@app-vitals/agent-runtime 1.2.3 → 1.2.5

package/Dockerfile

@@ -54,7 +54,10 @@ FROM oven/bun:1.4.4-slim@sha256:1846adf22496bd711036aae8be147e57bdebbaea2e5264e3
 #     package set as full `chromium` on this OS.
 #     oven/bun:1.4.4-slim is Debian trixie (13) — see node-source stage comment above
 #     — hence the t64-suffixed package names (Debian's 64-bit time_t transition).
-RUN apt-get update && apt-get install -y --no-install-recommends \
+# Upgrade apt/libapt-pkg7.0 past the base image's 3.0.3 (Trivy HIGH CVE-2026-109518, fixed in 3.0.4).
+RUN apt-get update \
+    && apt-get install -y --only-upgrade apt libapt-pkg7.0 \
+    && apt-get install -y --no-install-recommends \
     git \
     curl \
     ca-certificates \
@@ -129,13 +132,20 @@ RUN curl -fsSL -o /tmp/mise-install.sh https://mise.run \
 # deb.nodesource.com (see that stage's comment).
 COPY --from=node-source /usr/local/bin/node /usr/local/bin/node
 COPY --from=node-source /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/npm
+# The npm copied from node-source bundles vulnerable undici/brace-expansion, so
+# upgrade it in place before installing anything with it. npm 12 blocks install
+# scripts by default, so Claude Code's postinstall (native binary) is allowed explicitly.
+# renovate: datasource=npm depName=npm
+ARG NPM_VERSION=12.2.2
 # renovate: datasource=npm depName=@anthropic-ai/claude-code
 ARG CLAUDE_CODE_VERSION=2.1.292
 # The trailing check fails the build if the installed CLI doesn't report exactly
 # the pinned version (e.g. a registry/tag mismatch), so a drifted image can't ship.
 RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
     && ln -s /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \
-    && npm install -g @anthropic-ai/claude-code@${CLAUDE_CODE_VERSION} \
+    && npm install -g npm@${NPM_VERSION} \
+    && test "$(npm --version)" = "${NPM_VERSION}" \
+    && npm install -g --allow-scripts=@anthropic-ai/claude-code @anthropic-ai/claude-code@${CLAUDE_CODE_VERSION} \
     && INSTALLED="$(claude --version)" \
     && echo "claude --version: ${INSTALLED}" \
     && case "${INSTALLED}" in \
@@ -150,6 +160,32 @@ RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
 # from process.env, so spawned claude processes inherit it.
 ENV DISABLE_AUTOUPDATER=1
 
+# ─── Production dependencies ──────────────────────────────────────────────────
+# Production-only install: the runtime stage copies node_modules from here, so
+# devDependencies (semantic-release → handlebars, the TypeScript native `tsc`
+# binary, a nested npm, biome) never ship in the image. Same manifests as the
+# build stage; admin/prisma is needed because admin's postinstall runs
+# `prisma generate`.
+
+FROM base AS prod-deps
+
+WORKDIR /app
+
+COPY package.json bunfig.toml bun.lock* ./
+COPY runtime/package.json ./runtime/
+COPY admin/package.json ./admin/
+COPY admin/prisma ./admin/prisma/
+COPY admin/prisma.config.ts ./admin/
+COPY lib/package.json ./lib/
+COPY patches/ ./patches/
+
+# typescript is only an optional peer of prisma / @prisma/client, but bun still
+# links it (and its native tsc binary) into the store because the lockfile
+# carries it; nothing at runtime loads it, so drop it.
+RUN if [ -f bun.lock ]; then bun install --frozen-lockfile --production; else bun install --production; fi \
+    && rm -rf node_modules/.bun/typescript@* node_modules/.bun/@typescript+* \
+              node_modules/.bun/node_modules/typescript node_modules/.bun/node_modules/@typescript
+
 # ─── Build stage ──────────────────────────────────────────────────────────────
 
 FROM base AS build
@@ -215,7 +251,7 @@ ENV HOME=/home/bun
 # routes push through signed-push.
 ENV PATH="/home/bun/.local/share/mise/shims:/app/scripts/bin:${PATH}"
 
