diff --git a/changelog.d/2033-decision-path-cap.fixed.md b/changelog.d/2033-decision-path-cap.fixed.md new file mode 100644 index 000000000..8f79b1b8c --- /dev/null +++ b/changelog.d/2033-decision-path-cap.fixed.md @@ -0,0 +1 @@ +A decided meeting's row on a Project board no longer reports `decision file gone` for a file that is still there ([#2033](https://github.com/ThinkFlowLab/FlyBot/issues/2033)): the board lists only the newest 200 decision files ([#2021](https://github.com/ThinkFlowLab/FlyBot/issues/2021)), and the lookup behind a meeting's own file name was built from that cut list, so every decided meeting whose file fell off the oldest end claimed its file had been deleted — while the same read reported the full count. The lookup now falls back to the names this read actually saw in the folder, so a file past the cut is named and only a name the folder no longer holds reads as gone; the fallback takes names from that read, never from the filesystem, so `../outside.md` still yields no path. diff --git a/core/src/host/project-board.js b/core/src/host/project-board.js index f875c541e..c6cd8e424 100644 --- a/core/src/host/project-board.js +++ b/core/src/host/project-board.js @@ -321,7 +321,9 @@ export function install(rt) { : 'no decision file in any folder the record names' // #2021: the count is taken after the dedup and before the cut, so a reader can tell a complete // list from a truncated one instead of reading the cap as the answer. - return { dir: dir === '' ? null : dir, files, total: deduped.length, reason } + // #2033: the un-truncated dedupe of this read, paths only — the meeting lookup below has to + // tell "fell off the 200-row cut" from "was never here" without asking the disk again. + return { dir: dir === '' ? null : dir, files, total: deduped.length, reason, known: new Set(deduped.map(file => file.path)) } } // #1831: the card's level, who it is addressed to and whether it may advance ride on every @@ -354,13 +356,17 @@ export function install(rt) { // exactly then, and the reader can see the file the record names is gone. const named = text(meeting.decisionFile) const file = known.get(named) + // #2033: `files` keeps the newest 200 rows (#2021), so a name can miss there while this read + // still saw the file in the folder. That fallback asks this read's own dedupe set — never + // the filesystem — so a name like `../outside.md` cannot become a path. + const pastCut = file === undefined && decisions.known?.has(named) === true decided.push({ id, date: text(meeting.decidedAt) !== '' ? new Date(meeting.decidedAt).toISOString().slice(0, 10) : '', question, owner: text(meeting.owner) || null, ...cardOf(meeting), - path: file === undefined ? '' : file.path, + path: file !== undefined ? file.path : pastCut ? named : '', ...(file === undefined ? {} : { sha256: file.sha256 }), }) continue @@ -485,6 +491,9 @@ export function install(rt) { ? { waiting: [], inflight: [], blocked: [], counts: { waiting: null, inflight: null, blocked: null, done: null } } : buildQueues(mine, done.length) const decisions = await decisionsOf(project) + // `known` is this read's own path set for the meeting lookup (#2033); the page renders + // `dir`/`files`/`total`/`reason`, so it does not travel with the board. + const servedDecisions = { dir: decisions.dir, files: decisions.files, total: decisions.total, reason: decisions.reason } // #1829: the seven numbers ride on the same read as the rows, so the board and its header // cannot disagree, and a credential-less host answers `ok: false` (the client paints a dash). // #1848: the running table and the done-task median read `mine` — exactly the cards this @@ -497,7 +506,7 @@ export function install(rt) { now: typeof rt.now === 'function' ? rt.now() : Date.now(), tasks: mine, }) - return { rows: open, done, ...queues, decisions, meetings: meetingsOf(project, decisions), metrics } + return { rows: open, done, ...queues, decisions: servedDecisions, meetings: meetingsOf(project, decisions), metrics } } const buildQueues = (mine, done) => { const now = typeof rt.now === 'function' ? rt.now() : Date.now() diff --git a/core/test/project-board.test.js b/core/test/project-board.test.js index 70a47e65f..b1ee23194 100644 --- a/core/test/project-board.test.js +++ b/core/test/project-board.test.js @@ -420,6 +420,143 @@ test('#1767: a Project without a decisions folder answers an empty list with the } }) +// #2033: the Decisions row list is cut at the newest 200 files (#2021), but a decided meeting +// still finds its own file by name. A file that fell off the oldest end of that cut is on disk and +// was seen by this read, so its meeting must name it rather than report it gone. +const folderPastCap = () => { + const base = mkdtempSync(join(tmpdir(), 'ds-bot-decisions-cap-')) + const dir = join(base, 'project') + mkdirSync(join(dir, '.git'), { recursive: true }) + mkdirSync(join(dir, 'decisions')) + for (let index = 0; index < 200; index += 1) { + writeFileSync(join(dir, 'decisions', `2026-01-02-${String(index).padStart(3, '0')}.md`), `# Old decision ${index}\n`) + } + for (let index = 0; index < 5; index += 1) { + writeFileSync(join(dir, 'decisions', `2026-11-01-${String(index).padStart(3, '0')}.md`), `# New decision ${index}\n`) + } + // `../outside.md` from the Project folder: present on disk, never in this read's dedupe set. A + // fallback that asks the filesystem instead of the read would hand its path out. + writeFileSync(join(base, 'outside.md'), '# Outside the folder\n') + return { base, dir } +} + +const capSeed = (dir) => { + const team = seed() + team.projects['project-p1'].workDir = dir + team.meetings = { + 'meeting-oldest': { + id: 'meeting-oldest', status: 'decided', question: 'The oldest decision?', + owner: 'Chief', project: 'project-p1', decisionFile: 'decisions/2026-01-02-000.md', + createdAt: 1, updatedAt: 5, decidedAt: 6, + }, + 'meeting-newest': { + id: 