@aiworker/web 1.23.0 → 1.23.2

package/server/lib/project-context/runtime.test.js

@@ -3,6 +3,7 @@ import fsPromises from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 
+import { createProjectIdFromPath, projectConfigFileStemOf } from '../projects/project-id.js';
 import { createProjectContextRuntime, parsePlanMarkdown } from './runtime.js';
 
 const PROJECT_ID = 'path_dGVzdA';
@@ -200,6 +201,59 @@ describe('legacy migration', () => {
   });
 });
 
+describe('long project ids', () => {
+  // A checkout nested deep enough that its `path_<base64url>` id is longer
+  // than a file or folder name may be; the storage lands under the bounded
+  // stem instead of failing with ENAMETOOLONG.
+  const longProjectId = createProjectIdFromPath(`/private/tmp/claude-501/${'segment-'.repeat(18)}/scratchpad/evidence/demo-repo`);
+  const stem = projectConfigFileStemOf(longProjectId);
+
+  test('the id maps to a bounded folder name', () => {
+    expect(longProjectId.length).toBeGreaterThan(240);
+    expect(stem.startsWith('path_sha256_')).toBe(true);
+    expect(stem.length).toBeLessThan(100);
+    expect(runtime.contextPathFor(longProjectId)).toBe(path.join(projectsDirPath, stem, 'context.json'));
+    expect(runtime.plansDirFor(longProjectId)).toBe(path.join(projectsDirPath, stem, 'plans'));
+    // A short id keeps naming its folder itself.
+    expect(runtime.contextPathFor(PROJECT_ID)).toBe(contextPath());
+  });
+
+  test('a missing context reads as empty instead of failing on the legacy config lookup', async () => {
+    expect(await runtime.readContext(longProjectId)).toEqual({ version: 2, notes: [], todos: [], plans: [], sharedPlansDir: null });
+  });
+
+  test('context and plans round-trip through the bounded folder', async () => {
+    await runtime.saveTodos(longProjectId, [{ id: 't1', text: 'do it', completed: false, createdAt: 1 }]);
+    const { note } = await runtime.createNote(longProjectId, { body: 'kept' });
+    const { plan } = await runtime.createPlan(longProjectId, { title: 'Deep plan', body: 'step one' });
+
+    const context = await runtime.readContext(longProjectId);
+    expect(context.todos).toEqual([{ id: 't1', text: 'do it', completed: false, createdAt: 1 }]);
+    expect(context.notes.map((entry) => entry.id)).toEqual([note.id]);
+    expect(context.plans.map((entry) => entry.id)).toEqual([plan.id]);
+    expect((await runtime.readPlan(longProjectId, plan.id)).body).toBe('step one');
+
+    expect((await readJson(path.join(projectsDirPath, stem, 'context.json'))).todos).toHaveLength(1);
+    await fsPromises.access(path.join(projectsDirPath, stem, 'plans', plan.file));
+    expect(await fsPromises.readdir(projectsDirPath)).toEqual([stem]);
+  });
+
+  test('legacy keys are migrated out of the bounded config file', async () => {
+    const boundedConfigPath = path.join(projectsDirPath, `${stem}.json`);
+    await writeJson(boundedConfigPath, {
+      'setup-worktree': ['bun install'],
+      projectNotes: 'legacy notes',
+      projectTodos: [{ id: 't1', text: 'legacy todo', completed: true, createdAt: 5 }],
+    });
+
+    const context = await runtime.readContext(longProjectId);
+    expect(context.notes.map((entry) => entry.body)).toEqual(['legacy notes']);
+    expect(context.todos).toEqual([{ id: 't1', text: 'legacy todo', completed: true, createdAt: 5 }]);
+    expect(await readJson(boundedConfigPath)).toEqual({ 'setup-worktree': ['bun install'] });
+    expect((await readJson(path.join(projectsDirPath, stem, 'context.json'))).notes[0].body).toBe('legacy notes');
+  });
+});
+
 describe('todos', () => {
   test('round-trips through disk', async () => {
     await runtime.saveTodos(PROJECT_ID, [{ id: 't1', text: 'do it', completed: false, createdAt: 1 }]);

package/server/lib/projects/DOCUMENTATION.md

@@ -63,7 +63,7 @@ UI (`packages/ui/src/lib/sharedTrustConfirmation.ts`).
 