-COPY --from=build --chown=1000:1000 /app/node_modules ./node_modules
+COPY --from=prod-deps --chown=1000:1000 /app/node_modules ./node_modules
 COPY --from=build --chown=1000:1000 /app/runtime ./runtime
 COPY --from=build --chown=1000:1000 /app/admin ./admin
 COPY --from=build --chown=1000:1000 /app/lib ./lib

package/base-image-contract.smoke.test.ts

@@ -14,7 +14,13 @@
  */
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import {
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
@@ -146,4 +152,37 @@ describe.skipIf(!BASE_IMAGE)("agent base-image contract", () => {
       "/app/scripts/bin/git",
     ]);
   }, 60_000);
+
+  test("runtime image ships no devDependency-only packages and keeps the Prisma client", () => {
+    const run = docker([
+      "run",
+      "--rm",
+      "--entrypoint",
+      "bash",
+      DERIVED_TAG,
+      "-c",
+      'test -d /app/admin/prisma/client && test -z "$(find /app/node_modules/.bun -maxdepth 1 \\( -name "handlebars@*" -o -name "typescript@*" -o -name "@typescript+*" -o -name "semantic-release@*" -o -name "@biomejs+*" -o -name "npm@*" \\))"',
+    ]);
+    expect(run.exitCode, run.stdout + run.stderr).toBe(0);
+  }, 60_000);
+});
+
+// Static guard (no Docker needed): the runtime stage must take node_modules
+// from the production-only stage, never the build stage's full install.
+describe("runtime Dockerfile", () => {
+  const dockerfile = readFileSync(
+    join(import.meta.dir, "Dockerfile"),
+    "utf8",
+  );
+
+  test("copies node_modules from the production-only stage", () => {
+    expect(dockerfile).toMatch(
+      /^COPY --from=prod-deps\b.*\/app\/node_modules \.\/node_modules$/m,
+    );
+    expect(dockerfile).not.toMatch(
+      /^COPY --from=build\b.*\/app\/node_modules\b/m,
+    );
+    expect(dockerfile).toMatch(/^FROM base AS prod-deps$/m);
+    expect(dockerfile).toMatch(/bun install --frozen-lockfile --production/);
+  });
 });

package/boot.ts

@@ -63,6 +63,7 @@ import {
   HttpCronRunReporter,
   NoopCronRunReporter,
 } from "./cron-run-reporter.ts";
+import { reconcileCronTasks, type ScheduledEntry } from "./cron-sync.ts";
 import { markdownToSlack } from "./format.ts";
 import { buildGitHubAuthDeps } from "./github-auth-deps.ts";
 import {
@@ -728,7 +729,10 @@ export async function startAgent(
 
   // ─── Step 6: Cron sync loop ───────────────────────────────────────────────────
 
-  const cronTasks = new Map<string, ReturnType<typeof nodeCron.schedule>>();
+  const cronTasks = new Map<
+    string,
+    ScheduledEntry<ReturnType<typeof nodeCron.schedule>>
+  >();
 
   if (runtimeClient && agentId) {
     // Run-now requests (COS-42.1): honoured at most once each, in memory.
@@ -799,7 +803,7 @@ export async function startAgent(
       // kind (loop vs. generic). See planCronSchedule in agent-extension.ts and
       // the coding extension's loop-cron-classifier.ts for the full decision.
       const scheduled = planCronSchedule(extension, jobs);
-      const desired = new Map(scheduled.map((entry) => [entry.job.id, entry]));
+      const desired = new Set(scheduled.map((entry) => entry.job.id));
       dispatchKinds = new Map(
         scheduled.map((entry) => [entry.job.id, entry.dispatch]),
       );
@@ -808,54 +812,43 @@ export async function startAgent(
       // Only scheduled (enabled) jobs: a manually disabled cron is not run.
       void honourRunNow(jobs.filter((job) => desired.has(job.id)));
 
-      // Cancel removed/disabled jobs
-      for (const [id, task] of cronTasks) {
-        if (!desired.has(id)) {
-          task.stop();
-          cronTasks.delete(id);
-          console.log(`[cron-sync] unscheduled ${id}`);
-        }
-      }
-
-      // Schedule new jobs
-      for (const [id, entry] of desired) {
-        if (!cronTasks.has(id)) {
-          const { job, dispatch } = entry;
-          const task = nodeCron.schedule(job.schedule, async () => {
-            console.log(`[cron] firing job ${id}`);
-            try {
-              if (dispatch === "loop") {
-                if (!extension.dispatchLoop) {
-                  throw new Error(
-                    `cron job ${id} classified as loop but the agent extension has no dispatchLoop`,
-                  );
-                }
-                await extension.dispatchLoop(id);
-              } else {
-                await handleCronRequest(
-                  {
-                    jobId: id,
-                    prompt: job.prompt,
-                    channel: job.channel ?? undefined,
-                    user: job.user ?? undefined,
-                    silent: job.silent,
-                    preCheck: job.preCheck ?? undefined,
-                  },
-                  cronDeps,
+      // Unschedule removed/disabled jobs, schedule new ones, and reschedule any
+      // job whose schedule, prompt, channel, user, silent, preCheck or dispatch
+      // kind changed since the last tick.
+      reconcileCronTasks(cronTasks, scheduled, (job, dispatch) => {
+        const id = job.id;
+        return nodeCron.schedule(job.schedule, async () => {
+          console.log(`[cron] firing job ${id}`);
+          try {
+            if (dispatch === "loop") {
+              if (!extension.dispatchLoop) {
+                throw new Error(
+                  `cron job ${id} classified as loop but the agent extension has no dispatchLoop`,
                 );
               }
-            } catch (err) {
-              await reportCronFailure(id, err, {
-                cronRunReporter: cronRunReporter ?? new NoopCronRunReporter(),
-                sentryClient: process.env.SENTRY_DSN ? Sentry : undefined,
-                clock: SystemClock(),
-              });
+              await extension.dispatchLoop(id);
+            } else {
+              await handleCronRequest(
+                {
+                  jobId: id,
+                  prompt: job.prompt,
+                  channel: job.channel ?? undefined,
+                  user: job.user ?? undefined,
+                  silent: job.silent,
+                  preCheck: job.preCheck ?? undefined,
+                },
+                cronDeps,
+              );
             }
-          });
-          cronTasks.set(id, task);
-          console.log(`[cron-sync] scheduled ${id} (${job.schedule})`);
-        }
-      }
+          } catch (err) {
+            await reportCronFailure(id, err, {
+              cronRunReporter: cronRunReporter ?? new NoopCronRunReporter(),
+              sentryClient: process.env.SENTRY_DSN ? Sentry : undefined,
+              clock: SystemClock(),
+            });
+          }
+        });
+      });
     }
 