'meeting-newest', status: 'decided', question: 'The newest decision?', + owner: 'Chief', project: 'project-p1', decisionFile: 'decisions/2026-11-01-004.md', + createdAt: 1, updatedAt: 5, decidedAt: 7, + }, + 'meeting-absent': { + id: 'meeting-absent', status: 'decided', question: 'A file that never was?', + owner: 'Chief', project: 'project-p1', decisionFile: 'decisions/2026-12-31-missing.md', + createdAt: 1, updatedAt: 5, decidedAt: 8, + }, + 'meeting-escape': { + id: 'meeting-escape', status: 'decided', question: 'A name pointing outside?', + owner: 'Chief', project: 'project-p1', decisionFile: '../outside.md', + createdAt: 1, updatedAt: 5, decidedAt: 9, + }, + // Inside the cut, so this read lists it until the file is deleted; after that the meeting must + // read gone again. The fallback takes names from this read, so it cannot resurrect the file. + 'meeting-in-cap': { + id: 'meeting-in-cap', status: 'decided', question: 'A file inside the cut that is later deleted?', + owner: 'Chief', project: 'project-p1', decisionFile: 'decisions/2026-11-01-002.md', + createdAt: 1, updatedAt: 5, decidedAt: 10, + }, + } + return team +} + +async function startPastCap() { + const home = mkdtempSync(join(tmpdir(), 'ds-bot-board-')) + const { base, dir } = folderPastCap() + const { rt, stop } = await start(home, capSeed(dir)) + return { rt, home, base, dir, stop } +} + +test('#2033: a decided meeting whose file fell off the 200-row cut still names it', async () => { + const { rt, base, stop } = await startPastCap() + try { + const board = await rt.projectBoard('project-p1') + assert.equal(board.decisions.files.length, 200, 'the row list is still cut at the newest 200') + assert.equal(board.decisions.total, 205, 'the count still says how many files the read saw') + assert.equal(board.decisions.files.some(file => file.path === 'decisions/2026-01-02-000.md'), false, 'the oldest file is outside the cut, which is why the fallback is needed') + const oldest = board.meetings.decided.find(meeting => meeting.id === 'meeting-oldest') + assert.equal(oldest.path, 'decisions/2026-01-02-000.md', 'a file past the cut is named, not reported gone') + assert.equal('sha256' in oldest, false, 'only the cut rows carry a hash, so the fallback adds none') + } finally { + await stop() + rmSync(base, { recursive: true, force: true }) + } +}) + +test('#2033: a decided meeting inside the cut keeps its path and hash', async () => { + const { rt, base, stop } = await startPastCap() + try { + const board = await rt.projectBoard('project-p1') + const newest = board.meetings.decided.find(meeting => meeting.id === 'meeting-newest') + assert.equal(newest.path, 'decisions/2026-11-01-004.md') + assert.match(newest.sha256, /^[0-9a-f]{64}$/) + } finally { + await stop() + rmSync(base, { recursive: true, force: true }) + } +}) + +test('#2033: a decided meeting naming a file that is really absent still reads it gone', async () => { + const { rt, base, stop } = await startPastCap() + try { + const board = await rt.projectBoard('project-p1') + const absent = board.meetings.decided.find(meeting => meeting.id === 'meeting-absent') + assert.equal(absent.path, '', 'a name this read never saw is not a path') + assert.equal('sha256' in absent, false) + } finally { + await stop() + rmSync(base, { recursive: true, force: true }) + } +}) + +test('#2033: a decision file deleted from inside the cut still reads gone', async () => { + const { rt, dir, base, stop } = await startPastCap() + try { + const before = await rt.projectBoard('project-p1') + const kept = before.meetings.decided.find(meeting => meeting.id === 'meeting-in-cap') + assert.equal(kept.path, 'decisions/2026-11-01-002.md', 'the file is inside the cut while it is there') + assert.match(kept.sha256, /^[0-9a-f]{64}$/) + rmSync(join(dir, 'decisions', '2026-11-01-002.md')) + const after = await rt.projectBoard('project-p1') + assert.equal(after.decisions.total, 204, 'the read now sees one file fewer') + assert.equal(after.decisions.files.some(file => file.path === 'decisions/2026-11-01-002.md'), false, 'the deleted row is off the list') + const gone = after.meetings.decided.find(meeting => meeting.id === 'meeting-in-cap') + assert.equal(gone.path, '', 'a deleted file stays gone: the fallback names only what this read saw') + assert.equal('sha256' in gone, false) + } finally { + await stop() + rmSync(base, { recursive: true, force: true }) + } +}) + +test('#2033: a decision name that points outside the folder never becomes a path', async () => { + const { rt, base, stop } = await startPastCap() + try { + assert.equal(existsSync(join(base, 'outside.md')), true, 'the file it points at does exist on disk') + const board = await rt.projectBoard('project-p1') + const escape = board.meetings.decided.find(meeting => meeting.id === 'meeting-escape') + assert.equal(escape.path, '', 'the fallback takes names from this read, never from the filesystem') + } finally { + await stop() + rmSync(base, { recursive: true, force: true }) + } +}) + // #2005: a decision file's title is its first heading, bounded at 200 units. A heading whose 200th // unit is the first half of an emoji used to reach the board as an unpaired surrogate, so the // Decisions section carried half a character. diff --git a/docs/subsystems/core-host.md b/docs/subsystems/core-host.md index b3618b947..e03ee0740 100644 --- a/docs/subsystems/core-host.md +++ b/docs/subsystems/core-host.md @@ -211,7 +211,7 @@ An admin's `@` used to be the room's control plane: every `@Dev #1234 rebase and ### Team state and access -- The saved team (`state.json`) is versioned. Version 2 (#47) carries the identity schema — `members` records, a per-Bot `ownerId`, the owner's `designatedChiefId`. A legacy version-1 file is migrated on load with a one-time `state.json.v1` backup; an existing backup counts only when it is a readable file holding a parseable version-1 state, and anything