 ## Modules
 
-- `project-id.js` — `createProjectIdFromPath` / `projectPathFromId`: the path-derived id (`path_<base64url>`) that names the file, and the checkout path back from it. The shared UI derives the same id (`packages/ui/src/lib/projectId.ts`); both sides must agree.
+- `project-id.js` — `createProjectIdFromPath` / `projectPathFromId`: the path-derived id (`path_<base64url>`) that names the file, and the checkout path back from it. The shared UI derives the same id (`packages/ui/src/lib/projectId.ts`); both sides must agree. `projectConfigFileStemOf`: the stem that names the file and the sibling folder for an id, see the file name invariant below.
 - `project-config.js` — `createProjectConfigRuntime`: raw read, atomic write, the cross-process file lock (Electron and a CLI `serve` can share one projects dir), scheduled-task normalization, and the project-setup read/update.
 - `project-setup.js` — sanitizers, the shared-file parser (`parseSharedProjectConfig`, `normalizePlansDir`), the merge (`mergeProjectSetup`), and the personal view for the setup keys. Mirrored in the VS Code extension host (`packages/vscode/src/project-setup.ts`), which owns the same file when the webview has no AiWorker server; keep the two in sync.
 - `routes.js` — the setup routes. `/api/projects` is on the JSON-body allowlist in `opencode/core-routes.js`.
@@ -72,5 +72,6 @@ UI (`packages/ui/src/lib/sharedTrustConfirmation.ts`).
 
 - **Every write is a locked read-modify-write of the whole document.** Keys the writer does not own, and keys from newer builds, come back out unchanged. A setup update and a scheduled-task update never clobber each other.
 - **A wrongly shaped key is a 400, not a silent drop.** `projectSetupPatchToStored` throws; the file is untouched. Values inside a well-shaped key are sanitized (trimmed, capped, deduplicated) rather than rejected.
+- **The file name is bounded, and so is the folder beside it.** The file is `<projectId>.json` and the per-project folder is `<projectId>/` while the id is at most 200 characters. A `path_<base64url>` id grows with the checkout path, so a deeply nested project (a path of roughly 150 characters or more) would otherwise get a name beyond the 255-byte limit and every write, lock, and temp file would fail with ENAMETOOLONG. Such an id is stored as `path_sha256_<hex digest of the id>.json` instead, with the folder `path_sha256_<digest>/` beside it (`projectConfigFileStemOf`; every composer of either path goes through it: `project-config.js`, `project-context/runtime.js`, `agent-memory/runtime.js`, and the id migration and orphan recovery in `opencode/settings-runtime.js`). The digest keeps the `path_` prefix so orphan recovery skips it. A file an older build managed to write under the long name is still read when the bounded file is missing and is moved to the bounded name by the next write; a malformed one is a read failure, not an empty project. A folder an older build created under the raw id (possible only for ids of 201 to 255 characters; longer names never got one) is moved into the bounded folder once at startup, by the project id migration in `opencode/settings-runtime.js`, with `context.json` merged by entry identity when both exist. The VS Code extension host mirrors both the naming rule and the legacy read-then-move for the file (`bridge-project-setup-runtime.ts`), because a VS Code-only user has no server to do it; it never touches the folder.
 - **The client never composes the path.** `packages/ui/src/lib/openchamberConfig.ts` speaks only HTTP; the same code serves web, desktop, VS Code, and the phone, including a phone on a remote instance.
 - **`AIWORKER_DATA_DIR` moves this directory too.** Every AiWorker folder hangs off the one root; a custom root gets `projects/`, `themes/`, and `speech-models/` copied in from `~/.config/openchamber` once at startup (copied, not moved: a second instance beside the default one must not strip it) (`lib/data-dir-migration.js`). A scratch server started with its own data dir therefore never touches the real project configs.