     void syncCrons();
@@ -940,7 +933,7 @@ export async function startAgent(
     markSlackDisconnected(slackClock);
 
     // Stop cron tasks so no new Claude work fires during drain
-    for (const [id, task] of cronTasks) {
+    for (const [id, { task }] of cronTasks) {
       task.stop();
       console.log(`[agent] cron unscheduled on shutdown: ${id}`);
     }

package/cron-sync.ts

@@ -0,0 +1,81 @@
+/**
+ * runtime/cron-sync.ts
+ * Reconciles scheduled cron tasks against the desired job list on each sync
+ * tick. A job whose schedule, prompt, channel, user, silent, preCheck or
+ * dispatch kind changed is stopped and rescheduled; unchanged jobs are left
+ * alone. The scheduler is injected so the logic is testable without node-cron.
+ */
+
+import type {
+  CronDispatchKind,
+  ExtensionCronJob,
+  ScheduledCronJob,
+} from "./agent-extension.ts";
+
+export interface SyncableCronJob extends ExtensionCronJob {
+  schedule: string;
+  prompt: string;
+  channel: string | null;
+  user: string | null;
+  silent: boolean;
+  preCheck: string | null;
+}
+
+export interface StoppableTask {
+  stop(): void;
+}
+
+export interface ScheduledEntry<TTask extends StoppableTask> {
+  task: TTask;
+  signature: string;
+}
+
+/** Everything that, when edited, must take effect on the next sync tick. */
+export function cronSignature(
+  job: SyncableCronJob,
+  dispatch: CronDispatchKind,
+): string {
+  return JSON.stringify([
+    job.schedule,
+    job.prompt,
+    job.channel,
+    job.user,
+    job.silent,
+    job.preCheck,
+    dispatch,
+  ]);
+}
+
+export function reconcileCronTasks<
+  TJob extends SyncableCronJob,
+  TTask extends StoppableTask,
+>(
+  scheduled: Map<string, ScheduledEntry<TTask>>,
+  desired: ScheduledCronJob<TJob>[],
+  schedule: (job: TJob, dispatch: CronDispatchKind) => TTask,
+  log: (message: string) => void = console.log,
+): void {
+  const desiredIds = new Set(desired.map((entry) => entry.job.id));
+
+  for (const [id, existing] of scheduled) {
+    if (!desiredIds.has(id)) {
+      existing.task.stop();
+      scheduled.delete(id);
+      log(`[cron-sync] unscheduled ${id}`);
+    }
+  }
+
+  for (const { job, dispatch } of desired) {
+    const signature = cronSignature(job, dispatch);
+    const existing = scheduled.get(job.id);
+    if (existing?.signature === signature) continue;
+
+    existing?.task.stop();
+    scheduled.set(job.id, { task: schedule(job, dispatch), signature });
+    log(
+      existing
+        ? `[cron-sync] rescheduled ${job.id} (${job.schedule})`
+        : `[cron-sync] scheduled ${job.id} (${job.schedule})`,
+    );
+  }
+}

