +1,146 @@ +// Slack's native Markdown renderer keeps a Markdown image reachable as a link, but it does not +// render the image inline. Public URLs can become Block Kit image blocks. Images created in the +// channel workspace are better: after the text answer lands, upload those through Slack's Files +// API so Slack renders the same native thumbnail/file card as a human attachment. Local paths are +// resolved through the file explorer's realpath confinement before a byte is read. +import { splitFences } from "../platforms/format/degrade.js"; +import path from "node:path"; +import { resolveVisiblePath } from "./file-explorer.js"; +import { MAX_FILE_UPLOAD_BYTES, uploadLocalFile } from "./upload.js"; + +export const MAX_ANSWER_IMAGE_BLOCKS = 5; +export const MAX_ANSWER_IMAGE_FILES = 5; +const MAX_IMAGE_URL_CHARS = 3000; +const MAX_IMAGE_TEXT_CHARS = 2000; +const IMAGE_EXTENSIONS = new Set([".avif", ".gif", ".heic", ".heif", ".jpeg", ".jpg", ".png", ".webp"]); + +// One balanced parenthesis level covers common image URLs such as `/chart_(final).png` without +// letting the match consume the closing Markdown delimiter. Optional Markdown titles may use the +// three CommonMark forms: "title", 'title', or (title). +const MARKDOWN_IMAGE_RE = /!\[([^\]\n]*)\]\(\s*(?:<([^>\n]+)>|((?:[^()\s]|\([^()\s]*\))+))(?:\s+(?:"([^"\n]*)"|'([^'\n]*)'|\(([^)\n]*)\)))?\s*\)/gi; + +function plainText(value) { + return String(value || "") + .replace(/\\([\\`*_[\]{}()#+.!~>-])/g, "$1") + .replace(/<[^>\n]*>/g, "") + .replace(/[`*_~]/g, "") + .replace(/\s+/g, " ") + .trim() + .slice(0, MAX_IMAGE_TEXT_CHARS); +} + +function publicImageUrl(value) { + const candidate = String(value || "").trim(); + if (!candidate || candidate.length > MAX_IMAGE_URL_CHARS) return ""; + try { + const parsed = new URL(candidate); + if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return ""; + return candidate; + } catch { + return ""; + } +} + +export function answerImageBlocks(markdown, limit = MAX_ANSWER_IMAGE_BLOCKS) { + const max = Math.max(0, Math.min(MAX_ANSWER_IMAGE_BLOCKS, Number(limit) || 0)); + if (!markdown || max === 0) return []; + const blocks = []; + const seen = new Set(); + for (const segment of splitFences(markdown)) { + if (segment.code) continue; + for (const match of segment.text.matchAll(MARKDOWN_IMAGE_RE)) { + const imageUrl = publicImageUrl(match[2] || match[3]); + if (!imageUrl || seen.has(imageUrl)) continue; + seen.add(imageUrl); + const alt = plainText(match[1]); + const title = plainText(match[4] || match[5] || match[6] || alt); + blocks.push({ + type: "image", + image_url: imageUrl, + alt_text: alt || title || "Image preview", + ...(title ? { title: { type: "plain_text", text: title, emoji: true } } : {}), + }); + if (blocks.length >= max) return blocks; + } + } + return blocks; +} + +function localDestination(value, cwd) { + let candidate = String(value || "").trim(); + if (!candidate || candidate.length > MAX_IMAGE_URL_CHARS || !cwd) return ""; + if (/^[a-z][a-z0-9+.-]*:/i.test(candidate) || candidate.startsWith("#")) return ""; + try { candidate = decodeURIComponent(candidate); } catch { return ""; } + const root = path.resolve(cwd); + if (path.isAbsolute(candidate)) { + const relative = path.relative(root, path.resolve(candidate)); + if (!relative || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) return ""; + candidate = relative; + } + candidate = candidate.replace(/^\.\//, "").split(path.sep).join("/"); + if (!IMAGE_EXTENSIONS.has(path.extname(candidate).toLowerCase())) return ""; + return candidate; +} + +// Resolve the model-authored local image references without trusting their spelling. Missing +// files, traversal, escaping symlinks, non-images and oversized files are simply not promoted; +// the authoritative text answer must still be deliverable. +export async function answerImageFiles(markdown, cwd, limit = MAX_ANSWER_IMAGE_FILES) { + const max = Math.max(0, Math.min(MAX_ANSWER_IMAGE_FILES, Number(limit) || 0)); + if (!markdown || !cwd || max === 0) return []; + const files = []; + const seen = new Set(); + for (const segment of splitFences(markdown)) { + if (segment.code) continue; + for (const match of segment.text.matchAll(MARKDOWN_IMAGE_RE)) { + const relative = localDestination(match[2] || match[3], cwd); + if (!relative) continue; + try { + const resolved = await resolveVisiblePath(cwd, relative, { kind: "file" }); + if (resolved.stat.size > MAX_FILE_UPLOAD_BYTES || seen.has(resolved.path)) continue; + seen.add(resolved.path); + const filename = path.basename(resolved.relative); + files.push({ + path: resolved.path, + relative: resolved.relative, + filename, + title: plainText(match[4] || match[5] || match[6] || match[1] || filename), + }); + if (files.length >= max) return files; + } catch { + // A broken or forbidden image reference remains ordinary answer text. + } + } + } + return files; +} + +function uploadFailureLabel(error) { + return String(error?.data?.error || error?.code || error?.message || "unknown error") + .replace(/[\r\n]/g, " ") + .slice(0, 160); +} + +// Best-effort by design: answer delivery has already succeeded when this runs. One unavailable +// image or a missing Slack files:write scope must not turn a completed agent run into an error. +export async function shareAnswerImageFiles({ markdown, cwd, channel, threadTs, uploadFile = uploadLocalFile, onError = null } = {}) { + const files = await answerImageFiles(markdown, cwd); + const shared = []; + for (const file of files) { + try { + const uploaded = await uploadFile({ + filePath: file.path, + rootPath: cwd, + filename: file.filename, + title: file.title || file.filename, + channelId: channel, + threadTs, + }); + shared.push({ ...file, ...uploaded }); + } catch (error) { + if (onError) onError(error, file); + else console.warn(`[slack] Could not attach answer image ${JSON.stringify(file.filename)}: ${uploadFailureLabel(error)}`); + } + } + return shared; +} diff --git a/src/slack/message-normalize.js b/src/slack/message-normalize.js index b3aec414..0532473f 100644 --- a/src/slack/message-normalize.js +++ b/src/slack/message-normalize.js @@ -3,7 +3,7 @@ export const SLACK_MENTION_RE = /<@([A-Z0-9]+)(?:\|[^>]+)?>/g; const STOP_WORDS = new Set(["stop", "cancel", "abort", "halt", "stop it", "please stop", "stop please", "nevermind", "never mind"]); const PENDING_WORDS = new Set(["pending", "my followups", "my follow-ups", "followups", "follow-ups"]); -const SLASH_COMMANDS = new Set(["help", "menu", "clear", "context", "model", "effort", "engine", "compact", "update", "mode", "pending", "followups", "resume", "delete", "files"]); +const SLASH_COMMANDS = new Set(["help", "menu", "clear", "context", "model", "effort", "engine", "compact", "update", "mode", "sudo", "pending", "followups", "resume", "delete", "files"]); function normalizedControlText(text, punctuation = /[!.…]+$/) { return (text || "").trim().toLowerCase().replace(punctuation, "").replace(/\s+/g, " "); diff --git a/src/slack/message-pipeline.js b/src/slack/message-pipeline.js index 5d1abd2c..10f6845a 100644 --- a/src/slack/message-pipeline.js +++ b/src/slack/message-pipeline.js @@ -15,15 +15,19 @@ import { postModelWizard } from "./model-wizard.js"; import { getSessionMap, clearSession, hasThreadSession, getSessionEngine, saveSession } from "../gateway/sessions.js"; import { planSessionAdoption } from "../gateway/session-adopt.js"; import { resolveRuntime } from "../runtimes/resolve.js"; -import { setThreadEngine, getThreadEngine, resolveThreadEngine, setThreadClean, getThreadClean, setThreadModel, getThreadModel, setThreadEffort, getThreadEffort } from "../gateway/thread-engine.js"; +import { setThreadEngine, getThreadEngine, resolveThreadEngine, setThreadClean, getThreadClean, setThreadSudo, getThreadSudo, setThreadModel, getThreadModel, setThreadEffort, getThreadEffort } from "../gateway/thread-engine.js"; import { abortPooled, pooledBusy, interruptPooled } from "../engines/session-pool.js"; import { logEvent } from "../util/logger.js"; +import { removeRegularFileWithin } from "../gateway/safe-fs.js"; // A typed `/mode` is a channel POLICY change like any admin-UI save — audited the same way. import { logChannelPolicyChange } from "../config/channel-audit.js"; import { createUsageBank } from "../gateway/usage.js"; import { contextWindowFor } from "../gateway/model-info.js"; -import { recordActiveRun, updateActiveRunRuntime, clearActiveRun, clearActiveRunHandles, clearPendingRunChoices, shouldClearActiveRun } from "../gateway/active-runs.js"; +import { recordActiveRun, acceptQuestionReply, updateActiveRunRuntime, clearActiveRun, clearActiveRunHandles, clearPendingRunChoices, shouldClearActiveRun } from "../gateway/active-runs.js"; +import { cancelPendingQuestions, listPendingQuestions } from "../gateway/questions.js"; +import { assertQuestionAccess } from "../gateway/question-access.js"; +import { refreshQuestionCard } from "./questions.js"; import { clearStoppedTurn, formatStoppedTurnContext, saveStoppedTurn, takeStoppedTurn } from "../gateway/stopped-turns.js"; import { isMemorySaveTool } from "../gateway/channel-memory.js"; import { maybeQueueMemoryReview } from "../gateway/memory-review.js"; @@ -37,6 +41,7 @@ import { buildPendingReportForUser } from "../gateway/followups.js"; import { resolveSlackConfig, getProgressView, getContextWindow, getTrustedBotApps, getDefaultChannelAccess, applyChannelTemplate, getDefaultNudges, getSlackAdminUserToken, canChangeChannelRuntime, getWhisperEnabled, getEngineFallbackMode } from "../config/settings.js"; import { mdToMrkdwn, resolveMentions } from "./format.js"; +import { answerImageBlocks, shareAnswerImageFiles } from "./images.js"; import { appendSlackTables, extractSlackTables, formatSlackTables } from "./block-content.js"; import { hydrateSlackMessage } from "./attachments.js"; import { QUEUE_FULL, neutralizeSentinels, postChunkedReply } from "./util.js"; @@ -80,6 +85,7 @@ export function abortRunsInChannel(channelId, slug, byUser, threadKey = null) { // A message waiting on the steer/queue card is accepted user intent too. Stop invalidates it // durably, so an old button cannot resurrect that message after the active turn was cancelled. const pendingChoices = clearPendingRunChoices({ channelId, threadKey }); + const pendingQuestions = cancelPendingQuestions({ channelId, threadKey }); const stoppedRuns = []; const stoppedTurns = []; @@ -116,7 +122,17 @@ export function abortRunsInChannel(channelId, slug, byUser, threadKey = null) { } } } - return { pendingChoices, stoppedRuns, stoppedTurns }; + return { pendingChoices, pendingQuestions, stoppedRuns, stoppedTurns }; +} + +// State is already terminal before any Slack call. A failed update leaves harmless old buttons: +// every interaction rechecks the durable record before applying a draft or continuing a run. +function retireQuestionCards(client, records) { + if (!client?.chat?.update) return; + for (const record of records) { + if (!record.messageTs) continue; + refreshQuestionCard(record, client).catch(() => {}); + } } // Abort in-flight runs in a channel/DM. When `threadKey` is given, only the run in that one thread @@ -124,21 +140,29 @@ export function abortRunsInChannel(channelId, slug, byUser, threadKey = null) { // whole channel is swept (the `/stop` slash command). Posts "🛑 Stopped." (with the resume link) in // each stopped run's thread. Returns how many were stopped. export async function stopRunsInChannel(client, channelId, slug, byUser, threadKey = null) { - const { pendingChoices, stoppedRuns, stoppedTurns } = abortRunsInChannel(channelId, slug, byUser, threadKey); + const { pendingChoices, pendingQuestions, stoppedRuns, stoppedTurns } = abortRunsInChannel(channelId, slug, byUser, threadKey); // Persist loop cancellation and outcome counts BEFORE any rate-limited Slack API can wait. const droppedLoops = stopLoops(channelId, threadKey); for (const turn of stoppedTurns) void logEvent("run_stopped", { channel: channelId, author: byUser, slug, ...turn }); - if (stoppedTurns.length || pendingChoices.length || droppedLoops.length) { + if (stoppedTurns.length || pendingChoices.length || pendingQuestions.length || droppedLoops.length) { void logEvent("run_stop_requested", { channel: channelId, author: byUser, slug, threadKey, runs: stoppedTurns.length, queued: stoppedTurns.filter((turn) => turn.state === "queued").length, - choices: pendingChoices.length, loops: droppedLoops.length }); + choices: pendingChoices.length, questions: pendingQuestions.length, loops: droppedLoops.length }); } const deliveries = []; - const stopped = pendingChoices.length + stoppedRuns.length; + const stopped = pendingChoices.length + pendingQuestions.length + stoppedRuns.length; + retireQuestionCards(client, pendingQuestions); // All work is now terminal. User-facing cleanup may safely wait on Slack, grouped per thread so // a burst of pending cards produces one notice instead of a rate-limit-amplifying message storm. const pendingByThread = new Map(); + for (const questionThread of new Set(pendingQuestions.map((record) => record.threadKey))) { + deliveries.push(client.chat.postMessage({ + channel: channelId, + thread_ts: questionThread, + text: "🛑 Cancelled pending questions. Their old buttons can no longer continue this conversation.", + }).catch(() => {})); + } for (const pending of pendingChoices) { const kind = pending.kind || BUSY_THREAD_CHOICE_KIND; const key = `${pending.threadKey}\n${kind}`; @@ -534,7 +558,6 @@ export async function ensureRegistered(client, event) { if (!meta) { meta = applyChannelTemplate(defaultChannelMeta({ channelId: event.channel, ...info })); if (!info.isDM) meta.access = getDefaultChannelAccess(); // capture the org default at join - meta.nudges = getDefaultNudges(); // capture the org-default no-response nudge (channels + DMs) if (info.isDM) meta.dmUserId = event.user; // remember the peer for name resolution await saveChannelMeta(entry.slug, meta); } else if (info.isDM && !meta.dmUserId && event.user) { @@ -549,7 +572,12 @@ export async function ensureRegistered(client, event) { export // Record a Slack author in users.json the first time we see them, resolving a display name so // the admin UI has a populated list to grant access / set Composio tokens against. async function ensureUserKnown(client, userId) { - if (await getUser(userId)) return; + const existing = await getUser(userId); + if (existing) { + // One-time lazy migration for rows created before reminders became a user preference. + if (typeof existing.nudges !== "boolean") await setUser(userId, { nudges: getDefaultNudges() }); + return; + } let name = userId; try { const info = await client.users.info({ user: userId }); @@ -557,7 +585,7 @@ async function ensureUserKnown(client, userId) { } catch { /* missing users:read scope — fall back to the id */ } - await setUser(userId, { name }); + await setUser(userId, { name, nudges: getDefaultNudges() }); } // Core message processing, shared by the `message` event and the 🤖 reaction (which treats a @@ -567,7 +595,7 @@ async function ensureUserKnown(client, userId) { // harness-switch card (src/slack/engine-switch-choice.js) re-entering with the original event — // run it on `engineChoice`, pin the thread there when `engineChoiceSwitch`, and hand the pending // row over exactly like a busy-thread choice. -export async function processMessageEvent(event, client, { botUserId = "", teamId = "", bypassMention = false, dedupeTrigger = false, activeViewContext = null, busyChoice = "", busyTargetRunId = "", busyChoiceId = "", onBusyChoiceAccepted = null, engineChoice = "", engineChoiceSwitch = false, engineChoiceId = "", onEngineChoiceAccepted = null } = {}) { +export async function processMessageEvent(event, client, { botUserId = "", teamId = "", bypassMention = false, dedupeTrigger = false, activeViewContext = null, busyChoice = "", busyTargetRunId = "", busyChoiceId = "", onBusyChoiceAccepted = null, engineChoice = "", engineChoiceSwitch = false, engineChoiceId = "", onEngineChoiceAccepted = null, questionSubmissionId = "", onQuestionSubmissionAccepted = null } = {}) { try { if (isIgnorable(event, botUserId, getTrustedBotApps())) return; // A message without a human author (e.g. a trusted-bot post carrying no `user`) can't be @@ -602,12 +630,28 @@ export async function processMessageEvent(event, client, { botUserId = "", teamI }); return; } + const threadKey = event.thread_ts ?? event.ts; + // Sudo is a THREAD trust boundary, stronger than the channel's ordinary admission policy. + // Reject before hydration, attachment reads, queueing, or any process spawn. The stored flag + // is never authority by itself: the sender's current organization-admin status is rechecked. + if (await getThreadSudo(entry.slug, threadKey) && !authorIsAdmin) { + await logEvent("sudo_thread_message_rejected", { channel: event.channel, author: event.user, slug: entry.slug, threadKey }); + await client.chat.postMessage({ + channel: event.channel, + thread_ts: threadKey, + text: "⛔ This is a sudo thread. Only organization admins can send messages or run work here.", + }); + return; + } const mayUseSettings = true; // The message authorization gate above has passed. // Only an authorized trigger may spend Slack read/file API calls. Hydrate it from the exact // canonical message so omitted/incomplete attachment fields cannot produce a text-only agent // prompt, while keeping the original event as a non-fatal fallback. - event = await hydrateSlackMessage(event, client, { + // A question continuation is an internal event containing the answers authenticated by its + // Slack interaction handler. It is not a message Slack can hydrate: using the card timestamp + // would replace the answers with the card's text and could carry unrelated attachments. + if (!questionSubmissionId) event = await hydrateSlackMessage(event, client, { includeThreadFiles: async (message) => { const text = stripMentions(message.text, botUserId); const command = parseSlashCommand(text); @@ -634,8 +678,10 @@ export async function processMessageEvent(event, client, { botUserId = "", teamI return; } - const threadKey = event.thread_ts ?? event.ts; const runKey = `${entry.slug}::${threadKey}`; + // Synthetic question event IDs are stable idempotency keys, not numeric Slack timestamps. + // Keep them for run identity while using an actual cutoff for history/failover context. + const contextCurrentTs = questionSubmissionId ? Date.now() / 1000 : event.ts; // "stop"/"cancel" interrupts the in-flight run for this thread. Handled here (not via the // run path) so it isn't queued behind the very run it's trying to cancel. @@ -683,6 +729,7 @@ export async function processMessageEvent(event, client, { botUserId = "", teamI // (clearSession also bumps the thread's clear-generation, so even a run that unwinds // AFTER this line cannot re-save over it). const halted = abortRunsInChannel(event.channel, entry.slug, event.user, threadKey); + retireQuestionCards(client, halted.pendingQuestions); await clearSession(entry.slug, threadKey); clearStoppedTurn(entry.slug, threadKey); abortPooled(`${entry.slug}::${threadKey}`); // evict an IDLE warm session too (no active run) @@ -692,8 +739,9 @@ export async function processMessageEvent(event, client, { botUserId = "", teamI // still remembered the task. Clearing the thread ends its loop. const loopsDropped = stopThreadLoops(event.channel, threadKey); const stoppedNote = halted.stoppedRuns.length || halted.pendingChoices.length ? "stopped the in-flight run and " : ""; + const questionNote = halted.pendingQuestions.length ? " Pending questions were cancelled too." : ""; const loopNote = loopsDropped ? " The thread's loop was stopped too." : ""; - await reply(`🧹 Cleared — ${stoppedNote}this thread will start a fresh session on your next message.${loopNote}`); + await reply(`🧹 Cleared — ${stoppedNote}this thread will start a fresh session on your next message.${loopNote}${questionNote}`); } else if (sc.cmd === "delete") { // Wipe THIS thread's messages (deleteThreadMessages is hard-scoped to the triggering // event's channel + thread — it can never touch any other conversation). Org-admin only — @@ -840,6 +888,38 @@ export async function processMessageEvent(event, client, { botUserId = "", teamI await reply( `🚀 Update transaction \`${started.transaction.id}\` started. I’ll run preflight, snapshot, dependency audit/tests, restart, Slack + isolated Claude health checks, and automatic rollback if needed. I’ll report the final result here. Details: \`~/.channelgate/logs/update.log\`.`, ); + } else if (sc.cmd === "sudo") { + if (!authorIsAdmin) { + await reply("Only organization admins can use `/sudo`."); + return; + } + const arg = (sc.arg || "on").trim().toLowerCase(); + if (!["on", "off", "status"].includes(arg)) { + await reply("Use `/sudo`, `/sudo on`, `/sudo off`, or `/sudo status`."); + return; + } + const current = await getThreadSudo(entry.slug, threadKey); + if (arg === "status") { + await reply(current + ? "⚠️ Sudo is ON for this thread. Admin messages run directly on the gateway host as the daemon OS user; non-admin messages are rejected." + : "Sudo is OFF for this thread. Runs use the channel's normal container runtime."); + return; + } + const next = arg === "on"; + if (current === next) { + await reply(next ? "⚠️ Sudo is already ON for this thread." : "Sudo is already OFF for this thread."); + return; + } + if (runQueue.count(runKey) > 0) { + await reply("This thread has running or queued work — stop it or wait for it to finish before changing `/sudo`."); + return; + } + await setThreadSudo(entry.slug, threadKey, next); + abortPooled(runKey); // retire an idle process created on the other side of the boundary + await logEvent("sudo_thread_changed", { channel: event.channel, author: event.user, slug: entry.slug, threadKey, enabled: next }); + await reply(next + ? "⚠️ *Sudo enabled for this thread.* From the next message, the agent runs directly on the gateway host as the daemon OS user, with the host filesystem, processes, HOME, commands, and network available. There is no channel-container boundary. Only organization admins may message this thread; everyone else is rejected. Use `/sudo off` to return to the container." + : "✅ Sudo disabled for this thread. New turns return to the channel's normal container runtime. Only organization admins may have used the thread while sudo was enabled."); } else if (sc.cmd === "mode") { const rawMode = (sc.arg || "").trim().toLowerCase(); const arg = rawMode === "bash" ? "worker" : rawMode; @@ -906,7 +986,7 @@ export async function processMessageEvent(event, client, { botUserId = "", teamI // re-enters this pipeline with busyChoice="steer" or "queue". No persistent thread setting // changes and no attachment download happens until that choice is made. // A harness-choice re-entry never asks again: if the thread got busy meanwhile, it queues. - const busyTarget = !busyChoice && !forceQueue && !engineChoiceId ? runQueue.activeHandle(runKey) : null; + const busyTarget = !busyChoice && !forceQueue && !engineChoiceId && !questionSubmissionId ? runQueue.activeHandle(runKey) : null; if (busyTarget) { // Never ask about a message the gateway is ALREADY handling. Slack redelivers envelopes it // never saw acked — after a restart both in-memory dedupes (event id, message trigger) are @@ -969,13 +1049,13 @@ export async function processMessageEvent(event, client, { botUserId = "", teamI // It sticks until changed; the rest of the message is the task. if (files.length === 0) { const trimmed = prompt.trim(); - const anchored = /^(claude|codex|opencode)\b[\s:,.;–—-]*([\s\S]*)$/i.exec(trimmed); + const anchored = new RegExp(`^(${ENGINE_IDS.join("|")})\\b[\\s:,.;–—-]*([\\s\\S]*)$`, "i").exec(trimmed); // Only a switch INTENT near the START counts (index ≤ 12, allowing a short lead like // "ok "/"please "), so a long message that merely mentions switching ("explain how to // switch to codex in a script") doesn't flip the thread or get mangled. let phrase = null; if (!anchored) { - const m = /\b(?:switch(?:ing)?\s+to|use|using|try(?:\s+again)?(?:\s+with)?|retry(?:\s+with)?|run\s+(?:it|this|that)?\s*(?:with|on|in))\s+(claude|codex|opencode)\b/i.exec(trimmed); + const m = new RegExp(`\\b(?:switch(?:ing)?\\s+to|use|using|try(?:\\s+again)?(?:\\s+with)?|retry(?:\\s+with)?|run\\s+(?:it|this|that)?\\s*(?:with|on|in))\\s+(${ENGINE_IDS.join("|")})\\b`, "i").exec(trimmed); if (m && m.index <= 12) phrase = m; } if (anchored || phrase) { @@ -1114,6 +1194,7 @@ export async function processMessageEvent(event, client, { botUserId = "", teamI if (!local?.path) throw new Error(local?.skipped || "Slack audio download failed."); return local; }, + removeProcessed: (file) => removeRegularFileWithin(path.join(dest.root, "uploads"), file.path), slackOptions: { botToken }, }); } finally { @@ -1136,6 +1217,14 @@ export async function processMessageEvent(event, client, { botUserId = "", teamI reasons: voice.failed.map((item) => `${item.name}: ${item.reason}`).join("; ").slice(0, 1000), }); } + if (voice.cleanupFailed.length) { + await logEvent("attachment_cleanup_failed", { + channel: event.channel, + author: event.user, + slug: entry.slug, + reasons: voice.cleanupFailed.map((item) => `${item.name}: ${item.reason}`).join("; ").slice(0, 1000), + }); + } if (!voice.transcripts.length && !prompt.trim()) { await client.chat.postMessage({ channel: event.channel, @@ -1222,11 +1311,15 @@ export async function processMessageEvent(event, client, { botUserId = "", teamI authorId: event.user, threadKey, isDM: Boolean(meta.isDM), + ...(questionSubmissionId ? { questionSubmissionId } : {}), text: provenance + promptForClaude, attachments: attachmentPaths, startedAt: Date.now(), }; - if (busyChoiceId) { + if (questionSubmissionId) { + const accepted = onQuestionSubmissionAccepted?.({ runId, rec: acceptedRun }); + if (!accepted) throw new Error("These answers have already been submitted or the questions were cancelled."); + } else if (busyChoiceId) { const accepted = onBusyChoiceAccepted?.({ runId, rec: acceptedRun }); if (!accepted) throw new Error("This busy-thread choice is no longer available. Send the message again if it still needs attention."); } else if (engineChoiceId) { @@ -1328,7 +1421,20 @@ export async function processMessageEvent(event, client, { botUserId = "", teamI // Replay the earlier thread when the bot is first pulled into an existing thread OR when the // engine was just switched (the new engine starts a fresh, blind session — give it context). if (!threadClean && event.thread_ts && (!(await hasThreadSession(entry.slug, threadKey)) || engineSwitched)) { - threadContext = await fetchThreadContext(client, { channelId: event.channel, threadTs: threadKey, currentTs: event.ts, botUserId }); + threadContext = await fetchThreadContext(client, { channelId: event.channel, threadTs: threadKey, currentTs: contextCurrentTs, botUserId }); + } + // The requester may lose access while this accepted answer waits behind another turn. + // Recheck after all queue/preflight waits, then observe stop before recording or spawning. + if (questionSubmissionId) { + try { + await assertQuestionAccess(acceptedRun, client); + } catch { + markTerminal(); + await status.stop(); + await client.chat.postMessage({ channel: event.channel, thread_ts: threadKey, + text: "The submitted answers were not run because the requester no longer has access or access could not be verified." }).catch(() => {}); + return; + } } // Stop/force may arrive while the promoted owner awaits directory or thread-context // preflight. Recheck at the last asynchronous boundary before enriching the durable row; @@ -1340,20 +1446,34 @@ export async function processMessageEvent(event, client, { botUserId = "", teamI return; } const stoppedContext = formatStoppedTurnContext(takeStoppedTurn(entry.slug, threadKey)); + const pendingQuestionReplies = questionSubmissionId ? [] : listPendingQuestions({ + channelId: event.channel, threadKey, authorId: event.user, + }); + if (pendingQuestionReplies.length) { + const snapshot = pendingQuestionReplies.map(({ title, questions, answers }) => ({ title, questions, draftAnswers: answers })); + promptForClaude = "The user replied in the thread while these questions were pending. The following JSON is question context; draft answers are not submitted answers. Interpret the user's message below and do not assume unanswered questions are resolved.\n" + + JSON.stringify(snapshot) + "\n\nUser's reply:\n" + promptForClaude; + } const textForRun = provenance + stoppedContext + threadContext + promptForClaude; // Durable in-flight marker: if the daemon restarts mid-run, boot recovery re-runs this exact // turn (same threadKey → resumes the session). Deleted in the finally on normal completion. - recordActiveRun(runId, { + const promotedRun = { channelId: event.channel, slug: entry.slug, workspaceId: teamId, authorId: event.user, threadKey, isDM: Boolean(meta.isDM), + ...(questionSubmissionId ? { questionSubmissionId } : {}), text: textForRun, attachments: attachmentPaths, startedAt: Date.now(), - }); + }; + if (pendingQuestionReplies.length) { + retireQuestionCards(client, acceptQuestionReply(pendingQuestionReplies, runId, promotedRun)); + } else { + recordActiveRun(runId, promotedRun); + } let memorySavesInTurn = 0; const runArgs = { channelId: event.channel, @@ -1379,7 +1499,7 @@ export async function processMessageEvent(event, client, { botUserId = "", teamI status.onRuntimeResolved?.(runtime); }, getFallbackContext: fallbackContextFetcher({ threadContext, threadClean }, () => - fetchThreadContext(client, { channelId: event.channel, threadTs: threadKey, currentTs: event.ts, botUserId })), + fetchThreadContext(client, { channelId: event.channel, threadTs: threadKey, currentTs: contextCurrentTs, botUserId })), }; // ONE bounded auto-resume: a recoverable process death (see runDeathRecovery) doesn't // surface an error the user would answer with "continue" anyway — send that turn @@ -1446,12 +1566,26 @@ export async function processMessageEvent(event, client, { botUserId = "", teamI // footer; a long answer is split into multiple threaded messages instead of truncated. const md = resolveMentions(mdToMrkdwn(result.content || ""), dir).trim() || "_(no output)_"; if (await stopSuppressedDelivery()) return; - await postChunkedReply(client, event.channel, threadKey, md, footerText(result), footerButtons(result, { + await postChunkedReply( + client, + event.channel, + threadKey, + md, + footerText(result), + footerButtons(result, { + channel: event.channel, + threadTs: threadKey, + authorId: event.user, + mayUseSettings, + }), + { answerBlocks: answerImageBlocks(result.content || "") }, + ); + await shareAnswerImageFiles({ + markdown: result.content || "", + cwd: result.cwd, channel: event.channel, threadTs: threadKey, - authorId: event.user, - mayUseSettings, - })); + }); } // User-visible delivery is the durable terminal boundary. If force-stop begins while usage // bookkeeping finishes, boot must not replay an answer Slack already received. @@ -1468,8 +1602,8 @@ export async function processMessageEvent(event, client, { botUserId = "", teamI costUSD: result.costUSD, durationMs: result.durationMs, }); - // The bot just answered → track this thread for an opt-in no-response nudge. - noteBotReply(event.channel, entry.slug, threadKey); + // The bot just answered → track this thread against the requester's personal nudge setting. + noteBotReply(event.channel, entry.slug, threadKey, event.user); // Background memory review (gateway/memory-review.js): after the answer is delivered, decide // whether this thread deserves a reviewer pass that saves what the model itself did not. // Fire-and-forget — it must never delay or fail the turn; the module rate-limits itself. diff --git a/src/slack/progress.js b/src/slack/progress.js index b674ad88..da13050d 100644 --- a/src/slack/progress.js +++ b/src/slack/progress.js @@ -5,6 +5,7 @@ import { mdToMrkdwn, chunkMrkdwn, resolveMentions, createMentionStream } from "./format.js"; import { createTtlSet, isSlackInvalidBlocksError, postChunkedReply, MAX_SLACK_CHARS } from "./util.js"; import { footerText, footerButtons, footerBlocks } from "./footer.js"; +import { answerImageBlocks, shareAnswerImageFiles } from "./images.js"; import { modelLabel } from "../gateway/model-info.js"; import { engineLabel } from "../engines/registry.js"; import { describeSilence } from "../engines/watchdog.js"; @@ -622,7 +623,7 @@ function createTaskTimeline(push) { // All append/stop calls are serialized through a promise chain (the streamer's buffer is not // concurrency-safe). Any API failure flips `failed`, and finalize() falls back to a plain // postMessage so an answer is never lost if streaming is unavailable (missing scope / not enabled). -function startStreamingProgress(client, { channel, threadTs, isDM, authorId, teamId, dir, mayUseSettings = false, stopGraceMs = 1_000 }) { +function startStreamingProgress(client, { channel, threadTs, isDM, authorId, teamId, dir, mayUseSettings = false, stopGraceMs = 1_000, uploadFile }) { // Resolve "@Name" → "<@id>" as the answer streams in; the holdback buffer keeps a mention whole // even when it straddles two delta slices (flushed in finalize). const mentionStream = createMentionStream(dir); @@ -1139,6 +1140,13 @@ function startStreamingProgress(client, { channel, threadTs, isDM, authorId, tea stopHeartbeat(); await clearShimmer(); const fullRaw = result?.content || ""; + const imageBlocks = answerImageBlocks(fullRaw); + let imageFilesShared = false; + const shareImageFiles = async () => { + if (imageFilesShared) return; + imageFilesShared = true; + await shareAnswerImageFiles({ markdown: fullRaw, cwd: result?.cwd, channel, threadTs, uploadFile }); + }; // What is still OWED to this message. A gateway note (a substituted model) was streamed as // the head of the answer and the orchestrator also carries it on `content` for surfaces with // no stream — so it is subtracted here, and the sentence lands exactly once. @@ -1200,11 +1208,13 @@ function startStreamingProgress(client, { channel, threadTs, isDM, authorId, tea await stopTimeline(); await cleanupRetiredStreams(); if (hasOverflow) await postChunkedReply(client, channel, threadTs, resolveMentions(mdToMrkdwn(overflow), dir).trim() + tag); + await shareImageFiles(); return true; }; + const finalFooterBlocks = footerBlocks(result, { channel, threadTs, authorId, mayUseSettings }); const stopWithFooter = () => answerStreamer.stop({ ...terminalPayload, - blocks: footerBlocks(result, { channel, threadTs, authorId, mayUseSettings }), + blocks: [...imageBlocks, ...finalFooterBlocks], }); try { if (!answerStreamer) answerStreamer = client.chatStream(streamArgs); @@ -1226,13 +1236,20 @@ function startStreamingProgress(client, { channel, threadTs, isDM, authorId, tea } else if (isSlackInvalidBlocksError(error)) { try { // The SDK keeps buffered markdown after a rejected stopStream call. Retry the same - // terminal write without cosmetic footer blocks. Re-send the toolbox snapshot, which - // the helper does not retain, but do not append terminal markdown a second time: that - // text is still in ChatStreamer's buffer from the rejected request. - await answerStreamer.stop(); + // terminal write without image previews first, so a bad/unreachable image cannot + // discard a healthy stats footer. Do not append terminal markdown a second time: + // that text is still in ChatStreamer's buffer from the rejected request. + await answerStreamer.stop(imageBlocks.length ? { blocks: finalFooterBlocks } : undefined); if (await sealDelivered()) return; - } catch { - // The text-only stop failed too; fall through to the normal full-answer fallback. + } catch (footerError) { + if (imageBlocks.length && isSlackInvalidBlocksError(footerError)) { + try { + await answerStreamer.stop(); + if (await sealDelivered()) return; + } catch { + // The text-only stop failed too; use the complete classic fallback below. + } + } } } failed = true; @@ -1255,9 +1272,13 @@ function startStreamingProgress(client, { channel, threadTs, isDM, authorId, tea resolveMentions(mdToMrkdwn(fullRaw.trim()), dir).trim() + tag, footerText(result), footerButtons(result, { channel, threadTs, authorId, mayUseSettings }), - { footerBlocks: footerBlocks(result, { channel, threadTs, authorId, mayUseSettings }) }, + { + footerBlocks: footerBlocks(result, { channel, threadTs, authorId, mayUseSettings }), + answerBlocks: imageBlocks, + }, ); await stopTimeline(); + await shareImageFiles(); } catch (error) { // Both delivery surfaces failed. The outer run handler will call stop(), but this finalize // already owns the terminal state, so close and drain the Plan here before rethrowing. diff --git a/src/slack/question-views.js b/src/slack/question-views.js new file mode 100644 index 00000000..1267d2a7 --- /dev/null +++ b/src/slack/question-views.js @@ -0,0 +1,149 @@ +// Pure Block Kit views. The gateway owns validation, authorization and durable answers. +export const QUESTION_ACTION_PREFIX = "cg_question_"; +export const QUESTION_FORM_CALLBACK = "cg_question_form"; +export const QUESTION_CUSTOM_CALLBACK = "cg_question_custom_form"; +export const QUESTIONS_PER_PAGE = 3; + +const plain = (text) => ({ type: "plain_text", text: String(text), emoji: false }); +const section = (text) => ({ type: "section", text: plain(text) }); +const context = (text) => ({ type: "context", elements: [plain(text)] }); +const answerFor = (record, id) => record.answers?.