package/server/lib/projects/project-config.js

@@ -1,7 +1,7 @@
 import { DateTime, IANAZone } from 'luxon';
 import parser from 'cron-parser';
 
-import { projectPathFromId } from './project-id.js';
+import { projectConfigFileStemOf, projectPathFromId } from './project-id.js';
 import {
   DEFAULT_PLANS_DIR,
   EMPTY_SHARED_PROJECT_CONFIG,
@@ -399,6 +399,15 @@ export const createProjectConfigRuntime = (deps) => {
 
   const resolveProjectConfigPath = (projectID) => {
     const safeProjectID = sanitizeProjectID(projectID);
+    return path.join(projectsDirPath, `${projectConfigFileStemOf(safeProjectID)}.json`);
+  };
+
+  // Where a build before the bounded file name stored an id too long for one
+  // (on a filesystem that still accepted it), or null when the id's own name
+  // is the current one. Read as a fallback, moved on the next write.
+  const resolveLegacyProjectConfigPath = (projectID) => {
+    const safeProjectID = sanitizeProjectID(projectID);
+    if (projectConfigFileStemOf(safeProjectID) === safeProjectID) return null;
     return path.join(projectsDirPath, `${safeProjectID}.json`);
   };
 
@@ -500,18 +509,31 @@ export const createProjectConfigRuntime = (deps) => {
     throw new Error(`timeout acquiring project config lock for ${projectID}`);
   };
 
-  const readRawProjectConfigFromDisk = async (projectID) => {
-    const filePath = resolveProjectConfigPath(projectID);
+  // The parsed document, or null when there is no file (one of
+  // `missingCodes`). Malformed JSON still throws; it is a broken file, not
+  // an empty one.
+  const readJsonDocumentIfPresent = async (filePath, missingCodes) => {
+    let raw;
     try {
-      const raw = await fsPromises.readFile(filePath, 'utf8');
-      const parsed = JSON.parse(raw);
-      return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+      raw = await fsPromises.readFile(filePath, 'utf8');
     } catch (error) {
-      if (error && typeof error === 'object' && error.code === 'ENOENT') {
-        return {};
-      }
+      const code = error && typeof error === 'object' ? error.code : null;
+      if (missingCodes.includes(code)) return null;
       throw error;
     }
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+  };
+
+  // The legacy name of a long id may exceed what the filesystem can hold;
+  // ENAMETOOLONG there means "no such file". On the bounded path it would
+  // mean the projects dir itself is unusable, so it stays an error.
+  const readRawProjectConfigFromDisk = async (projectID) => {
+    const current = await readJsonDocumentIfPresent(resolveProjectConfigPath(projectID), ['ENOENT']);
+    if (current) return current;
+    const legacyPath = resolveLegacyProjectConfigPath(projectID);
+    const legacy = legacyPath ? await readJsonDocumentIfPresent(legacyPath, ['ENOENT', 'ENAMETOOLONG']) : null;
+    return legacy ?? {};
   };
 
   // Normalized tasks for reading, plus the raw on-disk record of each one for
@@ -578,6 +600,13 @@ export const createProjectConfigRuntime = (deps) => {
       await fsPromises.rm(temporaryPath, { force: true }).catch(() => {});
       throw error;
     }
+    // Every write goes through a read of the whole document, so the legacy
+    // file's content is now in the current one; drop it so a later read (or an
+    // older build) cannot see two copies drifting apart.
+    const legacyPath = resolveLegacyProjectConfigPath(projectID);
+    if (legacyPath) {
+      await fsPromises.rm(legacyPath, { force: true }).catch(() => {});
+    }
   };
 
   const writeProjectConfigToDisk = async (projectID, config) => {

package/server/lib/projects/project-config.test.js

@@ -3,6 +3,7 @@ import os from 'os';
 import path from 'path';
 import { mkdtemp, rm, readFile, writeFile } from 'fs/promises';
 import { createProjectConfigRuntime } from './project-config.js';
+import { createProjectIdFromPath } from './project-id.js';
 
 const createRuntime = async () => {
   const tempRoot = await mkdtemp(path.join(os.tmpdir(), 'oc-scheduled-project-config-'));
@@ -175,6 +176,102 @@ describe('project-config runtime', () => {
   });
 });
 
