@inetafrica/open-claudia 3.0.2 → 3.0.4

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## v3.0.4 — surviving the second mount, keeping the crons
+
+- **A Kubernetes PVC remount no longer crashloops the bot.** The migration snapshot validator demanded exact owner-only modes (`0700` dirs, `0600` files). But kubelet's fsGroup ownership pass ORs group `rwX` + setgid onto every file and directory each time the volume is mounted — so the first v3 boot passed (snapshot created after the mount), and the **second pod recreation** hit `INVALID_MIGRATION_SNAPSHOT: migration snapshot has unsafe permissions` at boot and went CrashLoopBackOff. Every v3 pod on an fsGroup-mounted PVC was one recreation away from this (euvy hit it live on 2026-07-12 and needed a manual chmod rescue). Validation now rejects only world-access bits — group access is the pod's own supplemental group, not an exposure — while snapshots are still *created* `0700`/`0600`.
+- **Legacy crons adopt your saved defaults instead of dying in the archive.** Pre-provider-aware jobs carried no pinned provider or project — they fired with whatever the bot had active — so the v3 migration classified every one of them "no unambiguous project" and archive-disabled it, silently killing real production crons (euvy's 6-hourly Airbyte data-sync among them). The jobs migration now looks up the owning user's saved state (`settings.backend` and `currentSession` name/dir, in both the v3 `users` shape and the pre-v3 global shape), adopts those as the job's provider/project, and marks the record `legacyDefaultsApplied` — preserving the old fire-time behaviour instead of erasing it. Jobs pinned to a removed provider (Cursor) keep their pin, stay archived, and are never reassigned; a job whose owner has no saved defaults still archives safely.
+- **Re-reading the jobs store no longer rewrites stored nulls.** `Number(null)` is `0`, so the re-migration pass that runs on every read flipped `nextAttemptAt`/`lastFireAt` from `null` to epoch-`0` — harmless at runtime but a silent mutation on every load. Migration output is now byte-stable across passes.
+- **Agent-space / OpenClaw:** no new deps, no new env, no schema change; Docker image builds identically. New hermetic probes: fsGroup-mode tolerance (group bits pass, world bits still refused) in `test-provider-migration-backup.js`; legacy-defaults adoption, v2/v3 state shapes, Cursor guard, and migration idempotency in `test-provider-scheduler.js`.
+
+## v3.0.3 — the lock-holder stands its ground
+
+- **A persistent 409 no longer restarts the bot.** v3.0.1 taught the poller to ride out short 409 conflicts but still `exit(1)` once a conflict outlived 2 minutes, on the theory that the survivor had to be a real second instance. In practice the rogue poller is lock-blind — a debugger-run dev checkout, a copy on another config dir, or another host on the same token — so the exit killed the *legitimate*, lock-holding service and launchd respawned it straight back into the same fight (five boot→409→exit cycles on 2026-07-12). The poller now never exits over a 409: it pauses 15s per retry, slows to 60s once the streak passes 2 minutes, sends the owner a throttled Telegram alert (max one per hour) naming the likely culprits, and posts an all-clear once the rogue goes away.
+- **The single-instance lock is atomic.** Acquisition was read-check-then-write, so two processes booting together (a launchd respawn racing a manual start) could both judge the lock stale and both claim it — each believing it was the only copy. The lock is now claimed with an exclusive-create (`O_EXCL`) in a bounded retry loop: stale, corrupt, or own-pid locks are unlinked and re-claimed atomically, a live holder still turns the newcomer away, and a process that loses every claim attempt refuses to boot rather than assuming ownership.
+- **Agent-space / OpenClaw:** no new deps, no new env, no schema change; Docker image builds identically. `test-telegram-409-grace.js` now proves the never-exit + owner-alert + all-clear path; `test-single-instance.js` passes unchanged against the atomic rewrite.
+
 ## v3.0.2 — honest context numbers, dream summaries that arrive
 
 - **The context warning counts the window again, not the bill.** The v3.0.0 provider rewrite computed the live context number from the provider's *cumulative* turn usage — every tool round-trip re-counted the cached prompt prefix, so a normal turn read as 347k+ "context" (crossing 1M on busy turns), spooked the usage alert, and could prematurely force-compact sessions whose real window was fine. The number now tracks the **peak single API call** in the turn (`peakContextTokens` over per-call usage events) — true window occupancy, the same semantics v2 reported (~160k on a heavy turn). Billing is untouched: ledger records keep the cumulative figure in `billedContextTokens`, and API-reported spend was never affected (v3 bills the same or less than v2 — the display was wrong, not the meter). The usage alert says "Context this turn" whenever the peak is available.