[id] || { values: [], custom: "" }; +const option = ({ label, value }) => ({ text: plain(label), value }); +const metadata = (record, extra = {}) => JSON.stringify({ id: record.id, revision: record.revision, ...extra }); +const button = (record, label, action, extra = {}, selected = false) => ({ + type: "button", text: plain(label), action_id: `${QUESTION_ACTION_PREFIX}${action}`, + value: metadata(record, extra), ...(selected ? { style: "primary" } : {}), +}); + +export function parseQuestionMetadata(value) { + try { + const parsed = JSON.parse(value); + if (!parsed || typeof parsed.id !== "string" || !parsed.id || !Number.isSafeInteger(parsed.revision) || parsed.revision < 0) return null; + if (parsed.page !== undefined && (!Number.isSafeInteger(parsed.page) || parsed.page < 0)) return null; + if (parsed.questionId !== undefined && typeof parsed.questionId !== "string") return null; + return parsed; + } catch { return null; } +} + +export function questionPage(record, page = 0) { + const totalPages = Math.ceil(record.questions.length / QUESTIONS_PER_PAGE); + if (!Number.isInteger(page) || page < 0 || page >= totalPages) throw new Error("Invalid question page"); + return { page, totalPages, questions: record.questions.slice(page * QUESTIONS_PER_PAGE, (page + 1) * QUESTIONS_PER_PAGE) }; +} + +export function questionPresentation(record) { + if (record.presentation === "modal" || record.questions.length > 4) return "modal"; + if (record.presentation === "message") return "message"; + return record.questions.some((q) => q.type === "text") ? "modal" : "message"; +} + +function answerText(question, answer) { + const labels = (question.options || []).filter((o) => answer.values?.includes(o.value)).map((o) => o.label); + if (answer.custom) { + if (question.type === "multi") labels.push(answer.custom); + else return answer.custom; + } + return labels.join(", ") || "Not answered"; +} + +/** Returns message payload fields usable by chat.postMessage and chat.update. */ +export function buildQuestionCard(record) { + const pending = record.status === "pending"; + const blocks = [{ type: "header", text: plain(record.title) }]; + if (!pending) { + blocks.push(context(record.status === "submitted" ? "Answers submitted" : record.answeredInThread ? "Continued with your reply in the thread" : "Questions cancelled")); + // One section per question stays below Slack's 50-block message limit at the schema maximum. + for (const q of record.questions) blocks.push(section(`${q.prompt}\n${answerText(q, answerFor(record, q.id))}`)); + } else if (questionPresentation(record) === "modal") { + blocks.push(section(`${record.questions.length} questions to continue. Your draft is saved as you move between pages.`)); + blocks.push({ type: "actions", elements: [button(record, "Answer questions", "open", {}, true), button(record, "Cancel", "cancel")] }); + } else { + blocks.push(context("Choose an answer for each question, then submit. Only the requester can answer.")); + for (const q of record.questions) { + const answer = answerFor(record, q.id); + blocks.push(section(`${q.prompt}${q.required ? "" : " (optional)"}`)); + const elements = []; + if (q.type === "single") { + for (const [index, o] of q.options.entries()) { + elements.push(button(record, o.label, `choose:${q.id}:${index}`, {}, !answer.custom && answer.values?.includes(o.value))); + } + } else if (q.type === "multi") { + const options = q.options.map(option); + const initial = options.filter((o) => answer.values?.includes(o.value)); + elements.push({ type: "checkboxes", action_id: `${QUESTION_ACTION_PREFIX}multi:${q.id}`, options, ...(initial.length ? { initial_options: initial } : {}) }); + } + if (q.allowCustom || q.type === "text") elements.push(button(record, q.type === "text" ? "Write answer" : "Custom answer…", `custom:${q.id}`)); + if (elements.length) blocks.push({ type: "actions", block_id: `cg_question:${record.id}:${record.revision}:${q.id}`, elements }); + if (answer.values?.length || answer.custom) blocks.push(section(`Current answer: ${answerText(q, answer)}`)); + } + blocks.push({ type: "actions", elements: [button(record, "Submit answers", "submit", {}, true), button(record, "Open form", "open"), button(record, "Cancel", "cancel")] }); + } + // Keep notification fallback caller-independent: plain_text blocks alone do not protect text. + return { text: pending ? "Questions need your answers" : record.status === "submitted" ? "Answers submitted" : "Questions cancelled", blocks, mrkdwn: false, unfurl_links: false, unfurl_media: false }; +} + +function textInput(question, answer, custom = false) { + return { + type: "input", block_id: `${custom ? "custom" : "q"}:${question.id}`, + label: plain(custom ? "Custom answer" : question.prompt), + optional: custom || !question.required, + element: { type: "plain_text_input", action_id: "custom", multiline: true, max_length: 2000, ...(answer.custom ? { initial_value: answer.custom } : {}) }, + ...(custom ? { hint: plain(question.type === "multi" ? "Adds to the options selected above." : "Overrides the option selected above. Leave empty to use that option.") } : {}), + }; +} + +export function buildQuestionModal(record, page = 0) { + const slice = questionPage(record, page); + const blocks = [section(record.title), context(`Page ${page + 1} of ${slice.totalPages}`)]; + for (const q of slice.questions) { + const answer = answerFor(record, q.id); + if (q.type === "text") blocks.push(textInput(q, answer)); + else { + const options = q.options.map(option); + const initial = options.filter((o) => answer.values?.includes(o.value)); + const element = { type: q.type === "multi" ? "checkboxes" : "radio_buttons", action_id: "choice", options }; + if (initial.length) { + if (q.type === "multi") element.initial_options = initial; + else element.initial_option = initial[0]; + } + blocks.push({ type: "input", block_id: `q:${q.id}`, label: plain(q.prompt), optional: !q.required || q.allowCustom, element }); + if (q.allowCustom) blocks.push(textInput(q, answer, true)); + } + blocks.push({ type: "divider" }); + } + if (page > 0) blocks.push({ type: "actions", elements: [button(record, "Back", "back", { page })] }); + return { + type: "modal", callback_id: QUESTION_FORM_CALLBACK, private_metadata: metadata(record, { page }), + title: plain("Answer questions"), close: plain("Close"), submit: plain(page + 1 < slice.totalPages ? "Next" : "Submit"), + blocks, + }; +} + +export function buildCustomAnswerModal(record, questionId) { + const q = record.questions.find((entry) => entry.id === questionId); + if (!q || (!q.allowCustom && q.type !== "text")) throw new Error("Custom answers are not allowed for this question"); + const input = textInput(q, answerFor(record, q.id)); + // Empty custom input removes the draft custom answer; final submission validates requirements. + input.optional = true; + return { + type: "modal", callback_id: QUESTION_CUSTOM_CALLBACK, + private_metadata: metadata(record, { questionId }), title: plain("Custom answer"), + close: plain("Close"), submit: plain("Save answer"), + blocks: [input, context(q.type === "multi" ? "Adds to your selected options." : "Replaces your selected option. To switch back, choose an option on the card.")], + }; +} + +/** Only extracts fields on the displayed page. The store validates and merges the patch. */ +export function parseQuestionPageAnswers(record, page, stateValues = {}) { + const answers = {}; + for (const q of questionPage(record, page).questions) { + const fields = stateValues[`q:${q.id}`] || {}; + const choice = fields.choice; + const values = q.type === "multi" ? (choice?.selected_options || []).map((o) => o.value) + : q.type === "single" && choice?.selected_option ? [choice.selected_option.value] : []; + const custom = q.type === "text" ? fields.custom?.value || "" + : q.allowCustom ? stateValues[`custom:${q.id}`]?.custom?.value || "" : ""; + answers[q.id] = { values: q.type === "single" && custom.trim() ? [] : values, custom }; + } + return answers; +} diff --git a/src/slack/questions.js b/src/slack/questions.js new file mode 100644 index 00000000..1ce8ef0b --- /dev/null +++ b/src/slack/questions.js @@ -0,0 +1,218 @@ +import { resolveSlackConfig } from "../config/settings.js"; +import { assertQuestionAccess } from "../gateway/question-access.js"; +import { createQuestion, getQuestion, bindQuestionMessage, updateQuestion, saveQuestionAnswers, validateAnswer, missingQuestionAnswers, acceptQuestionSubmission, formatQuestionAnswers } from "../gateway/questions.js"; +import { acquireKeyedLock } from "../util/keyed-lock.js"; +import { buildQuestionCard, buildQuestionModal, buildCustomAnswerModal, parseQuestionMetadata, parseQuestionPageAnswers, questionPage, QUESTION_FORM_CALLBACK, QUESTION_CUSTOM_CALLBACK } from "./question-views.js"; + +// The MCP connection lives in the daemon; no bot credential crosses into the engine container. +export function questionSlackClient({ token = resolveSlackConfig().botToken, fetchImpl = fetch } = {}) { + const call = async (method, body, read = false) => { + if (!token) throw new Error("Slack bot token is not configured."); + // conversations.members requires query/form parameters; JSON POSTs lose its channel argument. + const url = new URL(`https://slack.com/api/${method}`); + if (read) url.search = new URLSearchParams(body).toString(); + const response = await fetchImpl(url.toString(), { + method: read ? "GET" : "POST", + headers: { Authorization: `Bearer ${token}`, ...(!read ? { "Content-Type": "application/json; charset=utf-8" } : {}) }, + ...(!read ? { body: JSON.stringify(body) } : {}), signal: AbortSignal.timeout(20_000), + }); + const data = await response.json(); + if (!response.ok || !data.ok) throw new Error(`Slack ${method} failed: ${data.error || response.status}`); + return data; + }; + return { chat: { postMessage: (b) => call("chat.postMessage", b), update: (b) => call("chat.update", b) }, conversations: { members: (b) => call("conversations.members", b, true) } }; +} + +export async function refreshQuestionCard(record, client) { + if (!record?.id) return; + const release = await acquireKeyedLock("question-card", record.id); + try { + // Async view updates can finish out of order. Never render a captured draft over newer data. + const latest = getQuestion(record.id); + if (latest?.messageTs) await client.chat.update({ channel: latest.channelId, ts: latest.messageTs, ...buildQuestionCard(latest) }); + } finally { release(); } +} + +export async function postQuestions(context, input, { client = questionSlackClient() } = {}) { + const meta = await assertQuestionAccess(context, client); + const release = await acquireKeyedLock("question-post", `${context.channelId}:${context.threadKey}:${context.authorId}`); + try { + let record = createQuestion({ ...context, isDM: meta.isDM }, input); + if (record.messageTs) { + await refreshQuestionCard(record, client); + return record; + } + const result = await client.chat.postMessage({ channel: record.channelId, thread_ts: record.threadKey, client_msg_id: record.id, ...buildQuestionCard(record) }); + if (!result.ts) throw new Error("Slack did not return the question card's message timestamp. Retry with the same questions."); + // Stop/clear may have cancelled the request while Slack was posting it. Retire that late card. + record = bindQuestionMessage(record.id, result.ts); + if (record.status !== "pending") { + await refreshQuestionCard({ ...record, messageTs: result.ts }, client); + throw new Error("These questions were cancelled while being posted."); + } + return record; + } finally { release(); } +} + +function actionMetadata(action) { + if (action?.action_id?.startsWith("cg_question_multi:")) { + const parts = String(action.block_id || "").split(":"); + if (parts.length !== 4 || parts[0] !== "cg_question") return null; + return parseQuestionMetadata(JSON.stringify({ id: parts[1], revision: Number(parts[2]) })); + } + return parseQuestionMetadata(action?.value); +} + +function ownQuestion(metadata, body, { modal = false, allowStale = false } = {}) { + if (!metadata) throw new Error("Invalid question action."); + const record = getQuestion(metadata.id); + if (!record || record.authorId !== body?.user?.id) throw new Error("Only the person who requested these questions can answer them."); + if (!modal) { + const channel = body?.channel?.id || body?.container?.channel_id; + const ts = body?.message?.ts || body?.container?.message_ts; + if (channel !== record.channelId || ts !== record.messageTs) throw new Error("This action does not belong to this question card."); + } + if (record.status !== "pending") throw new Error("These questions have already been submitted or cancelled."); + if (!allowStale && record.revision !== metadata.revision) throw new Error("These answers changed. Use the latest card or reopen the form."); + return record; +} + +async function notice(client, record, userId, message) { + if (!record?.channelId || !userId) return; + await client.chat.postEphemeral({ channel: record.channelId, thread_ts: record.threadKey, user: userId, text: message }).catch(() => {}); +} + +const submitting = new Set(); +// Queue a synthetic human answer through the normal authorization, licensing and session path. +// Nothing executes on selection. The atomic callback alone makes submission terminal. Keep the +// promise observed, but never make Slack wait for an engine turn to finish before acknowledging. +export function startQuestionContinuation(record, client, processMessage, { onError = () => {} } = {}) { + if (submitting.has(record.id)) return false; + submitting.add(record.id); + const event = { + type: "message", channel: record.channelId, user: record.authorId, + channel_type: record.isDM ? "im" : "channel", thread_ts: record.threadKey, + ts: `question-${record.id}`, text: formatQuestionAnswers(record), + }; + let accepted = false; + const promise = Promise.resolve().then(() => processMessage(event, client, { + bypassMention: true, busyChoice: "queue", questionSubmissionId: record.id, + onQuestionSubmissionAccepted: ({ runId, rec }) => { + accepted = acceptQuestionSubmission(record.id, record.revision, runId, rec); + if (accepted) void refreshQuestionCard(getQuestion(record.id), client).catch(() => {}); + return accepted; + }, + })).then(() => { + if (!accepted && getQuestion(record.id)?.status === "pending") throw new Error("Your answers are saved, but the continuation could not be queued. Reopen the card and submit again."); + }).catch(async (error) => { + onError(error); + await notice(client, record, record.authorId, error.message); + }).finally(() => submitting.delete(record.id)); + return promise; +} + +export async function handleQuestionAction({ ack, body, action, client }, { processMessage }) { + await ack(); + let record; + try { + const metadata = actionMetadata(action); + const inModal = Boolean(body.view); + record = ownQuestion(metadata, body, { modal: inModal, allowStale: true }); + // Leave time within Slack's three-second interaction window to acknowledge errors/open views. + await assertQuestionAccess(record, client, { timeoutMs: 1500 }); + const actionId = action.action_id; + // Opening is read-only and also repairs a card whose last Slack update failed. Stale writes + // are never applied; their catch path refreshes the visible controls from the durable draft. + if (record.revision !== metadata.revision && actionId !== "cg_question_open" && !actionId.startsWith("cg_question_custom:")) throw new Error("These answers changed. The card has been refreshed; please try again."); + if (actionId === "cg_question_open") { + await client.views.open({ trigger_id: body.trigger_id, view: buildQuestionModal(record) }); + return; + } + if (actionId === "cg_question_back") { + const page = metadata.page; + if (!inModal || !(page > 0) || body.view.callback_id !== QUESTION_FORM_CALLBACK) throw new Error("Invalid question page."); + record = saveQuestionAnswers(record.id, record.revision, parseQuestionPageAnswers(record, page, body.view.state?.values)); + await client.views.update({ view_id: body.view.id, hash: body.view.hash, view: buildQuestionModal(record, page - 1) }); + } else if (actionId.startsWith("cg_question_custom:")) { + const qid = actionId.slice("cg_question_custom:".length); + await client.views.open({ trigger_id: body.trigger_id, view: buildCustomAnswerModal(record, qid) }); + return; + } else if (actionId.startsWith("cg_question_choose:")) { + const [, qid, index] = actionId.split(":"); + const q = record.questions.find((q) => q.id === qid); + const selected = /^\d+$/.test(index) ? q?.options[Number(index)] : null; + if (!selected || q.type !== "single") throw new Error("Invalid answer option."); + record = saveQuestionAnswers(record.id, record.revision, { [qid]: { values: [selected.value], custom: "" } }); + } else if (actionId.startsWith("cg_question_multi:")) { + const qid = actionId.slice("cg_question_multi:".length); + if (record.questions.find((q) => q.id === qid)?.type !== "multi") throw new Error("Invalid multiple-choice question."); + record = saveQuestionAnswers(record.id, record.revision, { [qid]: { values: (action.selected_options || []).map((o) => o.value), custom: record.answers[qid]?.custom || "" } }); + } else if (actionId === "cg_question_cancel") { + record = updateQuestion(record.id, record.revision, { status: "cancelled" }); + } else if (actionId === "cg_question_submit") { + if (missingQuestionAnswers(record).length) throw new Error("Please answer every required question before submitting."); + startQuestionContinuation(record, client, processMessage); + return; + } else throw new Error("Unknown question action."); + await refreshQuestionCard(record, client); + } catch (error) { + if (record) await refreshQuestionCard(record, client).catch(() => {}); + const target = record || { channelId: body?.channel?.id, threadKey: body?.message?.thread_ts }; + await notice(client, target, body?.user?.id, error.message); + } +} + +export async function handleQuestionView({ ack, body, view = body?.view, client }, { processMessage }) { + let acknowledged = false; + const respond = async (value) => { acknowledged = true; await ack(value); }; + let record; + try { + const metadata = parseQuestionMetadata(view?.private_metadata); + record = ownQuestion(metadata, body, { modal: true }); + await assertQuestionAccess(record, client, { timeoutMs: 1500 }); + if (view.callback_id === QUESTION_CUSTOM_CALLBACK) { + const qid = metadata.questionId; + const q = record.questions.find((q) => q.id === qid); + if (!q || !q.allowCustom) throw new Error("Custom answers are not allowed."); + const custom = view.state?.values?.[`q:${qid}`]?.custom?.value || ""; + record = saveQuestionAnswers(record.id, record.revision, { [qid]: { values: record.answers[qid]?.values || [], custom } }); + await respond(); + } else if (view.callback_id === QUESTION_FORM_CALLBACK) { + const page = metadata.page; + const slice = questionPage(record, page); + const patch = parseQuestionPageAnswers(record, page, view.state?.values); + const answers = { ...record.answers }; + for (const q of slice.questions) answers[q.id] = validateAnswer(q, patch[q.id]); + const missing = missingQuestionAnswers({ ...record, answers }, slice.questions); + if (missing.length) { + await respond({ response_action: "errors", errors: Object.fromEntries(missing.map((q) => [`q:${q.id}`, "Choose an option or write an answer."])) }); + return; + } + record = saveQuestionAnswers(record.id, record.revision, patch); + if (page + 1 < slice.totalPages) await respond({ response_action: "update", view: buildQuestionModal(record, page + 1) }); + else if (missingQuestionAnswers(record).length) { + // Back permits incomplete drafts. Return to the first missing page instead of dropping it. + const first = record.questions.findIndex((q) => missingQuestionAnswers(record).some((m) => m.id === q.id)); + await respond({ response_action: "update", view: buildQuestionModal(record, Math.floor(first / 3)) }); + } else { + await respond(); + startQuestionContinuation(record, client, processMessage); + } + } else throw new Error("Unknown question form."); + await refreshQuestionCard(getQuestion(record.id), client); + } catch (error) { + if (!acknowledged) { + const block = view?.blocks?.find((b) => b.type === "input")?.block_id; + await respond(block ? { response_action: "errors", errors: { [block]: error.message } } : {}); + } else await notice(client, record, body?.user?.id, error.message); + } +} + +export function registerQuestionActions(app, processMessage, context = {}) { + // The live connection owns bot/workspace identity; the synthetic answer must retain it for + // mention hydration and Slack's recipient_team_id on streamed channel replies. + const continuation = (event, client, options) => processMessage(event, client, { ...context, ...options }); + app.action(/^cg_question_/, (payload) => handleQuestionAction(payload, { processMessage: continuation })); + app.view(QUESTION_FORM_CALLBACK, (payload) => handleQuestionView(payload, { processMessage: continuation })); + app.view(QUESTION_CUSTOM_CALLBACK, (payload) => handleQuestionView(payload, { processMessage: continuation })); +} diff --git a/src/slack/upload.js b/src/slack/upload.js index a62d4e3e..05a2314c 100644 --- a/src/slack/upload.js +++ b/src/slack/upload.js @@ -10,7 +10,8 @@ // 3. files.completeUploadExternal({ files, channel_id?, thread_ts?, initial_comment? }) import { resolveSlackConfig } from "../config/settings.js"; import path from "node:path"; -import { readFile, stat } from "node:fs/promises"; +import { constants } from "node:fs"; +import { open, realpath } from "node:fs/promises"; export const MAX_FILE_UPLOAD_BYTES = 25 * 1024 * 1024; @@ -98,12 +99,30 @@ export async function uploadSnippet({ content, filename, title = "", channelId = // responsible for confinement and passes a realpath-validated file from the current channel root. // Capping at 25 MB keeps the daemon's in-memory Blob bounded; bigger files stay browseable but the // explorer explains that they need another transfer mechanism. -export async function uploadLocalFile({ filePath, filename = "", title = "", channelId = "", threadTs = "", comment = "" } = {}) { - const info = await stat(filePath); - if (!info.isFile()) throw new Error("Only regular files can be shared."); - if (info.size > MAX_FILE_UPLOAD_BYTES) throw new Error(`File is larger than the ${Math.round(MAX_FILE_UPLOAD_BYTES / 1024 / 1024)} MB explorer limit.`); - const bytes = await readFile(filePath); - if (bytes.length > MAX_FILE_UPLOAD_BYTES) throw new Error(`File grew larger than the ${Math.round(MAX_FILE_UPLOAD_BYTES / 1024 / 1024)} MB explorer limit before it could be shared.`); +export async function uploadLocalFile({ filePath, rootPath = "", filename = "", title = "", channelId = "", threadTs = "", comment = "" } = {}) { + // Open the resolved file itself without following a last-moment symlink swap. When a caller + // supplies its confinement root, validate the kernel-held descriptor through /proc before + // reading: even a concurrent parent-directory rename cannot redirect these bytes outside it. + const handle = await open(filePath, constants.O_RDONLY | constants.O_NOFOLLOW); + let bytes; + try { + const info = await handle.stat(); + if (!info.isFile()) throw new Error("Only regular files can be shared."); + if (rootPath) { + const [rootReal, openedReal] = await Promise.all([ + realpath(rootPath), + realpath(`/proc/self/fd/${handle.fd}`), + ]); + if (openedReal !== rootReal && !openedReal.startsWith(`${rootReal}${path.sep}`)) { + throw new Error("The file moved outside the channel working folder before it could be shared."); + } + } + if (info.size > MAX_FILE_UPLOAD_BYTES) throw new Error(`File is larger than the ${Math.round(MAX_FILE_UPLOAD_BYTES / 1024 / 1024)} MB explorer limit.`); + bytes = await handle.readFile(); + if (bytes.length > MAX_FILE_UPLOAD_BYTES) throw new Error(`File grew larger than the ${Math.round(MAX_FILE_UPLOAD_BYTES / 1024 / 1024)} MB explorer limit before it could be shared.`); + } finally { + await handle.close(); + } return uploadBytes({ bytes, filename: filename || path.basename(filePath), title, channelId, threadTs, comment }); } diff --git a/src/slack/util.js b/src/slack/util.js index 1a6ef288..7a5eaa62 100644 --- a/src/slack/util.js +++ b/src/slack/util.js @@ -24,8 +24,9 @@ const MAX_REPLY_CHUNKS = 6; // Slack's hard limit on one section block's text. A chunk longer than this cannot carry the footer // in the same message and keeps the separate trailer below it. const MAX_SECTION_CHARS = 3000; -export async function postChunkedReply(client, channel, threadTs, md, footer = "", buttonOrButtons = null, { footerBlocks = null } = {}) { +export async function postChunkedReply(client, channel, threadTs, md, footer = "", buttonOrButtons = null, { footerBlocks = null, answerBlocks = null } = {}) { const buttons = (Array.isArray(buttonOrButtons) ? buttonOrButtons : [buttonOrButtons]).filter(Boolean); + let previews = (Array.isArray(answerBlocks) ? answerBlocks : []).filter(Boolean); let chunks = chunkMrkdwn(md || "", MAX_SLACK_CHARS).filter((c) => c.trim()); if (!chunks.length) chunks = ["_(no output)_"]; if (chunks.length > MAX_REPLY_CHUNKS) { @@ -39,19 +40,30 @@ export async function postChunkedReply(client, channel, threadTs, md, footer = " // carries nothing but stats and buttons. One Slack message renders either `text` or `blocks`, // so the chunk becomes a section block — possible only while it fits the section limit; a // longer answer keeps the plain chunk and the trailer below it. - if (last && footerBlocks?.length && chunks[i].length <= MAX_SECTION_CHARS) { + if (last && (footerBlocks?.length || previews.length) && chunks[i].length <= MAX_SECTION_CHARS) { + const inlineFooter = footer && !buttons.length && !footerBlocks?.length + ? [{ type: "context", elements: [{ type: "mrkdwn", text: footer.slice(0, MAX_SECTION_CHARS) }] }] + : []; try { await client.chat.postMessage({ channel, thread_ts: threadTs, text: chunks[i], - blocks: [{ type: "section", text: { type: "mrkdwn", text: chunks[i] } }, ...footerBlocks], + blocks: [ + { type: "section", text: { type: "mrkdwn", text: chunks[i] } }, + ...previews, + ...(footerBlocks || []), + ...inlineFooter, + ], }); - return; + previews = []; + if (footerBlocks?.length || inlineFooter.length) return; + continue; } catch (error) { // Cosmetic Block Kit trouble must never cost a completed answer: post the chunk plainly // and let the trailer below carry the stats. if (!isSlackInvalidBlocksError(error)) throw error; + previews = []; } } await client.chat.postMessage({ @@ -60,6 +72,20 @@ export async function postChunkedReply(client, channel, threadTs, md, footer = " text: last && footer && !buttons.length ? `${chunks[i]}\n\n${footer}` : chunks[i], }); } + // A long final chunk cannot become a section block (Slack caps one at 3,000 characters). Keep + // the answer as ordinary unfurled text, then attach its native previews in one compact message. + if (previews.length) { + try { + await client.chat.postMessage({ + channel, + thread_ts: threadTs, + text: previews.length === 1 ? "Image preview" : "Image previews", + blocks: previews, + }); + } catch (error) { + if (!isSlackInvalidBlocksError(error)) throw error; + } + } // With controls, the footer moves to its own compact trailer message. One control fits as a // section accessory; multiple controls need an actions row because Slack sections allow only one // accessory. Rendered text can't carry interactive elements, and folding long answer chunks into @@ -275,8 +301,10 @@ export function neutralizeSentinels(s) { // ── /model validation ───────────────────────────────────────────────────────────────────────── // The /model value flows straight into the engine's --model / -m flag; a typo'd or arbitrary // string breaks every later turn in the channel. Accept only the engine aliases and the known -// model-id families (Claude: opus/sonnet/haiku aliases + claude-*; Codex: gpt-*, o*, codex*). -const MODEL_RE = /^(?:best|fable|haiku|opusplan|opus|sonnet|(?:opus|sonnet)\[1m\]|claude-[a-z0-9][a-z0-9.[\]-]*|gpt-[a-z0-9][a-z0-9.-]*|o[0-9][a-z0-9.-]*|codex(?:-[a-z0-9.-]+)?|[a-z0-9._-]+\/[a-z0-9._:/-]+)$/; +// model-id families (Claude: opus/sonnet/haiku aliases + claude-*; Codex: gpt-*, o*, codex*; +// Qwen: the QwenCloud catalog's own families — qwen*/glm-*/deepseek-*/kimi-*/minimax-*/auto, which +// a live `/models` fetch can extend at any time, so the shape is a family match, not a fixed list). +const MODEL_RE = /^(?:best|fable|haiku|opusplan|opus|sonnet|(?:opus|sonnet)\[1m\]|claude-[a-z0-9][a-z0-9.[\]-]*|gpt-[a-z0-9][a-z0-9.-]*|o[0-9][a-z0-9.-]*|codex(?:-[a-z0-9.-]+)?|auto|qwen[0-9][a-z0-9._-]*|qwen-[a-z0-9._-]+|glm-[a-z0-9._-]+|deepseek-[a-z0-9._-]+|kimi-[a-z0-9._-]+|minimax-[a-z0-9._-]+|[a-z0-9._-]+\/[a-z0-9._:/-]+)$/; export function isValidModel(value) { const v = String(value || "").trim().toLowerCase(); if (!v || v.length > 64 || /\s/.test(v)) return false; diff --git a/src/web/routes/channels.js b/src/web/routes/channels.js index e562c2ab..142e38bf 100644 --- a/src/web/routes/channels.js +++ b/src/web/routes/channels.js @@ -1,5 +1,5 @@ // Channel + DM admin routes: per-DM config, the channel list/members/meta, Make-toolbox and -// Drive-sync probes, the org-wide access/nudge/runtime resets, channel memory, and channel +// Drive-sync probes, the org-wide access/runtime resets, channel memory, and channel // instructions (CLAUDE.md). Split from admin.js; mounted by createAdminRouter so every URL is // unchanged. import { Router } from "express"; @@ -26,12 +26,12 @@ import { } from "../../config/store.js"; import { syncWorkspaceSkillsOrThrow } from "../../gateway/skills/workspace-sync.js"; import { ensureChannelFolder, effectiveWorkDir, gatewayInstructionsBlock, splitGatewayBlock, channelSeed } from "../../gateway/folders.js"; +import { workspaceConflictsBySlug } from "../../gateway/workspace-assignments.js"; import { memoryEnabled, countMemoryFacts, MEM_FILE, MEM_DIR } from "../../gateway/channel-memory.js"; import { ENGINES, CHANNEL_ACCESS_MODES, getDefaultChannelAccess, - getDefaultNudges, } from "../../config/settings.js"; import { testChannelSync } from "../../gateway/drivesync.js"; import { PROFILE_FLAGS, BASE_MODE_FLAGS, modeSettingsPatch } from "../../gateway/modes.js"; @@ -83,6 +83,7 @@ export function maskChannelMeta(meta = {}) { const mk = mask(meta.makeToolboxKey); return { ...stripDeadFields(meta), + nudges: undefined, // `...meta` would otherwise spread the env bag — VALUES included — into every save response. env: undefined, envVars: listChannelEnv(meta), @@ -179,7 +180,9 @@ export function createChannelsRouter({ router.get("/dms", async (_req, res, next) => { try { const users = await getUsers(); - const dms = (await listChannels()) + const allChannels = await listChannels(); + const conflicts = workspaceConflictsBySlug(allChannels); + const dms = allChannels .filter((c) => c.isDM) .map((c) => { const meta = c.meta || {}; @@ -190,6 +193,7 @@ export function createChannelsRouter({ dmUserId: uid, userName: users[uid]?.name || uid || c.slug, template: meta.template || "user", + workDirConflict: conflicts.get(c.slug) || null, // A DM is a channel too, so it gets the SAME masker — the copy that used to live here // masked Composio and Toolbox but not the Make toolbox key or a dead field. meta: maskChannelMeta(meta), @@ -249,13 +253,16 @@ export function createChannelsRouter({ // ── Channels ──────────────────────────────────────────────────────────────── router.get("/channels", async (_req, res, next) => { try { + const allChannels = await listChannels(); + const conflicts = workspaceConflictsBySlug(allChannels); // DMs aren't shown here — a DM has no per-channel settings (access is governed by the // user's approval in the Users tab, not allowedUsers/MCPs/skills). - const channels = (await listChannels()).filter((c) => !c.isDM && c.type !== "im"); + const channels = allChannels.filter((c) => !c.isDM && c.type !