+describe('project-config file naming', () => {
+  const nightly = {
+    name: 'nightly',
+    enabled: true,
+    schedule: { kind: 'daily', time: '09:00', timezone: 'UTC' },
+    execution: { prompt: 'run', providerID: 'openai', modelID: 'gpt-4.1' },
+  };
+
+  it('names the file by the id while the id fits a file name', async () => {
+    const { runtime, tempRoot, cleanup } = await createRuntime();
+    try {
+      const projectID = createProjectIdFromPath('/Users/someone/projects/demo');
+      expect(runtime.resolveProjectConfigPath(projectID)).toBe(path.join(tempRoot, `${projectID}.json`));
+    } finally {
+      await cleanup();
+    }
+  });
+
+  it('stores a project whose path is too long for a file name under a bounded name', async () => {
+    const { runtime, tempRoot, cleanup } = await createRuntime();
+    try {
+      // ~190 characters, like a scratchpad checkout nested under a worktree;
+      // the base64url id is longer than the 255-byte file name limit allows.
+      const projectPath = `/private/tmp/claude-501/${'segment-'.repeat(18)}/scratchpad/evidence/demo-repo`;
+      expect(projectPath.length).toBeGreaterThan(180);
+      const projectID = createProjectIdFromPath(projectPath);
+      expect(projectID.length).toBeGreaterThan(240);
+
+      const filePath = runtime.resolveProjectConfigPath(projectID);
+      const fileName = path.basename(filePath);
+      expect(path.dirname(filePath)).toBe(tempRoot);
+      expect(fileName.startsWith('path_sha256_')).toBe(true);
+      expect(fileName.length).toBeLessThan(100);
+      // The same id always maps to the same file.
+      expect(runtime.resolveProjectConfigPath(projectID)).toBe(filePath);
+
+      // The whole write path (lock file, temp file, rename) works on a real filesystem.
+      const created = await runtime.upsertScheduledTask(projectID, nightly);
+      expect(created.created).toBe(true);
+      const setup = await runtime.updateProjectSetup(projectID, { setupWorktree: ['bun install'] });
+      expect(setup.setupWorktree).toEqual(['bun install']);
+
+      const raw = JSON.parse(await readFile(filePath, 'utf8'));
+      expect(raw.scheduledTasks).toHaveLength(1);
+      expect(raw['setup-worktree']).toEqual(['bun install']);
+      expect(await runtime.listScheduledTasks(projectID)).toHaveLength(1);
+      expect((await runtime.readProjectSetup(projectID)).setupWorktree).toEqual(['bun install']);
+    } finally {
+      await cleanup();
+    }
+  });
+
+  it('reads a long id from its pre-bound file name and moves it on the next write', async () => {
+    const { runtime, tempRoot, cleanup } = await createRuntime();
+    try {
+      // Long enough for the bounded name, short enough that an older build
+      // could still have written `<id>.json` on this filesystem.
+      const projectID = `path_${'a'.repeat(200)}`;
+      const legacyPath = path.join(tempRoot, `${projectID}.json`);
+      const currentPath = runtime.resolveProjectConfigPath(projectID);
+      expect(currentPath).not.toBe(legacyPath);
+      await writeFile(legacyPath, JSON.stringify({
+        version: 1,
+        scheduledTasks: [{ id: 'task-legacy', ...nightly, state: { createdAt: 1, updatedAt: 2, lastStatus: 'idle' } }],
+        projectNotes: 'keep me',
+      }), 'utf8');
+
+      const tasks = await runtime.listScheduledTasks(projectID);
+      expect(tasks.map((task) => task.id)).toEqual(['task-legacy']);
+
+      await runtime.upsertScheduledTask(projectID, { ...nightly, name: 'weekly digest' });
+
+      const raw = JSON.parse(await readFile(currentPath, 'utf8'));
+      expect(raw.scheduledTasks.map((task) => task.id)).toEqual(['task-legacy', 'task-fixed-id']);
+      expect(raw.projectNotes).toBe('keep me');
+      await expect(readFile(legacyPath, 'utf8')).rejects.toMatchObject({ code: 'ENOENT' });
+      expect((await runtime.listScheduledTasks(projectID)).map((task) => task.name)).toEqual(['nightly', 'weekly digest']);
+    } finally {
+      await cleanup();
+    }
+  });
+
+  it('treats a malformed pre-bound file as a failure, not as an empty project', async () => {
+    const { runtime, tempRoot, cleanup } = await createRuntime();
+    try {
+      const projectID = `path_${'b'.repeat(200)}`;
+      await writeFile(path.join(tempRoot, `${projectID}.json`), '{ not json', 'utf8');
+      await expect(runtime.listScheduledTasks(projectID)).rejects.toThrow();
+      await expect(runtime.upsertScheduledTask(projectID, nightly)).rejects.toThrow();
+      await expect(readFile(runtime.resolveProjectConfigPath(projectID), 'utf8')).rejects.toMatchObject({ code: 'ENOENT' });
+    } finally {
+      await cleanup();
+    }
+  });
+});
+
 describe('project-config loop reconciliation', () => {
   const loop = (name, overrides = {}) => ({
     scope: 'project',