package/bot.js

@@ -22,10 +22,10 @@ ensureRuntimeDirectories();
 const { acquireSingleInstanceLock } = require("./core/single-instance");
 const instanceLock = acquireSingleInstanceLock({ configDir: CONFIG_DIR });
 if (!instanceLock.acquired) {
-  const h = instanceLock.holder;
+  const h = instanceLock.holder || {};
   console.error(
     `Another Open Claudia instance already owns ${CONFIG_DIR} ` +
-    `(pid ${h.pid}, started ${h.startedAt || "?"}, ${h.entrypoint || "unknown entrypoint"}). Exiting. ` +
+    `(pid ${h.pid || "?"}, started ${h.startedAt || "?"}, ${h.entrypoint || "unknown entrypoint"}). Exiting. ` +
     "Stop it first (launchctl stop com.claude-telegram-bot), or give a dev run its own OPEN_CLAUDIA_CONFIG_DIR."
   );
   process.exit(1);

package/channels/telegram/adapter.js

@@ -41,6 +41,8 @@ class TelegramAdapter {
     this._conflictSince = 0;         // start of the current 409 streak
     this._conflictTimer = null;      // pending paused retry after a 409
     this._conflictClearTimer = null; // quiet after a retry ⇒ streak over
+    this._conflictAlertAt = 0;       // last owner alert about a rogue poller (throttle: 1/h)
+    this._conflictAlerted = false;   // current streak already alerted ⇒ send the all-clear
     this._wireInbound();
   }
 
@@ -142,23 +144,31 @@ class TelegramAdapter {
     }, 30000);
   }
 
-  // Telegram 409s a getUpdates call while ANOTHER one holds the token. Two
-  // causes: a ghost long-poll left by an uncleanly-killed predecessor (clears
-  // within its ≤30s poll timeout), or a genuinely running second instance.
-  // Exiting on the first 409 turned the ghost case into a KeepAlive respawn
-  // storm (7 boot→409→die cycles on 2026-07-12). So: pause, retry inside a
-  // grace window, and exit only if the conflict outlives it — that really is
-  // a second instance, and the supervisor's throttled respawns pace the rest.
+  // Telegram 409s a getUpdates call while ANOTHER one holds the token: a
+  // ghost long-poll left by an uncleanly-killed predecessor (clears within
+  // its ≤30s poll timeout), or a genuinely running second poller. We hold
+  // the single-instance lock, so WE are the legitimate copy — the rogue is
+  // lock-blind (a pre-lock process, a checkout on another CONFIG_DIR, or
+  // another host on the same token). Exiting here just handed launchd a
+  // respawn into the same fight (the 5-boot storm of 2026-07-12), so we
+  // never exit: pause, retry, and once the streak outlives the ghost window
+  // slow to 60s retries and alert the owner (max 1/hour) until it clears.
   _on409Conflict() {
     const now = Date.now();
     if (!this._conflictSince) this._conflictSince = now;
     if (this._conflictClearTimer) { clearTimeout(this._conflictClearTimer); this._conflictClearTimer = null; }
-    if (now - this._conflictSince > 120000) {
-      console.error("Another instance is polling (409 persisted >2min). Exiting.");
-      process.exit(1);
+    const persisted = now - this._conflictSince > 120000;
+    if (persisted && this.ownerChatId && now - this._conflictAlertAt > 3600000) {
+      this._conflictAlertAt = now;
+      this._conflictAlerted = true;
+      Promise.resolve(this.bot.sendMessage(
+        this.ownerChatId,
+        "⚠️ Another poller has held my Telegram token for over 2 minutes — likely a dev checkout, a debugger run, or another host using this token. I hold the instance lock, so I'm staying up and retrying every 60s; messages may lag until it stops.",
+      )).catch(() => {});
     }
     if (this._conflictTimer) return; // a paused retry is already queued
-    console.error("409 Conflict: another poller holds this token — pausing 15s (ghost polls clear in <1min; exiting only if this persists >2min).");
+    const pauseMs = persisted ? 60000 : 15000;
+    console.error(`409 Conflict: another poller holds this token — pausing ${Math.round(pauseMs / 1000)}s, then retrying (we hold the instance lock; never exiting).`);
     // Stop hammering now; the timer below dials back in.
     Promise.resolve(this.bot.stopPolling({ cancel: true, reason: "409 conflict backoff" })).catch(() => {});
     this._conflictTimer = setTimeout(async () => {
@@ -168,8 +178,14 @@ class TelegramAdapter {
       this._conflictClearTimer = setTimeout(() => {
         this._conflictClearTimer = null;
         this._conflictSince = 0;
+        if (this._conflictAlerted) {
+          this._conflictAlerted = false;
+          if (this.ownerChatId) {
+            Promise.resolve(this.bot.sendMessage(this.ownerChatId, "✅ The competing Telegram poller is gone — normal polling resumed.")).catch(() => {});
+          }
+        }
       }, 45000);
-    }, 15000);
+    }, pauseMs);
   }
 