== "im"); // Per-channel Composio / Toolbox / Make toolbox secrets are NOT returned — only has*/last4 // for display. The UI fetches a value on demand via POST /secrets/reveal, which re-prompts // for the admin password. Only overwritten on save when a non-empty value is sent. for (const ch of channels) { + ch.workDirConflict = conflicts.get(ch.slug) || null; if (!ch.meta) continue; ch.meta = maskChannelMeta(ch.meta); } @@ -360,7 +367,6 @@ export function createChannelsRouter({ autoMode: typeof body.autoMode === "boolean" ? body.autoMode : current.autoMode, cleanMode: typeof body.cleanMode === "boolean" ? body.cleanMode : current.cleanMode, noDefaultTokens: typeof body.noDefaultTokens === "boolean" ? body.noDefaultTokens : current.noDefaultTokens, - nudges: typeof body.nudges === "boolean" ? body.nudges : current.nudges, memory: typeof body.memory === "boolean" ? body.memory : current.memory, engine: typeof body.engine === "string" && (body.engine === "" || ENGINES.includes(body.engine)) ? body.engine : current.engine, approvedTools: Array.isArray(body.approvedTools) ? body.approvedTools.map(String) : current.approvedTools, @@ -405,7 +411,7 @@ export function createChannelsRouter({ const workspaceSync = await syncWorkspaceSkillsOrThrow({ channelSlugs: [entry.slug] }); // One row per save, listing ONLY the policy keys that moved (and never a token or an env // value — see the allowlist in config/channel-audit.js). A save that changes nothing on that - // list — a nudge toggle, a token rotation, a re-submitted form — writes no event at all. + // list — a memory toggle, a token rotation, a re-submitted form — writes no event at all. await logChannelPolicyChange({ channelId, slug: entry.slug, actor: ADMIN_UI_ACTOR, before: replaced, after: next_ }); res.json({ ok: true, meta: maskChannelMeta(next_), workspaceSync }); } catch (e) { @@ -492,30 +498,6 @@ export function createChannelsRouter({ } }); - // Push the org-default no-response nudge onto EVERY existing channel AND DM's meta.nudges. New - // conversations already capture the default at join; this is the "apply to what's already here" - // action. Only meta.nudges changes — every other capability/token is left untouched. Audit-logged. - router.post("/channels/reset-nudges", async (_req, res, next) => { - try { - const nudges = getDefaultNudges(); - const all = await listChannels(); // channels + DMs - let reset = 0; - for (const ch of all) { - // Function patch: atomic read-modify-write. A never-configured channel gets a full default - // record (never a nudges-only partial); an existing one keeps every other field. - const patched = await patchChannelMeta(ch.slug, (current) => { - const base = current ?? defaultChannelMeta({ channelId: ch.channelId, name: ch.name, type: ch.type, isDM: ch.isDM }); - return { ...base, nudges }; - }); - if (patched) reset++; - } - await logEvent("channels_nudges_reset", { count: reset, nudges }); - res.json({ ok: true, count: reset, nudges }); - } catch (e) { - next(e); - } - }); - // Clear every channel's engine + model overrides so future runs inherit Settings → Engine & // runtime again. DMs are deliberately skipped: this action says channels, and their runtime is // governed separately by the User/Admin DM templates. Only these two fields change; effort, diff --git a/src/web/routes/settings.js b/src/web/routes/settings.js index 87718b4f..e471856b 100644 --- a/src/web/routes/settings.js +++ b/src/web/routes/settings.js @@ -11,7 +11,9 @@ import os from "node:os"; import path from "node:path"; import { allowedFsRoot, resolveWithinRoot, pathWithin, hashPassword, verifyPassword } from "../security.js"; import { listAvailableSkills } from "../../gateway/folders.js"; -import { requireAdapter } from "../../engines/registry.js"; +import { workspaceAssignmentsAtPath } from "../../gateway/workspace-assignments.js"; +import { listChannels } from "../../config/store.js"; +import { requireAdapter, modelBelongsToEngine } from "../../engines/registry.js"; import { getAdminPassword, settingsForApi, @@ -297,10 +299,17 @@ export function createSettingsRouter({ if (typeof body.modelChangeAccess === "string" && MODEL_CHANGE_ACCESS_MODES.includes(body.modelChangeAccess)) patch.modelChangeAccess = body.modelChangeAccess; // Gateway default model per engine (blank clears → CLI default). Same isValidModel guard as // /model and the channel-meta routes — a typo'd id here would break EVERY defaulted run. - for (const key of ["defaultClaudeModel", "defaultCodexModel"]) { + // Keys come from the ADAPTERS, not a literal pair: a harness added later (Qwen) would + // otherwise have a default-model control in the UI that silently never saved. + for (const id of ENGINES) { + const key = requireAdapter(id).defaultModelKey; if (typeof body[key] !== "string") continue; const v = body[key].trim(); if (v && !isValidModel(v)) return res.status(400).json({ error: `unrecognized model "${v}"` }); + // …and that it belongs to THIS harness. The shape check alone would accept a QwenCloud + // image/audio model as a Qwen default, or a Codex id as Claude's — either one breaks every + // defaulted run in the deployment. + if (v && !modelBelongsToEngine(v, id)) return res.status(400).json({ error: `model "${v}" is not a ${requireAdapter(id).label} model` }); patch[key] = v; } // Cross-engine failover. `codexFallback` is the pre-rename key an older UI still sends; both @@ -346,6 +355,20 @@ export function createSettingsRouter({ // The Claude subscription token for container runs (`claude setup-token` on the host). Same // write-only rule as every other credential: set on a value, cleared by an empty string or // the explicit flag, never echoed back by any listing. + // ── Qwen provider (the opt-in `qwen` harness) ─────────────────────────── + // Write-only, exactly like the tokens above: the value is never echoed back on a listing, + // and `clearQwenApiKey` is how the UI removes one it cannot read. + if (typeof body.qwenApiKey === "string") patch.qwenApiKey = body.qwenApiKey.trim(); + if (body.clearQwenApiKey === true) patch.qwenApiKey = ""; + if (typeof body.qwenBaseUrl === "string") { + const url = body.qwenBaseUrl.trim(); + // An endpoint the daemon will send a credential to: https only, and shape-checked here + // rather than at spawn time, where a bad value would fail every turn in the channel. + if (url && !/^https:\/\/[a-z0-9.-]+(?::\d+)?(?:\/[\w./-]*)?$/i.test(url)) { + return res.status(400).json({ error: "Qwen base URL must be an https:// endpoint" }); + } + patch.qwenBaseUrl = url; + } if (typeof body.containerClaudeOauthToken === "string") patch.containerClaudeOauthToken = body.containerClaudeOauthToken.trim(); if (body.clearContainerClaudeOauthToken === true) patch.containerClaudeOauthToken = ""; if (typeof body.agentsFile === "boolean") patch.agentsFile = body.agentsFile; @@ -407,7 +430,7 @@ export function createSettingsRouter({ if (body.scheduleMinIntervalMinutes !== undefined && Number.isFinite(Number(body.scheduleMinIntervalMinutes)) && Number(body.scheduleMinIntervalMinutes) >= 1) patch.scheduleMinIntervalMinutes = Math.floor(Number(body.scheduleMinIntervalMinutes)); if (body.scheduleMaxPerChannel !== undefined && Number.isFinite(Number(body.scheduleMaxPerChannel)) && Number(body.scheduleMaxPerChannel) >= 1) patch.scheduleMaxPerChannel = Math.floor(Number(body.scheduleMaxPerChannel)); if (body.noResponseReminderHours !== undefined && Number.isFinite(Number(body.noResponseReminderHours)) && Number(body.noResponseReminderHours) >= 1) patch.noResponseReminderHours = Number(body.noResponseReminderHours); - // Org-default no-response nudge (on/off), captured onto new channels & DMs at join. + // Org-default no-response nudge (on/off), captured onto newly seen users. if (typeof body.defaultNudges === "boolean") patch.defaultNudges = body.defaultNudges; // Personal pending-response follow-up digests. if (typeof body.followupRemindersEnabled === "boolean") patch.followupRemindersEnabled = body.followupRemindersEnabled; @@ -670,7 +693,8 @@ export function createSettingsRouter({ .sort((a, b) => a.name.localeCompare(b.name)); const parent = path.dirname(dir); const parentOk = parent !== dir && pathWithin(root, parent); - res.json({ path: dir, parent: parentOk ? parent : null, dirs, home: os.homedir() }); + const assignedConversations = workspaceAssignmentsAtPath(await listChannels(), dir); + res.json({ path: dir, parent: parentOk ? parent : null, dirs, home: os.homedir(), assignedConversations }); } catch (e) { res.status(400).json({ error: e.message }); } diff --git a/src/web/routes/users.js b/src/web/routes/users.js index 26a6ad6f..d1eb431d 100644 --- a/src/web/routes/users.js +++ b/src/web/routes/users.js @@ -1,7 +1,10 @@ -// User admin routes: the masked user list and per-user save (approval/admin flags + write-only -// personal tokens). Split from admin.js; mounted by createAdminRouter so every URL is unchanged. +// User admin routes: the masked user list and per-user save (approval/admin flags, personal +// preferences, and write-only tokens). Split from admin.js; mounted by createAdminRouter so every +// URL is unchanged. import { Router } from "express"; import { getUsers, setUser } from "../../config/store.js"; +import { getDefaultNudges, userNudgesEnabled } from "../../config/settings.js"; +import { logEvent } from "../../util/logger.js"; import { cleanAccessGrants } from "./helpers.js"; // The user listing is built field by field, never `...u`. That is the property that matters here: @@ -18,6 +21,7 @@ function maskUsers(users) { name: u.name || "", isAdmin: Boolean(u.isAdmin), approved: Boolean(u.approved), + nudges: userNudgesEnabled(u), hasComposioToken: Boolean(token), composioTokenLast4: token ? token.slice(-4) : "", composioTokenLabel: u.composioTokenLabel || "", @@ -51,7 +55,8 @@ export function filterUsersForSearch(users, query) { user.hasToolboxToken ? "toolbox t token configured set" : "", !user.hasComposioToken && !user.hasToolboxToken ? "no tokens" : "", ]; - const haystack = foldSearch([user.name, id, role, ...tokens].join(" ")); + const reminders = user.nudges ? "reminders on enabled" : "reminders off disabled"; + const haystack = foldSearch([user.name, id, role, reminders, ...tokens].join(" ")); return terms.every((term) => haystack.includes(term)); })); } @@ -73,6 +78,24 @@ export function createUsersRouter() { } }); + // Push the organization default onto every existing user. New users capture the same setting + // at first sight; this bulk action intentionally replaces personal overrides. + router.post("/users/reset-nudges", async (_req, res, next) => { + try { + const nudges = getDefaultNudges(); + const users = await getUsers(); + let reset = 0; + for (const userId of Object.keys(users)) { + await setUser(userId, { nudges }); + reset++; + } + await logEvent("users_nudges_reset", { count: reset, nudges }); + res.json({ ok: true, count: reset, nudges }); + } catch (error) { + next(error); + } + }); + router.put("/users/:userId", async (req, res, next) => { try { const { userId } = req.params; @@ -81,6 +104,7 @@ export function createUsersRouter() { if (typeof body.name === "string") patch.name = body.name; if (typeof body.isAdmin === "boolean") patch.isAdmin = body.isAdmin; if (typeof body.approved === "boolean") patch.approved = body.approved; + if (typeof body.nudges === "boolean") patch.nudges = body.nudges; // Only overwrite tokens when a non-empty value is sent (write-only fields). if (typeof body.composioToken === "string" && body.composioToken.length > 0) patch.composioToken = body.composioToken; @@ -102,6 +126,7 @@ export function createUsersRouter() { name: saved.name, isAdmin: saved.isAdmin, approved: saved.approved, + nudges: userNudgesEnabled(saved), hasComposioToken: Boolean(saved.composioToken), hasToolboxToken: Boolean(saved.toolboxToken), ...cleanAccessGrants(saved), diff --git a/src/web/secrets.js b/src/web/secrets.js index 2f07f63e..68c83385 100644 --- a/src/web/secrets.js +++ b/src/web/secrets.js @@ -40,6 +40,9 @@ const READERS = { // host). Same terms as the Slack tokens: listings carry has*/last4 only, and an admin who needs // the value back re-enters the admin password here. containerClaudeOauthToken: (s) => s.containerClaudeOauthToken, + // The QwenCloud API key the opt-in `qwen` harness authenticates with. Same terms as the rest: + // has*/last4 on listings, the value only here, behind a re-entered admin password. + qwenApiKey: (s) => s.qwenApiKey, }, user: { composioToken: (u) => u.composioToken, diff --git a/test/admin-container-runtime.test.js b/test/admin-container-runtime.test.js index a111d0c8..eb20e2d7 100644 --- a/test/admin-container-runtime.test.js +++ b/test/admin-container-runtime.test.js @@ -158,7 +158,7 @@ test("the retired runtime pin is ignored by the meta and DM PUTs, and every chan // An older UI (or a hand-written client) may still send `runtime`; the save succeeds and the // value is simply not honoured — there is nothing it could select any more. for (const runtime of ["host", "container", "vm", "", 1, null]) { - const r = await request(`/channels/${CHANNEL}/meta`, { method: "PUT", body: { runtime, nudges: true } }); + const r = await request(`/channels/${CHANNEL}/meta`, { method: "PUT", body: { runtime, memory: true } }); assert.equal(r.status, 200, `runtime=${JSON.stringify(runtime)} is ignored, not refused`); assert.equal(r.json.meta.runtimeEffective, undefined, "listings no longer carry an effective-runtime field"); } @@ -170,11 +170,11 @@ test("the retired runtime pin is ignored by the meta and DM PUTs, and every chan // The one door the admin API and the MCP tools ask "where does this channel run?" through always // answers the container — for a plain channel AND for an admin-mode one (admin mode is the trust // the bind-mounted work folder carries, not a way onto the daemon's host). - assert.deepEqual(decideRuntimeBackend(await getChannelMeta(entry.slug)), { backend: "container", reason: "only-runtime" }); + assert.deepEqual(decideRuntimeBackend(await getChannelMeta(entry.slug)), { backend: "container", reason: "default" }); const admin = await request(`/channels/${CHANNEL}/meta`, { method: "PUT", body: { adminMode: true, profile: "custom" } }); assert.equal(admin.status, 200); assert.equal(admin.json.meta.adminMode, true); - assert.deepEqual(decideRuntimeBackend(await getChannelMeta(entry.slug)), { backend: "container", reason: "only-runtime" }); + assert.deepEqual(decideRuntimeBackend(await getChannelMeta(entry.slug)), { backend: "container", reason: "default" }); await request(`/channels/${CHANNEL}/meta`, { method: "PUT", body: { adminMode: false } }); const listed = (await request("/channels")).json.channels.find((c) => c.channelId === CHANNEL); diff --git a/test/bg-agent-jobs.test.js b/test/bg-agent-jobs.test.js index d04dadcf..814873a6 100644 --- a/test/bg-agent-jobs.test.js +++ b/test/bg-agent-jobs.test.js @@ -21,6 +21,7 @@ const [{ BackgroundJobs, backgroundCompletionNotice }, { getDb, fromJson }, { up import("../src/db/index.js"), import("../src/config/store.js"), ]); +const { setThreadSudo } = await import("../src/gateway/thread-engine.js"); test("completion notices explain outcomes instead of exposing process codes", () => { const success = backgroundCompletionNotice({ @@ -55,6 +56,34 @@ test("agent jobs validate task/context before any spawn", async () => { assert.match((await jobs.start({ kind: "agent", task: "do X", channelId: "C-nope", threadKey: "t" })).error, /isn't registered/); }); +test("sudo background work rechecks the author and passes only the admin host posture to resolution", async () => { + const channelId = "C-bg-sudo"; + const threadKey = "sudo-thread"; + const entry = await upsertChannelEntry(channelId, { name: "bg-sudo", type: "channel", isDM: false }); + await saveChannelMeta(entry.slug, { channelId, autoMode: false, adminMode: false }); + await setUser("U-bg-sudo-admin", { name: "Sudo Admin", approved: true, isAdmin: true }); + await setUser("U-bg-sudo-member", { name: "Sudo Member", approved: true, isAdmin: false }); + await setThreadSudo(entry.slug, threadKey, true); + + let resolvedMeta = null; + const jobs = new BackgroundJobs({ + resolveTarget: (slug, meta) => { + resolvedMeta = meta; + throw new Error("intentional resolution stop"); + }, + }); + const admin = await jobs.start({ channelId, authorId: "U-bg-sudo-admin", threadKey, command: "true" }); + assert.match(admin.error, /could not resolve.*intentional resolution stop/i); + assert.equal(resolvedMeta.sudoMode, true); + assert.equal(resolvedMeta.adminMode, true); + assert.equal(resolvedMeta.autoMode, true); + + resolvedMeta = null; + const member = await jobs.start({ channelId, authorId: "U-bg-sudo-member", threadKey, command: "true" }); + assert.match(member.error, /sudo thread.*organization admins/i); + assert.equal(resolvedMeta, null, "a non-admin sudo job is rejected before runtime resolution"); +}); + // the 2026-08 update plan (internal repo) A1: shell jobs run OUTSIDE the engine sandbox (plain bash on the daemon // account), so Auto mode needs an explicit admin approval of the exact command. Admin mode skips // that second click only for an admin author, matching its explicit foreground sandbox-off tier. diff --git a/test/channel-members-admin.test.js b/test/channel-members-admin.test.js index a1e4ee6f..2c1f5514 100644 --- a/test/channel-members-admin.test.js +++ b/test/channel-members-admin.test.js @@ -125,14 +125,14 @@ test("channel save persists only submitted users who are current human members", method: "PUT", body: { allowedUsers: ["U_STALE", "U_EXTERNAL", "U_MEMBER", "U_BOT", "U_EXTERNAL"], - nudges: true, + memory: true, }, }); assert.equal(result.response.status, 200); assert.deepEqual(result.json.meta.allowedUsers, ["U_EXTERNAL", "U_MEMBER"]); assert.deepEqual((await getChannelMeta(entry.slug)).allowedUsers, ["U_EXTERNAL", "U_MEMBER"]); - assert.equal((await getChannelMeta(entry.slug)).nudges, true); + assert.equal((await getChannelMeta(entry.slug)).memory, true); }); test("disconnected Slack disables roster writes but unrelated saves preserve existing grants", async () => { @@ -144,7 +144,7 @@ test("disconnected Slack disables roster writes but unrelated saves preserve exi const unrelated = await request(`/channels/${channelId}/meta`, { method: "PUT", - body: { nudges: true }, + body: { memory: false }, }); assert.equal(unrelated.response.status, 200); assert.deepEqual(unrelated.json.meta.allowedUsers, ["U_MEMBER", "U_STALE"]); diff --git a/test/channel-policy-audit.test.js b/test/channel-policy-audit.test.js index 0b3f3837..efcdc587 100644 --- a/test/channel-policy-audit.test.js +++ b/test/channel-policy-audit.test.js @@ -68,8 +68,8 @@ test("policyDiff reports only the policy keys that actually changed", () => { test("policyDiff can never carry a token, an env value, or any other non-policy field", () => { const changes = policyDiff( - { composioToken: "comp_old_1111", toolboxToken: "tb_old", makeToolboxKey: "mk_old", env: { SUPABASE_ACCESS_TOKEN: { value: "sk-old" } }, nudges: false, allowNetwork: false }, - { composioToken: "comp_new_2222", toolboxToken: "tb_new", makeToolboxKey: "mk_new", env: { SUPABASE_ACCESS_TOKEN: { value: "sk-new" } }, nudges: true, allowNetwork: true }, + { composioToken: "comp_old_1111", toolboxToken: "tb_old", makeToolboxKey: "mk_old", env: { SUPABASE_ACCESS_TOKEN: { value: "sk-old" } }, memory: false, allowNetwork: false }, + { composioToken: "comp_new_2222", toolboxToken: "tb_new", makeToolboxKey: "mk_new", env: { SUPABASE_ACCESS_TOKEN: { value: "sk-new" } }, memory: true, allowNetwork: true }, ); assert.deepEqual(Object.keys(changes), ["allowNetwork"], "only the allowlisted policy key is diffed"); const blob = JSON.stringify(changes); @@ -127,10 +127,10 @@ test("a save that changes no policy key writes no audit row at all", async () => // audit with noise. const again = await request(`/channels/${CHANNEL_ID}/meta`, { method: "PUT", - body: { allowNetwork: true, adminMode: true, workDir: PROJECT_DIR, nudges: true }, + body: { allowNetwork: true, adminMode: true, workDir: PROJECT_DIR, memory: true }, }); assert.equal(again.response.status, 200); - assert.equal(policyEvents().length, before, "nudges is not a policy key — nothing is logged"); + assert.equal(policyEvents().length, before, "memory is not a policy key — nothing is logged"); }); test("an environment-secret change stays in its own name-only audit and never duplicates into the policy row", async () => { diff --git a/test/channel-workdir-ui.test.js b/test/channel-workdir-ui.test.js index 45f105c6..8205cd95 100644 --- a/test/channel-workdir-ui.test.js +++ b/test/channel-workdir-ui.test.js @@ -63,7 +63,7 @@ function fixture({ workDir = "/home/operator/project", saveError } = {}) { tokenValue: () => "", selectedMcpEntries: () => [], checkedValues: () => [], explicitCheckedValues: () => [], channelGuestSavePatch: () => ({}), channelGuestAcceptedIds: () => null, reconcileChannelMeta, - attachReveal() {}, revealSecret() {}, paintModePill() {}, renderConvList() {}, refreshVpn() {}, setTimeout() {}, + attachReveal() {}, revealSecret() {}, paintModePill() {}, renderConvList() {}, refreshVpn() {}, async refreshConversationRows() { return true; }, setTimeout() {}, openFolderPicker() { throw new Error("Reset must not browse folders"); }, async api(url, request) { calls.push({ url, method: request.method, body: JSON.parse(request.body) }); diff --git a/test/claude-selected-mcp.test.js b/test/claude-selected-mcp.test.js index bef97d4e..8f268b07 100644 --- a/test/claude-selected-mcp.test.js +++ b/test/claude-selected-mcp.test.js @@ -14,6 +14,7 @@ process.env.SESSION_KEEPALIVE = "0"; process.env.CG_WORKSPACE_DIR = path.join(scratch, "selected-mcp-workspaces"); const pick = (name) => ({ name, namespace: "mcp__" + name.replace(/[^a-zA-Z0-9]+/g, "_"), match: { serverName: name } }); const stdio = { type: "stdio", command: "node", args: ["/workspace/echo.mjs"] }; +const servers = async (picks, opts) => (await resolveClaudeMcpConfig(picks, opts)).servers; async function config(name) { const dir = path.join(scratch, name); @@ -41,28 +42,50 @@ test("Claude selected scopes use fresh bytes and preserve exact args without cop const user = { unrelatedCredential: "must-not-copy", mcpServers: { echo: structuredClone(stdio), unselected: { command: "never" } }, projects: { [opts.discoveryCwd]: { mcpServers: { echo: { ...stdio, args: ["local arg with spaces"] } } } } }; await writeFile(opts.configFile, JSON.stringify(user)); await writeFile(path.join(opts.discoveryCwd, ".mcp.json"), JSON.stringify({ mcpServers: { echo: { ...stdio, args: ["project"] } } })); - assert.deepEqual(await resolveClaudeMcpConfig([pick("echo")], opts), { echo: { ...stdio, args: ["local arg with spaces"] } }); + assert.deepEqual(await servers([pick("echo")], opts), { echo: { ...stdio, args: ["local arg with spaces"] } }); delete user.projects; await writeFile(opts.configFile, JSON.stringify(user)); - assert.deepEqual((await resolveClaudeMcpConfig([pick("echo")], opts)).echo.args, ["project"]); + assert.deepEqual((await servers([pick("echo")], opts)).echo.args, ["project"]); await rm(path.join(opts.discoveryCwd, ".mcp.json")); - assert.deepEqual(await resolveClaudeMcpConfig([pick("echo")], opts), { echo: stdio }); + assert.deepEqual(await servers([pick("echo")], opts), { echo: stdio }); user.mcpServers.echo.env = { HOST_SECRET: "must-not-copy" }; await writeFile(opts.configFile, JSON.stringify(user)); - await assert.rejects(resolveClaudeMcpConfig([pick("echo")], opts), /no safe matching transport/); + const credentialed = await resolveClaudeMcpConfig([pick("echo")], opts); + assert.deepEqual(credentialed.servers, {}, "a credential-bearing definition is never relayed"); + assert.deepEqual(credentialed.rejected.map((r) => r.name), ["echo"]); + assert.match(credentialed.rejected[0].reason, /host credentials/); + assert.ok(!/must-not-copy|HOST_SECRET/.test(JSON.stringify(credentialed)), "a rejection never carries the config value"); }); -test("Claude selected names, stale URL grants and unavailable definitions fail closed", async () => { +test("Claude selected names, stale URL grants and unavailable definitions are dropped, never fatal", async () => { const opts = await config("selected-invalid"); await writeFile(opts.configFile, JSON.stringify({ mcpServers: { echo: stdio, web: { type: "http", url: "https://new.example.test/mcp" }, gateway: stdio } })); - for (const name of ["gateway", "composio-agent", "makeitfuture-toolbox", "__proto__", "constructor", "bad\nname"]) - await assert.rejects(resolveClaudeMcpConfig([pick(name)], opts), /invalid or reserved/); - await assert.rejects(resolveClaudeMcpConfig([pick("missing")], opts), /no safe matching transport/); - await assert.rejects(resolveClaudeMcpConfig([{ name: "web", namespace: "mcp__web", match: { serverUrl: "https://old.example.test/mcp" } }], opts), /no safe matching transport/); - await assert.rejects(resolveClaudeMcpConfig([{ ...pick("echo"), namespace: "mcp__gateway" }], opts), /no safe matching transport/); + // Each unusable shape is dropped with its own category reason instead of ending the turn, and a + // healthy sibling in the SAME selection still reaches the payload. + const cases = [ + [pick("gateway"), /reserved or invalid/], + [pick("composio-agent"), /reserved or invalid/], + [pick("makeitfuture-toolbox"), /reserved or invalid/], + [pick("__proto__"), /reserved or invalid/], + [pick("constructor"), /reserved or invalid/], + [pick("bad\nname"), /reserved or invalid/], + [pick("missing"), /not defined in/], + [{ name: "web", namespace: "mcp__web", match: { serverUrl: "https://old.example.test/mcp" } }, /no longer matches/], + [{ ...pick("echo"), namespace: "mcp__gateway" }, /tool namespace/], + ]; + for (const [entry, reason] of cases) { + const result = await resolveClaudeMcpConfig([entry, pick("echo")], opts); + assert.deepEqual(Object.keys(result.servers), ["echo"], JSON.stringify(entry)); + assert.equal(result.rejected.length, 1, JSON.stringify(entry)); + assert.match(result.rejected[0].reason, reason); + assert.ok(!Object.hasOwn(result.servers, "__proto__") && Object.getPrototypeOf(result.servers) === Object.prototype); + } await writeFile(opts.configFile, '{"private":"do-not-print",broken'); - await assert.rejects(resolveClaudeMcpConfig([pick("echo")], opts), (error) => /could not be read safely/.test(error.message) && !/private|do-not-print|selected-invalid/.test(error.message)); - assert.deepEqual(await resolveClaudeMcpConfig([], opts), {}, "no grant never loads an ambient config"); + const unreadable = await resolveClaudeMcpConfig([pick("echo")], opts); + assert.deepEqual(unreadable.servers, {}, "a corrupt operator config admits nothing"); + assert.match(unreadable.rejected[0].reason, /could not be read/); + assert.ok(!/private|do-not-print|selected-invalid/.test(JSON.stringify(unreadable)), "no config bytes or paths are disclosed"); + assert.deepEqual(await resolveClaudeMcpConfig([], opts), { servers: {}, rejected: [] }, "no grant never loads an ambient config"); }); test("actual Claude launches keep settings isolation while grants add, resume, change and revoke", async () => { @@ -100,9 +123,19 @@ test("actual Claude launches keep settings isolation while grants add, resume, c await runMessage(input); await writeFile(file, JSON.stringify({ mcpServers: { echo: { ...stdio, args: ["/workspace/v2.mjs"] } } })); await runMessage(input); + // An unusable selection never ends the turn: the credentialed server is dropped from the + // payload, the healthy one still launches, and the author is told which was skipped. + await writeFile(file, JSON.stringify({ mcpServers: { echo: stdio, leaky: { type: "http", url: "https://leaky.example.test/mcp", headers: { Authorization: "must-not-copy" } } } })); + await patchChannelMeta(entry.slug, { allowedMcps: [pick("echo"), pick("leaky")] }); + const dropped = await runMessage(input); + assert.match(dropped.content, /Skipped MCP connection: `leaky`/); + assert.match(dropped.content, /host credentials/); + assert.ok(!/must-not-copy/.test(dropped.content)); await patchChannelMeta(entry.slug, { allowedMcps: [] }); await runMessage(input); - assert.equal(actual.length, 5); + assert.equal(actual.length, 6); + assert.deepEqual(actual[4].config.mcpServers.echo, stdio, "the healthy sibling still launched"); + assert.equal(actual[4].config.mcpServers.leaky, undefined, "a credentialed selection never reaches the payload"); for (const call of actual) { assert.ok(call.args.includes("--strict-mcp-config")); assert.equal(call.args[call.args.indexOf("--setting-sources") + 1], ""); @@ -112,7 +145,7 @@ test("actual Claude launches keep settings isolation while grants add, resume, c assert.deepEqual(actual[1].config.mcpServers.echo, stdio); assert.deepEqual(actual[2].config.mcpServers.echo, stdio); assert.deepEqual(actual[3].config.mcpServers.echo.args, ["/workspace/v2.mjs"]); - assert.equal(actual[4].config.mcpServers.echo, undefined); + assert.equal(actual[5].config.mcpServers.echo, undefined); assert.ok(actual[2].args.includes("-r"), "the grant remains available in an actual resumed launch"); } finally { await useFakeRuntime(null); diff --git a/test/codex-args.test.js b/test/codex-args.test.js index 40e6bd30..b04729f7 100644 --- a/test/codex-args.test.js +++ b/test/codex-args.test.js @@ -13,7 +13,8 @@ import { createFakeRuntime } from "./fixtures/fake-runtime-backend.js"; const scratch = ensureTestEnv(); const { buildCodexArgs, buildCodexEnv, createCodexProgressState, headerHelperPath, headerHelperSource, progressFromCodexEvent } = await import("../src/engines/codex.js"); -const { CONTAINER_HOME, CONTAINER_PATH, localRuntimeTarget } = await import("../src/engines/runtime-target.js"); +const { CONTAINER_HOME, CONTAINER_PATH } = await import("../src/engines/runtime-target.js"); +const { hostBackend } = await import("../src/runtimes/host.js"); const { workspaceRoot } = await import("../src/config/paths.js"); const { allowedFsRoot } = await import("../src/web/security.js"); @@ -112,11 +113,19 @@ test("the network switch is validated but compiles to nothing in argv — egress assert.throws(() => argsFor({ networkMode: "unrestricted" }), /Unknown Codex network mode/); }); -test("Codex has no host path any more: no target, or the daemon's own local spawner, is refused before any argv exists", () => { - assert.throws(() => argsFor({ target: null }), /Codex runs only inside a channel container/); - assert.throws(() => argsFor({ target: localRuntimeTarget(target.cwd) }), /Codex runs only inside a channel container/); - assert.throws(() => buildCodexEnv({}, { PATH: "/usr/bin" }), /Codex runs only inside a channel container/); - assert.throws(() => buildCodexEnv({ target: localRuntimeTarget("/work") }, { PATH: "/usr/bin" }), /Codex runs only inside a channel container/); +test("sudo-host Codex uses host helpers and the direct host environment", () => { + const host = hostBackend.prepareTarget({ slug: "sudo", cwd: "/work", workDir: "/work", cleanWorkDir: "", meta: { sudoMode: true }, settings: {} }); + const args = argsFor({ target: host, cwd: "/work", outFile: "/tmp/out.txt", dangerouslySkip: true, gatewayFsRoot: "/", gatewayWorkspaceRoot: "/work", secretBundlePath: "/tmp/bundle.json" }); + assert.ok(args.includes("--dangerously-bypass-approvals-and-sandbox")); + assert.ok(args.some((value) => value.includes("src/mcp/secret-env-bridge.js")), "host helper comes from this checkout"); + assert.ok(cfgValues(args).some((value) => value.startsWith("mcp_servers.gateway.env.CHANNELGATE_DIR="))); + assert.ok(!cfgValues(args).includes("features.use_legacy_landlock=true"), "the container-only sandbox mechanism is absent"); + + const env = buildCodexEnv({ target: host }, { HOME: "/home/operator", CODEX_HOME: "/home/operator/.codex", PATH: "/usr/bin", SLACK_BOT_TOKEN: "never" }); + assert.equal(env.HOME, "/home/operator"); + assert.equal(env.CODEX_HOME, "/home/operator/.codex"); + assert.equal(env.PATH, "/usr/bin"); + assert.equal(env.SLACK_BOT_TOKEN, undefined, "direct host execution still does not leak daemon secrets"); }); test("autonomous Codex runs use auto-review instead of invisible approval cancellation", () => { diff --git a/test/codex-rates.test.js b/test/codex-rates.test.js index e3d8a08b..1c259c80 100644 --- a/test/codex-rates.test.js +++ b/test/codex-rates.test.js @@ -12,7 +12,8 @@ const { DEFAULT_CODEX_RATES, getCodexModelRates, saveSettings } = await import(" test("default rates cover exactly the fixed model list", () => { const rates = getCodexModelRates(); assert.deepEqual(Object.keys(rates).sort(), Object.keys(DEFAULT_CODEX_RATES).sort()); - assert.equal(rates["gpt-5.6-sol"].input, 5); + assert.deepEqual(rates["gpt-6-astra"], { input: 10, cachedInput: 1, output: 50 }); + assert.deepEqual(rates["gpt-5.6-sol"], { input: 4, cachedInput: 0.4, output: 20 }); assert.equal(rates["gpt-5.6-terra"].output, 12); assert.equal(rates["gpt-5.6-luna"].cachedInput, 0.02); assert.equal(rates["gpt-5.5"].input, 5); @@ -41,12 +42,13 @@ test("matches official model variants by boundary and leaves an unresolved CLI s test("applies long-context rates per request, never to a turn aggregate", () => { const aggregate = { input_tokens: 400_000, cached_input_tokens: 200_000, output_tokens: 10_000 }; - assert.equal(estimateCodexCost(aggregate, "gpt-5.6-sol").costUSD, 1.4); - assert.equal(estimateCodexCost(aggregate, "gpt-5.6-sol", [{ usage: aggregate }]).costUSD, 2.65); + assert.equal(estimateCodexCost(aggregate, "gpt-5.6-sol").costUSD, 1.08); + assert.equal(estimateCodexCost(aggregate, "gpt-5.6-sol", [{ usage: aggregate }]).costUSD, 2.06); const atThreshold = { input_tokens: 272_000, output_tokens: 0 }; const overThreshold = { input_tokens: 272_001, output_tokens: 0 }; - assert.equal(estimateCodexCost(atThreshold, "gpt-5.6-sol", [{ usage: atThreshold }]).costUSD, 1.36); - assert.equal(estimateCodexCost(overThreshold, "gpt-5.6-sol", [{ usage: overThreshold }]).costUSD, 2.72001); + assert.equal(estimateCodexCost(atThreshold, "gpt-5.6-sol", [{ usage: atThreshold }]).costUSD, 1.088); + assert.equal(estimateCodexCost(overThreshold, "gpt-5.6-sol", [{ usage: overThreshold }]).costUSD, 2.176008); + assert.equal(estimateCodexCost(overThreshold, "gpt-6-astra", [{ usage: overThreshold }]).costUSD, 5.44002); }); test("supports nested cached/cache-write details and clamps malformed subsets", () => { @@ -55,10 +57,10 @@ test("supports nested cached/cache-write details and clamps malformed subsets", input_tokens_details: { cached_tokens: 400_000, cache_write_tokens: 100_000 }, output_tokens: 0, }; - // 500k full × $5 + 400k cached × $.50 + 100k write × $6.25 = $3.325. - assert.equal(estimateCodexCost(usage, "gpt-5.6-sol").costUSD, 3.325); + // 500k full × $4 + 400k cached × $.40 + 100k write × $5 = $2.66. + assert.equal(estimateCodexCost(usage, "gpt-5.6-sol").costUSD, 2.66); const malformed = { input_tokens: 10, input_tokens_details: { cached_tokens: 20, cache_write_tokens: 20 } }; - assert.equal(estimateCodexCost(malformed, "gpt-5.6-sol").costUSD, 0.000005); + assert.equal(estimateCodexCost(malformed, "gpt-5.6-sol").costUSD, 0.000004); }); test("normalizeUsage estimates only for codex; claude without cost stays null", () => { @@ -76,9 +78,13 @@ test("normalizeUsage estimates only for codex; claude without cost stays null", test("retired full-table defaults migrate while genuine admin overrides survive", () => { saveSettings({ codexModelRates: { + "gpt-5.6-sol": { input: 5, cachedInput: 0.5, output: 30 }, + "gpt-5.6": { input: 5, cachedInput: 0.5, output: 30 }, "gpt-5.6-terra": { input: 2.5, cachedInput: 0.25, output: 15 }, "gpt-5.6-luna": { input: 1, cachedInput: 0.1, output: 6 }, } }); + assert.deepEqual(getCodexModelRates()["gpt-5.6-sol"], { input: 4, cachedInput: 0.4, output: 20 }); + assert.deepEqual(getCodexModelRates()["gpt-5.6"], { input: 4, cachedInput: 0.4, output: 20 }); assert.deepEqual(getCodexModelRates()["gpt-5.6-terra"], { input: 2, cachedInput: 0.2, output: 12 }); assert.deepEqual(getCodexModelRates()["gpt-5.6-luna"], { input: 0.2, cachedInput: 0.02, output: 1.2 }); saveSettings({ codexModelRates: { @@ -86,3 +92,7 @@ test("retired full-table defaults migrate while genuine admin overrides survive" } }); assert.deepEqual(getCodexModelRates()["gpt-5.6-terra"], { input: 3, cachedInput: 0.3, output: 18 }); }); + +test("keeps CLI-only models without published API rates explicitly unpriced", () => { + assert.equal(estimateCodexCost({ input_tokens: 1_000_000 }, "gpt-5.3-codex-spark").costUSD, null); +}); diff --git a/test/default-nudges.test.js b/test/default-nudges.test.js index d8a85ac6..4d7cc3e2 100644 --- a/test/default-nudges.test.js +++ b/test/default-nudges.test.js @@ -1,51 +1,78 @@ -// Org-default no-response nudge: getDefaultNudges reads the settings flag, and the "reset all" -// route's patch (patchChannelMeta with a defaultChannelMeta fallback) preserves every other field -// on an existing channel while writing a FULL default record — never a nudges-only partial — for a -// channel that has no meta row yet. Scratch gateway dir + SQLite (env set before the store import). -import { test } from "node:test"; +// Organization default + bulk reset for personal quiet-thread reminders. The preference belongs +// to a user record, never channel metadata, and bulk changes preserve every unrelated user field. +import { test, after } from "node:test"; import assert from "node:assert/strict"; +import express from "express"; import { ensureTestEnv } from "./helpers.js"; ensureTestEnv(); -const { saveChannelMeta, getChannelMeta, patchChannelMeta, defaultChannelMeta } = await import("../src/config/store.js"); -const { getDefaultNudges, saveSettings } = await import("../src/config/settings.js"); +const { getUser, setUser } = await import("../src/config/store.js"); +const { getDefaultNudges, saveSettings, userNudgesEnabled } = await import("../src/config/settings.js"); +const { createUsersRouter } = await import("../src/web/routes/users.js"); -// Mirror of the reset-nudges route body for one channel. -const resetOne = (ch, nudges) => - patchChannelMeta(ch.slug, (current) => { - const base = current ?? defaultChannelMeta({ channelId: ch.channelId, name: ch.name, type: ch.type, isDM: ch.isDM }); - return { ...base, nudges }; - }); +const app = express(); +app.use(express.json()); +app.use(createUsersRouter()); +const server = await new Promise((resolve) => { + const instance = app.listen(0, "127.0.0.1", () => resolve(instance)); +}); +const base = `http://127.0.0.1:${server.address().port}`; +after(() => server.close()); + +test("user reminder preference defaults off and follows an explicit personal override", async () => { + assert.equal(getDefaultNudges(), false); + assert.equal(userNudgesEnabled(await getUser("U_MISSING")), false); -test("getDefaultNudges defaults off and follows the saved flag", () => { - assert.equal(getDefaultNudges(), false); // unset → off (nudges stay opt-in) saveSettings({ defaultNudges: true }); assert.equal(getDefaultNudges(), true); + assert.equal(userNudgesEnabled(null), false, "a missing/deleted user fails closed"); + assert.equal(userNudgesEnabled({ name: "legacy row" }), true, "legacy rows inherit the current default until backfilled"); + assert.equal(userNudgesEnabled({ nudges: false }), false, "a user's own choice wins"); + saveSettings({ defaultNudges: false }); - assert.equal(getDefaultNudges(), false); + assert.equal(userNudgesEnabled({ nudges: true }), true); }); -test("reset flips nudges but keeps every other field", async () => { - await saveChannelMeta("keep", { adminMode: true, allowBash: true, skills: ["x"], nudges: false }); - const next = await resetOne({ slug: "keep", channelId: "C1", name: "keep", type: "channel", isDM: false }, true); - assert.equal(next.nudges, true); - assert.equal(next.adminMode, true); // untouched - assert.equal(next.allowBash, true); - assert.deepEqual(next.skills, ["x"]); +test("bulk reset applies the default to users without changing their other fields", async () => { + await setUser("U_KEEP", { + name: "Keep", + approved: true, + isAdmin: true, + skills: ["x"], + composioToken: "secret-kept", + nudges: false, + }); + await setUser("U_OTHER", { name: "Other", approved: false, nudges: false }); + saveSettings({ defaultNudges: true }); + + const response = await fetch(`${base}/users/reset-nudges`, { method: "POST" }); + assert.equal(response.status, 200); + const result = await response.json(); + assert.equal(result.nudges, true); + assert.equal(result.count, 2); + + const kept = await getUser("U_KEEP"); + assert.equal(kept.nudges, true); + assert.equal(kept.name, "Keep"); + assert.equal(kept.approved, true); + assert.equal(kept.isAdmin, true); + assert.deepEqual(kept.skills, ["x"]); + assert.equal(kept.composioToken, "secret-kept"); + assert.equal((await getUser("U_OTHER")).nudges, true); }); -test("reset on a channel with no meta row writes a full default record, not a nudges-only partial", async () => { - const next = await resetOne({ slug: "fresh", channelId: "C9", name: "fresh", type: "channel", isDM: false }, true); - assert.equal(next.nudges, true); - // A full record has the rest of the default shape — a partial {nudges} would be missing these. - assert.equal(next.channelId, "C9"); - assert.equal(next.access, "approved"); - assert.deepEqual(next.allowedUsers, []); - assert.equal(next.adminMode, false); - const stored = await getChannelMeta("fresh"); // survives the JSON round-trip with the full shape - assert.equal(stored.nudges, true); - assert.equal(stored.access, "approved"); - assert.equal(stored.channelId, "C9"); - assert.equal(stored.adminMode, false); +test("the user API exposes and saves the personal reminder choice", async () => { + const save = await fetch(`${base}/users/U_KEEP`, { + method: "PUT", + headers: { "content-type": "application/json" }, + body: JSON.stringify({ nudges: false }), + }); + assert.equal(save.status, 200); + assert.equal((await save.json()).user.nudges, false); + + const list = await fetch(`${base}/users`); + const users = (await list.json()).users; + assert.equal(users.U_KEEP.nudges, false); + assert.equal(users.U_KEEP.composioToken, undefined, "the new preference does not weaken secret masking"); }); diff --git a/test/drivesync.test.js b/test/drivesync.test.js index 6935614c..6f6fc69d 100644 --- a/test/drivesync.test.js +++ b/test/drivesync.test.js @@ -5,7 +5,7 @@ import { test } from "node:test"; import assert from "node:assert/strict"; import path from "node:path"; -import { statSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; +import { chmodSync, statSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"; import os from "node:os"; import { ensureTestEnv, tempDir } from "./helpers.js"; @@ -180,7 +180,7 @@ test("the resync sentinel is written only on a successful pass", () => { assert.ok(write > success && write < failure, "a failed --resync must leave the channel in first-run state"); }); -test("rclone availability is cached per binary path, so correcting a wrong path takes effect", () => { +test("rclone availability caches hits per path but retries misses after a live install", () => { assert.equal(rcloneAvailable(path.join(os.tmpdir(), "cg-absent-rclone-a")), false); assert.equal(rcloneAvailable(path.join(os.tmpdir(), "cg-absent-rclone-b")), false); if (process.platform !== "win32") { @@ -188,7 +188,13 @@ test("rclone availability is cached per binary path, so correcting a wrong path // path in Settings did nothing until the daemon restarted. `/bin/echo version` exits 0, which // is all the probe asks of a binary. assert.equal(rcloneAvailable("/bin/echo"), true); - assert.equal(rcloneAvailable(path.join(os.tmpdir(), "cg-absent-rclone-a")), false); // still remembered + const late = path.join(tempDir("cg-rclone-late-"), "rclone"); + assert.equal(rcloneAvailable(late), false); + writeFileSync(late, "#!/bin/sh\nexit 0\n"); + chmodSync(late, 0o755); + assert.equal(rcloneAvailable(late), true, "a previously missing binary becomes available without a daemon restart"); + rmSync(late, { force: true }); + assert.equal(rcloneAvailable(late), true, "successful probes remain cached for the same path"); assert.equal(rcloneAvailable("/bin/echo"), true); // …and so is the hit } }); diff --git a/test/engine-adapter-contract.test.js b/test/engine-adapter-contract.test.js index f0b6d6ae..e09c8472 100644 --- a/test/engine-adapter-contract.test.js +++ b/test/engine-adapter-contract.test.js @@ -38,11 +38,16 @@ test("adapter registration and RunContext validation fail closed", () => { test("built-in registry publishes safe UI manifests and a generic fallback graph", () => { const manifests = engineUiManifest(); - assert.deepEqual(manifests.map((m) => m.id), ["claude", "codex", "opencode"]); + assert.deepEqual(manifests.map((m) => m.id), ["claude", "codex", "qwen", "opencode"]); assert.ok(manifests.every((m) => !Object.values(m).some((v) => typeof v === "function"))); assert.deepEqual(fallbackTargets("claude"), ["codex"]); assert.deepEqual(fallbackTargets("codex"), ["claude"], "failover is bidirectional — either harness covers the other"); assert.deepEqual(fallbackTargets("opencode"), []); + // An opt-in, third-party-provider harness is a terminal node in BOTH directions: failing a Qwen + // turn over would spend the operator's Anthropic quota, and failing Claude over to Qwen would + // spend a QwenCloud balance nobody pointed at that thread. + assert.deepEqual(fallbackTargets("qwen"), []); + assert.ok(!fallbackTargets("claude").includes("qwen")); assert.throws(() => requireAdapter("missing"), /Unknown or unavailable/); }); diff --git a/test/engine-failover.test.js b/test/engine-failover.test.js index 4766fbed..32b2d9b1 100644 --- a/test/engine-failover.test.js +++ b/test/engine-failover.test.js @@ -73,6 +73,15 @@ test("codexTurnError attaches the classification to the thrown details", () => { assert.equal(details.providerKind, "usage_limit"); }); +test("a plain-text turn.failed capacity error is a transient provider failure", () => { + const message = "Selected model is at capacity. Please try a different model."; + const failure = codexTurnError({ type: "turn.failed", error: message }); + assert.equal(failure.message, message); + assert.equal(failure.details.engine, "codex"); + assert.equal(failure.details.providerError, true, "turn.failed is the terminal provider verdict even when error is a string"); + assert.equal(failure.details.providerKind, "transient"); +}); + // ── Failover graph + replay safety ───────────────────────────────────────────── test("either harness is the other's failover target", () => { @@ -115,10 +124,14 @@ test("engines are enabled by default and the map round-trips through settings", assert.equal(isEngineEnabled("codex"), true); assert.equal(isEngineEnabled("nope"), false, "an unknown id is never enabled"); + // …except an OPT-IN harness (Qwen), which needs a provider credential nobody has by default and + // is therefore available only where an admin explicitly switched it on. + assert.equal(isEngineEnabled("qwen"), false, "an opt-in harness is not enabled by a missing key"); + saveSettings({ engineEnabled: { claude: true, codex: false, opencode: false } }); assert.equal(isEngineEnabled("codex"), false); assert.deepEqual(getEnabledEngines(), ["claude"]); - assert.deepEqual(getEngineEnabledMap(), { claude: true, codex: false, opencode: false }); + assert.deepEqual(getEngineEnabledMap(), { claude: true, codex: false, qwen: false, opencode: false }); assert.equal(settingsForApi().engineEnabled.codex, false); }); diff --git a/test/engine-registry.test.js b/test/engine-registry.test.js index 8c5fdd29..77bcc2c9 100644 --- a/test/engine-registry.test.js +++ b/test/engine-registry.test.js @@ -17,7 +17,7 @@ const { const UNKNOWN = "future-engine"; test("all shipped engines are registered with the facts callers depend on", () => { - assert.deepEqual([...ENGINE_IDS], ["claude", "codex", "opencode"]); + assert.deepEqual([...ENGINE_IDS], ["claude", "codex", "qwen", "opencode"]); for (const id of ENGINE_IDS) { const a = adapterFor(id); assert.equal(a.id, id); @@ -29,6 +29,12 @@ test("all shipped engines are registered with the facts callers depend on", () = } }); +test("Codex fallback models match the current selectable CLI catalog", () => { + assert.deepEqual(adapterFor("codex").models.map((model) => model.value), [ + "codex", "gpt-6-astra", "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.5", "gpt-5.3-codex-spark", + ]); +}); + test("an unregistered engine is detectable rather than silently treated as Claude", () => { assert.equal(isEngineId(UNKNOWN), false); assert.equal(adapterFor(UNKNOWN), null, "the honest answer is 'I don't know this engine'"); diff --git a/test/engine-runtime-isolated.test.js b/test/engine-runtime-isolated.test.js index 7378e154..24613650 100644 --- a/test/engine-runtime-isolated.test.js +++ b/test/engine-runtime-isolated.test.js @@ -3,8 +3,8 @@ // host-shaped fact — the daemon's HOME and PATH, the toolchain launcher dir, the permission // profiles compiled against host paths, the gateway root — is either replaced by the image's // equivalent or left out entirely. The only non-container spawn left is the daemon's OWN local -// turn (the update smoke probe): Claude still serves it with the host layout, unchanged, and Codex -// — which has no daemon-own turn — refuses it outright. +// turn (the update smoke probe): Claude still serves it with the host layout, unchanged. Codex's +// non-isolated path is used by the explicitly admitted sudo-host runtime. import test from "node:test"; import assert from "node:assert/strict"; import { readdirSync, rmSync, writeFileSync } from "node:fs"; @@ -149,7 +149,7 @@ test("a containerized Claude turn passes the argv it was given, and nothing host await pending; }); -test("Codex env inside a container points at the image's HOME, CODEX_HOME and tmpfs", () => { +test("Codex env follows the container inside isolation and the host on a sudo runtime", () => { const rt = createFakeRuntime(); const target = rt.target(); const env = buildCodexEnv({ @@ -165,10 +165,11 @@ test("Codex env inside a container points at the image's HOME, CODEX_HOME and tm assert.equal(env.NODE_USE_ENV_PROXY, "1"); assert.equal(env.XDG_RUNTIME_DIR, undefined, "host locations are dropped, not carried into the image"); - // There is no host layout for Codex any more: the builder refuses to produce one rather than - // hand a container-less child the daemon's HOME and CODEX_HOME. - assert.throws(() => buildCodexEnv({ extraEnv: { VERCEL_TOKEN: "vt_live" } }, SOURCE), /Codex runs only inside a channel container/); - assert.throws(() => buildCodexEnv({ target: localRuntimeTarget("/work") }, SOURCE), /Codex runs only inside a channel container/); + const host = buildCodexEnv({ extraEnv: { VERCEL_TOKEN: "vt_live" }, target: localRuntimeTarget("/work") }, SOURCE); + assert.equal(host.HOME, SOURCE.HOME); + assert.equal(host.PATH, SOURCE.PATH); + assert.equal(host.TMPDIR, SOURCE.TMPDIR); + assert.equal(host.VERCEL_TOKEN, "vt_live"); }); test("Codex in a container states a sandbox MODE and compiles no host permission profile", () => { @@ -257,22 +258,24 @@ test("Codex MCP entries in a container are composed from the runtime's helper co assert.ok(!args.some((arg) => arg.includes(gatewayRoot())), "no daemon-root path anywhere in the argv"); }); -test("Codex has no local path: the daemon's own spawner is refused before any argv names a checkout script", async () => { - // Before 2026-09-03 a host run composed its MCP entries from this checkout, run by this node. - // That path is gone with the host backend, and the refusal is the same for the args builder, - // the env builder and the runner — nothing partial is ever produced. - const base = { prompt: "go", sessionId: "t-1", isNewSession: true, cwd: "/work", outFile: "/gw/out.txt", secretBundlePath: "/gw/run-tmp/bundle.json", gatewayCapability: "signed-cap", gatewayFsRoot: "/gw", gatewayWorkspaceRoot: "/work" }; - assert.throws(() => buildCodexArgs({ ...base, target: localRuntimeTarget("/work") }), /Codex runs only inside a channel container/); - assert.throws(() => buildCodexArgs(base), /Codex runs only inside a channel container/); - await assert.rejects( - runCodex({ cwd: "/work", prompt: "go", sessionId: "", isNewSession: true, target: localRuntimeTarget("/work"), timeoutMs: 5_000 }), - (error) => { - assert.match(error.message, /Codex runs only inside a channel container/); - assert.equal(error.details?.engine, "codex"); - assert.equal(error.details?.providerError, false, "a runtime refusal, not a provider failure"); - return true; - }, - ); +test("a sudo-host Codex turn uses host scratch/auth state and crosses the runtime seam", async (t) => { + const rt = createFakeRuntime({ id: "host", isolated: false, fingerprint: "host" }); + const codexHome = tempDir("cg-codex-host-"); + writeFileSync(path.join(codexHome, "auth.json"), JSON.stringify({ tokens: { access_token: "present" } })); + t.after(() => rmSync(codexHome, { recursive: true, force: true })); + const target = rt.target({ artifactDir: null, container: null, cwd: "/work" }); + const pending = runCodex({ cwd: "/work", prompt: "go", sessionId: "", isNewSession: true, dangerouslySkip: true, clean: true, codexStateDir: codexHome, target, timeoutMs: 60_000 }); + await waitUntil(() => rt.spawns.length === 1); + const spec = rt.spawns[0]; + assert.ok(spec.args.includes("--dangerously-bypass-approvals-and-sandbox")); + assert.ok(spec.args[spec.args.indexOf("-o") + 1].startsWith(path.join(gatewayRoot(), "tmp"))); + assert.equal(spec.env.HOME, process.env.HOME); + writeFileSync(spec.args[spec.args.indexOf("-o") + 1], "host answer"); + rt.children[0].stdout.write(`${JSON.stringify({ type: "thread.started", thread_id: "host-thread" })}\n`); + rt.children[0].stdout.write(`${JSON.stringify({ type: "turn.completed", usage: { input_tokens: 1, output_tokens: 1 } })}\n`); + rt.children[0].emit("close", 0, null); + const result = await pending; + assert.equal(result.content, "host answer"); }); test("a containerized Codex turn writes its answer file and secret bundle into the mounted artifact dir", async (t) => { diff --git a/test/file-explorer.test.js b/test/file-explorer.test.js index f567dacf..31361bcb 100644 --- a/test/file-explorer.test.js +++ b/test/file-explorer.test.js @@ -612,6 +612,20 @@ test("local uploads reject oversized files before contacting Slack", async (t) = await assert.rejects(() => uploadLocalFile({ filePath: huge, channelId: "C123" }), /larger than the 25 MB/i); }); +test("local uploads refuse a final-component symlink before reading or contacting Slack", async (t) => { + const root = await mkdtemp(path.join(os.tmpdir(), "cg-upload-root-")); + const outside = await mkdtemp(path.join(os.tmpdir(), "cg-upload-outside-")); + t.after(async () => Promise.all([rm(root, { recursive: true, force: true }), rm(outside, { recursive: true, force: true })])); + await writeFile(path.join(outside, "private.png"), Buffer.from("private")); + const link = path.join(root, "preview.png"); + await symlink(path.join(outside, "private.png"), link); + + await assert.rejects( + () => uploadLocalFile({ filePath: link, rootPath: root, channelId: "C123" }), + /ELOOP|symbolic link|outside/i, + ); +}); + test("browser uploads preserve safe folder trees and collision-rename files", async (t) => { const { root } = await fixture(t); const first = await saveBrowserUploadedFile(root, "docs", "Project/assets/logo.txt", Buffer.from("first\n")); diff --git a/test/fixtures/codex b/test/fixtures/codex index 4b00f611..3e60cad3 100755 --- a/test/fixtures/codex +++ b/test/fixtures/codex @@ -21,6 +21,7 @@ fail="no" two_segments="no" subagents="no" transient_times=0 +capacity_plain="no" transient_after_tool="no" reject_model="no" reject_all_models="no" @@ -51,6 +52,7 @@ for arg in "$@"; do *CODEX_STUB_SUBAGENTS*) subagents="yes" ;; *CODEX_STUB_TRANSIENT_TWICE*) transient_times=2 ;; *CODEX_STUB_TRANSIENT_ALWAYS*) transient_times=999 ;; + *CODEX_STUB_CAPACITY_PLAIN*) capacity_plain="yes" ;; *CODEX_STUB_TRANSIENT_AFTER_TOOL*) transient_after_tool="yes" ;; *CODEX_STUB_REJECT_MODEL_BODY*) reject_model_body="yes" ;; *CODEX_STUB_REJECT_ALL_MODELS_BODY*) reject_all_models_body="yes" ;; @@ -151,6 +153,13 @@ if [ "$transient_times" -gt 0 ]; then exit 1 fi fi +# A current Codex capacity refusal: `turn.failed` carries a plain string instead of the structured +# error object older CLI builds emitted. It is still a provider verdict and must take the same +# transient retry/failover path. +if [ "$capacity_plain" = "yes" ]; then + printf '%s\n' '{"type":"turn.failed","error":"Selected model is at capacity. Please try a different model."}' + exit 1 +fi # The same outage AFTER a tool ran: the turn may have mutated something, so it must NOT be retried. if [ "$transient_after_tool" = "yes" ]; then printf '%s\n' '{"type":"item.started","item":{"id":"tool-before-transient","type":"command_execution","command":"already-ran"}}' diff --git a/test/folders-settings.test.js b/test/folders-settings.test.js index fbb2c901..1a2dfc80 100644 --- a/test/folders-settings.test.js +++ b/test/folders-settings.test.js @@ -228,7 +228,7 @@ test("gateway MCP permission list tracks registered gateway tools", () => { // Tool registrations live in the per-group modules under src/mcp/tools/ (registered by the // gateway-server.js entry). Group order differs from the flat pre-split file, so compare the // registered names as a sorted list — same set, no duplicates, nothing lost. - const toolModules = ["schedules.js", "background.js", "channel-admin.js", "channel-database.js", "tokens.js", "slack-native.js", "skills.js"]; + const toolModules = ["schedules.js", "background.js", "channel-admin.js", "channel-database.js", "tokens.js", "slack-native.js", "skills.js", "questions.js"]; const source = toolModules .map((file) => readFileSync(new URL(`../src/mcp/tools/${file}`, import.meta.url), "utf8")) .join("\n"); diff --git a/test/gateway-mcp-authz.test.js b/test/gateway-mcp-authz.test.js index 112019f0..a8e41a5d 100644 --- a/test/gateway-mcp-authz.test.js +++ b/test/gateway-mcp-authz.test.js @@ -127,6 +127,21 @@ test("API-spoofed admin ids cannot use any user/channel gateway authority", asyn }); }); +test("an untrusted principal's permission prompt is refused in the shape Claude Code parses", async () => { + // Plain text here surfaces as "The permission prompt tool returned an invalid permission result". + const capability = mintGatewayCapability({ + secret: "authz-test-secret", channelId: "C_MCP_CURRENT", slug: "mcp-authz-test", + authorId: "U_MCP_API_SPOOF", threadKey: "1.000", origin: "api_foreground", engine: "claude", + principalTrusted: false, + }); + await withGateway({ author: "U_MCP_API_SPOOF", capability }, async (client) => { + const result = await client.callTool({ name: "permission_prompt", arguments: { tool_name: "Bash", input: { command: "true" } } }); + const decision = JSON.parse(resultText(result)); + assert.equal(decision.behavior, "deny"); + assert.match(decision.message, /trusted Slack principal/i); + }); +}); + test("set_my_composio_token writes only the signed principal's record", async () => { await setUser("U_MCP_CALLER", { name: "Caller", composioToken: "caller-old" }); await setUser("U_MCP_OTHER", { name: "Other", composioToken: "other-unchanged" }); diff --git a/test/home-nudges.test.js b/test/home-nudges.test.js new file mode 100644 index 00000000..3c950617 --- /dev/null +++ b/test/home-nudges.test.js @@ -0,0 +1,67 @@ +// Slack App Home owns the user's self-service reminder switch. It may update only the clicking +// user's record, and immediately republishes Home so the visible state matches the saved value. +import { test } from "node:test"; +import assert from "node:assert/strict"; +import { ensureTestEnv } from "./helpers.js"; + +ensureTestEnv(); + +const { + NUDGE_HOME_TOGGLE_ACTION, + nudgeHomeBlocks, + registerNudgeHomeActions, +} = await import("../src/slack/home-nudges.js"); +const { getUser, setUser } = await import("../src/config/store.js"); + +function makeApp() { + const actions = new Map(); + return { actions, action: (id, fn) => actions.set(id, fn) }; +} + +test("Home renders the opposite action for the current personal state", () => { + const off = nudgeHomeBlocks({ enabled: false })[0]; + assert.match(off.text.text, /off/); + assert.equal(off.accessory.action_id, NUDGE_HOME_TOGGLE_ACTION); + assert.equal(off.accessory.value, "on"); + assert.match(off.accessory.text.text, /Turn on/); + + const on = nudgeHomeBlocks({ enabled: true })[0]; + assert.match(on.text.text, /on/); + assert.equal(on.accessory.value, "off"); + assert.match(on.accessory.text.text, /Turn off/); +}); + +test("the Home action changes only the clicking user's preference and republishes their view", async () => { + await setUser("U_CLICK", { name: "Click", nudges: false }); + await setUser("U_OTHER", { name: "Other", nudges: true }); + const app = makeApp(); + const published = []; + registerNudgeHomeActions(app, { publishHome: async (_client, userId) => published.push(userId) }); + + let acked = 0; + await app.actions.get(NUDGE_HOME_TOGGLE_ACTION)({ + ack: async () => { acked++; }, + body: { user: { id: "U_CLICK" } }, + action: { value: "on" }, + client: {}, + }); + + assert.equal(acked, 1); + assert.equal((await getUser("U_CLICK")).nudges, true); + assert.equal((await getUser("U_OTHER")).nudges, true); + assert.deepEqual(published, ["U_CLICK"]); +}); + +test("a forged toggle value is acknowledged but changes nothing", async () => { + await setUser("U_FORGED", { nudges: false }); + const app = makeApp(); + registerNudgeHomeActions(app, { publishHome: async () => assert.fail("must not republish") }); + + await app.actions.get(NUDGE_HOME_TOGGLE_ACTION)({ + ack: async () => {}, + body: { user: { id: "U_FORGED" } }, + action: { value: "surprise" }, + client: {}, + }); + assert.equal((await getUser("U_FORGED")).nudges, false); +}); diff --git a/test/make-toolbox-admin.test.js b/test/make-toolbox-admin.test.js index ef299f4f..03b99967 100644 --- a/test/make-toolbox-admin.test.js +++ b/test/make-toolbox-admin.test.js @@ -72,7 +72,7 @@ test("channel API saves, preserves, masks, validates, and clears one Make toolbo const unrelated = await request("/channels/C_MAKE/meta", { method: "PUT", - body: { nudges: true }, + body: { memory: true }, }); assert.equal(unrelated.response.status, 200); assert.equal((await getChannelMeta(entry.slug)).makeToolboxKey, "channel-key-1234"); diff --git a/test/managed-write-symlinks.test.js b/test/managed-write-symlinks.test.js index ba3b1ad5..314c4fbe 100644 --- a/test/managed-write-symlinks.test.js +++ b/test/managed-write-symlinks.test.js @@ -12,6 +12,8 @@ import assert from "node:assert/strict"; import { chmod, mkdtemp, mkdir, readFile, readdir, realpath, stat, writeFile, symlink, lstat, rm } from "node:fs/promises"; import os from "node:os"; import path from "node:path"; +import { spawnSync } from "node:child_process"; +import { fileURLToPath } from "node:url"; import { ensureTestEnv } from "./helpers.js"; ensureTestEnv(); @@ -19,7 +21,7 @@ ensureTestEnv(); // test ever provisions a folder in the operator's real ~/Slack Agent. process.env.CG_WORKSPACE_DIR ||= await mkdtemp(path.join(os.tmpdir(), "cg-ws-")); -const [{ readNoFollow, writeNoFollow, writeStreamNoFollow, createExclusive, ensureRealDir }, memory, guide, folders, librarySkills, apiRuns, pipeline, paths, attachments, { ATTACHMENT_MAX_BYTES }] = +const [{ readNoFollow, writeNoFollow, writeStreamNoFollow, createExclusive, ensureRealDir, removeRegularFileWithin }, memory, guide, folders, librarySkills, apiRuns, pipeline, paths, attachments, { ATTACHMENT_MAX_BYTES }] = await Promise.all([ import("../src/gateway/safe-fs.js"), import("../src/gateway/channel-memory.js"), @@ -91,6 +93,25 @@ test("readNoFollow rethrows a REAL read failure instead of reporting the file as assert.equal(await readNoFollow(dir), null); }); +test("managed cleanup removes only regular files that remain inside its trusted root", async (t) => { + const { cwd, outside } = await scratch(t); + const uploads = path.join(cwd, "uploads"); + await mkdir(uploads); + const processed = path.join(uploads, "voice.wav"); + const outsideFile = path.join(outside, "keep.wav"); + const plantedLink = path.join(uploads, "swapped.wav"); + await writeFile(processed, "processed"); + await writeFile(outsideFile, "outside"); + await symlink(outsideFile, plantedLink); + + assert.equal(await removeRegularFileWithin(uploads, processed), true); + await assert.rejects(readFile(processed), { code: "ENOENT" }); + assert.equal(await removeRegularFileWithin(uploads, outsideFile), false); + assert.equal(await removeRegularFileWithin(uploads, plantedLink), false); + assert.equal(await readFile(outsideFile, "utf8"), "outside"); + assert.equal((await lstat(plantedLink)).isSymbolicLink(), true); +}); + test("writeNoFollow replaces a symlink node atomically and leaves no temp files behind", async (t) => { const { cwd, outside } = await scratch(t); const managed = path.join(cwd, "MANAGED.md"); @@ -234,7 +255,33 @@ test("the gateway-usage refresh replaces planted symlinks inside its own skill f await assertReplacedNode(path.join(skillDir, "SKILL.md"), skillVictim); assert.match(await readFile(path.join(skillDir, "SKILL.md"), "utf8"), /name: gateway-usage/); assert.match(await readFile(path.join(skillDir, "references", "video-understanding.md"), "utf8"), /two synchronized evidence streams/); + assert.match(await readFile(path.join(skillDir, "references", "video-understanding.md"), "utf8"), /remove the original only[\s\S]*beneath the current channel's `uploads\/` directory/); assert.match(await readFile(path.join(skillDir, "scripts", "analyze_video.py"), "utf8"), /timestamped visual\/audio evidence pack/); + assert.match(await readFile(path.join(skillDir, "scripts", "cleanup_uploaded_media.py"), "utf8"), /current channel's managed uploads directory/); +}); + +test("the video cleanup helper removes uploads and refuses outside files or symlinks", async (t) => { + const { cwd, outside } = await scratch(t); + const uploads = path.join(cwd, "uploads"); + const script = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "src", "gateway", "gateway-usage", "scripts", "cleanup_uploaded_media.py"); + await mkdir(uploads); + const uploaded = path.join(uploads, "recording.mp4"); + const outsideFile = path.join(outside, "project.mp4"); + const link = path.join(uploads, "linked.mp4"); + await writeFile(uploaded, "uploaded"); + await writeFile(outsideFile, "project"); + await symlink(outsideFile, link); + + const removed = spawnSync("python3", [script, uploaded], { cwd, encoding: "utf8" }); + assert.equal(removed.status, 0, removed.stderr); + await assert.rejects(readFile(uploaded), { code: "ENOENT" }); + + const outsideResult = spawnSync("python3", [script, outsideFile], { cwd, encoding: "utf8" }); + assert.equal(outsideResult.status, 2); + const linkResult = spawnSync("python3", [script, link], { cwd, encoding: "utf8" }); + assert.equal(linkResult.status, 2); + assert.equal(await readFile(outsideFile, "utf8"), "project"); + assert.equal((await lstat(link)).isSymbolicLink(), true); }); test("the gateway-usage refresh rebuilds a symlinked .claude/skills path as real directories", async (t) => { diff --git a/test/mcp-control-plane-approval.test.js b/test/mcp-control-plane-approval.test.js index 7fd10ec6..4f3ed4fb 100644 --- a/test/mcp-control-plane-approval.test.js +++ b/test/mcp-control-plane-approval.test.js @@ -378,7 +378,7 @@ test("every registered gateway tool is consciously classified as gated or open ( "slack_channel_history", "slack_thread_replies", "slack_download_file", // lands only in this thread's uploads/ folder, this channel's files only "run_in_background", "run_agent_in_background", // shell kind has its own admin-click gate in background.js - "request_approval", "permission_prompt", "report_progress", + "request_approval", "permission_prompt", "report_progress", "ask_questions", "update_channel_memory", // operator decision 2026-08-07: memory is agent-owned, never approval-gated // operator decision 2026-08-19: reminders/scheduled tasks are an ordinary channel request and // are never approval-gated. A schedule fires with origin "schedule" (cannot escalate — A2), in diff --git a/test/message-normalize.test.js b/test/message-normalize.test.js index 50db4f4b..bc4050c0 100644 --- a/test/message-normalize.test.js +++ b/test/message-normalize.test.js @@ -15,6 +15,7 @@ test("message controls normalize case, spacing, and trailing punctuation", () => assert.equal(isPendingCommand("My Follow-Ups?"), true); assert.equal(isPendingCommand("pending review my PR"), false); assert.deepEqual(parseSlashCommand(" /MODEL high "), { cmd: "model", arg: "high" }); + assert.deepEqual(parseSlashCommand(" /SUDO off "), { cmd: "sudo", arg: "off" }); assert.equal(parseSlashCommand("/unknown"), null); }); diff --git a/test/modes.test.js b/test/modes.test.js index 66163ece..c94c78d9 100644 --- a/test/modes.test.js +++ b/test/modes.test.js @@ -3,9 +3,10 @@ import assert from "node:assert/strict"; import { ensureTestEnv } from "./helpers.js"; ensureTestEnv(); -const { MODE_FLAGS, MODES, channelMode, modeLabel, networkLabel, networkState, PROFILE_FLAGS, PROFILES, channelProfile, canManage, modeSettingsPatch, normalizeModeMeta, authorModeMeta } = +const { MODE_FLAGS, MODES, channelMode, modeLabel, networkLabel, networkState, PROFILE_FLAGS, PROFILES, channelProfile, canManage, modeSettingsPatch, normalizeModeMeta, authorModeMeta, sudoModeMeta } = await import("../src/gateway/modes.js"); const { NETWORK_ADVISORY_NOTE, NETWORK_POLICY_ENFORCED } = await import("../src/engines/network-policy.js"); +const { hasSudoRuntimeAuthority } = await import("../src/runtimes/sudo-authority.js"); // modes.js is the mode/profile → capability-flag mapping plus the "who may manage a channel" // authz check. Both feed directly into what a spawned engine is allowed to do, so the exact @@ -105,6 +106,23 @@ test("Admin gives non-admins Worker plus modifiers and trusted admins full conte assert.equal(authorModeMeta({ cleanMode: true }, { isAdminAuthor: true }).cleanMode, true); }); +test("sudo posture is a transient full host-work bundle without mutating stored metadata", () => { + const stored = { allowBash: false, autoMode: false, cleanMode: true, allowNetwork: false, marker: "kept" }; + const sudo = sudoModeMeta(stored); + assert.deepEqual(Object.fromEntries(Object.entries(sudo)), { + allowBash: true, + autoMode: true, + cleanMode: false, + allowNetwork: true, + adminMode: true, + sudoMode: true, + marker: "kept", + }); + assert.equal(hasSudoRuntimeAuthority(sudo), true); + assert.equal(hasSudoRuntimeAuthority(JSON.parse(JSON.stringify(sudo))), false, "serialization cannot persist host authority"); + assert.deepEqual(stored, { allowBash: false, autoMode: false, cleanMode: true, allowNetwork: false, marker: "kept" }); +}); + test("canManage: admins always; default policy is admins-only", () => { assert.equal(canManage({}, { isAdminUser: true }), true); assert.equal(canManage({}, { isApprovedUser: true }), false); diff --git a/test/nudges-ttl.test.js b/test/nudges-ttl.test.js index 0d73ffe4..bda02350 100644 --- a/test/nudges-ttl.test.js +++ b/test/nudges-ttl.test.js @@ -5,7 +5,7 @@ import { ensureTestEnv } from "./helpers.js"; ensureTestEnv(); // nudges.js imports the store chain — keep any DB access on the scratch file -const { pruneExpired } = await import("../src/gateway/nudges.js"); +const { noteBotReply, pruneExpired, sweepNudges } = await import("../src/gateway/nudges.js"); const DAY = 24 * 60 * 60 * 1000; const rec = (lastBotTs, extra = {}) => ({ channelId: "C1", slug: "s", threadKey: "t", lastBotTs, awaitingUser: true, reminded: false, ...extra }); @@ -38,3 +38,28 @@ test("a custom ttl is honored", () => { pruneExpired(map, now, 5_000); assert.deepEqual([...map.keys()], ["b"]); }); + +test("a due reminder follows the requesting user's live preference and mentions that user", async () => { + const map = new Map(); + noteBotReply("C1", "s", "thread-on", "U_ON", { map, nowMs: 1_000 }); + noteBotReply("C1", "s", "thread-off", "U_OFF", { map, nowMs: 1_000 }); + const posted = []; + const logged = []; + const slack = { snapshot: () => ({ connected: true }), getClient: () => ({}) }; + + await sweepNudges(slack, { + map, + nowMs: 2_000, + thresholdMs: 500, + loadUser: async (userId) => ({ nudges: userId === "U_ON" }), + post: async (_client, notice) => posted.push(notice), + log: async (event, data) => logged.push({ event, data }), + }); + + assert.equal(posted.length, 1); + assert.equal(posted[0].threadKey, "thread-on"); + assert.match(posted[0].text, /<@U_ON>/, "the personal reminder addresses its owner"); + assert.equal(map.get("s::thread-on").reminded, true); + assert.equal(map.get("s::thread-off").reminded, false, "an opted-out user remains unnotified"); + assert.deepEqual(logged, [{ event: "nudge_sent", data: { slug: "s", channel: "C1", author: "U_ON" } }]); +}); diff --git a/test/platform-voice.test.js b/test/platform-voice.test.js index 1e226703..c13b26c6 100644 --- a/test/platform-voice.test.js +++ b/test/platform-voice.test.js @@ -11,9 +11,10 @@ const { runProcess, transcribeAudioFiles } = await import('../src/gateway/transc const audio = (name = 'clip.wav') => ({ name, contentType: 'audio/wav', download: async () => Buffer.from('fixture audio') }); test('voice metadata follows original attachment index through download failures; files remain files', async () => { - let seen; - const result = await prepareVoiceAttachments({ text: 'Please summarize', attachments: [{ name: 'missing.pdf', contentType: 'application/pdf' }, audio(), { name: 'data.txt', contentType: 'text/plain' }] }, ['/fixture/2-clip.wav', '/fixture/3-data.txt'], { enabled: true, transcribe: async (files) => { seen = files; return { transcripts: [{ name: 'clip.wav', text: 'Book a meeting' }], failed: [] }; } }); + let seen; let removed; + const result = await prepareVoiceAttachments({ text: 'Please summarize', attachments: [{ name: 'missing.pdf', contentType: 'application/pdf' }, audio(), { name: 'data.txt', contentType: 'text/plain' }] }, ['/fixture/2-clip.wav', '/fixture/3-data.txt'], { enabled: true, removeProcessed: async (file) => { removed = file.path; return true; }, transcribe: async (files, options) => { seen = files; await options.removeProcessed(files[0]); return { transcripts: [{ name: 'clip.wav', text: 'Book a meeting' }], failed: [], cleanupFailed: [] }; } }); assert.equal(seen[0].path, '/fixture/2-clip.wav'); assert.deepEqual(result.paths, ['/fixture/3-data.txt']); assert.match(result.text, /Please summarize/); assert.match(result.text, /Book a meeting/); + assert.equal(removed, '/fixture/2-clip.wav'); assert.deepEqual(result.cleanupFailed, []); }); test('local-only disabled, failed, missing and empty speech paths explain failure', async () => { diff --git a/test/question-continuation.test.js b/test/question-continuation.test.js new file mode 100644 index 00000000..6e7eb217 --- /dev/null +++ b/test/question-continuation.test.js @@ -0,0 +1,265 @@ +import path from "node:path"; +import { fileURLToPath } from "node:url"; +import { setTimeout as delay } from "node:timers/promises"; +import test from "node:test"; +import assert from "node:assert/strict"; +import { ensureTestEnv } from "./helpers.js"; + +ensureTestEnv(); +const projectRoot = fileURLToPath(new URL("..", import.meta.url)); +process.env.PATH = `${path.join(projectRoot, "test", "fixtures", "prompt-echo")}${path.delimiter}${process.env.PATH || ""}`; +process.env.SESSION_KEEPALIVE = "0"; +process.env.PROGRESS_VIEW = "shimmer"; +const { useFakeRuntime } = await import("./runtime-fake.js"); +const runtime = await useFakeRuntime(); +const { setUser, upsertChannelEntry, defaultChannelMeta, saveChannelMeta } = await import("../src/config/store.js"); +const { saveSettings } = await import("../src/config/settings.js"); +const { getDb } = await import("../src/db/index.js"); +const { processMessageEvent, runQueue, stopRunsInChannel } = await import("../src/slack/message-pipeline.js"); +const { acceptQuestionReply, clearActiveRun, listActiveRuns, recordActiveRun, recoverRuns } = await import("../src/gateway/active-runs.js"); +const { createQuestion, getQuestion, updateQuestion, saveQuestionAnswers, acceptQuestionSubmission } = await import("../src/gateway/questions.js"); + +const USER = "U_QUESTION_CONTINUATION"; +const CHANNEL = "D_QUESTION_CONTINUATION"; +let sequence = 0; + +function fakeSlack() { + const posted = []; + const updated = []; + const ok = async () => ({ ok: true }); + const client = { + posted, updated, members: [USER], + chat: { + postMessage: async (message) => { posted.push(message); return { ok: true, ts: `9000.${++sequence}` }; }, + update: async (message) => { updated.push(message); return { ok: true }; }, + postEphemeral: ok, + }, + users: { + info: async ({ user }) => ({ user: { id: user, real_name: "Question User" } }), + list: async () => ({ members: [{ id: USER, real_name: "Question User" }], response_metadata: {} }), + }, + conversations: { + history: async () => ({ messages: [] }), + replies: async () => ({ messages: [] }), + info: async ({ channel }) => ({ channel: { id: channel } }), + members: async () => ({ members: client.members, response_metadata: {} }), + }, + apiCall: ok, + }; + client.chatStream = () => ({ + ts: `9000.${++sequence}`, append: ok, + stop: async ({ markdown_text = "" } = {}) => { posted.push({ text: markdown_text }); return { ok: true }; }, + }); + return client; +} + +async function setup(threadKey) { + saveSettings({ engine: "claude", composioMode: "personal" }); + await setUser(USER, { name: "Question User", approved: true, isAdmin: false }); + const entry = await upsertChannelEntry(CHANNEL, { name: "question-continuation", type: "im", isDM: true, platform: "slack" }); + await saveChannelMeta(entry.slug, { ...defaultChannelMeta({ channelId: CHANNEL, name: entry.name, type: "im", isDM: true, platform: "slack" }), dmUserId: USER }); + return { channelId: CHANNEL, authorId: USER, slug: entry.slug, threadKey, isDM: true }; +} + +function question(context) { + return createQuestion(context, { title: "Access preferences", questions: [ + { id: "access", prompt: "Who should have access?", type: "single", options: [{ label: "Team only", value: "team" }, { label: "Everyone", value: "everyone" }] }, + ] }); +} + +function event(context, text = "Answers submitted to the agent's questions: Team only") { + return { type: "message", channel: context.channelId, channel_type: "im", user: context.authorId, + text, thread_ts: context.threadKey, ts: `${Number(context.threadKey) + 1}.001` }; +} + +async function queued(key) { + for (let attempt = 0; attempt < 200 && runQueue.count(key) < 2; attempt++) await delay(5); + assert.equal(runQueue.count(key), 2, "the answers should be accepted into the existing thread queue"); +} + +test("submitted answers bypass canonical card hydration and queue durably without steering", async () => { + const context = await setup("6000.001"); + const client = fakeSlack(); + const request = saveQuestionAnswers(question(context).id, 0, { access: { values: ["team"] } }); + const input = event(context); + let hydrated = 0; + client.conversations.replies = async () => { hydrated++; return { messages: [{ ts: input.ts, text: "WRONG canonical card text" }] }; }; + const key = `${context.slug}::${context.threadKey}`; + const active = { aborted: false, controller: new AbortController(), authorId: USER }; + await runQueue.acquire(key, active); + const running = processMessageEvent(input, client, { + botUserId: "U_BOT", teamId: "T_QUESTIONS", bypassMention: true, questionSubmissionId: request.id, + onQuestionSubmissionAccepted: ({ runId, rec }) => acceptQuestionSubmission(request.id, request.revision, runId, rec), + }); + try { + await queued(key); + assert.equal(hydrated, 0); + assert.equal(active.controller.signal.aborted, false); + const stored = listActiveRuns().find((r) => r.questionSubmissionId === request.id); + assert.equal(stored.authorId, USER); + assert.equal(stored.threadKey, context.threadKey); + assert.match(stored.text, /Team only/); + assert.doesNotMatch(stored.text, /WRONG/); + assert.equal(getQuestion(request.id).status, "submitted"); + assert.equal(acceptQuestionSubmission(request.id, request.revision, "duplicate", stored), false); + await stopRunsInChannel(client, CHANNEL, context.slug, USER, context.threadKey); + } finally { + runQueue.release(key, active); + await running; + } + assert.equal(listActiveRuns().some((r) => r.questionSubmissionId === request.id), false); +}); + +test("requester access revoked while answers are queued prevents the engine spawn", async () => { + const context = await setup("6100.001"); + const client = fakeSlack(); + const request = saveQuestionAnswers(question(context).id, 0, { access: { values: ["team"] } }); + const key = `${context.slug}::${context.threadKey}`; + const active = { aborted: false, controller: new AbortController(), authorId: USER }; + await runQueue.acquire(key, active); + const spawnsBefore = runtime.calls.spawn.length; + const running = processMessageEvent(event(context), client, { + botUserId: "U_BOT", questionSubmissionId: request.id, + onQuestionSubmissionAccepted: ({ runId, rec }) => acceptQuestionSubmission(request.id, request.revision, runId, rec), + }); + try { + await queued(key); + await setUser(USER, { approved: false }); + } finally { + runQueue.release(key, active); + await running; + } + assert.equal(runtime.calls.spawn.length, spawnsBefore); + assert.equal(listActiveRuns().some((r) => r.questionSubmissionId === request.id), false); + assert.ok(client.posted.some((m) => /no longer has access|could not be verified/.test(m.text || ""))); +}); + +test("live promotion preserves submission marker before the fixture engine starts", async () => { + const context = await setup("6150.001"); + const client = fakeSlack(); + const request = saveQuestionAnswers(question(context).id, 0, { access: { values: ["team"] } }); + const input = { ...event(context), ts: `question-${request.id}` }; + client.conversations.replies = async () => ({ messages: [{ ts: context.threadKey, user: USER, text: "Original task needs thread context." }] }); + const spawn = runtime.spawn; + let observed = false; + runtime.spawn = (target, spec) => { + const stored = listActiveRuns().find((r) => r.questionSubmissionId === request.id); + assert.equal(stored?.threadKey, context.threadKey); + assert.match(stored.text, /Team only/); + assert.match(stored.text, /Original task needs thread context/); + observed = true; + return spawn(target, spec); + }; + try { + await processMessageEvent(input, client, { + botUserId: "U_BOT", questionSubmissionId: request.id, + onQuestionSubmissionAccepted: ({ runId, rec }) => acceptQuestionSubmission(request.id, request.revision, runId, rec), + }); + } finally { + runtime.spawn = spawn; + } + assert.equal(observed, true); + assert.ok(client.posted.some((m) => /Team only/.test(m.text || ""))); +}); + +test("a typed thread answer carries pending question context into the fixture engine", async () => { + const context = await setup("6175.001"); + const client = fakeSlack(); + const request = question(context); + await processMessageEvent(event(context, "Actually, invite only please."), client, { botUserId: "U_BOT" }); + assert.equal(getQuestion(request.id).answeredInThread, true); + assert.ok(client.posted.some((m) => /Who should have access/.test(m.text || "") && /invite only please/.test(m.text || ""))); +}); + +test("restart recovery rechecks current membership before replaying submitted answers", async () => { + const context = await setup("6200.001"); + const client = fakeSlack(); + client.members = []; + const rec = { ...context, id: "question-recovery-revoked", questionSubmissionId: "saved-question", text: "saved answers", attachments: [] }; + recordActiveRun(rec.id, rec); + let calls = 0; + await recoverRuns([rec], { + slack: { snapshot: () => ({ connected: true }), getClient: () => client }, + runner: async () => { calls++; throw new Error("must never spawn"); }, + forceStopping: () => false, + }); + assert.equal(calls, 0); + assert.equal(listActiveRuns().some((r) => r.id === rec.id), false); + assert.ok(client.posted.some((m) => /not resumed/.test(m.text || ""))); +}); + +test("authorized restart recovery retains the submission identity in the durable run", async () => { + const context = await setup("6300.001"); + const client = fakeSlack(); + const rec = { ...context, id: "question-recovery-valid", questionSubmissionId: "saved-valid-question", text: "saved answers", attachments: [] }; + recordActiveRun(rec.id, rec); + let calls = 0; + await recoverRuns([rec], { + slack: { snapshot: () => ({ connected: true }), getClient: () => client }, + runner: async (args) => { + calls++; + assert.equal(args.authorId, USER); + assert.equal(args.threadKey, context.threadKey); + assert.equal(listActiveRuns().find((r) => r.id === rec.id).questionSubmissionId, rec.questionSubmissionId); + return { content: "continued", engine: "claude", usage: { output_tokens: 1 } }; + }, + deliver: async () => {}, usageRecorder: async () => {}, progressFactory: () => null, forceStopping: () => false, + }); + assert.equal(calls, 1); + assert.equal(listActiveRuns().some((r) => r.id === rec.id), false); +}); + +test("stop cancels questions before Slack acknowledgement and retires their controls", async () => { + const context = await setup("6400.001"); + const client = fakeSlack(); + const request = updateQuestion(question(context).id, 0, { messageTs: "6400.002" }); + let release; + const gate = new Promise((resolve) => { release = resolve; }); + client.chat.postMessage = async (message) => { client.posted.push(message); await gate; return { ok: true }; }; + const stopping = stopRunsInChannel(client, CHANNEL, context.slug, USER, context.threadKey); + assert.equal(getQuestion(request.id).status, "cancelled"); + release(); + assert.equal(await stopping, 1); + await delay(0); + assert.ok(client.updated.some((m) => m.ts === request.messageTs && !m.blocks.some((b) => b.type === "actions"))); +}); + +test("clear cancels only questions in the cleared thread", async () => { + const context = await setup("6500.001"); + const current = question(context); + const other = question({ ...context, threadKey: "6501.001" }); + const client = fakeSlack(); + await processMessageEvent(event(context, "/clear"), client, { botUserId: "U_BOT" }); + assert.equal(getQuestion(current.id).status, "cancelled"); + assert.equal(getQuestion(other.id).status, "pending"); + await stopRunsInChannel(client, CHANNEL, context.slug, USER, "6501.001"); +}); + +test("ordinary reply atomically retires only matching forms and keeps their prompt context", async () => { + const context = await setup("6600.001"); + const current = question(context); + const other = question({ ...context, authorId: "U_OTHER" }); + const text = `Question context: ${JSON.stringify(current.questions)}\nUser reply: invite only`; + const retired = acceptQuestionReply([current], "question-typed-reply", { ...context, text }); + assert.equal(retired[0].answeredInThread, true); + assert.equal(getQuestion(current.id).status, "cancelled"); + assert.equal(getQuestion(other.id).status, "pending"); + assert.equal(listActiveRuns().find((r) => r.id === "question-typed-reply").text, text); + clearActiveRun("question-typed-reply"); + await stopRunsInChannel(fakeSlack(), CHANNEL, context.slug, USER, context.threadKey); +}); + +test("ordinary reply persistence failure rolls back form cancellation", async () => { + const context = await setup("6700.001"); + const request = question(context); + const db = getDb(); + db.exec("CREATE TRIGGER question_reply_failure BEFORE INSERT ON active_runs BEGIN SELECT RAISE(ABORT, 'fixture write failure'); END"); + try { + assert.throws(() => acceptQuestionReply([request], "question-write-failure", { ...context, text: "answer" }), /fixture write failure/); + assert.equal(getQuestion(request.id).status, "pending"); + assert.equal(listActiveRuns().some((r) => r.id === "question-write-failure"), false); + } finally { + db.exec("DROP TRIGGER question_reply_failure"); + } + await stopRunsInChannel(fakeSlack(), CHANNEL, context.slug, USER, context.threadKey); +}); diff --git a/test/question-interactions.test.js b/test/question-interactions.test.js new file mode 100644 index 00000000..a4bdefd5 --- /dev/null +++ b/test/question-interactions.test.js @@ -0,0 +1,325 @@ +// Real durable store and authorization with captured Slack payloads; no engine/network access. +import test from "node:test"; +import assert from "node:assert/strict"; +import { randomUUID } from "node:crypto"; +import { ensureTestEnv } from "./helpers.js"; +ensureTestEnv(); + +const { setUser, upsertChannelEntry, saveChannelMeta, getChannelMeta } = await import("../src/config/store.js"); +const { getDb } = await import("../src/db/index.js"); +const { getQuestion, saveQuestionAnswers } = await import("../src/gateway/questions.js"); +const { postQuestions, handleQuestionAction, handleQuestionView, refreshQuestionCard, registerQuestionActions, questionSlackClient } = await import("../src/slack/questions.js"); +const { buildQuestionCard, buildQuestionModal, buildCustomAnswerModal } = await import("../src/slack/question-views.js"); + +const OWNER = "UQUESTION_OWNER"; +const OTHER = "UQUESTION_OTHER"; +const CHANNEL = "CQUESTION_INTERACTIONS"; +await setUser(OWNER, { name: "Question owner", approved: true, isAdmin: false }); +await setUser(OTHER, { name: "Other member", approved: true, isAdmin: false }); +const entry = await upsertChannelEntry(CHANNEL, { name: "question-interactions", type: "channel", isDM: false }); +const SLUG = entry.slug; +await saveChannelMeta(SLUG, { ...await getChannelMeta(SLUG), channelId: CHANNEL, access: "approved", platform: "slack", isDM: false }); + +const choice = (id = "access", extra = {}) => ({ id, prompt: "Who can access this?", type: "single", required: true, + allowCustom: true, options: [{ label: "Team", value: "team" }, { label: "Everyone", value: "all" }], ...extra }); +const elements = (view) => view.blocks.flatMap((b) => (b.elements || []).map((el) => ({ ...el, block_id: b.block_id }))); +const settle = async () => { for (let i = 0; i < 12; i++) await new Promise((resolve) => setImmediate(resolve)); }; + +async function fixture(questions = [choice()]) { + const log = { posts: [], updates: [], notices: [], opens: [], viewUpdates: [], continuations: [], accepted: [] }; + const control = { members: [OWNER, OTHER], updateError: null }; + const client = { + conversations: { members: async () => ({ members: control.members }) }, + chat: { + postMessage: async (payload) => { log.posts.push(payload); return { ok: true, ts: `1900.${log.posts.length}` }; }, + update: async (payload) => { if (control.updateError) throw control.updateError; log.updates.push(payload); return { ok: true }; }, + postEphemeral: async (payload) => { log.notices.push(payload); return { ok: true }; }, + }, + views: { + open: async (payload) => { log.opens.push(payload); return { ok: true }; }, + update: async (payload) => { log.viewUpdates.push(payload); return { ok: true }; }, + }, + }; + const context = { channelId: CHANNEL, authorId: OWNER, slug: SLUG, threadKey: `1800.${randomUUID()}` }; + const input = { title: "Choose the behavior", questions }; + const initial = await postQuestions(context, input, { client }); + const current = () => getQuestion(initial.id); + const processMessage = async (event, usedClient, options) => { + assert.equal(usedClient, client); + log.continuations.push({ event, options }); + log.accepted.push(options.onQuestionSubmissionAccepted({ runId: randomUUID(), rec: { ...context, userId: OWNER } })); + }; + const act = async (actionId, { data = current(), user = OWNER, channel = CHANNEL, ts = data.messageTs, selected_options, view } = {}) => { + const source = view || buildQuestionCard(data); + const action = elements(source).find((el) => el.action_id === actionId); + assert.ok(action, `missing action ${actionId}`); + if (selected_options) action.selected_options = selected_options; + const acks = []; + const body = { user: { id: user }, channel: { id: channel }, message: { ts, thread_ts: data.threadKey }, trigger_id: "trigger-test", ...(view ? { view } : {}) }; + await handleQuestionAction({ ack: async (result) => acks.push(result), body, action, client }, { processMessage }); + assert.equal(acks.length, 1); + return acks; + }; + const submitView = async (view, values, user = OWNER) => { + const acks = []; + view = { ...view, id: "VQUESTION", hash: "hash-test", state: { values } }; + await handleQuestionView({ ack: async (result) => acks.push(result), body: { user: { id: user }, view }, view, client }, { processMessage }); + assert.equal(acks.length, 1); + return acks[0]; + }; + return { log, control, client, context, input, initial, current, act, submitView }; +} + +test("posting is idempotent and visible card carries the persisted revision", async () => { + const f = await fixture(); + const again = await postQuestions(f.context, f.input, { client: f.client }); + assert.equal(again.id, f.initial.id); + assert.equal(f.log.posts.length, 1); + const visible = f.log.updates.at(-1) || f.log.posts.at(-1); + assert.equal(JSON.parse(elements(visible).find((el) => el.action_id === "cg_question_submit").value).revision, again.revision); +}); + +test("registered submit handlers preserve the live bot and workspace context", async () => { + const f = await fixture(); + await f.act("cg_question_choose:access:0"); + let handler; + let received; + registerQuestionActions({ action(_pattern, fn) { handler = fn; }, view() {} }, async (_event, _client, options) => { + received = options; + options.onQuestionSubmissionAccepted({ runId: randomUUID(), rec: f.context }); + }, { botUserId: "U_BOT_CONTEXT", teamId: "T_WORKSPACE_CONTEXT" }); + const record = f.current(); + const action = elements(buildQuestionCard(record)).find((el) => el.action_id === "cg_question_submit"); + await handler({ ack: async () => {}, action, client: f.client, body: { user: { id: OWNER }, channel: { id: CHANNEL }, message: { ts: record.messageTs } } }); + await settle(); + assert.equal(received.botUserId, "U_BOT_CONTEXT"); + assert.equal(received.teamId, "T_WORKSPACE_CONTEXT"); + assert.equal(received.bypassMention, true); + assert.equal(f.current().status, "submitted"); +}); + +test("options and custom save are drafts; duplicate submit creates one durable continuation", async () => { + const f = await fixture(); + await f.act("cg_question_choose:access:0"); + assert.deepEqual(f.current().answers.access, { values: ["team"], custom: "" }); + await f.act("cg_question_custom:access"); + const custom = f.log.opens.at(-1).view; + const result = await f.submitView(custom, { "q:access": { custom: { type: "plain_text_input", value: "Invited guests" } } }); + assert.equal(result, undefined); + assert.deepEqual(f.current().answers.access, { values: [], custom: "Invited guests" }); + assert.equal(f.log.continuations.length, 0); + const before = f.current(); + await Promise.all([f.act("cg_question_submit", { data: before }), f.act("cg_question_submit", { data: before })]); + await settle(); + assert.equal(f.log.continuations.length, 1); + assert.deepEqual(f.log.accepted, [true]); + assert.equal(f.current().status, "submitted"); + const continuation = f.log.continuations[0]; + assert.equal(continuation.event.channel, CHANNEL); + assert.equal(continuation.event.user, OWNER); + assert.equal(continuation.event.thread_ts, f.context.threadKey); + assert.match(continuation.event.text, /Invited guests/); + assert.equal(continuation.options.busyChoice, "queue"); + assert.equal(getDb().prepare("SELECT COUNT(*) AS n FROM active_runs WHERE id=?").get(f.current().runId).n, 1); +}); + +test("other user, wrong channel/message, stale buttons and departed members cannot mutate drafts", async () => { + const f = await fixture(); + const initial = f.current(); + for (const args of [{ user: OTHER }, { channel: "CWRONG" }, { ts: "wrong.timestamp" }]) { + await f.act("cg_question_choose:access:0", args); + assert.equal(f.current().revision, initial.revision); + } + await f.act("cg_question_choose:access:0"); + const selected = f.current(); + await f.act("cg_question_choose:access:1", { data: initial }); + assert.deepEqual(f.current().answers, selected.answers); + f.control.members = [OTHER]; + await f.act("cg_question_choose:access:1"); + assert.deepEqual(f.current().answers, selected.answers); + assert.equal(f.log.notices.length, 5); + assert.equal(f.log.continuations.length, 0); +}); + +test("modal owner and revision checks reject replayed custom answers", async () => { + const f = await fixture(); + const stale = buildCustomAnswerModal(f.current(), "access"); + const values = { "q:access": { custom: { value: "Untrusted answer" } } }; + const denied = await f.submitView(stale, values, OTHER); + assert.equal(denied.response_action, "errors"); + assert.deepEqual(f.current().answers, {}); + await f.act("cg_question_choose:access:0"); + const rejected = await f.submitView(stale, values); + assert.equal(rejected.response_action, "errors"); + assert.deepEqual(f.current().answers.access, { values: ["team"], custom: "" }); + assert.equal(f.log.continuations.length, 0); +}); + +test("multi checkbox payload identity persists options and custom text together", async () => { + const f = await fixture([choice("features", { type: "multi" })]); + await f.act("cg_question_multi:features", { selected_options: [{ text: { type: "plain_text", text: "Everyone" }, value: "all" }] }); + await f.submitView(buildCustomAnswerModal(f.current(), "features"), { "q:features": { custom: { value: "One more" } } }); + assert.deepEqual(f.current().answers.features, { values: ["all"], custom: "One more" }); + await f.act("cg_question_multi:features", { selected_options: [] }); + assert.deepEqual(f.current().answers.features, { values: [], custom: "One more" }); + assert.equal(f.log.continuations.length, 0); +}); + +test("Next validates required answers, Back saves incomplete drafts and Submit resumes once", async () => { + const f = await fixture(Array.from({ length: 4 }, (_, i) => choice(`q${i}`, { allowCustom: false }))); + await f.act("cg_question_open"); + const first = f.log.opens.at(-1).view; + const missing = await f.submitView(first, {}); + assert.equal(missing.response_action, "errors"); + assert.deepEqual(Object.keys(missing.errors), ["q:q0", "q:q1", "q:q2"]); + const firstValues = Object.fromEntries([0, 1, 2].map((i) => [`q:q${i}`, { choice: { type: "radio_buttons", selected_option: { value: "team" } } }])); + const next = await f.submitView(first, firstValues); + assert.equal(next.response_action, "update"); + assert.equal(JSON.parse(next.view.private_metadata).page, 1); + const page1 = { ...next.view, id: "VQUESTION", hash: "hash-test", state: { values: {} } }; + await f.act("cg_question_back", { view: page1 }); + assert.equal(JSON.parse(f.log.viewUpdates.at(-1).view.private_metadata).page, 0); + assert.deepEqual(f.current().answers.q3, { values: [], custom: "" }); + assert.equal(f.log.continuations.length, 0); + const secondNext = await f.submitView(f.log.viewUpdates.at(-1).view, firstValues); + await f.submitView(secondNext.view, { "q:q3": { choice: { type: "radio_buttons", selected_option: { value: "all" } } } }); + await settle(); + assert.equal(f.current().status, "submitted"); + assert.equal(f.log.continuations.length, 1); + assert.deepEqual(f.current().answers.q3, { values: ["all"], custom: "" }); +}); + +test("cancellation retires a form without invoking the agent", async () => { + const f = await fixture(); + await f.act("cg_question_cancel"); + assert.equal(f.current().status, "cancelled"); + assert.equal(f.log.continuations.length, 0); + assert.ok(!f.log.updates.at(-1).blocks.some((b) => b.type === "actions")); +}); + +test("retry repairs a failed card refresh without duplicate posting", async () => { + const f = await fixture(); + f.control.updateError = new Error("temporary update failure"); + await f.act("cg_question_choose:access:0"); + const updated = f.current(); + assert.deepEqual(updated.answers.access, { values: ["team"], custom: "" }); + assert.match(f.log.notices.at(-1).text, /temporary update failure/); + // A retry of the original request must redraw this persisted revision, even if an earlier + // interactive card edit failed after the draft was saved. + f.control.updateError = null; + await postQuestions(f.context, f.input, { client: f.client }); + assert.equal(f.log.posts.length, 1); + const visible = f.log.updates.at(-1); + assert.equal(JSON.parse(elements(visible).find((el) => el.action_id === "cg_question_submit").value).revision, updated.revision); +}); + +test("stale Open form recovers the durable draft after a card update fails", async () => { + const f = await fixture(); + const original = f.current(); + f.control.updateError = new Error("temporary card update failure"); + await f.act("cg_question_choose:access:1"); + assert.ok(f.current().revision > original.revision); + f.control.updateError = null; + await f.act("cg_question_open", { data: original }); + assert.equal(f.log.opens.length, 1); + const view = f.log.opens[0].view; + assert.equal(JSON.parse(view.private_metadata).revision, f.current().revision); + assert.equal(view.blocks.find((b) => b.block_id === "q:access").element.initial_option.value, "all"); + assert.equal(f.log.continuations.length, 0); +}); + +test("overlapping card refreshes serialize and reread the newest durable answers", async () => { + const f = await fixture(); + const saved = saveQuestionAnswers(f.current().id, f.current().revision, { access: { values: ["team"], custom: "" } }); + let releaseFirst; + let announceFirst; + const firstEntered = new Promise((resolve) => { announceFirst = resolve; }); + const firstGate = new Promise((resolve) => { releaseFirst = resolve; }); + const completed = []; + let inFlight = 0; + let maxInFlight = 0; + let calls = 0; + f.client.chat.update = async (payload) => { + inFlight++; + maxInFlight = Math.max(maxInFlight, inFlight); + if (++calls === 1) { + announceFirst(); + await firstGate; + } + completed.push(payload); + inFlight--; + return { ok: true }; + }; + const first = refreshQuestionCard(saved, f.client); + await firstEntered; + const newest = saveQuestionAnswers(saved.id, saved.revision, { access: { values: ["all"], custom: "" } }); + // Intentionally pass the old record: rendering must reread after the first update finishes. + const second = refreshQuestionCard(saved, f.client); + await settle(); + assert.equal(calls, 1); + releaseFirst(); + await Promise.all([first, second]); + assert.equal(maxInFlight, 1); + assert.equal(completed.length, 2); + const final = completed.at(-1); + assert.equal(JSON.parse(elements(final).find((el) => el.action_id === "cg_question_submit").value).revision, newest.revision); + assert.equal(elements(final).find((el) => el.action_id === "cg_question_choose:access:1").style, "primary"); + assert.equal(f.log.continuations.length, 0); +}); + +test("slow modal membership verification acknowledges an error before Slack's three-second deadline", async () => { + const f = await fixture(); + const original = f.current(); + let resolveMembership; + f.client.conversations.members = () => new Promise((resolve) => { resolveMembership = resolve; }); + const started = performance.now(); + const response = await f.submitView(buildCustomAnswerModal(original, "access"), { + "q:access": { custom: { value: "Must not be saved after timeout" } }, + }); + const elapsed = performance.now() - started; + assert.equal(response.response_action, "errors"); + assert.match(response.errors["q:access"], /verification took too long/); + assert.ok(elapsed < 3000, `Slack acknowledgement took ${elapsed}ms`); + assert.equal(f.current().revision, original.revision); + resolveMembership({ members: [OWNER] }); + await settle(); + assert.deepEqual(f.current().answers, {}); + assert.equal(f.log.continuations.length, 0); +}); + + +test("question Slack transport encodes member queries and preserves JSON chat writes", async () => { + const requests = []; + const client = questionSlackClient({ token: "test-only-token", fetchImpl: async (url, init) => { + requests.push({ url: new URL(url), init }); + return { ok: true, json: async () => ({ ok: true, members: ["UOWNER"] }) }; + } }); + await client.conversations.members({ channel: "CQUESTION", limit: 200, cursor: "next+/=&" }); + const { url, init } = requests[0]; + assert.equal(url.pathname, "/api/conversations.members"); + assert.equal(url.searchParams.get("channel"), "CQUESTION"); + assert.equal(url.searchParams.get("limit"), "200"); + assert.equal(url.searchParams.get("cursor"), "next+/=&"); + assert.equal(init.method, "GET"); + assert.equal(init.body, undefined); + assert.equal(init.headers.Authorization, "Bearer test-only-token"); + assert.equal(url.toString().includes("test-only-token"), false); + for (const method of ["postMessage", "update"]) { + const payload = { channel: "CQUESTION", text: "Demo" }; + await client.chat[method](payload); + const request = requests.at(-1); + assert.equal(request.url.pathname, `/api/chat.