package/server/lib/projects/project-id.js

@@ -1,3 +1,11 @@
+import crypto from 'node:crypto';
+
+// The longest stem `<stem>.json` may have and still leave room, inside the
+// 255-byte file name limit, for the atomic-write `.tmp-<pid>-<ms>-<random>`
+// suffix and the `.json.lock` sibling. Ids are ASCII, so characters are bytes.
+const MAX_PROJECT_CONFIG_FILE_STEM_LENGTH = 200;
+const HASHED_PROJECT_CONFIG_FILE_STEM_PREFIX = 'path_sha256_';
+
 const normalizeProjectPathForId = (value) => {
   if (typeof value !== 'string') return '';
   return value.replace(/\\/g, '/').replace(/\/+$/g, '') || value;
@@ -28,3 +36,21 @@ export const projectPathFromId = (projectId) => {
     return '';
   }
 };
+
+/**
+ * The stem of everything a project owns in the projects dir: the per-user
+ * config file `<projectsDir>/<stem>.json` and the sibling folder
+ * `<projectsDir>/<stem>/` (context, plans, memory). It is the id itself while
+ * that fits a file name. A `path_<base64url>` id grows with the checkout path,
+ * so a deeply nested project would otherwise get a name the filesystem
+ * rejects (ENAMETOOLONG); such an id maps to a fixed-length digest instead.
+ * The digest keeps the `path_` prefix so the orphan recovery in
+ * `opencode/settings-runtime.js` never mistakes the file for a leftover of the
+ * random-id era. The VS Code extension host applies the same rule
+ * (`packages/vscode/src/bridge-project-setup-runtime.ts`); keep the two in sync.
+ */
+export const projectConfigFileStemOf = (projectId) => {
+  if (projectId.length <= MAX_PROJECT_CONFIG_FILE_STEM_LENGTH) return projectId;
+  const digest = crypto.createHash('sha256').update(projectId, 'utf8').digest('hex');
+  return `${HASHED_PROJECT_CONFIG_FILE_STEM_PREFIX}${digest}`;
+};

package/server/lib/relay/DOCUMENTATION.md

@@ -97,6 +97,26 @@ It does not replace a physical iOS/LTE check.
 