else (or any malformed ownership) fails closed (read-only). An older binary refuses a newer version read-only. This is schema foundation only — team mode stays disabled, see [team](team.md). On top of it, a durable **Project** record (#1691): `state.projects` holds `{id, name, repository, defaultBranch, ownerUserId, createdAt, updatedAt, status}`, `bot.projectId` / `room.projectId` and `state.projectRuns[runId]` bind a member (a group, a Bot or a workflow run) to at most one Project, and the `api/bot` endpoints `projects`, `project-create`, `project-read`, `project-bind`, `project-of` and `project-board` sit in the task allow list. An unbound member resolves `null`, so an install with zero Projects behaves exactly as before. The read-only board over those bindings is `project-board` (#1696): Project id in, `{ tasks: [...] }` out, one row per core task id with `source` (`bot`/`group`/`workflow`), `column`, `assignee`, `updatedAt` and `runId`/`nodeId` when a run holds it. `core/src/host/project-board.js` reads `state.tasks` and the bindings and asks the registered providers through `rt.projectRunRefs` (`flybot.tasks.onProjectProvider`); it never reads `workflows.json` and writes nothing. Since #2021 the board's record halves say what their caps left out and cut the right end of the list: the decision read answers `total` — the files left after the one-row-per-path dedup, before the cut — and takes `.slice(-DECISIONS_MAX)` over the still-ascending sort, so a Project past 200 decisions keeps the newest instead of dropping the ones just written and the order on screen does not change, while the meetings read answers `decidedTotal`/`pendingTotal` per list beside the 100 rows it already kept newest; a list at or under its cap answers the same rows as before, plus the count ([#2021](https://github.com/ThinkFlowLab/FlyBot/issues/2021)). Since [#2029](https://github.com/ThinkFlowLab/FlyBot/issues/2029) a blocked card also carries the age of its own question: `blockedOf(task, now)` answers `since` (the `inputRequest.requestedAt` stamp `tasks.js` wrote, preserved across a re-ask) and `waitedMs` (`now - since`, the same shape `waitingOf` answers), both `null` when the ask wrote no stamp — never derived from `createdAt`/`updatedAt` — and `buildQueues` sorts `blocked` oldest-first with the comparator `waiting.sort` already uses, so an undated card sorts last; the Waiting group's own output is unchanged. Tests: `core/test/project-board.test.js`. On top of the record and the board sits the **Project Assistant** (#1712, Stage 2.5): `project-delete` removes the Project, its bindings and its memory; the assistant's digest is one stored note plus one `deliver()` to the owner, idempotent per Asia/Shanghai day, and its identity is the connector account and never the shared app — no connector signed in, or a multi-member host whose Project owner is not this host's own user, refuses and escalates with nothing written. Per-owner memory (#1733) keys those three fields by `(Project, owner)` under `projectMemory[id].owners`, mirrors the primary owner onto the row itself so a single-owner Project reads as before, and migrates a pre-#1733 record onto its primary owner on the first write instead of replacing it; the boundary a memory read is checked against is the Project's own owner list, so an owner asking for another owner's entries is refused naming that list, while the assistant's own render walks every owner. A card needs an owner's decision when the Bot that owns the card belongs to that owner, never from the board's `assignee` (a Bot name or null); the ask names the card's own title, at most `MAX_ACTIONABLE` (5) per owner. A quiet window on the assistant record holds a due digest and releases it once, labelled, when the window ends; a window covering 09:00 delivers nothing that day; an owner's opt-out stops generation and pauses the shared 09:00 task once every owner is off, and a re-enable resumes it; delivery goes to each owner's own Session and falls back to the main Bot only for the primary owner. A held digest is released by the next `digest()` call, not by the 09:00 task, which does not make one after a window ends. On top of it, member auth (#48) adds host module `src/host/member-auth.js`, installed after `store` in `MODULES` (`core/index.js`): `invitations` and `authSessions` maps live on state (no `STATE_VERSION` bump), the channel resolves the actor from the `x-flybot-member-session` header, and endpoints are `auth-invite` / `auth-redeem` / `auth-revoke` / `auth-whoami` / `auth-remove-member` / `auth-revoke-invite` with `body.actorId` ignored; `auth-invite` alone also opens for an anonymous caller on a host with no sessions yet (bootstrap first invite), `auth-revoke-invite` kills an unredeemed invitation (redeeming it afterwards fails with `revoked`), `removeMember` refuses a member that still owns a Bot (`has_bots`), and the auth mutations are serialized behind an in-process lock so concurrent `removeMember` calls cannot both pass the last-owner check. Sign-in surface only — still not team mode; details in [team](team.md). On top of it, owner-scoped access (#49) adds host module `src/host/authz.js`, installed after member-auth: when any `authSessions` exist, the channel `authorize()` default-denies cross-owner Bot/room/session access, blocks shared non-isolatable resources (secrets, connectors, folder picks, browser bridge, update-install, diagnostics, set-prefs, `add-agent` — the DSH Agent is one per deployment and carries no owner) with `bot/blocked-shared` when more than one member exists, stamps `create-bot` with `actor.memberId`, and filters `view()`/`live()` to the actor; with no sessions the single-human behavior is unchanged. Session targets resolve through the store's owner maps — a Bot id via `botOf`, current chats and group Sessions and earlier parts via `selfOf`/`groupOwners`/`pastOwners` (a shared room