${method}`); + assert.equal(request.init.method, "POST"); + assert.deepEqual(JSON.parse(request.init.body), payload); + } +}); + +test("question Slack transport fails closed on API and HTTP errors", async () => { + for (const response of [ + { ok: true, json: async () => ({ ok: false, error: "invalid_arguments" }) }, + { ok: false, status: 503, json: async () => ({}) }, + ]) { + const client = questionSlackClient({ token: "test-only-token", fetchImpl: async () => response }); + await assert.rejects(client.conversations.members({ channel: "CQUESTION" }), /Slack conversations.members failed:/); + } +}); diff --git a/test/question-views.test.js b/test/question-views.test.js new file mode 100644 index 00000000..f3342dd6 --- /dev/null +++ b/test/question-views.test.js @@ -0,0 +1,185 @@ +import test from "node:test"; +import assert from "node:assert/strict"; +import { + buildQuestionCard, buildQuestionModal, buildCustomAnswerModal, questionPage, + questionPresentation, parseQuestionMetadata, parseQuestionPageAnswers, + QUESTION_FORM_CALLBACK, QUESTION_CUSTOM_CALLBACK, +} from "../src/slack/question-views.js"; + +const single = (id = "access", extra = {}) => ({ + id, prompt: "Who should have access?", type: "single", required: true, allowCustom: true, + options: [{ label: "Team only", value: "team" }, { label: "Everyone", value: "all" }], ...extra, +}); +const record = (extra = {}) => ({ + id: "question-form-id", revision: 2, title: "A few decisions", status: "pending", + questions: [single()], answers: {}, ...extra, +}); +const allElements = (view) => view.blocks.flatMap((block) => block.elements || (block.element ? [block.element] : [])); + +function assertSlackBounds(view, modal = false) { + assert.ok(view.blocks.length <= (modal ? 100 : 50)); + if (modal) { + assert.ok(view.title.text.length <= 24); + assert.ok(view.submit.text.length <= 24); + assert.ok(view.close.text.length <= 24); + assert.ok(view.private_metadata.length <= 3000); + } + const visit = (obj) => { + if (!obj || typeof obj !== "object") return; + assert.notEqual(obj.type, "mrkdwn"); + if (obj.action_id) assert.ok(obj.action_id.length <= 255); + if (obj.block_id) assert.ok(obj.block_id.length <= 255); + if (obj.type === "section") assert.ok(obj.text.text.length <= 3000); + if (obj.type === "header") assert.ok(obj.text.text.length <= 150); + if (obj.type === "actions") assert.ok(obj.elements.length <= 25); + if (obj.type === "button") { + assert.ok(obj.text.text.length <= 75); + assert.ok(obj.value.length <= 2000); + } + if (obj.type === "input") assert.ok(obj.label.text.length <= 2000); + if (["radio_buttons", "checkboxes"].includes(obj.type)) { + assert.ok(obj.options.length <= 10); + for (const option of obj.options) { + assert.ok(option.text.text.length <= 75); + assert.ok(option.value.length <= 150); + } + for (const initial of obj.initial_options || (obj.initial_option ? [obj.initial_option] : [])) { + assert.ok(obj.options.some((o) => JSON.stringify(o) === JSON.stringify(initial))); + } + } + for (const value of Object.values(obj)) { + if (Array.isArray(value)) value.forEach(visit); + else if (value && typeof value === "object") visit(value); + } + }; + visit(view); +} + +test("message buttons carry form/revision identity, dynamic labels and selected state", () => { + const data = record({ answers: { access: { values: ["team"], custom: "" } } }); + const card = buildQuestionCard(data); + const elements = allElements(card); + const team = elements.find((el) => el.action_id === "cg_question_choose:access:0"); + assert.equal(team.text.text, "Team only"); + assert.equal(team.style, "primary"); + assert.deepEqual(JSON.parse(team.value), { id: data.id, revision: 2 }); + assert.equal(elements.find((el) => el.action_id === "cg_question_choose:access:1").style, undefined); + assert.ok(elements.some((el) => el.action_id === "cg_question_custom:access")); + assert.ok(elements.some((el) => el.action_id === "cg_question_submit")); + assert.ok(card.blocks.some((b) => b.block_id === `cg_question:${data.id}:2:access`)); + assertSlackBounds(card); +}); + +test("multi choices use checkboxes with exact initial option objects and custom text", () => { + const card = buildQuestionCard(record({ questions: [single("features", { type: "multi" })], + answers: { features: { values: ["team"], custom: "Another feature" } } })); + const checkbox = allElements(card).find((el) => el.type === "checkboxes"); + assert.deepEqual(checkbox.initial_options, [checkbox.options[0]]); + assert.equal(checkbox.action_id, "cg_question_multi:features"); + assert.ok(card.blocks.some((b) => b.text?.text === "Current answer: Team only, Another feature")); + assertSlackBounds(card); +}); + +test("auto presentation opens long/text forms and explicit short text message gets write button", () => { + const long = record({ questions: Array.from({ length: 5 }, (_, i) => single(`q${i}`)) }); + assert.equal(questionPresentation(long), "modal"); + assert.equal(questionPresentation({ ...long, presentation: "message" }), "modal"); + const text = record({ questions: [single("notes", { type: "text", options: [] })] }); + assert.equal(questionPresentation(text), "modal"); + const launch = allElements(buildQuestionCard(long)); + assert.ok(launch.some((el) => el.action_id === "cg_question_open")); + assert.ok(!launch.some((el) => el.action_id === "cg_question_submit")); + const explicit = buildQuestionCard({ ...text, presentation: "message" }); + assert.ok(allElements(explicit).some((el) => el.action_id === "cg_question_custom:notes")); +}); + +test("submitted and cancelled cards remove all controls and show answers as plain text", () => { + for (const status of ["submitted", "cancelled"]) { + const card = buildQuestionCard(record({ status, answers: { access: { values: ["team"], custom: "My choice" } } })); + assert.equal(allElements(card).length, 1); // Header excluded, single context text included. + assert.ok(!card.blocks.some((b) => b.type === "actions")); + assert.ok(card.blocks.some((b) => b.text?.text.endsWith("\nMy choice"))); + assertSlackBounds(card); + } +}); + +test("paginated form restores each page's draft and exposes Back/Next/Submit", () => { + const data = record({ questions: Array.from({ length: 7 }, (_, i) => single(`q${i}`)), + answers: { q3: { values: ["all"], custom: "" }, q4: { values: [], custom: "Custom value" } } }); + assert.deepEqual(questionPage(data, 1).questions.map((q) => q.id), ["q3", "q4", "q5"]); + for (const invalid of [-1, 3, 0.2, NaN]) assert.throws(() => questionPage(data, invalid), /Invalid question page/); + const first = buildQuestionModal(data); + assert.equal(first.callback_id, QUESTION_FORM_CALLBACK); + assert.equal(first.submit.text, "Next"); + assert.ok(!allElements(first).some((el) => el.action_id === "cg_question_back")); + const second = buildQuestionModal(data, 1); + assert.deepEqual(JSON.parse(second.private_metadata), { id: data.id, revision: 2, page: 1 }); + assert.equal(second.blocks.find((b) => b.block_id === "q:q3").element.initial_option.value, "all"); + assert.equal(second.blocks.find((b) => b.block_id === "custom:q4").element.initial_value, "Custom value"); + assert.ok(allElements(second).some((el) => el.action_id === "cg_question_back")); + const last = buildQuestionModal(data, 2); + assert.equal(last.submit.text, "Submit"); + assert.equal(last.blocks.filter((b) => b.type === "input").length, 2); + [first, second, last].forEach((view) => assertSlackBounds(view, true)); +}); + +test("custom modal preserves text, permits clearing and disallows unsupported questions", () => { + const data = record({ answers: { access: { values: [], custom: "Specific team" } } }); + const view = buildCustomAnswerModal(data, "access"); + assert.equal(view.callback_id, QUESTION_CUSTOM_CALLBACK); + assert.deepEqual(JSON.parse(view.private_metadata), { id: data.id, revision: 2, questionId: "access" }); + assert.equal(view.blocks[0].optional, true); + assert.equal(view.blocks[0].element.initial_value, "Specific team"); + assert.equal(view.blocks[0].element.max_length, 2000); + assert.throws(() => buildCustomAnswerModal(data, "unknown"), /not allowed/); + assert.throws(() => buildCustomAnswerModal(record({ questions: [single("access", { allowCustom: false })] }), "access"), /not allowed/); + assertSlackBounds(view, true); +}); + +test("page parsing gives custom single answer precedence, supplements multi and excludes other pages", () => { + const data = record({ questions: [single(), single("features", { type: "multi" }), single("notes", { type: "text" }), single("later")] }); + const answers = parseQuestionPageAnswers(data, 0, { + "q:access": { choice: { selected_option: { value: "team" } } }, + "custom:access": { custom: { value: "A custom team" } }, + "q:features": { choice: { selected_options: [{ value: "team" }, { value: "all" }] } }, + "custom:features": { custom: { value: "One more" } }, + "q:notes": { custom: { value: "Notes" } }, + "q:later": { choice: { selected_option: { value: "all" } } }, + }); + assert.deepEqual(answers, { access: { values: [], custom: "A custom team" }, features: { values: ["team", "all"], custom: "One more" }, notes: { values: [], custom: "Notes" } }); + assert.deepEqual(parseQuestionPageAnswers(data, 0), { access: { values: [], custom: "" }, features: { values: [], custom: "" }, notes: { values: [], custom: "" } }); + assert.deepEqual(parseQuestionPageAnswers(data, 0, { + "q:access": { choice: { selected_option: { value: "team" } } }, + "custom:access": { custom: { value: " " } }, + }).access, { values: ["team"], custom: " " }); +}); + +test("modal input requirements permit custom alternatives and preserve strict required choice", () => { + const view = buildQuestionModal(record({ questions: [single(), single("strict", { allowCustom: false }), single("notes", { type: "text" })] })); + assert.equal(view.blocks.find((b) => b.block_id === "q:access").optional, true); + assert.equal(view.blocks.find((b) => b.block_id === "q:strict").optional, false); + assert.equal(view.blocks.find((b) => b.block_id === "q:notes").optional, false); +}); + +test("metadata parser rejects malformed, negative and noninteger identities", () => { + for (const value of [null, "no json", "null", "{}", '{"id":"x","revision":-1}', '{"id":"x","revision":1.5}', '{"id":"x","revision":1,"page":-1}', '{"id":"x","revision":1,"questionId":3}']) { + assert.equal(parseQuestionMetadata(value), null); + } + assert.deepEqual(parseQuestionMetadata('{"id":"x","revision":0}'), { id: "x", revision: 0 }); +}); + +test("maximum schema sizes remain Slack-valid and caller text cannot inject mentions or mrkdwn", () => { + const questions = Array.from({ length: 20 }, (_, i) => single(`q${i}`, { + prompt: "<@U123> *unsafe* ".padEnd(300, "x"), type: "multi", + options: Array.from({ length: 10 }, (_, j) => ({ label: "<@U123>".padEnd(60, "x"), value: String(j).padEnd(60, "v") })), + })); + const data = record({ title: "".padEnd(150, "x"), questions, + answers: Object.fromEntries(questions.map((q) => [q.id, { values: q.options.map((o) => o.value), custom: "".padEnd(2000, "x") }])) }); + for (let page = 0; page < 7; page++) assertSlackBounds(buildQuestionModal(data, page), true); + assertSlackBounds(buildQuestionCard({ ...data, status: "submitted" })); + const card = buildQuestionCard({ ...data, questions: questions.slice(0, 4) }); + assertSlackBounds(card); + assert.equal(card.mrkdwn, false); + assert.ok(!card.text.includes("")); + assert.ok(card.blocks.some((b) => b.text?.text.includes(""))); +}); diff --git a/test/questions.test.js b/test/questions.test.js new file mode 100644 index 00000000..9dd9a5f5 --- /dev/null +++ b/test/questions.test.js @@ -0,0 +1,101 @@ +import test from "node:test"; +import assert from "node:assert/strict"; +import { execFileSync } from "node:child_process"; +import { ensureTestEnv } from "./helpers.js"; +ensureTestEnv(); +const store = await import("../src/gateway/questions.js"); +const { getDb } = await import("../src/db/index.js"); +const { register } = await import("../src/mcp/tools/questions.js"); + +let nextThread = 0; +const context = () => ({ channelId: "C_QUESTIONS", slug: "questions-test", authorId: "U_REQUESTER", threadKey: `${++nextThread}.00001` }); +const input = () => ({ title: "Choices", questions: [ + { id: "access", prompt: "Access?", type: "single", options: [{ label: "Team only", value: "team" }, { label: "Invite only", value: "invite" }] }, +] }); + +test("schema rejects duplicate IDs, forged fields, unsupported choices and invalid lengths", () => { + const value = input(); + assert.equal(store.normalizeQuestions(value).questions[0].allowCustom, true); + assert.throws(() => store.normalizeQuestions({ ...value, channelId: "C_OTHER" })); + assert.throws(() => store.normalizeQuestions({ ...value, questions: [...value.questions, ...value.questions] }), /unique/); + assert.throws(() => store.normalizeQuestions({ ...value, questions: [{ ...value.questions[0], options: Array(5).fill({ label: "x", value: "x" }) }] }), /four/); + assert.throws(() => store.normalizeQuestions({ ...value, questions: [{ ...value.questions[0], options: [{ label: "x", value: "x" }, { label: "y", value: "x" }] }] }), /unique/); + assert.throws(() => store.normalizeQuestions({ ...value, title: "x".repeat(121) })); + assert.throws(() => store.normalizeQuestions({ ...value, questions: [{ id: "__proto__", prompt: "bad", type: "text" }] })); + assert.throws(() => store.normalizeQuestions({ ...value, presentation: "message", questions: Array.from({ length: 5 }, (_, i) => ({ id: `q${i}`, prompt: "x", type: "text" })) }), /four/); +}); + +test("creation retries reuse the same pending card, drafts are readable by a fresh process", () => { + const ctx = context(); + let record = store.createQuestion(ctx, input()); + record = store.bindQuestionMessage(record.id, "123.001"); + assert.equal(record.revision, 0, "delivery binding must not stale the posted controls"); + record = store.saveQuestionAnswers(record.id, record.revision, { access: { values: ["team"], custom: "" } }); + assert.equal(store.createQuestion(ctx, input()).id, record.id); + assert.throws(() => store.createQuestion(ctx, { ...input(), title: "Different" }), /pending/); + const moduleUrl = new URL("../src/gateway/questions.js", import.meta.url).href; + const fresh = JSON.parse(execFileSync(process.execPath, ["--input-type=module", "-e", `const {getQuestion}=await import(${JSON.stringify(moduleUrl)}); process.stdout.write(JSON.stringify(getQuestion(${JSON.stringify(record.id)})));`], { encoding: "utf8" })); + assert.deepEqual(fresh.answers.access.values, ["team"]); + assert.equal(fresh.messageTs, "123.001"); +}); + +test("draft validation rejects forged options, stale writes and custom text where disabled", () => { + let record = store.createQuestion(context(), input()); + assert.throws(() => store.saveQuestionAnswers(record.id, 0, { access: { values: ["forged"] } }), /Invalid/); + assert.throws(() => store.saveQuestionAnswers(record.id, 0, { missing: { custom: "x" } }), /Unknown/); + record = store.saveQuestionAnswers(record.id, 0, { access: { values: ["team"], custom: " My answer " } }); + assert.deepEqual(record.answers.access, { values: [], custom: "My answer" }); + assert.throws(() => store.saveQuestionAnswers(record.id, 0, { access: { values: ["invite"] } }), /changed/); + assert.throws(() => store.validateAnswer({ ...record.questions[0], allowCustom: false }, { custom: "No" }), /Invalid/); + assert.throws(() => store.validateAnswer(record.questions[0], { custom: "x".repeat(2001) }), /2000/); + assert.deepEqual(store.validateAnswer(record.questions[0], { values: ["team"], custom: " " }), { values: ["team"], custom: "" }); +}); + +test("Submit validates required answers and atomically creates exactly one continuation", () => { + const ctx = context(); + let record = store.createQuestion(ctx, input()); + const run = { ...ctx, text: "Answers", questionSubmissionId: record.id }; + assert.equal(store.acceptQuestionSubmission(record.id, 0, "unanswered", run), false); + record = store.saveQuestionAnswers(record.id, 0, { access: { values: ["invite"] } }); + assert.throws(() => store.acceptQuestionSubmission(record.id, record.revision, "wrong-author", { ...run, authorId: "U_OTHER" }), /identity/); + assert.equal(store.getQuestion(record.id).status, "pending"); + assert.equal(store.acceptQuestionSubmission(record.id, record.revision, "submitted-once", run), true); + assert.equal(store.acceptQuestionSubmission(record.id, record.revision, "submitted-twice", run), false); + assert.equal(store.getQuestion(record.id).status, "submitted"); + assert.ok(getDb().prepare("SELECT id FROM active_runs WHERE id=?").get("submitted-once")); + assert.equal(getDb().prepare("SELECT id FROM active_runs WHERE id=?").get("submitted-twice"), undefined); +}); + +test("failed continuation persistence rolls back submission, and cancellation is scoped", () => { + const ctx = context(); + let record = store.createQuestion(ctx, input()); + record = store.saveQuestionAnswers(record.id, 0, { access: { values: ["team"] } }); + getDb().exec("CREATE TEMP TRIGGER reject_question_run BEFORE INSERT ON active_runs BEGIN SELECT RAISE(ABORT, 'test failure'); END"); + try { assert.throws(() => store.acceptQuestionSubmission(record.id, record.revision, "rollback", ctx), /test failure/); } + finally { getDb().exec("DROP TRIGGER reject_question_run"); } + assert.equal(store.getQuestion(record.id).status, "pending"); + assert.equal(store.getQuestion(record.id).revision, record.revision); + const other = store.createQuestion({ ...ctx, authorId: "U_OTHER" }, input()); + assert.equal(store.cancelPendingQuestions(ctx).length, 1); + assert.equal(store.getQuestion(other.id).status, "pending"); + assert.equal(store.acceptQuestionSubmission(record.id, record.revision, "after-stop", ctx), false); +}); + +test("question tool is available to both engines only for a trusted foreground thread", async () => { + const base = { origin: "slack_foreground", principalTrusted: true, threadKey: "123.456", channelId: "C_THIS", slug: "this", createdBy: "U_THIS", text: (s) => ({ content: [{ type: "text", text: s }] }) }; + for (const activeEngine of ["claude", "codex"]) { + const calls = []; + let handler; + register({ registerTool(name, def, fn) { assert.equal(name, "ask_questions"); handler = fn; } }, { ...base, activeEngine }, { + post: async (ctx, args) => { calls.push({ ctx, args }); return { id: "request-id" }; }, + }); + const result = await handler(input()); + assert.deepEqual(calls[0].ctx, { channelId: "C_THIS", threadKey: "123.456", authorId: "U_THIS", slug: "this" }); + assert.match(result.content[0].text, /Awaiting.*Submit/); + } + for (const override of [{ origin: "schedule" }, { origin: "recovery" }, { origin: "background_agent" }, { principalTrusted: false }, { threadKey: "123.456::agent-1" }]) { + let registered = false; + register({ registerTool() { registered = true; } }, { ...base, ...override }); + assert.equal(registered, false); + } +}); diff --git a/test/qwen-engine.test.js b/test/qwen-engine.test.js new file mode 100644 index 00000000..cdd473db --- /dev/null +++ b/test/qwen-engine.test.js @@ -0,0 +1,283 @@ +// The Qwen harness: the Claude Code CLI pointed at QwenCloud's Anthropic-compatible endpoint. +// +// Everything here guards a way this engine could quietly become Claude (or quietly spend Claude's +// credential): the credential boundary, the opt-in switch, the model families, and the cost the +// CLI fabricates for a provider whose prices it does not know. +import test from "node:test"; +import assert from "node:assert/strict"; +import { ensureTestEnv } from "./helpers.js"; + +ensureTestEnv(); +const { saveSettings, isEngineEnabled, getEnabledEngines, getEngine, getQwenConfig, getDefaultModel } = await import("../src/config/settings.js"); +const { adapterFor, fallbackTargets, modelBelongsToEngine, engineCostRateKey, ENGINE_IDS } = await import("../src/engines/registry.js"); +const { buildClaudeEnv } = await import("../src/engines/claude.js"); +const qwen = await import("../src/engines/qwen.js"); +const { normalizeUsage } = await import("../src/gateway/usage.js"); + +const reset = () => saveSettings({ engineEnabled: undefined, engine: "claude", qwenApiKey: "", qwenBaseUrl: "", defaultQwenModel: "", codexRatePer1MTokens: 0 }); + +// ── The credential boundary ─────────────────────────────────────────────────────────────────── + +test("a provider run carries NO Anthropic credential, inherited or relayed", () => { + const env = buildClaudeEnv({ + home: "/home/agent", + oauthToken: "sk-ant-oat-RELAYED-OPERATOR-TOKEN", + providerEnv: qwen.qwenProviderEnv({ apiKey: "sk-sp-QWEN", baseUrl: "https://example.invalid/apps/anthropic" }), + }, { + PATH: "/usr/bin", + ANTHROPIC_API_KEY: "sk-ant-api-DAEMON-KEY", + ANTHROPIC_AUTH_TOKEN: "sk-ant-auth-DAEMON", + ANTHROPIC_BASE_URL: "https://api.anthropic.com", + }); + assert.equal(env.ANTHROPIC_BASE_URL, "https://example.invalid/apps/anthropic"); + assert.equal(env.ANTHROPIC_AUTH_TOKEN, "sk-sp-QWEN"); + // The three ways the operator's own Anthropic access could have leaked to a third-party host. + assert.equal(env.ANTHROPIC_API_KEY, undefined, "an inherited daemon API key must not ride along"); + assert.equal(env.CLAUDE_CODE_OAUTH_TOKEN, undefined, "the operator's relayed login must never reach another provider"); + assert.ok(!Object.values(env).includes("sk-ant-oat-RELAYED-OPERATOR-TOKEN")); + assert.ok(!Object.values(env).includes("sk-ant-api-DAEMON-KEY")); +}); + +test("a Claude run is unchanged when no provider is supplied", () => { + const env = buildClaudeEnv({ home: "/home/agent", oauthToken: "sk-ant-oat-RELAY" }, { PATH: "/usr/bin", ANTHROPIC_API_KEY: "sk-ant-api-DAEMON" }); + assert.equal(env.CLAUDE_CODE_OAUTH_TOKEN, "sk-ant-oat-RELAY"); + assert.equal(env.ANTHROPIC_API_KEY, "sk-ant-api-DAEMON"); + assert.equal(env.ANTHROPIC_BASE_URL, undefined); +}); + +test("a channel secret cannot redirect a Qwen run at its own endpoint", () => { + const env = buildClaudeEnv({ + home: "/home/agent", + // safeSpawnEnv drops reserved names; the provider group is applied last regardless. + extraEnv: { ANTHROPIC_BASE_URL: "https://attacker.invalid", ANTHROPIC_AUTH_TOKEN: "stolen", MY_TOKEN: "fine" }, + providerEnv: qwen.qwenProviderEnv({ apiKey: "sk-sp-QWEN", baseUrl: "https://token-plan.example/apps/anthropic" }), + }, { PATH: "/usr/bin" }); + assert.equal(env.ANTHROPIC_BASE_URL, "https://token-plan.example/apps/anthropic"); + assert.equal(env.ANTHROPIC_AUTH_TOKEN, "sk-sp-QWEN"); + assert.equal(env.MY_TOKEN, "fine", "ordinary channel secrets still ride in"); +}); + +test("the run fails closed, naming the remedy, when no key is configured", async () => { + reset(); + const adapter = adapterFor("qwen"); + await assert.rejects( + () => adapter.run({ + cwd: "/tmp", prompt: "hi", session: { id: "s", fresh: true }, + policy: { network: { mode: "on" } }, runtime: { pluginRuntime: null }, + }), + (error) => { + assert.match(error.message, /Qwen harness is selected/); + assert.match(error.message, /API key/); + assert.equal(error.details?.runtimeCredential, true); + return true; + }, + ); +}); + +test("with no model configured anywhere, a Qwen run asks for a Qwen model, never the CLI default", async () => { + // The CLI's own default is an Anthropic id; QwenCloud answers it with 400 "Model not exist". + const { mkdtempSync, writeFileSync, chmodSync, rmSync } = await import("node:fs"); + const { join } = await import("node:path"); + const { tmpdir } = await import("node:os"); + const dir = mkdtempSync(join(tmpdir(), "cg-qwen-model-")); + writeFileSync(join(dir, "claude"), `#!/usr/bin/env node +const i = process.argv.indexOf("--model"); +process.stdout.write(JSON.stringify({ type: "result", subtype: "success", session_id: "s", + result: "model=" + (i >= 0 ? process.argv[i + 1] : ""), usage: { input_tokens: 1, output_tokens: 1 } }) + "\\n"); +`); + chmodSync(join(dir, "claude"), 0o755); + const oldPath = process.env.PATH; + process.env.PATH = `${dir}:${oldPath}`; + try { + reset(); + saveSettings({ qwenApiKey: "sk-sp-TEST" }); + const result = await adapterFor("qwen").run({ + cwd: dir, prompt: "hi", session: { id: "s", fresh: true }, + policy: { network: { mode: "on" } }, runtime: { pluginRuntime: null, model: "" }, + }); + assert.equal(result.text ?? result.content ?? result.result, `model=${qwen.QWEN_DEFAULT_MODEL}`); + assert.ok(modelBelongsToEngine(qwen.QWEN_DEFAULT_MODEL, "qwen")); + } finally { + process.env.PATH = oldPath; + rmSync(dir, { recursive: true, force: true }); + reset(); + } +}); + +// ── Opt-in enablement ───────────────────────────────────────────────────────────────────────── + +test("Qwen is off until an admin turns it on, and is never enabled by a fallback", () => { + reset(); + assert.equal(adapterFor("qwen").optIn, true); + assert.equal(isEngineEnabled("qwen"), false, "a gateway that merely pulled this release must not offer it"); + assert.ok(!getEnabledEngines().includes("qwen")); + assert.ok(getEnabledEngines().includes("claude")); + + // The "never lock every harness out" rescue restores the DEFAULT harnesses only. + saveSettings({ engineEnabled: { claude: false, codex: false, qwen: false, opencode: false } }); + assert.equal(isEngineEnabled("claude"), true); + assert.equal(isEngineEnabled("qwen"), false, "the rescue must not switch the gateway onto a third-party provider"); + + saveSettings({ engineEnabled: { claude: true, codex: true, qwen: true, opencode: false } }); + assert.equal(isEngineEnabled("qwen"), true); + assert.ok(getEnabledEngines().includes("qwen")); + + // A deployment deliberately running ONLY Qwen keeps the others off. + saveSettings({ engineEnabled: { claude: false, codex: false, qwen: true, opencode: false } }); + assert.equal(isEngineEnabled("qwen"), true); + assert.equal(isEngineEnabled("claude"), false, "an explicit single-harness choice must survive"); + assert.equal(getEngine(), "qwen", "the default engine resolves to the one that is actually on"); + reset(); +}); + +test("Qwen sits outside the failover graph in both directions", () => { + assert.deepEqual([...fallbackTargets("qwen")], [], "a Qwen limit must not spend the Anthropic quota"); + assert.ok(!fallbackTargets("claude").includes("qwen")); + assert.ok(!fallbackTargets("codex").includes("qwen")); +}); + +// ── Models ──────────────────────────────────────────────────────────────────────────────────── + +test("only text models are selectable — image/audio families answer 400 on /v1/messages", () => { + for (const id of ["qwen3.8-max", "qwen3.6-flash", "glm-5.3", "deepseek-v4.1-flash", "auto"]) { + assert.equal(qwen.isQwenTextModel(id), true, id); + assert.equal(modelBelongsToEngine(id, "qwen"), true, id); + } + for (const id of ["wan2.7-image", "wan2.7-image-pro", "qwen-audio-3.0-tts-plus", "qwen-audio-3.0-realtime-plus"]) { + assert.equal(qwen.isQwenTextModel(id), false, id); + assert.equal(modelBelongsToEngine(id, "qwen"), false, id); + } + // Never another harness's ids, in either direction — the wrong answer here is a run on the + // wrong provider rather than an error. + for (const id of ["sonnet", "opus[1m]", "claude-opus-5", "gpt-5.6-sol", "codex"]) { + assert.equal(modelBelongsToEngine(id, "qwen"), false, id); + } + assert.equal(modelBelongsToEngine("qwen3.8-max", "claude"), false); + assert.equal(modelBelongsToEngine("qwen3.8-max", "codex"), false); +}); + +test("the model-list URL is derived from the configured Anthropic endpoint", () => { + assert.equal( + qwen.qwenModelsUrl("https://token-plan.maas.qwencloudapi.com/apps/anthropic"), + "https://token-plan.maas.qwencloudapi.com/compatible-mode/v1/models", + ); + assert.equal( + qwen.qwenModelsUrl("https://maas.qwencloudapi.com/apps/anthropic/"), + "https://maas.qwencloudapi.com/compatible-mode/v1/models", + ); + // A proxy that does not follow the documented shape gets the sibling appended, never guessed at. + assert.equal(qwen.qwenModelsUrl("https://proxy.example/qwen"), "https://proxy.example/qwen/compatible-mode/v1/models"); +}); + +test("discovery reads the account's own list, filtered and labelled", async () => { + reset(); + saveSettings({ qwenApiKey: "sk-sp-TEST", qwenBaseUrl: "https://token-plan.example/apps/anthropic" }); + let seenUrl = ""; + let seenAuth = ""; + const models = await qwen.discoverQwenModels({ + fetchImpl: async (url, options) => { + seenUrl = url; + seenAuth = options.headers.Authorization; + return { + ok: true, + json: async () => ({ data: [ + { id: "qwen3.8-max" }, { id: "wan2.7-image" }, { id: "glm-5.3" }, + { id: "qwen-audio-3.0-tts-plus" }, { id: "auto" }, { id: "" }, + ] }), + }; + }, + }); + assert.equal(seenUrl, "https://token-plan.example/compatible-mode/v1/models"); + assert.equal(seenAuth, "Bearer sk-sp-TEST"); + assert.deepEqual(models.map((m) => m.value), ["auto", "glm-5.3", "qwen3.8-max"]); + assert.equal(models.find((m) => m.value === "glm-5.3").label, "GLM 5.3"); + assert.equal(models.find((m) => m.value === "auto").label, "Auto (provider routing)"); + reset(); +}); + +test("discovery refuses to guess when the account is not configured", async () => { + reset(); + await assert.rejects(() => qwen.discoverQwenModels({ fetchImpl: async () => { throw new Error("must not be called"); } }), /API key/); +}); + +test("an HTTP failure is reported rather than silently blanking the picker", async () => { + reset(); + saveSettings({ qwenApiKey: "sk-sp-TEST" }); + await assert.rejects(() => qwen.discoverQwenModels({ fetchImpl: async () => ({ ok: false, status: 401 }) }), /HTTP 401/); + reset(); +}); + +test("a provider failure names the harness that failed, not the CLI it borrows", async () => { + const { claudeProviderError } = await import("../src/engines/stream.js"); + const event = { error: { type: "authentication_error", message: "401 Invalid API-key provided" } }; + // Sending someone to check the wrong account is the bug this prevents. + assert.match(claudeProviderError(event, "Qwen").message, /^Qwen authentication failed/); + assert.match(claudeProviderError(event).message, /^Claude authentication failed/, "the default is unchanged"); + assert.equal(claudeProviderError(event, "Qwen").kind, "authentication"); +}); + +// ── Cost ────────────────────────────────────────────────────────────────────────────────────── + +test("a Qwen turn records tokens and no dollar figure", () => { + reset(); + // An operator who priced Codex must not thereby price QwenCloud with OpenAI's rates. + saveSettings({ codexRatePer1MTokens: 10 }); + const usage = { input_tokens: 1000, output_tokens: 500, cache_read_input_tokens: 200 }; + const qwenRow = normalizeUsage({ engine: "qwen", usage, costUSD: null }); + assert.equal(qwenRow.costUSD, null, "no invoice will ever match an invented number"); + assert.equal(qwenRow.estimated, false); + assert.equal(qwenRow.outTok, 500, "the tokens themselves are real and are kept"); + assert.equal(qwenRow.inTok, 1200); + // Codex still gets its configured estimate; the guard is per-engine, not a blanket off-switch. + const codexRow = normalizeUsage({ engine: "codex", usage: { prompt_tokens: 1000, completion_tokens: 500 }, costUSD: null }); + assert.equal(codexRow.estimated, true); + assert.ok(codexRow.costUSD > 0); + assert.equal(engineCostRateKey("qwen"), ""); + assert.equal(engineCostRateKey("codex"), "codexRatePer1MTokens"); + reset(); +}); + +// ── Settings surface ────────────────────────────────────────────────────────────────────────── + +test("the provider is gateway configuration, defaulting to the documented endpoint", () => { + reset(); + assert.equal(getQwenConfig().apiKey, ""); + assert.equal(getQwenConfig().baseUrl, qwen.QWEN_DEFAULT_BASE_URL); + saveSettings({ qwenApiKey: " sk-sp-PADDED ", qwenBaseUrl: " https://maas.qwencloudapi.com/apps/anthropic " }); + assert.equal(getQwenConfig().apiKey, "sk-sp-PADDED"); + assert.equal(getQwenConfig().baseUrl, "https://maas.qwencloudapi.com/apps/anthropic"); + saveSettings({ defaultQwenModel: "qwen3.8-max" }); + assert.equal(getDefaultModel("qwen"), "qwen3.8-max", "the per-engine default is keyed off the adapter, not a hardcoded pair"); + reset(); +}); + +test("the key is revealable only through the audited one-at-a-time endpoint", async () => { + const { revealableFields } = await import("../src/web/secrets.js"); + assert.ok(revealableFields("settings").includes("qwenApiKey")); + const { settingsForApi } = await import("../src/config/settings.js"); + reset(); + saveSettings({ qwenApiKey: "sk-sp-SECRET-VALUE-1234" }); + const snapshot = settingsForApi(); + assert.equal(snapshot.hasQwenApiKey, true); + assert.equal(snapshot.qwenApiKeyLast4, "1234"); + assert.equal(snapshot.qwenApiKey, undefined, "a listing response must never carry the value"); + assert.ok(!JSON.stringify(snapshot).includes("sk-sp-SECRET-VALUE-1234")); + reset(); +}); + +test("the harness reuses Claude's CLI, instruction file and skills dir, and its own everything else", () => { + const q = adapterFor("qwen"); + const c = adapterFor("claude"); + assert.equal(q.cli, c.cli, "same binary"); + assert.equal(q.instructionFile, c.instructionFile); + assert.equal(q.skillsDir, c.skillsDir); + assert.equal(q.mcpTransport, c.mcpTransport); + assert.equal(q.mcpMetaKey, c.mcpMetaKey, "one Cloud MCP selection serves both"); + assert.equal(q.sessionState.containerDirKey, c.sessionState.containerDirKey); + // …and the provider-owned facts are its own. + assert.notEqual(q.defaultModelKey, c.defaultModelKey); + assert.equal(q.supports.realCost, false); + assert.equal(q.supports.warmPool, false, "a warm process would outlive a provider-key rotation"); + assert.equal(q.supports.permissionPrompt, true, "the approval card is the CLI's, and it works"); + assert.ok(ENGINE_IDS.includes("qwen")); +}); diff --git a/test/runtime-access-facts.test.js b/test/runtime-access-facts.test.js index 50e3f254..f215643b 100644 --- a/test/runtime-access-facts.test.js +++ b/test/runtime-access-facts.test.js @@ -53,3 +53,11 @@ test("missing resolved facts stay unknown instead of inferring a mode or host is assert.match(note, /Network policy for this attempt is unknown/); assert.doesNotMatch(note, /runtime directory: \*\*(not )?mounted\*\*/); }); + +test("a sudo-host target states that the container boundary is absent", () => { + const note = runtimeAccessPreamble({ backend: "host", container: null }, { clean: false, allowNetwork: true }); + assert.match(note, /Direct host access.