 ## Authentication model
 
+### Self-reported app diagnostics
+
+Host-control, host-data and client upgrades include optional `appId`,
+`appVersion` and `platform` query parameters. AiWorker sends `aiworker`,
+the local package version and the local runtime. Client platforms use the
+existing presence values: `desktop` for Electron, `vscode`, `ios`, `android`
+and `web` for browsers, including hosted mobile. Hosts use
+`AIWORKER_RUNTIME`, defaulting to `web`, so SSH hosts report `ssh-remote`.
+These labels describe the connecting process, not its remote target.
+
+These fields are diagnostics only, outside the signed auth payload. Older
+relays ignore them and older apps remain connectable. The hosted relay groups
+missing or invalid fields as `unknown`. Its analytics count host-control and
+client connections separately, including reconnects, and show labels as
+self-reported, never as verified app identity. Host-data sockets are excluded.
+App diagnostics are written on connection, without per-app traffic counters.
+No credentials, device names or application contents are added to diagnostics.
+
+### Access checks
+
 - The tunnel is **transport only**. The AiWorker server still authenticates every tunneled request exactly as it authenticates a direct remote client. The relay path grants reachability, not authorization.
 - Clients carry their normal credential. HTTP and SSE requests authenticate with the client's bearer token (a header). **WebSocket upgrades cannot send headers**, so they authenticate with a short-lived URL-scoped token minted beforehand and passed as a query parameter. This asymmetry is important when adding new WebSocket features (see the skill).
 - The host authenticates itself to the relay with a signed handshake using its long-lived signing key.

package/server/lib/relay/host-client.js

@@ -4,6 +4,7 @@
 // dispatcher. Spec: .opencode/plans/private-relay/01-protocol-spec.md (Layer 1).
 
 import { WebSocket } from 'ws';
+import { createRequire } from 'node:module';
 
 import { RELAY_PROTOCOL_VERSION, RelayCloseCode, createHostHandshake } from './e2ee.js';
 import { createOutboundFrameBatcher, decodeFrameBatch, decodeTunnelFrame, decodeDeliveryAck, encodeFrameBatch, TunnelFrameType } from './tunnel-codec.js';
@@ -50,6 +51,8 @@ const resolveBatchWindowMs = (option) => {
  * }} options
  */
 export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, onStatus, logger = console, batchWindowMs, batch, flowControl }) => {
+  const { version } = createRequire(import.meta.url)('../../../package.json');
+  const platform = process.env.AIWORKER_RUNTIME || 'web';
   const resolveLocalPort = typeof getLocalPort === 'function' ? getLocalPort : () => localPort;
   const localBatch = batch !== false;
   const resolvedBatchWindowMs = resolveBatchWindowMs(batchWindowMs);
@@ -82,6 +85,10 @@ export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, on
     url.searchParams.set('v', String(RELAY_PROTOCOL_VERSION));
     url.searchParams.set('role', role);
     url.searchParams.set('serverId', identity.serverId);
+    // Self-reported diagnostics, not part of relay authentication.
+    url.searchParams.set('appId', 'aiworker');
+    url.searchParams.set('appVersion', version);
+    url.searchParams.set('platform', platform);
     if (connectionId) url.searchParams.set('connectionId', connectionId);
     const auth = identity.signRelayAuth(role, connectionId ?? null);
     url.searchParams.set('ts', String(auth.ts));

package/server/lib/relay/host-client.test.js

@@ -39,11 +39,17 @@ const startFakeRelay = () => {
     clients: new Map(), // connectionId -> ws
     buffered: new Map(), // connectionId -> [[data, isBinary]] awaiting host-data
     relayFrames: [], // observed forwarded frames (for plaintext assertions)
+    apps: new Map(),
   };
 