Session also resolves for its current participants, #50) — and unresolvable ids deny. `approval-answer` gates on the approval's own Bot or room (resolved by approval id), never on caller-supplied session fields. `flybot/*` plugin endpoints (src/host/hooks.js) reach any signed-in actor for reads — except a Bot Social read naming a `body.botId` the actor does not own, which `bot/forbidden` refuses before the plugin handler registers that Bot's identity or syncs its grants (#1788, an owner-decided tightening); plugin writes follow the shared rule. `view()`/`live()` narrowing (`rt.ownedView`/`rt.ownedLive` in authz.js) keeps per-session entries (`questions`, `exchangeTurns`) the actor owns, and deployment-wide surfaces (agents, secrets, connectors, memory reviews) only while a single member exists — the same rule as the shared writes; rooms the actor belongs to and the Bots in them (#50) stay visible. `create-room` refuses a request with neither a member Bot nor any participant. On top of it, room membership (#50) adds host module `src/host/room-membership.js`, installed after groups: a room may carry typed `participants` (`human` / local `bot` / granted remote `bot` with `handle` + owner fields, roles `admin` / `member`, `joinedSeq` / `leftSeq`); log lines carry `authorId` + `authorKind`; history is the membership window (current members and the owner of an invited Bot see `seq >=` their interval; leave withdraws access; rejoin starts a new interval); local cross-owner rooms accept each side's *granted* Bots (#90: default deny, Chief included); a friend's Bot from `social/remote-bots` (`cleanRemote`) may be added and ungranted Bots stay private, and a room with a friend's Bot holds only granted local Bots (a Bot that joined by room code, `viaCode`, only for that room); `view()` labels remotes with an owner badge and shows an invited owner **Shared room from \**. Face-to-face rooms (#83) reuse the same `participants` / membership-window / owner-badge presentation with `origin: 'face-to-face'`: room-only remotes may sit in the room without a person-grant or a friendship, `presentRoom` treats the viewer as a member (not Shared room from), leave skips the two-Bot floor, and `fanoutRoomLine` goes to `rt.faceRoomFanout` instead of friend `flybotSend`. Still not team mode — see [team](team.md). Per-Bot grants (#90) add host module `src/host/reach.js`, installed after room-membership: `state.grants[botId]` is the list of independent grants (one Bot → one grantee, optionally room-scoped); default deny, Chief included; a Bot whose owner is not a member has none. Grants are set with `rt.setGrants`, exposed as `BotView.granted`, `flybot.bot.hasGrant` / `hasAnyGrant`, `flybot.grants` and the `bot.grants` event. `reach()` is the owner policy: a friend's Bot may reach only local Bots granted to that sender, only a granted Bot (or one code-joined in that room) may message a friend's Bot, another owner's Bot is reached only if both sides have matching grants or both are members of the room the message belongs to. It is not a middleware: hooks.js runs it before the `bot.send` chain, again on approval release, and on every deliver with a sender or remote origin (resumed, retried, deferred, re-sent), so no verdict or `bypass` can skip it and a queued message is judged by what is true when it is delivered. Revoking a grant, or replacing its Chief, removes it from rooms that have friends' Bots or several owners at once (`rt.evictUnshared`). Approval binding (#52) completes the held-send half of this: `state.flybot.approvals` records carry `requestId`, a sha256 `version` over the request content, server-derived `ownerId` and `origin` (`via`/`hop`/audience) — claims in the message (`meta`, text) never confer authority. `flybot/decide` is allowed through authz for any signed-in actor and the per-record check happens in hooks (`decide` requires the sender Bot's owner's session, `bot/forbidden` otherwise, `bot/unauthorized` without a session); `release()` revalidates before dispatch and marks the record `stale` when the request changed, the sender or target Bot is gone (also invalidated eagerly on `deleteBot`), or the Bot changed owners; a demoted Chief's sender-side holds are invalidated eagerly on `setMain` (not inside `staleReason`), and `release()` re-checks immediately before dispatch so an in-flight approve cannot go out after a concurrent invalidation. Unknown `invalidateFor` field values throw. `flybot/approvals` lists only the actor's own holds while enforcement is on; decided stale records keep their attribution in state but appear in no member's list. Which statuses still wait for that decision is one rule in `src/shared/approval-waiting.js` (#754): `decide()`, `heldOf()` in the chat view, the in-flight filter that invalidates holds, `PENDING_MAX` and the `APPROVALS_KEPT` cleanup all ask `isApprovalWaiting()`, and `channel.js` counts a row's waiting replies with it, so a `pending_approval` hold (Bot Social's own spelling) is decidable, drawn as waiting and never dropped mid-wait. +- The saved team (`state.json`) is versioned. Version 2 (#47) carries the identity schema — `members` records, a per-Bot `ownerId`, the owner's `designatedChiefId`. A legacy version-1 file is migrated on load with a one-time `state.json.v1` backup; an existing backup counts only when it is a readable file holding a parseable version-1 state, and anything else (or any malformed ownership) fails closed (read-only). An older binary refuses a newer version read-only. This is schema foundation only — team mode stays disabled, see [team](team.md). On top of it, a durable **Project** record (#1691): `state.projects` holds `{id, name, repository, defaultBranch, ownerUserId, createdAt, updatedAt, status}`, `bot.projectId` / `room.projectId` and `state.projectRuns[runId]` bind a member (a group, a Bot or a workflow run) to at most one Project, and the `api/bot` endpoints `projects`, `project-create`, `project-read`, `project-bind`, `project-of` and `project-board` sit in the task allow list. An unbound member resolves `null`, so an install with zero Projects behaves exactly as before. The read-only board over those bindings is `project-board` (#1696): Project id in, `{ tasks: [...] }` out, one row per core task id with `source` (`bot`/`group`/`workflow`), `column`, `assignee`, `updatedAt` and `runId`/`nodeId` when a run holds it. `core/src/host/project-board.js` reads `state.tasks` and the bindings and asks the registered providers through `rt.projectRunRefs` (`flybot.tasks.onProjectProvider`); it never reads `workflows.json` and writes nothing. Since #2021 the board's record halves say what their caps left out and cut the right end of the list: the decision read answers `total` — the files left after the one-row-per-path dedup, before the cut — and takes `.slice(-DECISIONS_MAX)` over the still-ascending sort, so a Project past 200 decisions keeps the newest instead of dropping the ones just written and the order on screen does not change, while the meetings read answers `decidedTotal`/`pendingTotal` per list beside the 100 rows it already kept newest; a list at or under its cap answers the same rows as before, plus the count ([#2021](https://github.com/ThinkFlowLab/FlyBot/issues/2021)). Since #2033 the lookup a decided meeting uses for its own file falls back to the un-truncated dedupe set of that same read when the name is not among the kept rows, so a file that fell off the oldest end of the cut is still named by the meeting (`path` set, and no `sha256`, because only the kept rows carry one) while a name the folder no longer holds still answers `path: ''`; the fallback reads names from that dedupe set and never asks the filesystem, so a crafted `../outside.md` yields no path either ([#2033](https://github.com/ThinkFlowLab/FlyBot/issues/2033)). Since [#2029](https://github.com/ThinkFlowLab/FlyBot/issues/2029) a blocked card also carries the age of its own question: `blockedOf(task, now)` answers `since` (the `inputRequest.requestedAt` stamp `tasks.js` wrote, preserved across a re-ask) and `waitedMs` (`now - since`, the same shape `waitingOf` answers), both `null` when the ask wrote no stamp — never derived from `createdAt`/`updatedAt` — and `buildQueues` sorts `blocked` oldest-first with the comparator `waiting.sort` already uses, so an undated card sorts last; the Waiting group's own output is unchanged. Tests: `core/test/project-board.test.js`. On top of the record and the board sits the **Project Assistant** (#1712, Stage 2.5): `project-delete` removes the Project, its bindings and its memory; the assistant's digest is one stored note plus one `deliver()` to the owner, idempotent per Asia/Shanghai day, and its identity is the connector account and never the shared app — no connector signed in, or a multi-member host whose Project owner is not this host's own user, refuses and escalates with nothing written. Per-owner memory (#1733) keys those three fields by `(Project, owner)` under `projectMemory[id].owners`, mirrors the primary owner onto the row itself so a single-owner Project reads as before, and migrates a pre-#1733 record onto its primary owner on the first write instead of replacing it; the boundary a memory read is checked against is the Project's own owner list, so an owner asking for another owner's entries is refused naming that list, while the assistant's own render walks every owner. A card needs an owner's decision when the Bot that owns the card belongs to that owner, never from the board's `assignee` (a Bot name or null); the ask names the card's own title, at most `MAX_ACTIONABLE` (5) per owner. A quiet window on the assistant record holds a due digest and releases it once, labelled, when the window ends; a window covering 09:00 delivers nothing that day; an owner's opt-out stops generation and pauses the shared 09:00 task once every owner is off, and a re-enable resumes it; delivery goes to each owner's own Session and falls back to the main Bot only for the primary owner. A held digest is released by the next `digest()` call, not by the 09:00 task, which does not make one after a window ends. On top of it, member auth (#48) adds host module `src/host/member-auth.js`, installed after `store` in `MODULES` (`core/index.js`): `invitations` and `authSessions` maps live on state (no `STATE_VERSION` bump), the channel resolves the actor from the `x-flybot-member-session` header, and endpoints are `auth-invite` / `auth-redeem` / `auth-revoke` / `auth-whoami` / `auth-remove-member` / `auth-revoke-invite` with `body.actorId` ignored; `auth-invite` alone also opens for an anonymous caller on a host with no sessions yet (bootstrap first invite), `auth-revoke-invite` kills an unredeemed invitation (redeeming it afterwards fails with `revoked`), `removeMember` refuses a member that still owns a Bot (`has_bots`), and the auth mutations are serialized behind an in-process lock so concurrent `removeMember` calls cannot both pass the last-owner check. Sign-in surface only — still not team mode; details in [team](team.md). On top of it, owner-scoped access (#49) adds host module `src/host/authz.js`, installed after member-auth: when any `authSessions` exist, the channel `authorize()` default-denies cross-owner Bot/room/session access, blocks shared non-isolatable resources (secrets, connectors, folder picks, browser bridge, update-install, diagnostics, set-prefs, `add-agent` — the DSH Agent is one per deployment and carries no owner) with `bot/blocked-shared` when more than one member exists, stamps `create-bot` with `actor.memberId`, and filters `view()`/`live()` to the actor; with no sessions the single-human behavior is unchanged. Session targets resolve through the store's owner maps — a Bot id via `botOf`, current chats and group Sessions and