*enabled by `\/sudo`/s); + assert.match(note, /There is no channel-container boundary/); + assert.match(note, /runtime directory: \*\*directly accessible\*\*/); + assert.match(note, /Only organization-admin messages are admitted/); +}); diff --git a/test/runtime-integration-folders.test.js b/test/runtime-integration-folders.test.js index 3dfddd15..6a8efd97 100644 --- a/test/runtime-integration-folders.test.js +++ b/test/runtime-integration-folders.test.js @@ -1,5 +1,5 @@ -// The provisioning half of the container runtime: what a channel folder and a run's engine-facing -// artifacts look like now that every turn runs behind an OS boundary the daemon owns. +// Runtime provisioning: ordinary channel turns keep all engine-facing artifacts behind the +// container boundary, while the explicit sudo-host target uses native host homes and paths. // // Two rules are under test, and both cut both ways: // 1. the settings file carries POLICY only — no sandbox block, no host-path carve-outs and no host @@ -21,7 +21,8 @@ process.env.CG_WORKSPACE_DIR ||= path.join(scratch, "workspace"); const { buildSettings, ensureChannelFolder, subagentStopHooks, STOP_SUBAGENTS_HOOK } = await import("../src/gateway/folders.js"); const { createRunGrantArtifacts, engineHomesFor, refreshRuntimeReadPaths, CONTAINER_AGENT_HOME } = await import("../src/gateway/run-grant-artifacts.js"); const { channelFolder, gatewayRoot } = await import("../src/config/paths.js"); -const { localRuntimeTarget } = await import("../src/engines/runtime-target.js"); +const { hostClaudeStateDir, hostCodexStateDir } = await import("../src/engines/host-state.js"); +const { hostBackend } = await import("../src/runtimes/host.js"); const { IMAGE_HELPERS } = await import("../src/runtimes/container/image-paths.js"); const { createFakeRuntimeBackend, fakeTarget } = await import("./runtime-fake.js"); @@ -114,22 +115,31 @@ test("a run's engine-facing artifacts all live under the mounted artifact dir", } }); -test("a caller with no artifact dir is refused instead of being served files from the gateway root", async () => { +test("a non-isolated host caller receives run-private artifacts without requiring a mount", async () => { const meta = { platform: "slack", allowedMcps: [] }; await ensureChannelFolder("rt-no-artifacts", meta); - // No target at all, and the daemon's own local target (which mounts nothing and so names no - // artifact dir): a containerized engine would silently find neither settings nor MCP config. - for (const target of [undefined, null, localRuntimeTarget(process.cwd())]) { - await assert.rejects( - createRunGrantArtifacts({ slug: "rt-no-artifacts", meta, needsClaudeSettings: true, target }), - /runtime target must carry an artifactDir/, - ); + const target = hostBackend.prepareTarget({ + slug: "rt-no-artifacts", platform: "slack", cwd: process.cwd(), workDir: process.cwd(), + cleanWorkDir: "", artifactDir: null, meta: { ...meta, sudoMode: true }, settings: {}, container: null, + }); + const artifacts = await createRunGrantArtifacts({ slug: "rt-no-artifacts", meta, needsClaudeSettings: true, target }); + try { + assert.ok(artifacts.settingsFile); + assert.equal(artifacts.claudeConfigDir, hostClaudeStateDir()); + assert.equal(artifacts.codexHome, hostCodexStateDir()); + } finally { + await artifacts.cleanup(); } }); -test("engineHomesFor answers null for no target, and prefers what the backend declares", () => { - assert.equal(engineHomesFor(null), null); - assert.equal(engineHomesFor(undefined), null); +test("engineHomesFor uses native host state only for the explicit host target and prefers container declarations", () => { + const host = hostBackend.prepareTarget({ cwd: process.cwd(), meta: { sudoMode: true } }); + const homes = engineHomesFor(host); + assert.equal(homes.claudeHome, os.homedir()); + assert.equal(homes.claudeConfigDir, hostClaudeStateDir()); + assert.equal(homes.codexHome, hostCodexStateDir()); + assert.equal(homes.codexStateDir, hostCodexStateDir()); + assert.equal(engineHomesFor(null), null, "missing runtime facts never imply host access"); const target = fakeTarget(backend, "rt-homes", { platform: "slack" }); assert.deepEqual(engineHomesFor(target), { diff --git a/test/runtime-integration-run.test.js b/test/runtime-integration-run.test.js index 6263c0ab..eca96a9f 100644 --- a/test/runtime-integration-run.test.js +++ b/test/runtime-integration-run.test.js @@ -38,7 +38,8 @@ const { saveSettings } = await import("../src/config/settings.js"); const { runMessage, setRuntimeResolver, runArtifactRoot } = await import("../src/gateway/run.js"); const { getSessionRuntime, getSession, getSessionEngine, saveSession } = await import("../src/gateway/sessions.js"); const { readEvents } = await import("../src/util/logger.js"); -const { runTmpDir, claudeEngineHome } = await import("../src/config/paths.js"); +const { runTmpDir } = await import("../src/config/paths.js"); +const { hostClaudeStateDir } = await import("../src/engines/host-state.js"); const { resolveRuntime } = await import("../src/runtimes/resolve.js"); const { localRuntimeTarget } = await import("../src/engines/runtime-target.js"); const { createFakeRuntimeBackend, fakeContainerPath, fakeTarget, FAKE_IMAGE } = await import("./runtime-fake.js"); @@ -104,18 +105,15 @@ function useBackend(backend, { record = null } = {}) { } // A thread that last ran on the HOST — what every session row from before the container runtime -// looks like, and the one case the carry-over exists for. There is no host backend to run the -// first turn on any more, so the row is put into that state directly: the first turn runs through -// a fake container (the only backend there is), its row is then re-stamped the way the host -// backend used to write it, and the transcript is planted where a host turn's engine wrote it — -// the daemon's own engine state dir. +// looks like. The fixture stamps the state directly so this test can isolate host→container carry +// from the sudo admission path, then plants the transcript where a direct host turn writes it. async function hostThread(channelId, threadKey, { entry, meta }) { useBackend(createFakeRuntimeBackend()); const first = await runMessage({ channelId, authorId: "U_RT", text: "one", threadKey, origin: "slack_foreground", preferCold: true }); await saveSession(entry.slug, threadKey, first.sessionId, "claude", null, JSON.stringify({ backend: "host", fingerprint: "host", image: "" })); assert.equal((await getSessionRuntime(entry.slug, threadKey)).backend, "host"); const key = resolveRuntime(entry.slug, meta).cwd.replace(/[^a-zA-Z0-9]/g, "-"); - const projects = path.join(claudeEngineHome(), ".claude", "projects", key); + const projects = path.join(hostClaudeStateDir(), "projects", key); await mkdir(path.join(projects, first.sessionId), { recursive: true }); await writeFile(path.join(projects, `${first.sessionId}.jsonl`), "host transcript\n"); await writeFile(path.join(projects, first.sessionId, "sub.jsonl"), "subagent\n"); @@ -164,7 +162,7 @@ test("a Claude turn relays the OPERATOR's login into the container — never a s // …and the child's config dir is the IMAGE's, never the daemon's synthetic engine home (which // is not mounted, and whose credentials copy is exactly the dead one above). assert.equal(spawned.env.CLAUDE_CONFIG_DIR, "/home/agent/.claude"); - assert.ok(!spawned.env.CLAUDE_CONFIG_DIR.startsWith(claudeEngineHome())); + assert.notEqual(spawned.env.CLAUDE_CONFIG_DIR, hostClaudeStateDir()); }); test("a runtime that cannot start ends the turn with its own error, before the engine runs", async () => { @@ -279,8 +277,7 @@ test("the session row and the run_config event both record where the turn ran", const config = readEvents({ limit: 50 }).find((e) => e.event === "run_config" && e.slug === entry.slug); assert.equal(config.runtime, "container"); - // There is exactly one backend, and the record says so rather than pretending a choice was made. - assert.equal(config.runtimeReason, "only-runtime"); + assert.equal(config.runtimeReason, "default"); // The compiled network policy is what the engine was TOLD, never a boundary anything applied: // the container is on the bridge network and no egress is policed per channel. Recorded next to // the mode so an operator reading the event after an incident cannot mistake `"off"` for "this diff --git a/test/runtimes-core.test.js b/test/runtimes-core.test.js index 2753921d..08760538 100644 --- a/test/runtimes-core.test.js +++ b/test/runtimes-core.test.js @@ -1,8 +1,7 @@ // The runtime layer's core facts (src/runtimes/): the fail-closed backend contract, the registry -// that holds exactly one channel runtime — the container — and the resolver that hands every -// channel turn to it. The daemon's OWN process spawner (src/runtimes/local.js) is covered here too, -// precisely because it is NOT a channel runtime: it exists for the update smoke probe and the -// direct-runner tests, and nothing a channel does can resolve to it. +// that defaults every channel to its container and admits the direct host backend only for the +// transient, admin-authenticated sudo-thread posture. The daemon's OWN local spawner remains +// separate from both registered channel runtimes. import test from "node:test"; import assert from "node:assert/strict"; import { mkdirSync, renameSync } from "node:fs"; @@ -15,12 +14,14 @@ const { validateRuntimeBackend, runtimeSupports, runtimeCanCarry, newRunId, runI const { localRuntime } = await import("../src/runtimes/local.js"); const { runtimeBackend, runtimeBackendOr, runtimeBackendIds, isRuntimeBackendId } = await import("../src/runtimes/registry.js"); const { decideRuntimeBackend, resolveRuntime } = await import("../src/runtimes/resolve.js"); +const { sudoModeMeta } = await import("../src/gateway/modes.js"); const { localRuntimeTarget } = await import("../src/engines/runtime-target.js"); const { credentialError: containerCredentialError } = await import("../src/runtimes/container/credentials.js"); const { installId, channelArtifactDir, runtimeSocketFile } = await import("../src/config/paths.js"); const { getContainerRuntime } = await import("../src/config/settings.js"); const container = runtimeBackend("container"); +const host = runtimeBackend("host"); test("contract: a backend missing a method or capability fails closed", () => { assert.doesNotThrow(() => validateRuntimeBackend(container)); @@ -31,8 +32,7 @@ test("contract: a backend missing a method or capability fails closed", () => { const extraCap = { ...container, capabilities: { ...container.capabilities, superpowers: true } }; assert.throws(() => validateRuntimeBackend(extraCap), /unknown capability/); assert.throws(() => validateRuntimeBackend({ ...container, id: "vm" }), /unknown id/); - // The host OS-sandbox backend is gone: a module that still calls itself "host" cannot load. - assert.throws(() => validateRuntimeBackend({ ...container, id: "host" }), /unknown id/); + assert.doesNotThrow(() => validateRuntimeBackend(host)); }); test("contract: an OPTIONAL method may be absent but may never be the wrong thing", () => { @@ -62,37 +62,36 @@ test("contract: runtimeSupports reads declared capabilities and throws on unknow assert.throws(() => runtimeSupports(container, "teleport"), /unknown runtime capability/); }); -test("registry: the container backend is the only channel runtime, and every stored id resolves to it", () => { - assert.deepEqual([...RUNTIME_BACKEND_IDS], ["container"]); +test("registry: host is registered for sudo while container remains the universal default", () => { + assert.deepEqual([...RUNTIME_BACKEND_IDS], ["host", "container"]); assert.equal(DEFAULT_RUNTIME_BACKEND, "container"); - assert.deepEqual(runtimeBackendIds(), ["container"]); + assert.deepEqual(runtimeBackendIds(), ["host", "container"]); assert.equal(runtimeBackend("container").id, "container"); - assert.throws(() => runtimeBackend("host"), /unknown runtime backend/); + assert.equal(runtimeBackend("host").id, "host"); assert.throws(() => runtimeBackend("docker"), /unknown runtime backend/); - // Rows written before v0.8 name no backend; rows written while the host backend existed name - // "host". Both resolve to the one backend there is. + // Default/fallback lookup remains container; only an explicit valid host id resolves host. assert.equal(runtimeBackendOr("").id, "container"); - assert.equal(runtimeBackendOr("host").id, "container"); + assert.equal(runtimeBackendOr("host").id, "host"); assert.equal(runtimeBackendOr("bogus").id, "container"); assert.equal(isRuntimeBackendId("container"), true); - assert.equal(isRuntimeBackendId("host"), false); + assert.equal(isRuntimeBackendId("host"), true); assert.equal(isRuntimeBackendId("local"), false, "the daemon's own spawner is deliberately not registered"); }); -test("resolve: every channel runs in the container — no kill switch, no pin, no admin-mode exception", () => { - for (const meta of [{}, { runtime: "host" }, { runtime: "container" }, { adminMode: true }, { cleanMode: true }, { runtime: "vm" }]) { - assert.deepEqual(decideRuntimeBackend(meta), { backend: "container", reason: "only-runtime" }, JSON.stringify(meta)); +test("resolve: only the authorized transient sudo posture selects host; stored fields and admin mode do not", () => { + for (const meta of [{}, { runtime: "host" }, { runtime: "container" }, { adminMode: true }, { cleanMode: true }, { runtime: "vm" }, { sudoMode: true }]) { + assert.deepEqual(decideRuntimeBackend(meta), { backend: "container", reason: "default" }, JSON.stringify(meta)); } - // The pre-2026-09 signature (meta, settings) is tolerated and ignored: the answer never changes. - assert.deepEqual(decideRuntimeBackend({ runtime: "host" }, { enabled: false, defaultBackend: "host" }), { backend: "container", reason: "only-runtime" }); - assert.deepEqual(decideRuntimeBackend(), { backend: "container", reason: "only-runtime" }); + assert.deepEqual(decideRuntimeBackend(sudoModeMeta({})), { backend: "host", reason: "thread-sudo" }); + assert.deepEqual(decideRuntimeBackend({ runtime: "host" }, { enabled: false, defaultBackend: "host" }), { backend: "container", reason: "default" }); + assert.deepEqual(decideRuntimeBackend(), { backend: "container", reason: "default" }); }); test("resolve: the target carries cwd, durable workDir, clean workspace, the artifact dir and the backend object", () => { const meta = { platform: "slack", channelId: "C1", name: "#rt" }; const target = resolveRuntime("rt-core", meta); assert.equal(target.backend, "container"); - assert.equal(target.reason, "only-runtime"); + assert.equal(target.reason, "default"); assert.equal(target.runtime, container); assert.equal(target.cwd, target.workDir); assert.match(target.cleanWorkDir, /clean-workspaces[\\/]slack[\\/]rt-core$/); @@ -111,6 +110,13 @@ test("resolve: the target carries cwd, durable workDir, clean workspace, the art const admin = resolveRuntime("rt-core", { ...meta, adminMode: true }); assert.equal(admin.backend, "container", "admin mode runs in a container like every other channel"); assert.equal(admin.cwd, target.cwd, "the same channel, the same working directory"); + + const sudo = resolveRuntime("rt-core", sudoModeMeta(meta)); + assert.equal(sudo.backend, "host"); + assert.equal(sudo.reason, "thread-sudo"); + assert.equal(sudo.runtime, host); + assert.equal(sudo.artifactDir, null); + assert.equal(sudo.container, null); }); test("local spawner: spawn tags the child, probe follows the pid, signal takes the group — and it is no channel runtime", async () => { @@ -141,10 +147,10 @@ test("local spawner: spawn tags the child, probe follows the pid, signal takes t assert.equal(localRuntime.resumeCommand(target, { baseCommand: "claude --resume abc" }), "claude --resume abc"); assert.deepEqual(await localRuntime.describe(target), { backend: "local", state: "local" }); assert.deepEqual(await localRuntime.ensureUp(target), { created: false, started: false, warmupMs: 0 }); - // The engine-side helpers (the gateway MCP bridge, the secret bridges, the Stop hook) are the - // image's baked bundle: a local child has none, and asking is a programming error, not a fallback. - assert.throws(() => localRuntime.helperCommand(target, "gateway-mcp"), /only available inside a channel container/); - assert.throws(() => localRuntime.helperCommand(target, "warp-drive"), /only available inside a channel container/); + // Engine-side helpers belong to registered runtimes (the image bundle or sudo-host checkout): + // a daemon-internal local child has none, and asking is a programming error, not a fallback. + assert.throws(() => localRuntime.helperCommand(target, "gateway-mcp"), /unavailable in the daemon-internal local runtime/); + assert.throws(() => localRuntime.helperCommand(target, "warp-drive"), /unavailable in the daemon-internal local runtime/); // It can never be registered as a channel runtime: the contract does not know its id. assert.throws(() => validateRuntimeBackend(localRuntime), /unknown id "local"/); }); diff --git a/test/session-carry.test.js b/test/session-carry.test.js index 01a80a25..f36e342a 100644 --- a/test/session-carry.test.js +++ b/test/session-carry.test.js @@ -15,7 +15,8 @@ ensureTestEnv(); const { engineSessionFiles, engineSessionState, engineStateDir } = await import("../src/engines/registry.js"); const { copyCarryEntries, expandCarryEntry, walkFiles } = await import("../src/runtimes/copy.js"); const { buildCarryEntries, carrySession, storedRuntimeBackend, CARRY_DIRECTIONS } = await import("../src/gateway/session-carry.js"); -const { claudeEngineHome, codexEngineHome } = await import("../src/config/paths.js"); +const { hostClaudeStateDir, hostCodexStateDir } = await import("../src/engines/host-state.js"); +const { hostBackend } = await import("../src/runtimes/host.js"); const SESSION = "9f3ab7c2-1111-4000-8000-abcdefabcdef"; @@ -48,8 +49,8 @@ test("engine facts: a Codex rollout is a PATTERN whose date directories must sur }); test("engine facts: state dirs come from the target, and an engine that declares none never carries", () => { - assert.equal(engineStateDir("claude", null), path.join(claudeEngineHome(), ".claude")); - assert.equal(engineStateDir("codex", null), codexEngineHome()); + assert.equal(engineStateDir("claude", null), hostClaudeStateDir()); + assert.equal(engineStateDir("codex", null), hostCodexStateDir()); const containerTarget = { container: { claudeConfigDir: "/home/agent/.claude", codexHome: "/home/agent/.codex" } }; assert.equal(engineStateDir("claude", containerTarget), "/home/agent/.claude"); assert.equal(engineStateDir("codex", containerTarget), "/home/agent/.codex"); @@ -162,11 +163,10 @@ function carryHarness(name) { return { root, ctrDir, calls, containerTarget, logs, log: (m) => logs.push(m) }; } -// The claude host state dir is claudeEngineHome()/.claude, which the scratch env pins; a test that -// wants its own directory writes there instead of guessing. +// The direct host backend uses the native CLI state dir, which the scratch env pins. function claudeHostFile(sessionId, cwd) { const key = String(cwd).replace(/[^a-zA-Z0-9]/g, "-"); - return path.join(claudeEngineHome(), ".claude", "projects", key, `${sessionId}.jsonl`); + return path.join(hostClaudeStateDir(), "projects", key, `${sessionId}.jsonl`); } test("carry: same backend on both sides is a no-op — a recreated container still has its volume", async () => { @@ -208,11 +208,10 @@ test("carry: host→container copies the session in, leases the runtime, and rep assert.equal(existsSync(claudeHostFile(SESSION, cwd)), true); }); -// There is no container→host direction any more: every channel runs in a container, so a row -// that already names one has nothing to move and nowhere else to go. -test("carry: the only direction is host→container, and a container row is never copied anywhere", async () => { - assert.deepEqual(Object.keys(CARRY_DIRECTIONS), ["IN"]); +test("carry: container→host copies session history out for a sudo turn", async () => { + assert.deepEqual(Object.keys(CARRY_DIRECTIONS), ["IN", "OUT"]); assert.equal(CARRY_DIRECTIONS.IN, "host→container"); + assert.equal(CARRY_DIRECTIONS.OUT, "container→host"); const h = carryHarness("out"); const cwd = "/w/out"; @@ -220,18 +219,23 @@ test("carry: the only direction is host→container, and a container row is neve const key = cwd.replace(/[^a-zA-Z0-9]/g, "-"); write(path.join(h.ctrDir, ".claude", "projects", key, `${sessionId}.jsonl`), "in-container\n"); + const hostTarget = hostBackend.prepareTarget({ + slug: "out", platform: "slack", meta: { platform: "slack", sudoMode: true }, + cwd, workDir: cwd, cleanWorkDir: "", settings: {}, artifactDir: null, + }); const result = await carrySession({ engine: "claude", sessionId, cwd, storedRuntime: JSON.stringify({ backend: "container", image: "channelgate/runtime:test" }), - target: h.containerTarget, slug: "out", threadKey: "1.2", log: h.log, + target: hostTarget, slug: "out", threadKey: "1.2", log: h.log, + resolveFor: () => h.containerTarget, }); - assert.equal(result, null); - assert.equal(h.calls.copyOut.length, 0); + assert.deepEqual(result, { direction: CARRY_DIRECTIONS.OUT, files: 1 }); + assert.equal(h.calls.copyOut.length, 1); assert.equal(h.calls.copyIn.length, 0); - assert.equal(h.calls.leases.length, 0, "nothing to copy, so nothing to hold the container up for"); - assert.equal(existsSync(claudeHostFile(sessionId, cwd)), false, "the host state dir is never written to"); - assert.deepEqual(h.logs, []); + assert.equal(h.calls.leases.length, 1, "the source container stays leased while state is copied out"); + assert.equal(readFileSync(claudeHostFile(sessionId, cwd), "utf8"), "in-container\n"); + assert.match(h.logs.join("\n"), /container→host \(1 file\)/); }); test("carry: no files to carry is silent, and the resume simply falls back to the heal", async () => { diff --git a/test/slack-answer-images.test.js b/test/slack-answer-images.test.js new file mode 100644 index 00000000..1425bdbc --- /dev/null +++ b/test/slack-answer-images.test.js @@ -0,0 +1,308 @@ +import { mkdtemp, mkdir, readFile, rm, symlink, writeFile } from "node:fs/promises"; +import os from "node:os"; +import path from "node:path"; +import { test } from "node:test"; +import assert from "node:assert/strict"; + +import { ensureTestEnv } from "./helpers.js"; + +ensureTestEnv(); + +const { + answerImageBlocks, + answerImageFiles, + shareAnswerImageFiles, + MAX_ANSWER_IMAGE_BLOCKS, +} = await import("../src/slack/images.js"); +const { deliverResult } = await import("../src/slack/deliver.js"); +const { startProgress } = await import("../src/slack/progress.js"); +const { postChunkedReply } = await import("../src/slack/util.js"); + +test("Markdown images become bounded, deduplicated Slack image blocks outside code fences", () => { + const markdown = [ + "![**Revenue** by region](https://img.example/chart_(final).png \"Q3 revenue\")", + "![duplicate](https://img.example/chart_(final).png)", + "![No title](http://img.example/no-title.gif)", + "![local](./chart.png)", + "![data](data:image/png;base64,AAAA)", + "```md", + "![example only](https://img.example/code.png)", + "```", + ...Array.from({ length: 10 }, (_, index) => `![extra ${index}](https://img.example/${index}.jpg)`), + ].join("\n"); + + const blocks = answerImageBlocks(markdown); + + assert.equal(blocks.length, MAX_ANSWER_IMAGE_BLOCKS); + assert.deepEqual(blocks[0], { + type: "image", + image_url: "https://img.example/chart_(final).png", + alt_text: "Revenue by region", + title: { type: "plain_text", text: "Q3 revenue", emoji: true }, + }); + assert.equal(blocks[1].image_url, "http://img.example/no-title.gif"); + assert.equal(blocks[1].alt_text, "No title"); + assert.equal(blocks.some((block) => /code|data|chart\.png$/.test(block.image_url)), false); + assert.equal(new Set(blocks.map((block) => block.image_url)).size, blocks.length); +}); + +test("local Markdown images resolve inside the workspace and reject escapes", async (t) => { + const root = await mkdtemp(path.join(os.tmpdir(), "cg-answer-images-")); + const outside = await mkdtemp(path.join(os.tmpdir(), "cg-answer-images-outside-")); + t.after(async () => Promise.all([rm(root, { recursive: true, force: true }), rm(outside, { recursive: true, force: true })])); + await mkdir(path.join(root, "reports")); + await writeFile(path.join(root, "reports", "chart final.png"), Buffer.from("png")); + await writeFile(path.join(outside, "private.png"), Buffer.from("private")); + await symlink(outside, path.join(root, "escape")); + + const markdown = [ + "![Revenue]( \"Quarterly revenue\")", + "![duplicate](./reports/chart%20final.png)", + "![escape](escape/private.png)", + "![not an image](reports/data.csv)", + "```md", + "![example](reports/chart%20final.png)", + "```", + ].join("\n"); + const files = await answerImageFiles(markdown, root); + + assert.equal(files.length, 1); + assert.equal(files[0].relative, "reports/chart final.png"); + assert.equal(files[0].filename, "chart final.png"); + assert.equal(files[0].title, "Quarterly revenue"); +}); + +test("local answer images are uploaded into the Slack thread as native files", async (t) => { + const root = await mkdtemp(path.join(os.tmpdir(), "cg-answer-image-share-")); + t.after(async () => rm(root, { recursive: true, force: true })); + const imagePath = path.join(root, "preview.png"); + await writeFile(imagePath, Buffer.from("png")); + const uploads = []; + + const shared = await shareAnswerImageFiles({ + markdown: "Done.\n\n![Result](preview.png)", + cwd: root, + channel: "C1", + threadTs: "111.222", + uploadFile: async (payload) => { + uploads.push(payload); + return { fileId: "F1", permalink: "https://slack.test/F1" }; + }, + }); + + assert.equal(uploads.length, 1); + assert.deepEqual(uploads[0], { + filePath: imagePath, + rootPath: root, + filename: "preview.png", + title: "Result", + channelId: "C1", + threadTs: "111.222", + }); + assert.equal(shared[0].fileId, "F1"); +}); + +test("a native file upload failure stays cosmetic after answer delivery", async (t) => { + const root = await mkdtemp(path.join(os.tmpdir(), "cg-answer-image-failure-")); + t.after(async () => rm(root, { recursive: true, force: true })); + await writeFile(path.join(root, "preview.png"), Buffer.from("png")); + const failures = []; + + const shared = await shareAnswerImageFiles({ + markdown: "![Result](preview.png)", + cwd: root, + channel: "C1", + threadTs: "111.222", + uploadFile: async () => { throw new Error("missing_scope"); }, + onError: (error, file) => failures.push([error.message, file.filename]), + }); + + assert.deepEqual(shared, []); + assert.deepEqual(failures, [["missing_scope", "preview.png"]]); +}); + +test("classic Slack delivery keeps the answer and image preview in one Block Kit message", async () => { + const posts = []; + const client = { chat: { postMessage: async (payload) => posts.push(payload) } }; + const blocks = answerImageBlocks("![Architecture](https://img.example/architecture.png)"); + + await postChunkedReply(client, "C1", "111.222", "Architecture: ", "", null, { + answerBlocks: blocks, + }); + + assert.equal(posts.length, 1); + assert.equal(posts[0].text, "Architecture: "); + assert.deepEqual(posts[0].blocks.map((block) => block.type), ["section", "image"]); + assert.equal(posts[0].blocks[1].image_url, "https://img.example/architecture.png"); +}); + +test("unattended Slack delivery promotes the model's Markdown image into the answer blocks", async () => { + const posts = []; + const client = { chat: { postMessage: async (payload) => posts.push(payload) } }; + + await deliverResult(client, { + channel: "C1", + threadKey: "111.222", + dir: null, + result: { content: "Report\n\n![Trend](https://img.example/trend.png)" }, + }); + + assert.equal(posts.length, 1); + assert.deepEqual(posts[0].blocks.map((block) => block.type), ["section", "image"]); + assert.equal(posts[0].blocks[1].image_url, "https://img.example/trend.png"); + assert.match(posts[0].text, /https:\/\/img\.example\/trend\.png/); +}); + +test("unattended Slack delivery shares a referenced workspace image after its text", async (t) => { + const root = await mkdtemp(path.join(os.tmpdir(), "cg-unattended-image-")); + t.after(async () => rm(root, { recursive: true, force: true })); + await writeFile(path.join(root, "result.png"), Buffer.from("png")); + const calls = []; + const client = { chat: { postMessage: async (payload) => calls.push(["post", payload]) } }; + + await deliverResult(client, { + channel: "C1", + threadKey: "111.222", + dir: null, + uploadFile: async (payload) => calls.push(["upload", payload]), + result: { cwd: root, content: "Report\n\n![Result](result.png)" }, + }); + + assert.deepEqual(calls.map(([kind]) => kind), ["post", "upload"]); + assert.equal(calls[1][1].channelId, "C1"); + assert.equal(calls[1][1].threadTs, "111.222"); +}); + +test("an image preview does not displace an unattended run footer with no resume control", async () => { + const posts = []; + const client = { chat: { postMessage: async (payload) => posts.push(payload) } }; + + await deliverResult(client, { + channel: "C1", + threadKey: "111.222", + dir: null, + footer: true, + result: { + content: "![Trend](https://img.example/trend.png)", + usage: { input_tokens: 3, output_tokens: 2 }, + }, + }); + + assert.equal(posts.length, 1); + assert.deepEqual(posts[0].blocks.map((block) => block.type), ["section", "image", "context"]); + assert.match(posts[0].blocks[2].elements[0].text, /3\/2/); +}); + +test("invalid classic preview blocks never cost the completed text answer", async () => { + const posts = []; + const client = { + chat: { + postMessage: async (payload) => { + posts.push(payload); + if (payload.blocks) throw Object.assign(new Error("invalid_blocks"), { data: { error: "invalid_blocks" } }); + }, + }, + }; + + await postChunkedReply(client, "C1", "111.222", "Completed answer", "", null, { + answerBlocks: answerImageBlocks("![Preview](https://img.example/preview.png)"), + }); + + assert.equal(posts.length, 2); + assert.ok(posts[0].blocks); + assert.deepEqual(posts[1], { channel: "C1", thread_ts: "111.222", text: "Completed answer" }); +}); + +test("native answer finalization appends image blocks before the run footer", async () => { + const stops = []; + const streamer = { + ts: "1720000000.000100", + append: async () => {}, + stop: async (payload) => stops.push(payload), + }; + const client = { + apiCall: async () => {}, + chatStream: () => streamer, + chat: { postMessage: async () => {}, delete: async () => {} }, + }; + const markdown = "Result\n\n![Rendered chart](https://img.example/chart.png)"; + const progress = startProgress("stream", client, "C1", "111.222"); + + progress.onDelta(markdown); + await progress.finalize({ content: markdown, usage: { input_tokens: 1, output_tokens: 1 } }); + + assert.equal(stops.length, 1); + assert.deepEqual(stops[0].blocks.map((block) => block.type), ["image", "context"]); + assert.equal(stops[0].blocks[0].image_url, "https://img.example/chart.png"); +}); + +test("native finalization shares a referenced workspace image exactly once", async (t) => { + const root = await mkdtemp(path.join(os.tmpdir(), "cg-native-image-")); + t.after(async () => rm(root, { recursive: true, force: true })); + await writeFile(path.join(root, "render.png"), Buffer.from("png")); + const events = []; + const streamer = { + ts: "1720000000.000100", + append: async () => {}, + stop: async () => events.push("stop"), + }; + const client = { + apiCall: async () => {}, + chatStream: () => streamer, + chat: { postMessage: async () => {}, delete: async () => {} }, + }; + const markdown = "Result\n\n![Rendered chart](render.png)"; + const progress = startProgress("stream", client, "C1", "111.222", { + uploadFile: async (payload) => events.push(["upload", payload]), + }); + + progress.onDelta(markdown); + await progress.finalize({ cwd: root, content: markdown, usage: { input_tokens: 1, output_tokens: 1 } }); + + assert.equal(events[0], "stop"); + assert.equal(events.length, 2); + assert.equal(events[1][0], "upload"); + assert.equal(events[1][1].filename, "render.png"); +}); + +test("a rejected native image preview retries with the healthy footer", async () => { + const stops = []; + let attempts = 0; + const streamer = { + ts: "1720000000.000100", + append: async () => {}, + stop: async (payload) => { + attempts += 1; + stops.push(payload); + if (attempts === 1) throw Object.assign(new Error("invalid_blocks"), { data: { error: "invalid_blocks" } }); + }, + }; + const posts = []; + const client = { + apiCall: async () => {}, + chatStream: () => streamer, + chat: { postMessage: async (payload) => posts.push(payload), delete: async () => {} }, + }; + const markdown = "![Preview](https://img.example/preview.png)"; + const progress = startProgress("stream", client, "C1", "111.222"); + + progress.onDelta(markdown); + await progress.finalize({ content: markdown, usage: { input_tokens: 1, output_tokens: 1 } }); + + assert.equal(stops.length, 2); + assert.deepEqual(stops[0].blocks.map((block) => block.type), ["image", "context"]); + assert.deepEqual(stops[1].blocks.map((block) => block.type), ["context"]); + assert.equal(stops[1].markdown_text, undefined, "the SDK's retained terminal Markdown is not duplicated"); + assert.equal(posts.length, 0, "a rejected preview does not force a duplicate classic answer"); +}); + +test("the injected Slack guide documents the image-preview contract", async () => { + const [platform, writing] = await Promise.all([ + readFile(new URL("../src/gateway/gateway-usage/platforms/slack/platform.md", import.meta.url), "utf8"), + readFile(new URL("../src/gateway/gateway-usage/platforms/slack/writing-replies.md", import.meta.url), "utf8"), + ]); + assert.match(platform, /native Slack file preview/i); + assert.match(writing, /!\[descriptive alt text\]\(https:\/\//); + assert.match(writing, /!