   wss.on('connection', (ws, req) => {
     const url = new URL(req.url, 'http://localhost');
     const role = url.searchParams.get('role');
+    state.apps.set(role, {
+      appId: url.searchParams.get('appId'),
+      appVersion: url.searchParams.get('appVersion'),
+      platform: url.searchParams.get('platform'),
+    });
     const connectionId = url.searchParams.get('connectionId');
 
     if (role === 'host-control') {
@@ -101,6 +107,7 @@ const startFakeRelay = () => {
           // A socket a failed test left open would hold server.close() until
           // the hook timeout; drop them so a failure is reported once.
           for (const client of wss.clients) client.terminate();
+          server.closeAllConnections();
           wss.close();
           server.close(() => r());
         }),
@@ -286,6 +293,13 @@ describe('relay host-client integration', () => {
     });
 
     expect(result.status).toBe(200);
+    for (const role of ['host-control', 'host-data']) {
+      expect(relay.state.apps.get(role)).toEqual({
+        appId: 'aiworker',
+        appVersion: expect.stringMatching(/^\d+\.\d+\.\d+/),
+        platform: process.env.AIWORKER_RUNTIME || 'web',
+      });
+    }
     expect(result.body.ok).toBe(true);
     expect(result.body.relayConn).toBe('conn-test-1');
     expect(result.body.origin).toBe(`http://127.0.0.1:${origin.port}`);

package/server/lib/scheduled-tasks/DOCUMENTATION.md

@@ -25,6 +25,12 @@ in shared project config under the project write lock:
   from the winner's persisted `nextRunAt`.
 - Project config writes also take a cross-process `.json.lock` file so the
   read-modify-write is serialized across processes, not only within one process.
+- `syncAllProjects` (startup and every full resync) syncs each registered
+  project on its own: a project whose config cannot be read or written (a
+  broken file, a lock timeout) is logged with its id and skipped, and every
+  other project's tasks are still scheduled. Only `listProjects` failing
+  aborts the sync as a whole. `syncProject` for one project still throws, so
+  a route for that project reports the failure.
 - The sharing processes may run different AiWorker versions. Normalization
   keeps only the fields a build knows, so every writer persists tasks it did
   not change verbatim from disk and swaps only `state` onto a task whose state
@@ -63,7 +69,9 @@ in shared project config under the project write lock:
 - Claiming always writes `nextRunAt` (including `undefined`) so a past once-slot
   is cleared when there is no following occurrence.
 
-Manual `runNow` does not claim a schedule occurrence.
+Manual `runNow` does not claim a schedule occurrence. It also runs paused
+(`enabled: false`) tasks — that is the point of the button — while scheduled
+dispatches still skip disabled tasks, and completion never re-arms a paused task.
 
 ## Files
 

package/server/lib/scheduled-tasks/issue-2710-double-execution.test.js

@@ -485,4 +485,32 @@ describe('issue 2710: daily scheduled task double execution at the configured ti
 
     runtime.stop();
   });
+
+  it('manual runNow runs a paused task but does not schedule future runs', async () => {
+    vi.setSystemTime(UTC(2026, 0, 1, 14, 0, 0));
+    const task = { ...makeTask({ kind: 'daily', times: ['15:00'] }), enabled: false };
+    const projectConfigRuntime = createSharedProjectConfigRuntime(task);
+
+    const runtime = createScheduledTasksRuntime(createRuntimeDeps(projectConfigRuntime));
+    await runtime.start();
+
+    // The scheduler must not fire a disabled task on its own.
+    await vi.advanceTimersByTimeAsync(HOUR + 3_000);
+    expect(sdk.sessionCreates.length).toBe(0);
+
+    const manual = await runtime.runNow('p1', 'task-1');
+    expect(manual.ok).toBe(true);
+    expect(manual.sessionID).toBeTruthy();
+    expect(sdk.sessionCreates.length).toBe(1);
+    expect(runtime.getStatus().runningScheduledTasksCount).toBe(0);
+
+    // Completion records state but leaves the task paused with no next run.
+    const tasks = await projectConfigRuntime.listScheduledTasks('p1');
+    expect(tasks[0].enabled).toBe(false);
+    expect(tasks[0].state.lastStatus).toBe('success');
+    expect(tasks[0].state.lastSessionId).toBe('sess-1');
+    expect(tasks[0].state.nextRunAt).toBeUndefined();
+
+    runtime.stop();
+  });
 });