package/cron-sync.unit.test.ts

@@ -0,0 +1,126 @@
+/**
+ * runtime/cron-sync.unit.test.ts
+ * Reconcile logic for the 60s cron sync tick, with a fake scheduler.
+ */
+
+import { describe, expect, it } from "bun:test";
+import type { CronDispatchKind } from "./agent-extension.ts";
+import {
+  reconcileCronTasks,
+  type ScheduledEntry,
+  type SyncableCronJob,
+} from "./cron-sync.ts";
+
+function job(over: Partial<SyncableCronJob> = {}): SyncableCronJob {
+  return {
+    id: "job-1",
+    name: "Job",
+    enabled: true,
+    parentCronId: null,
+    schedule: "0 * * * *",
+    prompt: "do it",
+    channel: "C1",
+    user: "U1",
+    silent: false,
+    preCheck: null,
+    ...over,
+  };
+}
+
+function harness() {
+  const created: { id: string; schedule: string; stopped: boolean }[] = [];
+  const logs: string[] = [];
+  const scheduled = new Map<string, ScheduledEntry<{ stop(): void }>>();
+  const schedule = (j: SyncableCronJob) => {
+    const rec = { id: j.id, schedule: j.schedule, stopped: false };
+    created.push(rec);
+    return {
+      stop() {
+        rec.stopped = true;
+      },
+    };
+  };
+  const tick = (
+    jobs: SyncableCronJob[],
+    dispatch: CronDispatchKind = "generic",
+  ) =>
+    reconcileCronTasks(
+      scheduled,
+      jobs.map((j) => ({ job: j, dispatch })),
+      schedule,
+      (m) => logs.push(m),
+    );
+  return { created, logs, scheduled, tick };
+}
+
+describe("reconcileCronTasks", () => {
+  it("schedules a new job", () => {
+    const h = harness();
+    h.tick([job()]);
+    expect(h.created).toHaveLength(1);
+    expect(h.logs).toEqual(["[cron-sync] scheduled job-1 (0 * * * *)"]);
+  });
+
+  it("does not reschedule an unchanged job", () => {
+    const h = harness();
+    h.tick([job()]);
+    h.tick([job()]);
+    expect(h.created).toHaveLength(1);
+    expect(h.created[0]?.stopped).toBe(false);
+  });
+
+  it("reschedules when the schedule changes", () => {
+    const h = harness();
+    h.tick([job()]);
+    h.tick([job({ schedule: "*/5 * * * *" })]);
+    expect(h.created).toHaveLength(2);
+    expect(h.created[0]?.stopped).toBe(true);
+    expect(h.created[1]?.schedule).toBe("*/5 * * * *");
+    expect(h.logs.at(-1)).toContain("[cron-sync] rescheduled job-1");
+  });
+
+  it("reschedules on a prompt-only change", () => {
+    const h = harness();
+    h.tick([job()]);
+    h.tick([job({ prompt: "new prompt" })]);
+    expect(h.created).toHaveLength(2);
+    expect(h.created[0]?.stopped).toBe(true);
+    expect(h.created[1]?.stopped).toBe(false);
+  });
+
+  it("reschedules when channel, user, silent or preCheck change", () => {
+    const h = harness();
+    h.tick([job()]);
+    h.tick([job({ channel: "C2" })]);
+    h.tick([job({ channel: "C2", user: "U2" })]);
+    h.tick([job({ channel: "C2", user: "U2", silent: true })]);
+    h.tick([job({ channel: "C2", user: "U2", silent: true, preCheck: "x" })]);
+    expect(h.created).toHaveLength(5);
+  });
+
+  it("reschedules when the dispatch kind changes", () => {
+    const h = harness();
+    h.tick([job()], "generic");
+    h.tick([job()], "loop");
+    expect(h.created).toHaveLength(2);
+    expect(h.created[0]?.stopped).toBe(true);
+  });
+
+  it("unschedules a disabled job (absent from desired)", () => {
+    const h = harness();
+    h.tick([job()]);
+    h.tick([]);
+    expect(h.created[0]?.stopped).toBe(true);
+    expect(h.scheduled.size).toBe(0);
+    expect(h.logs.at(-1)).toBe("[cron-sync] unscheduled job-1");
+  });
+
+  it("unschedules a deleted job without touching its siblings", () => {
+    const h = harness();
+    h.tick([job(), job({ id: "job-2" })]);
+    h.tick([job({ id: "job-2" })]);
+    expect(h.created.find((c) => c.id === "job-1")?.stopped).toBe(true);
+    expect(h.created.find((c) => c.id === "job-2")?.stopped).toBe(false);
+    expect([...h.scheduled.keys()]).toEqual(["job-2"]);
+  });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@app-vitals/agent-runtime",
-  "version": "1.2.3",
+  "version": "1.2.5",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/app-vitals/agent.git",
@@ -40,8 +40,8 @@
     "./workspace-paths": "./workspace-paths.ts"
   },
   "dependencies": {
-    "@app-vitals/agent-admin": "1.2.3",
-    "@app-vitals/agent-lib": "1.2.3",
+    "@app-vitals/agent-admin": "1.2.5",
+    "@app-vitals/agent-lib": "1.2.5",
     "@octokit/auth-app": "^8.2.0",
     "@sentry/bun": "^10.63.0",
     "@slack/bolt": "^5.0.0",