\[descriptive alt text\]\(reports\/chart\.png\)/); + assert.match(writing, /up to five/i); +}); diff --git a/test/slack-members.test.js b/test/slack-members.test.js index 961e0a76..0e84d6de 100644 --- a/test/slack-members.test.js +++ b/test/slack-members.test.js @@ -183,7 +183,7 @@ test("departed member cleanup removes only that guest grant and preserves other channelId: "C_CHANNEL", allowedUsers: ["U_KEEP", "U_LEAVE"], allowedMcps: [{ name: "shared-tools" }], - nudges: true, + memory: true, }; let provisioned = null; const deps = { @@ -205,7 +205,7 @@ test("departed member cleanup removes only that guest grant and preserves other channelId: "C_CHANNEL", allowedUsers: ["U_KEEP"], allowedMcps: [{ name: "shared-tools" }], - nudges: true, + memory: true, }); assert.deepEqual(provisioned, { slug: entry.slug, next: stored }); diff --git a/test/store-patch.test.js b/test/store-patch.test.js index 95577fb3..9d886717 100644 --- a/test/store-patch.test.js +++ b/test/store-patch.test.js @@ -23,15 +23,23 @@ test("patchChannelMeta merges only the supplied keys", async () => { }); test("patchChannelMeta: two writers patching different keys both persist", async () => { - await saveChannelMeta("chan-b", { adminMode: false, allowBash: false, nudges: false }); + await saveChannelMeta("chan-b", { adminMode: false, allowBash: false, memory: false }); await patchChannelMeta("chan-b", { adminMode: true }); - await patchChannelMeta("chan-b", { nudges: true }); + await patchChannelMeta("chan-b", { memory: true }); const meta = await getChannelMeta("chan-b"); assert.equal(meta.adminMode, true); // NOT clobbered by the second patch - assert.equal(meta.nudges, true); + assert.equal(meta.memory, true); assert.equal(meta.allowBash, false); }); +test("retired conversation-level nudge fields cannot be read or written back", async () => { + await saveChannelMeta("chan-retired-nudges", { channelId: "C_OLD", nudges: true, memory: true }); + assert.deepEqual(await getChannelMeta("chan-retired-nudges"), { channelId: "C_OLD", memory: true }); + const next = await patchChannelMeta("chan-retired-nudges", { nudges: false, allowBash: true }); + assert.equal(Object.hasOwn(next, "nudges"), false); + assert.equal(next.allowBash, true); +}); + test("patchChannelMeta function form derives the partial from the current record", async () => { await saveChannelMeta("chan-c", { allowedMcps: [{ name: "one" }] }); const next = await patchChannelMeta("chan-c", (cur) => ({ allowedMcps: [...cur.allowedMcps, { name: "two" }] })); diff --git a/test/sudo-thread.test.js b/test/sudo-thread.test.js new file mode 100644 index 00000000..6ec386aa --- /dev/null +++ b/test/sudo-thread.test.js @@ -0,0 +1,108 @@ +// `/sudo` is a thread-scoped escape hatch, not a channel mode. Only a current organization admin +// may set it or speak in the thread once set; the gate runs before hydration and process spawn. +import test from "node:test"; +import assert from "node:assert/strict"; +import { ensureTestEnv } from "./helpers.js"; + +ensureTestEnv(); + +const { setUser, getChannelEntry, upsertChannelEntry, saveChannelMeta, defaultChannelMeta } = await import("../src/config/store.js"); +const { getThreadSudo, setThreadSudo } = await import("../src/gateway/thread-engine.js"); +const { processMessageEvent } = await import("../src/slack/message-pipeline.js"); +const { runMessage } = await import("../src/gateway/run.js"); +const { readEvents } = await import("../src/util/logger.js"); + +const ADMIN = "U_SUDO_ADMIN"; +const MEMBER = "U_SUDO_MEMBER"; +const CHANNEL = "D_SUDO_THREAD"; + +function fakeSlack() { + const posted = []; + const reads = { history: 0, replies: 0 }; + const ok = async () => ({ ok: true }); + return { + posted, + reads, + chat: { + postMessage: async (message) => { posted.push(message); return { ok: true, ts: `bot.${posted.length}` }; }, + update: ok, + delete: ok, + postEphemeral: async (message) => { posted.push(message); return { ok: true }; }, + }, + users: { info: async ({ user }) => ({ user: { id: user, real_name: user } }) }, + conversations: { + history: async () => { reads.history += 1; return { messages: [] }; }, + replies: async () => { reads.replies += 1; return { messages: [] }; }, + info: async ({ channel }) => ({ channel: { id: channel, is_im: true } }), + members: async () => ({ members: [ADMIN, MEMBER], response_metadata: {} }), + }, + apiCall: ok, + }; +} + +function send(client, user, text, ts, threadTs = "") { + return processMessageEvent({ + type: "message", channel: CHANNEL, channel_type: "im", user, text, ts, + ...(threadTs ? { thread_ts: threadTs } : {}), + }, client, { botUserId: "U_BOT", teamId: "T_SUDO" }); +} + +test("sudo is admin-only, sticky to one thread, audited, and rejects members before hydration", async () => { + await setUser(ADMIN, { name: "Admin", isAdmin: true, approved: true }); + await setUser(MEMBER, { name: "Member", isAdmin: false, approved: true }); + const client = fakeSlack(); + + await send(client, ADMIN, "/sudo", "5000.001"); + const entry = await getChannelEntry(CHANNEL); + assert.equal(await getThreadSudo(entry.slug, "5000.001"), true); + assert.match(client.posted.at(-1).text, /Sudo enabled.*directly on the gateway host/is); + const change = readEvents({ limit: 100 }).find((event) => event.event === "sudo_thread_changed" && event.slug === entry.slug); + assert.equal(change.author, ADMIN); + assert.equal(change.enabled, true); + + const readsBefore = { ...client.reads }; + await send(client, MEMBER, "/help", "5000.002", "5000.001"); + assert.equal(client.reads.history, readsBefore.history, "rejected traffic does not hydrate the message"); + assert.equal(client.reads.replies, readsBefore.replies, "rejected traffic does not read the thread"); + assert.equal(client.posted.at(-1).text, "⛔ This is a sudo thread. Only organization admins can send messages or run work here."); + + await send(client, ADMIN, "/sudo off", "5000.003", "5000.001"); + assert.equal(await getThreadSudo(entry.slug, "5000.001"), false); + assert.match(client.posted.at(-1).text, /Sudo disabled/); +}); + +test("an approved non-admin cannot activate sudo", async () => { + const client = fakeSlack(); + await send(client, MEMBER, "/sudo", "5100.001"); + const entry = await getChannelEntry(CHANNEL); + assert.equal(await getThreadSudo(entry.slug, "5100.001"), false); + assert.equal(client.posted.at(-1).text, "Only organization admins can use `/sudo`."); +}); + +test("the run orchestrator independently refuses non-admin work in a sudo thread", async () => { + const channelId = "D_SUDO_CORE"; + const entry = await upsertChannelEntry(channelId, { name: "sudo-core", type: "im", isDM: true, platform: "slack" }); + await saveChannelMeta(entry.slug, defaultChannelMeta({ channelId, name: "sudo-core", type: "im", isDM: true, platform: "slack" })); + await setThreadSudo(entry.slug, "core-thread", true); + const result = await runMessage({ + channelId, + authorId: MEMBER, + text: "run a command", + threadKey: "core-thread", + origin: "background_agent", + }); + assert.equal(result.accessRefused, true); + assert.equal(result.sudoThread, true); + assert.match(result.content, /Only organization admins/); + + const spoofedAdmin = await runMessage({ + channelId, + authorId: ADMIN, + text: "run a command", + threadKey: "core-thread", + origin: "api_foreground", + untrustedPrincipal: true, + }); + assert.equal(spoofedAdmin.accessRefused, true, "a run-API caller cannot gain host access by naming an admin"); + assert.equal(spoofedAdmin.sudoThread, true); +}); diff --git a/test/transient-retry.test.js b/test/transient-retry.test.js index cd166903..93b6ba32 100644 --- a/test/transient-retry.test.js +++ b/test/transient-retry.test.js @@ -279,6 +279,23 @@ test("Codex: with failover ON, a failure that outlives every attempt is answered assert.equal(retryEvents(entry.slug).length, 2, "Codex was not re-probed during the cooldown"); }); +test("Codex: a plain-text turn.failed capacity refusal retries, then falls back", async () => { + resetEngineCooldowns(); + saveSettings({ engine: "codex", engineFallback: true, engineEnabled: { claude: true, codex: true }, composioMode: "personal" }); + await setUser("U_TR_CAPACITY", { name: "Capacity Failover", approved: true, isAdmin: false }); + const entry = await channel("D_TR_CAPACITY", "transient-capacity", "codex"); + + const result = await turn("D_TR_CAPACITY", "U_TR_CAPACITY", "CODEX_STUB_CAPACITY_PLAIN", "1903.012"); + assert.equal(result.engine, "claude"); + assert.equal(result.fellBack, true); + assert.equal(result.fallbackFrom, "codex"); + assert.match(result.content, /Codex hit a temporary provider error — retried 2× before giving up — using Claude/); + assert.match(result.content, /Stub engine reply/); + const events = retryEvents(entry.slug); + assert.equal(events.length, 2); + assert.ok(events.every((event) => event.kind === "transient" && /model is at capacity/i.test(event.error))); +}); + test("ask mode: the exhausted failure is handed back as a choice — no switch, no cooldown", async () => { resetEngineCooldowns(); saveSettings({ engine: "codex", engineFallback: true, engineEnabled: { claude: true, codex: true }, composioMode: "personal" }); diff --git a/test/update-runner.test.js b/test/update-runner.test.js index 7b9fc534..e501ca5e 100644 --- a/test/update-runner.test.js +++ b/test/update-runner.test.js @@ -537,6 +537,7 @@ test("a failed pin rebuild is retried on the next update even with an unchanged const reserved = reserveUpdate({ root, source: "test", pidAlive: () => false }); const state = await executeUpdateTransaction({ root, owner: reserved.owner, ops: { preflight: async () => context, + provision: async () => {}, image: () => defaultImageBuild({ root, repoRoot, context, run: retry.run, log: () => {} }), verifyImage: async ({ context: received }) => { assert.deepEqual(received.smokeEngines, ["claude", "codex"]); verified = true; }, checkout: () => assert.fail("must not change an up-to-date checkout"), @@ -547,6 +548,22 @@ test("a failed pin rebuild is retried on the next update even with an unchanged assert.match(state.reason, /image rebuilt and verified/); }); +test("an up-to-date update still runs provisioning so optional host tools can be repaired", async () => { + const root = tempDir("cg-update-provision-repair-"); + const calls = []; + const reserved = reserveUpdate({ root, source: "test", pidAlive: () => false }); + const state = await executeUpdateTransaction({ root, owner: reserved.owner, ops: { + preflight: async () => ({ oldRevision: "same", targetRevision: "same" }), + provision: async () => calls.push("provision"), + image: async () => { calls.push("image"); return { built: false }; }, + checkout: () => assert.fail("must not change an up-to-date checkout"), + restart: () => assert.fail("provision-only repair does not restart active turns"), + } }); + assert.deepEqual(calls, ["provision", "image"]); + assert.equal(state.changed, false); + assert.match(state.reason, /Already up to date/); +}); + test("a successful builder exit cannot claim a still-stale image was rebuilt", async () => { const root = containerRoot(); const repoRoot = candidateCheckout("1.1.1"); diff --git a/test/update-script.test.js b/test/update-script.test.js index b3af69d3..670b5b0b 100644 --- a/test/update-script.test.js +++ b/test/update-script.test.js @@ -4,6 +4,9 @@ import { readFileSync } from "node:fs"; const update = readFileSync(new URL("../scripts/update.sh", import.meta.url), "utf8"); const provision = readFileSync(new URL("../scripts/update-provision.sh", import.meta.url), "utf8"); +const install = readFileSync(new URL("../scripts/install.sh", import.meta.url), "utf8"); +const installSystemd = readFileSync(new URL("../scripts/install-systemd.sh", import.meta.url), "utf8"); +const installRclone = readFileSync(new URL("../scripts/install-rclone.sh", import.meta.url), "utf8"); const runner = readFileSync(new URL("../scripts/update-runner.mjs", import.meta.url), "utf8"); test("update shell is a strict compatibility wrapper around the Node transaction runner", () => { @@ -37,3 +40,13 @@ test("optional provisioning retains Whisper, workspace migration, and gated rclo assert.match(provision, /driveSyncEnabled/); assert.match(provision, /install_rclone/); }); + +test("fresh deployments and updates share a checksum-verified host rclone installer", () => { + assert.match(install, /scripts\/install-rclone\.sh/); + assert.match(installSystemd, /scripts\/install-rclone\.sh/); + assert.match(provision, /scripts\/install-rclone\.sh/); + assert.match(installSystemd, /SERVICE_HOME\/\.local\/bin/); + assert.match(installRclone, /SHA256SUMS/); + assert.match(installRclone, /sha256sum -c/); + assert.match(installRclone, /\.local\/bin/); +}); diff --git a/test/usage-pricing.test.js b/test/usage-pricing.test.js new file mode 100644 index 00000000..1a9bc6c9 --- /dev/null +++ b/test/usage-pricing.test.js @@ -0,0 +1,121 @@ +import test from "node:test"; +import assert from "node:assert/strict"; +import { DatabaseSync } from "node:sqlite"; +import { ensureTestEnv } from "./helpers.js"; + +ensureTestEnv(); +const { runMigrations } = await import("../src/db/index.js"); +const { + CODEX_PRICING_HISTORY_SINCE, + CODEX_SOL_PRICE_CUTOVER, + applyCodexPricingRefresh, + autoRefreshCodexPricing, + buildCodexPricingRefresh, + pendingCodexPricingRefresh, +} = await import("../src/gateway/usage-pricing.js"); +const { CODEX_PRICING_BASIS } = await import("../src/gateway/usage.js"); + +function fixture() { + const db = new DatabaseSync(":memory:"); + db.exec("CREATE TABLE _meta (key TEXT PRIMARY KEY, value TEXT)"); + runMigrations(db); + const usage = db.prepare( + `INSERT INTO usage(ts, channel_id, slug, author_id, engine, model, task_kind, + tokens_in, tokens_out, cost_usd, cost_estimated, duration_ms, runtime_model, accounting_status) + VALUES(?, 'C', 'pricing', 'U', 'codex', ?, 'interactive', ?, ?, ?, 1, 1, ?, 'verified')` + ); + const component = db.prepare( + `INSERT INTO usage_components(usage_id, source_key, source_kind, model, tokens_in, + tokens_cached, tokens_cache_write, tokens_out, cost_usd, cost_estimated, pricing_basis) + VALUES(?, ?, 'root', ?, ?, ?, ?, ?, ?, 1, 'openai-standard-2026-08-16')` + ); + const request = db.prepare( + `INSERT INTO usage_requests(component_id, request_index, model, tokens_in, tokens_cached, + tokens_cache_write, tokens_out, reasoning_tokens, context_window, long_context, cost_usd) + VALUES(?, 0, ?, ?, ?, 0, ?, 0, 1050000, ?, ?)` + ); + + const sol = usage.run(CODEX_SOL_PRICE_CUTOVER, "gpt-5.6-sol", 300_000, 1_000, 2.145, "gpt-5.6-sol"); + const solComponent = component.run(Number(sol.lastInsertRowid), "sol", "gpt-5.6-sol", 300_000, 100_000, 0, 1_000, 2.145); + request.run(Number(solComponent.lastInsertRowid), "gpt-5.6-sol", 300_000, 100_000, 1_000, 1, 2.145); + component.run(Number(sol.lastInsertRowid), "review", "codex-auto-review", 1_000, 0, 0, 10, null); + + const solBefore = usage.run("2026-08-20T23:59:59.999Z", "gpt-5.6-sol", 300_000, 1_000, 2.145, "gpt-5.6-sol"); + const solBeforeComponent = component.run(Number(solBefore.lastInsertRowid), "sol-before", "gpt-5.6-sol", 300_000, 100_000, 0, 1_000, 2.145); + request.run(Number(solBeforeComponent.lastInsertRowid), "gpt-5.6-sol", 300_000, 100_000, 1_000, 1, 2.145); + + const astra = usage.run("2026-09-10T00:00:00.000Z", "gpt-6-astra", 1_000_000, 10_000, null, "gpt-6-astra"); + component.run(Number(astra.lastInsertRowid), "astra", "gpt-6-astra", 1_000_000, 500_000, 0, 10_000, null); + + const old = usage.run("2026-07-12T23:59:59.000Z", "gpt-5.6-sol", 100, 1, 9.99, "gpt-5.6-sol"); + component.run(Number(old.lastInsertRowid), "before-window", "gpt-5.6-sol", 100, 0, 0, 1, 9.99); + + const claude = db.prepare( + `INSERT INTO usage(ts, channel_id, slug, author_id, engine, model, task_kind, + tokens_in, tokens_out, cost_usd, cost_estimated, duration_ms, runtime_model, accounting_status) + VALUES('2026-09-11T00:00:00.000Z', 'C', 'pricing', 'U', 'claude', 'claude-opus-4-1', + 'interactive', 100, 10, 8.88, 0, 1, 'claude-opus-4-1', 'verified')` + ).run(); + component.run(Number(claude.lastInsertRowid), "claude", "claude-opus-4-1", 100, 0, 0, 10, 8.88); + return db; +} + +test("pricing refresh reprices the two-month evidence window and records an idempotent basis", () => { + const db = fixture(); + assert.deepEqual(pendingCodexPricingRefresh(db), { pending: true, appliedBasis: "", basis: CODEX_PRICING_BASIS }); + const plan = buildCodexPricingRefresh({ db }); + assert.equal(plan.since, CODEX_PRICING_HISTORY_SINCE); + assert.equal(plan.usageRows, 3); + assert.equal(plan.components, 4); + assert.equal(plan.requests, 2); + assert.equal(plan.unpricedComponents, 1); + assert.equal(plan.models["gpt-5.6-sol"].repricedValue, 3.855); + assert.equal(plan.models["gpt-6-astra"].repricedValue, 6); + assert.equal(plan.models["codex-auto-review"].unpricedComponents, 1); + + applyCodexPricingRefresh(db, plan); + assert.deepEqual(pendingCodexPricingRefresh(db), { pending: false, appliedBasis: CODEX_PRICING_BASIS, basis: CODEX_PRICING_BASIS }); + assert.deepEqual(db.prepare("SELECT source_key, cost_usd, cost_estimated, pricing_basis FROM usage_components ORDER BY id").all().map((row) => ({ ...row })), [ + { source_key: "sol", cost_usd: 1.71, cost_estimated: 1, pricing_basis: CODEX_PRICING_BASIS }, + { source_key: "review", cost_usd: null, cost_estimated: 0, pricing_basis: "unpriced" }, + { source_key: "sol-before", cost_usd: 2.145, cost_estimated: 1, pricing_basis: CODEX_PRICING_BASIS }, + { source_key: "astra", cost_usd: 6, cost_estimated: 1, pricing_basis: CODEX_PRICING_BASIS }, + { source_key: "before-window", cost_usd: 9.99, cost_estimated: 1, pricing_basis: "openai-standard-2026-08-16" }, + { source_key: "claude", cost_usd: 8.88, cost_estimated: 1, pricing_basis: "openai-standard-2026-08-16" }, + ]); + assert.deepEqual(db.prepare("SELECT model, cost_usd FROM usage ORDER BY id").all().map((row) => ({ ...row })), [ + { model: "gpt-5.6-sol", cost_usd: 1.71 }, + { model: "gpt-5.6-sol", cost_usd: 2.145 }, + { model: "gpt-6-astra", cost_usd: 6 }, + { model: "gpt-5.6-sol", cost_usd: 9.99 }, + { model: "claude-opus-4-1", cost_usd: 8.88 }, + ]); + assert.deepEqual(db.prepare("SELECT cost_usd FROM usage_requests ORDER BY id").all().map((row) => row.cost_usd), [1.71, 2.145]); + + db.prepare("UPDATE usage_components SET pricing_basis = 'unpriced' WHERE source_key = 'astra'").run(); + assert.deepEqual(pendingCodexPricingRefresh(db), { + pending: true, + appliedBasis: CODEX_PRICING_BASIS, + basis: CODEX_PRICING_BASIS, + }); + db.close(); +}); + +test("boot pricing refresh backs up once and then skips the applied basis", async () => { + const db = fixture(); + let backups = 0; + const first = await autoRefreshCodexPricing({ + db, + makeBackup: async () => { backups += 1; return "pricing-backup"; }, + log: { log: () => {} }, + }); + assert.equal(first.applied, true); + assert.equal(first.backupPath, "pricing-backup"); + assert.equal(backups, 1); + assert.deepEqual(await autoRefreshCodexPricing({ db, makeBackup: async () => { backups += 1; } }), { + applied: false, + basis: CODEX_PRICING_BASIS, + }); + assert.equal(backups, 1); + db.close(); +}); diff --git a/test/whisper-transcribe.test.js b/test/whisper-transcribe.test.js index 280ee5b4..4e2d306a 100644 --- a/test/whisper-transcribe.test.js +++ b/test/whisper-transcribe.test.js @@ -2,7 +2,7 @@ import { test } from "node:test"; import assert from "node:assert/strict"; import os from "node:os"; import path from "node:path"; -import { mkdtemp, readdir, rm, writeFile } from "node:fs/promises"; +import { mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises"; import { MAX_TRANSCRIPT_CHARS, composeVoicePrompt, @@ -131,6 +131,45 @@ test("audio batches serialize the daemon-wide Whisper work and preserve failures assert.deepEqual(two.transcripts, [{ name: "b.ogg", text: "b.ogg" }]); }); +test("completed local audio is cleaned while failed processing keeps its source for retry", async (t) => { + const dir = await mkdtemp(path.join(os.tmpdir(), "cg-whisper-cleanup-")); + t.after(() => rm(dir, { recursive: true, force: true })); + const good = path.join(dir, "good.wav"); + const bad = path.join(dir, "bad.wav"); + await writeFile(good, "good audio"); + await writeFile(bad, "bad audio"); + + const result = await transcribeAudioFiles([ + { name: "good.wav", path: good }, + { name: "bad.wav", path: bad }, + ], { + transcribe: async (filePath) => { + if (filePath === bad) throw new Error("decode failed"); + return "spoken text"; + }, + removeProcessed: async (file) => { + await rm(file.path); + return true; + }, + }); + + assert.deepEqual(result.transcripts, [{ name: "good.wav", text: "spoken text" }]); + assert.equal(result.failed[0].name, "bad.wav"); + assert.deepEqual(result.cleanupFailed, []); + await assert.rejects(readFile(good), { code: "ENOENT" }); + assert.equal(await readFile(bad, "utf8"), "bad audio"); +}); + +test("cleanup refusal is observable without discarding a successful transcript", async () => { + const result = await transcribeAudioFiles([{ name: "voice.wav", path: "/tmp/voice.wav" }], { + transcribe: async () => "spoken text", + removeProcessed: async () => false, + }); + assert.deepEqual(result.transcripts, [{ name: "voice.wav", text: "spoken text" }]); + assert.equal(result.failed.length, 0); + assert.match(result.cleanupFailed[0].reason, /no longer a managed regular upload/i); +}); + test("Slack WebVTT parsing removes cue metadata but keeps complete spoken text", () => { assert.equal( parseWebVtt("WEBVTT\n\n00:00:00.579 --> 00:00:01.700\n- How are you?\n\n00:00:02.000 --> 00:00:03.000\nSecond line."), @@ -210,6 +249,7 @@ test("disabled local Whisper never downloads audio and uses Slack transcripts in test("local failures fall back to Slack while local successes stay local", async () => { let slackCalls = 0; + const removed = []; const result = await resolveAudioTranscripts([ { id: "GOOD", name: "good.m4a" }, { id: "BAD", name: "bad.m4a" }, @@ -223,8 +263,25 @@ test("local failures fall back to Slack while local successes stay local", async slackCalls += 1; return { transcripts: [{ name: files[0].name, text: "Slack text" }], failed: [] }; }, + removeProcessed: async (file) => { removed.push(file.id); return true; }, }); assert.equal(slackCalls, 1); assert.deepEqual(result.transcripts.map((item) => item.text), ["local text", "Slack text"]); assert.equal(result.localFailed[0].name, "bad.m4a"); + assert.deepEqual(removed, ["GOOD", "BAD"]); + assert.deepEqual(result.cleanupFailed, []); +}); + +test("an audio source is retained when neither local nor Slack processing succeeds", async () => { + let removals = 0; + const result = await resolveAudioTranscripts([{ id: "BAD", name: "bad.m4a" }], { + localEnabled: true, + downloadLocal: async (file) => ({ ...file, path: "/tmp/BAD.m4a" }), + localTranscriber: async () => ({ transcripts: [], failed: [{ name: "bad.m4a", reason: "Whisper failed" }] }), + slackTranscriber: async () => ({ transcripts: [], failed: [{ name: "bad.m4a", reason: "Slack failed" }] }), + removeProcessed: async () => { removals += 1; return true; }, + }); + assert.equal(result.transcripts.length, 0); + assert.equal(result.failed.length, 1); + assert.equal(removals, 0); }); diff --git a/test/workspace-conflict-admin.test.js b/test/workspace-conflict-admin.test.js new file mode 100644 index 00000000..858fc7f7 --- /dev/null +++ b/test/workspace-conflict-admin.test.js @@ -0,0 +1,107 @@ +import test, { after } from "node:test"; +import assert from "node:assert/strict"; +import { mkdir, readFile, symlink } from "node:fs/promises"; +import path from "node:path"; +import express from "express"; +import { ensureTestEnv, tempDir } from "./helpers.js"; + +ensureTestEnv(); +const fsRoot = tempDir("cg-workspace-warning-"); +process.env.CG_FS_ROOT = fsRoot; +const shared = path.join(fsRoot, "shared-project"); +const sharedAlias = path.join(fsRoot, "shared-project-alias"); +const separate = path.join(fsRoot, "separate-project"); +await mkdir(shared, { recursive: true }); +await symlink(shared, sharedAlias, "dir"); +await mkdir(separate, { recursive: true }); + +const { defaultChannelMeta, listChannels, saveChannelMeta, upsertChannelEntry } = await import("../src/config/store.js"); +const { workspaceAssignmentsAtPath, workspaceConflictsBySlug } = await import("../src/gateway/workspace-assignments.js"); +const { createAdminRouter } = await import("../src/web/routes/admin.js"); + +async function conversation(channelId, name, { type = "channel", isDM = false, workDir = shared } = {}) { + const entry = await upsertChannelEntry(channelId, { name, type, isDM, platform: "slack" }); + await saveChannelMeta(entry.slug, { + ...defaultChannelMeta({ channelId, name, type, isDM, platform: "slack" }), + workDir, + // These values prove the warning is about folder ownership, even when the runtime guard's + // shared selections happen to be compatible. + skills: [], + memory: true, + }); + return { ...entry, channelId }; +} + +const first = await conversation("C_WORKDIR_FIRST", "first-project"); +const second = await conversation("C_WORKDIR_SECOND", "second-project", { workDir: sharedAlias }); +const dm = await conversation("D_WORKDIR_DM", "Fixture Person", { type: "im", isDM: true }); +const alone = await conversation("C_WORKDIR_ALONE", "separate-project", { workDir: separate }); + +const app = express(); +app.use(express.json()); +app.use(createAdminRouter({ slack: { snapshot: () => ({ status: "disconnected", connected: false }), getClient: () => null } })); +const server = await new Promise((resolve) => { + const instance = app.listen(0, "127.0.0.1", () => resolve(instance)); +}); +const base = `http://127.0.0.1:${server.address().port}`; +after(() => server.close()); + +async function getJson(url) { + const response = await fetch(base + url); + return { response, json: await response.json() }; +} + +test("workspace assignment helper marks every conversation sharing one effective folder", async () => { + const all = await listChannels(); + const conflicts = workspaceConflictsBySlug(all); + assert.deepEqual([...conflicts.keys()].sort(), [first.slug, second.slug, dm.slug].sort()); + assert.equal(conflicts.get(first.slug).path, shared); + assert.deepEqual( + conflicts.get(first.slug).conversations.map((item) => item.channelId).sort(), + [second.channelId, dm.channelId].sort(), + ); + assert.equal(conflicts.has(alone.slug), false); + assert.deepEqual(workspaceAssignmentsAtPath(all, separate).map((item) => item.channelId), [alone.channelId]); +}); + +test("conversation APIs expose duplicate-folder warnings for channels and DMs", async () => { + const channels = await getJson("/channels"); + assert.equal(channels.response.status, 200); + const firstRow = channels.json.channels.find((item) => item.channelId === first.channelId); + const aloneRow = channels.json.channels.find((item) => item.channelId === alone.channelId); + assert.equal(firstRow.workDirConflict.path, shared); + assert.deepEqual(firstRow.workDirConflict.conversations.map((item) => item.channelId).sort(), [second.channelId, dm.channelId].sort()); + assert.equal(aloneRow.workDirConflict, null); + + const dms = await getJson("/dms"); + assert.equal(dms.response.status, 200); + const dmRow = dms.json.dms.find((item) => item.channelId === dm.channelId); + assert.deepEqual(dmRow.workDirConflict.conversations.map((item) => item.channelId).sort(), [first.channelId, second.channelId].sort()); +}); + +test("folder browser reports existing assignments before the folder is selected", async () => { + const used = await getJson(`/fs/list?path=${encodeURIComponent(shared)}`); + assert.equal(used.response.status, 200); + assert.deepEqual(used.json.assignedConversations.map((item) => item.channelId).sort(), [first.channelId, second.channelId, dm.channelId].sort()); + + const unused = path.join(fsRoot, "unused-project"); + await mkdir(unused); + const clear = await getJson(`/fs/list?path=${encodeURIComponent(unused)}`); + assert.equal(clear.response.status, 200); + assert.deepEqual(clear.json.assignedConversations, []); +}); + +test("admin UI paints duplicate conversations and the folder warning in red", async () => { + const [html, client, css] = await Promise.all([ + readFile(new URL("../public/index.html", import.meta.url), "utf8"), + readFile(new URL("../public/app.js", import.meta.url), "utf8"), + readFile(new URL("../public/styles.css", import.meta.url), "utf8"), + ]); + assert.match(html, /id="fs-conflict" class="fs-conflict" role="alert" hidden/); + assert.match(client, /workDirConflictSummary/); + assert.match(client, /className = "list-item conv-item" \+ \(conflictText \? " workdir-conflict"/); + assert.match(client, /Already assigned to .*Selecting it here will share one working folder between conversations/); + assert.match(client, /if \(!\(await refreshConversationRows\(\)\)\) renderConvList\(\)/); + assert.match(css, /\.conv-item\.workdir-conflict[^}]*rgba\(229, 96, 77/); + assert.match(css, /\.fs-conflict[^}]*color: var\(--danger\)/); +}); diff --git a/test/workspace-conflict-browser.test.js b/test/workspace-conflict-browser.test.js new file mode 100644 index 00000000..53f14626 --- /dev/null +++ b/test/workspace-conflict-browser.test.js @@ -0,0 +1,90 @@ +// Real browser acceptance for duplicate working-folder warnings. +// In the shipped image, follow TEST-PLAN.md's Browser acceptance runner with this test path. +import test from "node:test"; +import assert from "node:assert/strict"; +import { mkdir } from "node:fs/promises"; +import path from "node:path"; +import { fileURLToPath } from "node:url"; +import express from "express"; +import { ensureTestEnv, tempDir } from "./helpers.js"; + +ensureTestEnv(); + +test("duplicate conversation rows and used folders render red warnings that clear after save", { skip: !process.env.CG_BROWSER_MODULE }, async (t) => { + const { chromium } = await import(process.env.CG_BROWSER_MODULE); + const root = tempDir("cg-workspace-browser-"); + process.env.CG_FS_ROOT = root; + const shared = path.join(root, "shared-project"); + const separate = path.join(root, "separate-project"); + const unused = path.join(root, "unused-project"); + await Promise.all([mkdir(shared), mkdir(separate), mkdir(unused)]); + + const { createAdminRouter } = await import("../src/web/routes/admin.js"); + const { defaultChannelMeta, saveChannelMeta, upsertChannelEntry } = await import("../src/config/store.js"); + const add = async (channelId, name, workDir) => { + const entry = await upsertChannelEntry(channelId, { name, type: "channel", isDM: false, platform: "slack" }); + await saveChannelMeta(entry.slug, { ...defaultChannelMeta({ channelId, name, type: "channel", isDM: false, platform: "slack" }), workDir }); + }; + await add("C_FOLDER_WARNING_A", "folder-warning-a", shared); + await add("C_FOLDER_WARNING_B", "folder-warning-b", shared); + await add("C_FOLDER_WARNING_CONTROL", "folder-warning-control", separate); + + const app = express(); + app.use(express.json()); + app.get("/api/mcp/available", (_req, res) => res.json({ servers: [] })); + app.get("/api/health", (_req, res) => res.json({ slack: { connected: false, status: "off" }, engines: {} })); + app.get("/api/channels/:channelId/members", (_req, res) => res.json({ members: [] })); + app.use("/api", createAdminRouter({ slack: { snapshot: () => ({ status: "disconnected", connected: false }), getClient: () => null } })); + const publicDir = fileURLToPath(new URL("../public", import.meta.url)); + app.use(express.static(publicDir, { dotfiles: "allow" })); + app.get("/conversations/channel/:channelId", (_req, res) => res.sendFile(path.join(publicDir, "index.html"), { dotfiles: "allow" })); + const server = await new Promise((resolve) => { const instance = app.listen(0, "127.0.0.1", () => resolve(instance)); }); + t.after(() => new Promise((resolve) => { server.closeAllConnections(); server.close(resolve); })); + + const browser = await chromium.launch({ headless: true, args: ["--no-sandbox"] }); + t.after(() => browser.close()); + const page = await browser.newPage({ viewport: { width: 1440, height: 900 } }); + page.setDefaultTimeout(15_000); + // The fixture targets folder warnings, not the daemon-wide live-session feed. Disabling SSE + // avoids a deliberately open stream producing teardown noise in the console-error assertion. + await page.addInitScript(() => Object.defineProperty(globalThis, "EventSource", { value: undefined })); + const errors = []; + page.on("pageerror", (error) => errors.push(error.message)); + page.on("console", (message) => { + if (message.type() !== "error") return; + const source = message.location().url; + errors.push(`${message.text()}${source ? ` (${source})` : ""}`); + }); + await page.goto(`http://127.0.0.1:${server.address().port}/conversations/channel/C_FOLDER_WARNING_A`); + + const warningRows = page.locator("#channel-list .workdir-conflict"); + await warningRows.first().waitFor(); + assert.equal(await warningRows.count(), 2); + assert.deepEqual(await warningRows.locator(".conv-nm b").allTextContents(), ["#folder-warning-a", "#folder-warning-b"]); + assert.equal(await page.locator('#channel-list a[href="/conversations/channel/C_FOLDER_WARNING_CONTROL"]').getAttribute("class"), "list-item conv-item"); + + await page.locator('#channel-detail .subtab[data-pane="runtime"]').click(); + await page.locator("#channel-detail .ch-browse").click(); + const folderWarning = page.locator("#fs-conflict"); + await folderWarning.waitFor(); + assert.match(await folderWarning.textContent(), /Already assigned to #folder-warning-b/); + assert.doesNotMatch(await folderWarning.textContent(), /folder-warning-a/); + + await page.locator("#fs-home").click(); + await page.waitForFunction((expected) => globalThis.document.querySelector("#fs-current")?.textContent === expected, root); + await page.locator("#fs-list .fs-item", { hasText: "separate-project" }).click(); + await page.waitForFunction((expected) => globalThis.document.querySelector("#fs-current")?.textContent === expected, separate); + assert.match(await folderWarning.textContent(), /Already assigned to #folder-warning-control/); + await page.locator("#fs-home").click(); + await page.waitForFunction((expected) => globalThis.document.querySelector("#fs-current")?.textContent === expected, root); + await page.locator("#fs-list .fs-item", { hasText: "unused-project" }).click(); + await page.waitForFunction((expected) => globalThis.document.querySelector("#fs-current")?.textContent === expected, unused); + assert.equal(await folderWarning.isHidden(), true); + + await page.locator("#fs-select").click(); + const saved = page.waitForResponse((response) => response.url().endsWith("/channels/C_FOLDER_WARNING_A/meta") && response.request().method() === "PUT"); + await page.locator("#channel-detail .save-channel").click(); + assert.equal((await saved).status(), 200); + await page.waitForFunction(() => globalThis.document.querySelectorAll("#channel-list .workdir-conflict").length === 0); + assert.deepEqual(errors, []); +});