earlier parts via `selfOf`/`groupOwners`/`pastOwners` (a shared room Session also resolves for its current participants, #50) — and unresolvable ids deny. `approval-answer` gates on the approval's own Bot or room (resolved by approval id), never on caller-supplied session fields. `flybot/*` plugin endpoints (src/host/hooks.js) reach any signed-in actor for reads — except a Bot Social read naming a `body.botId` the actor does not own, which `bot/forbidden` refuses before the plugin handler registers that Bot's identity or syncs its grants (#1788, an owner-decided tightening); plugin writes follow the shared rule. `view()`/`live()` narrowing (`rt.ownedView`/`rt.ownedLive` in authz.js) keeps per-session entries (`questions`, `exchangeTurns`) the actor owns, and deployment-wide surfaces (agents, secrets, connectors, memory reviews) only while a single member exists — the same rule as the shared writes; rooms the actor belongs to and the Bots in them (#50) stay visible. `create-room` refuses a request with neither a member Bot nor any participant. On top of it, room membership (#50) adds host module `src/host/room-membership.js`, installed after groups: a room may carry typed `participants` (`human` / local `bot` / granted remote `bot` with `handle` + owner fields, roles `admin` / `member`, `joinedSeq` / `leftSeq`); log lines carry `authorId` + `authorKind`; history is the membership window (current members and the owner of an invited Bot see `seq >=` their interval; leave withdraws access; rejoin starts a new interval); local cross-owner rooms accept each side's *granted* Bots (#90: default deny, Chief included); a friend's Bot from `social/remote-bots` (`cleanRemote`) may be added and ungranted Bots stay private, and a room with a friend's Bot holds only granted local Bots (a Bot that joined by room code, `viaCode`, only for that room); `view()` labels remotes with an owner badge and shows an invited owner **Shared room from \**. Face-to-face rooms (#83) reuse the same `participants` / membership-window / owner-badge presentation with `origin: 'face-to-face'`: room-only remotes may sit in the room without a person-grant or a friendship, `presentRoom` treats the viewer as a member (not Shared room from), leave skips the two-Bot floor, and `fanoutRoomLine` goes to `rt.faceRoomFanout` instead of friend `flybotSend`. Still not team mode — see [team](team.md). Per-Bot grants (#90) add host module `src/host/reach.js`, installed after room-membership: `state.grants[botId]` is the list of independent grants (one Bot → one grantee, optionally room-scoped); default deny, Chief included; a Bot whose owner is not a member has none. Grants are set with `rt.setGrants`, exposed as `BotView.granted`, `flybot.bot.hasGrant` / `hasAnyGrant`, `flybot.grants` and the `bot.grants` event. `reach()` is the owner policy: a friend's Bot may reach only local Bots granted to that sender, only a granted Bot (or one code-joined in that room) may message a friend's Bot, another owner's Bot is reached only if both sides have matching grants or both are members of the room the message belongs to. It is not a middleware: hooks.js runs it before the `bot.send` chain, again on approval release, and on every deliver with a sender or remote origin (resumed, retried, deferred, re-sent), so no verdict or `bypass` can skip it and a queued message is judged by what is true when it is delivered. Revoking a grant, or replacing its Chief, removes it from rooms that have friends' Bots or several owners at once (`rt.evictUnshared`). Approval binding (#52) completes the held-send half of this: `state.flybot.approvals` records carry `requestId`, a sha256 `version` over the request content, server-derived `ownerId` and `origin` (`via`/`hop`/audience) — claims in the message (`meta`, text) never confer authority. `flybot/decide` is allowed through authz for any signed-in actor and the per-record check happens in hooks (`decide` requires the sender Bot's owner's session, `bot/forbidden` otherwise, `bot/unauthorized` without a session); `release()` revalidates before dispatch and marks the record `stale` when the request changed, the sender or target Bot is gone (also invalidated eagerly on `deleteBot`), or the Bot changed owners; a demoted Chief's sender-side holds are invalidated eagerly on `setMain` (not inside `staleReason`), and `release()` re-checks immediately before dispatch so an in-flight approve cannot go out after a concurrent invalidation. Unknown `invalidateFor` field values throw. `flybot/approvals` lists only the actor's own holds while enforcement is on; decided stale records keep their attribution in state but appear in no member's list. Which statuses still wait for that decision is one rule in `src/shared/approval-waiting.js` (#754): `decide()`, `heldOf()` in the chat view, the in-flight filter that invalidates holds, `PENDING_MAX` and the `APPROVALS_KEPT` cleanup all ask `isApprovalWaiting()`, and `channel.js` counts a row's waiting replies with it, so a `pending_approval` hold (Bot Social's own spelling) is decidable, drawn as waiting and never dropped mid-wait. - One writer per home (`src/host/home-lock.js`): the first dsh to load `~/.dsh` takes `state.lock` (pid, host, a random token in the file, its mtime bumped on a timer) and a second window on the same data only reads, answering `bot/read-only` and naming the other host. Takeover is **on the next write**, not on a poll (#1027): a window that was read-only claims the free lock inside `save()` too, and a change made outside a request (a plugin, a scheduled task, a delivery) belongs in `rt.mutate(fn)`, which takes over and adopts what the other host left *before* the change is made and written. The writers that changed `rt.state` inline and then called `save()` are gone (#1048): `delivery.js` (a friend's first line and its unread mark, a team exchange) and `agents.js` (add, adopt, archive