package/server/lib/scheduled-tasks/runtime.js

@@ -426,7 +426,16 @@ export const createScheduledTasksRuntime = (deps) => {
     }
 
     for (const projectID of activeProjectIDs) {
-      await syncProject(projectID);
+      try {
+        await syncProject(projectID);
+      } catch (error) {
+        // One project's config being unusable (a broken file, a lock timeout)
+        // must not keep every other project's tasks from being scheduled.
+        logger.warn?.('[ScheduledTasks] failed to sync project', {
+          projectID,
+          error: error?.message ?? String(error),
+        });
+      }
     }
   };
 
@@ -676,7 +685,8 @@ export const createScheduledTasksRuntime = (deps) => {
   const runTask = async (projectID, taskID, reason, scheduledFor) => {
     const taskMap = tasksByProject.get(projectID);
     const task = taskMap?.get(taskID);
-    if (!task || !task.enabled) {
+    // Manual runNow runs paused tasks too; only scheduled dispatches skip them.
+    if (!task || (reason !== 'manual' && !task.enabled)) {
       return { ok: false, skipped: true };
     }
 

package/server/lib/scheduled-tasks/runtime.test.js

@@ -206,3 +206,56 @@ Run daily.
     }
   });
 });
+
+describe('scheduled-tasks runtime syncAllProjects', () => {
+  it('keeps scheduling the other projects when one project cannot be synced', async () => {
+    const tempRoot = await mkdtemp(path.join(os.tmpdir(), 'oc-runtime-sync-all-'));
+    try {
+      const brokenPath = path.join(tempRoot, 'broken');
+      const healthyPath = path.join(tempRoot, 'healthy');
+      await mkdir(path.join(healthyPath, '.agents', 'loops'), { recursive: true });
+      await mkdir(brokenPath, { recursive: true });
+      await writeFile(path.join(healthyPath, '.agents', 'loops', 'daily.md'), `---
+name: daily
+schedule: "0 9 * * *"
+enabled: true
+model: openai/gpt-5
+---
+Run daily.
+`, 'utf8');
+
+      const projectConfigRuntime = createProjectConfigRuntime({
+        fsPromises: await import('fs/promises'),
+        path,
+        projectsDirPath: path.join(tempRoot, 'config'),
+        createTaskID: () => 'task-fixed-id',
+      });
+      await mkdir(path.join(tempRoot, 'config'), { recursive: true });
+      await writeFile(projectConfigRuntime.resolveProjectConfigPath('broken'), '{ not json', 'utf8');
+
+      const warnings = [];
+      const runtime = createScheduledTasksRuntime({
+        buildOpenCodeUrl: () => 'http://localhost',
+        getOpenCodeAuthHeaders: () => ({}),
+        waitForOpenCodeReady: async () => {},
+        projectConfigRuntime,
+        listProjects: async () => [
+          { id: 'broken', path: brokenPath },
+          { id: 'healthy', path: healthyPath },
+        ],
+        logger: { warn: (...args) => warnings.push(args) },
+      });
+
+      await expect(runtime.start()).resolves.toBeUndefined();
+
+      expect(runtime.getStatus().enabledScheduledTasksCount).toBe(1);
+      const healthyTasks = await projectConfigRuntime.listScheduledTasks('healthy');
+      expect(healthyTasks.map((task) => task.id)).toEqual(['loop:project:daily']);
+      expect(warnings).toHaveLength(1);
+      expect(warnings[0][1]).toMatchObject({ projectID: 'broken' });
+      runtime.stop();
+    } finally {
+      await rm(tempRoot, { recursive: true, force: true });
+    }
+  });
+});