and remove of the DSH Agent) take the free lock and adopt first, re-resolving their records inside the change, so a write from a window that was read-only keeps what the other host left instead of replacing it with its older copy. `save()` itself never adopts: `adopt()` replaces `rt.state` whole, so adopting there would discard a change the caller has already made (`#1032`). Either takeover prints one line — `the other dsh has closed; this one now saves the Bot team (was pid on )` — from `refresh()` and from `save()` alike, so a window that writes over the file another host left leaves a trace (#1041). A lock file still naming a live holder on this host (its pid answers) keeps the window read-only, which is the #14 rule. A write that fails does not decide the delivery (#1096): the friend-line mark and the exchange record both land before the agent has the line, so a rejected `mutate()` (the lock was taken away, or the disk refused) prints one warning naming what was not recorded and the line is still handed over — a throw there would drop a message that exists nowhere else. The write chain is also readable: `rt.savesQueued()` is a monotonic watermark — every save this host has accepted since it started, never decremented — and `rt.savesSettled()` resolves once the chain is empty, so a caller that must read `state.json` after a save it did not await — a rollback's own write, in the tests — waits on the store instead of on a delay, where a wait long enough on an idle machine reads a half-written team on a busy one (#1368). diff --git a/patches/ds-bot/files/src/host/project-board.js b/patches/ds-bot/files/src/host/project-board.js index f875c541e..c6cd8e424 100644 --- a/patches/ds-bot/files/src/host/project-board.js +++ b/patches/ds-bot/files/src/host/project-board.js @@ -321,7 +321,9 @@ export function install(rt) { : 'no decision file in any folder the record names' // #2021: the count is taken after the dedup and before the cut, so a reader can tell a complete // list from a truncated one instead of reading the cap as the answer. - return { dir: dir === '' ? null : dir, files, total: deduped.length, reason } + // #2033: the un-truncated dedupe of this read, paths only — the meeting lookup below has to + // tell "fell off the 200-row cut" from "was never here" without asking the disk again. + return { dir: dir === '' ? null : dir, files, total: deduped.length, reason, known: new Set(deduped.map(file => file.path)) } } // #1831: the card's level, who it is addressed to and whether it may advance ride on every @@ -354,13 +356,17 @@ export function install(rt) { // exactly then, and the reader can see the file the record names is gone. const named = text(meeting.decisionFile) const file = known.get(named) + // #2033: `files` keeps the newest 200 rows (#2021), so a name can miss there while this read + // still saw the file in the folder. That fallback asks this read's own dedupe set — never + // the filesystem — so a name like `../outside.md` cannot become a path. + const pastCut = file === undefined && decisions.known?.has(named) === true decided.push({ id, date: text(meeting.decidedAt) !== '' ? new Date(meeting.decidedAt).toISOString().slice(0, 10) : '', question, owner: text(meeting.owner) || null, ...cardOf(meeting), - path: file === undefined ? '' : file.path, + path: file !== undefined ? file.path : pastCut ? named : '', ...(file === undefined ? {} : { sha256: file.sha256 }), }) continue @@ -485,6 +491,9 @@ export function install(rt) { ? { waiting: [], inflight: [], blocked: [], counts: { waiting: null, inflight: null, blocked: null, done: null } } : buildQueues(mine, done.length) const decisions = await decisionsOf(project) + // `known` is this read's own path set for the meeting lookup (#2033); the page renders + // `dir`/`files`/`total`/`reason`, so it does not travel with the board. + const servedDecisions = { dir: decisions.dir, files: decisions.files, total: decisions.total, reason: decisions.reason } // #1829: the seven numbers ride on the same read as the rows, so the board and its header // cannot disagree, and a credential-less host answers `ok: false` (the client paints a dash). // #1848: the running table and the done-task median read `mine` — exactly the cards this @@ -497,7 +506,7 @@ export function install(rt) { now: typeof rt.now === 'function' ? rt.now() : Date.now(), tasks: mine, }) - return { rows: open, done, ...queues, decisions, meetings: meetingsOf(project, decisions), metrics } + return { rows: open, done, ...queues, decisions: servedDecisions, meetings: meetingsOf(project, decisions), metrics } } const buildQueues = (mine, done) => { const now = typeof rt.now === 'function' ? rt.now() : Date.now() diff --git a/patches/ds-bot/files/test/project-board.test.js b/patches/ds-bot/files/test/project-board.test.js index 70a47e65f..b1ee23194 100644 --- a/patches/ds-bot/files/test/project-board.test.js +++ b/patches/ds-bot/files/test/project-board.test.js @@ -420,6 +420,143 @@ test('#1767: a Project without a decisions folder answers an empty list with the } }) +// #2033: the Decisions row list is cut at the newest 200 files (#2021), but a decided meeting +// still finds its own file by name. A file that fell off the oldest end of that cut is on disk and +// was seen by this read, so its meeting must name it rather than report it gone. +const folderPastCap = () => { + const base = mkdtempSync(join(tmpdir(), 'ds-bot-decisions-cap-')) + const dir = join(base, 'project') + mkdirSync(join(dir, '.git'), { recursive: true }) + mkdirSync(join(dir, 'decisions')) + for (let index = 0; index < 200; index += 1) { + writeFileSync(join(dir, 'decisions', `2026-01-02-${String(index).padStart(3, '0')}.md`), `# Old decision ${index}\n`) + } + for (let index = 0; index < 5; index += 1) { + writeFileSync(join(dir, 'decisions', `2026-11-01-${String(index).padStart(3, '0')}.md`), `# New decision ${index}\n`) + } + // `../outside.md` from the Project folder: present on disk, never in this read's dedupe set. A + // fallback that asks the filesystem instead of the read would hand its path out. + writeFileSync(join(base, 'outside.md'), '# Outside the folder\n') + return { base, dir } +} + +const capSeed = (dir) => { + const team = seed() + team.projects['project-p1'].workDir = dir + team.meetings = { + 'meeting-oldest': { + id: 'meeting-oldest', status: 'decided', question: 'The oldest decision?', + owner: 'Chief', project: 'project-p1', decisionFile: 'decisions/2026-01-02-000.md', + createdAt: 1, updatedAt: 5, decidedAt: 6, + }, + 'meeting-newest': { + id: 'meeting-newest', status: 'decided', question: 'The newest decision?', + owner: 'Chief', project: 'project-p1', decisionFile: 'decisions/2026-11-01-004.md', + createdAt: 1, updatedAt: 5, decidedAt: 7, + }, + 'meeting-absent': { + id: 'meeting-absent', status: 'decided', question: 'A file that never was?', + owner: 'Chief', project: 'project-p1', decisionFile: 'decisions/2026-12-31-missing.md', + createdAt: 1, updatedAt: 5, decidedAt: 8, + }, + 'meeting-escape': { + id: 'meeting-escape', status: 'decided', question: 'A name pointing outside?', + owner: 'Chief', project: 'project-p1', decisionFile: '../outside.md', + createdAt: 1, updatedAt: 5, decidedAt: 9, + }, + // Inside the cut, so this read lists it until the file is deleted; after that the meeting must + // read gone again. The fallback takes names from this read, so it cannot resurrect the file. + 'meeting-in-cap': { + id: 'meeting-in-cap', status: 'decided', question: 'A file inside the cut that is later deleted?', + owner: 'Chief', project: 'project-p1', decisionFile: 'decisions/2026-11-01-002.md', + createdAt: 1, updatedAt: 5, decidedAt: 10, + }, + } + return team +} + +async function startPastCap() { + const home = mkdtempSync(join(tmpdir(), 'ds-bot-board-')) + const { base, dir } = folderPastCap() + const { rt, stop } = await start(home, capSeed(dir)) + return { rt, home, base, dir, stop } +} + +test('#2033: a decided meeting whose file fell off the 200-row cut still names it', async () => { + const { rt, base, stop } = await startPastCap() + try { + const board = await rt.projectBoard('project-p1') + assert.equal(board.decisions.files.length, 200, 'the row list is still cut at the newest 200') + assert.equal(board.decisions.total, 205, 'the count still says how many files the read saw') + assert.equal(board.decisions.files.some(file => file.path === 'decisions/2026-01-02-000.md'), false, 'the oldest file is outside the cut, which is why the fallback is needed') + const oldest = board.meetings.decided.find(meeting => meeting.id === 'meeting-oldest') + assert.equal(oldest.path, 'decisions/2026-01-02-000.md', 'a file past the cut is named, not reported gone') + assert.equal('sha256' in oldest, false, 'only the cut rows carry a hash, so the fallback adds none') + } finally { + await stop() + rmSync(base, { recursive: true, force: true }) + } +}) + +test('#2033: a decided meeting inside the cut keeps its path and hash', async () => { + const { rt, base, stop } = await startPastCap() + try { + const board = await rt.projectBoard('project-p1') + const newest = board.meetings.decided.find(meeting => meeting.id === 'meeting-newest') + assert.equal(newest.path, 'decisions/2026-11-01-004.md') + assert.match(newest.sha256, /^[0-9a-f]{64}$/) + } finally { + await stop() + rmSync(base, { recursive: true, force: true }) + } +}) + +test('#2033: a decided meeting naming a file that is really absent still reads it gone', async () => { + const { rt, base, stop } = await startPastCap() + try { + const board = await rt.projectBoard('project-p1') + const absent = board.meetings.decided.find(meeting => meeting.id === 'meeting-absent') + assert.equal(absent.path, '', 'a name this read never saw is not a path') + assert.equal('sha256' in absent, false) + } finally { + await stop() + rmSync(base, { recursive: true, force: true }) + } +}) + +test('#2033: a decision file deleted from inside the cut still reads gone', async () => { + const { rt, dir, base, stop } = await startPastCap() + try { + const before = await rt.projectBoard('project-p1') + const kept = before.meetings.decided.find(meeting => meeting.id === 'meeting-in-cap') + assert.equal(kept.path, 'decisions/2026-11-01-002.md', 'the file is inside the cut while it is there') + assert.match(kept.sha256, /^[0-9a-f]{64}$/) + rmSync(join(dir, 'decisions', '2026-11-01-002.md')) + const after = await rt.projectBoard('project-p1') + assert.equal(after.decisions.total, 204, 'the read now sees one file fewer') + assert.equal(after.decisions.files.some(file => file.path === 'decisions/2026-11-01-002.md'), false, 'the deleted row is off the list') + const gone = after.meetings.decided.find(meeting => meeting.id === 'meeting-in-cap') + assert.equal(gone.path, '', 'a deleted file stays gone: the fallback names only what this read saw') + assert.equal('sha256' in gone, false) + } finally { + await stop() + rmSync(base, { recursive: true, force: true }) + } +}) + +test('#2033: a decision name that points outside the folder never becomes a path', async () => { + const { rt, base, stop } = await startPastCap() + try { + assert.equal(existsSync(join(base, 'outside.md')), true, 'the file it points at does exist on disk') + const board = await rt.projectBoard('project-p1') + const escape = board.meetings.decided.find(meeting => meeting.id === 'meeting-escape') + assert.equal(escape.path, '', 'the fallback takes names from this read, never from the filesystem') + } finally { + await stop() + rmSync(base, { recursive: true, force: true }) + } +}) + // #2005: a decision file's title is its first heading, bounded at 200 units. A heading whose 200th // unit is the first half of an emoji used to reach the board as an unpaired surrogate, so the // Decisions section carried half a character.