   _wireInbound() {

package/core/jobs.js

@@ -46,6 +46,14 @@ function clone(value) {
   return value === undefined ? undefined : structuredClone(value);
 }
 
+// Number(null) is 0, so a bare Number.isFinite gate rewrites stored nulls to
+// epoch timestamps on every re-migration pass.
+function finiteTimeOrNull(value) {
+  if (value === null || value === undefined) return null;
+  const number = Number(value);
+  return Number.isFinite(number) ? number : null;
+}
+
 function occurrenceId(job, options = {}) {
   if (nonEmpty(job.occurrenceId)) return nonEmpty(job.occurrenceId);
   const factory = options.occurrenceIdFactory || (() => (
@@ -155,9 +163,9 @@ function normalizeRunnableJob(record, options = {}) {
     disabled,
     attemptCount,
     maxAttempts,
-    nextAttemptAt: Number.isFinite(Number(record.nextAttemptAt)) ? Number(record.nextAttemptAt) : null,
+    nextAttemptAt: finiteTimeOrNull(record.nextAttemptAt),
     createdAt,
-    lastFireAt: Number.isFinite(Number(record.lastFireAt)) ? Number(record.lastFireAt) : null,
+    lastFireAt: finiteTimeOrNull(record.lastFireAt),
     lastFireOk: typeof record.lastFireOk === "boolean" ? record.lastFireOk : null,
     lastError: isRecord(record.lastError) ? clone(record.lastError) : null,
   };
@@ -169,6 +177,66 @@ function normalizeRunnableJob(record, options = {}) {
   return normalized;
 }
 
+function readLegacyStateUsers(options = {}) {
+  if (options._legacyStateUsers !== undefined) return options._legacyStateUsers;
+  let users = null;
+  try {
+    if (!options.stateFile) throw new Error("no state file wired");
+    const raw = JSON.parse(fs.readFileSync(options.stateFile, "utf8"));
+    if (isRecord(raw)) {
+      // v3 state is { schemaVersion, users: { "<canonicalUserId>": {...} } };
+      // the pre-v3 file was one global user state at the top level.
+      users = isRecord(raw.users) ? raw.users : { "": raw };
+    }
+  } catch (_) {}
+  options._legacyStateUsers = users;
+  return users;
+}
+
+function legacyStateDefaultsFor(record, options = {}) {
+  const users = readLegacyStateUsers(options);
+  if (!users) return null;
+  const canonicalUserId = nonEmpty(record.canonicalUserId) || nonEmpty(options.defaultCanonicalUserId);
+  const user = (canonicalUserId && isRecord(users[canonicalUserId]) ? users[canonicalUserId] : null)
+    || (isRecord(users[""]) ? users[""] : null);
+  if (!user) return null;
+  const provider = nonEmpty(user.settings?.backend)?.toLowerCase() || null;
+  const session = isRecord(user.currentSession) ? user.currentSession : {};
+  return {
+    provider: provider && RUNNABLE_PROVIDERS.has(provider) ? provider : null,
+    project: nonEmpty(session.name),
+    projectDir: nonEmpty(session.dir),
+  };
+}
+
+// Pre-provider-aware jobs fired with whatever provider and project the bot had
+// active at fire time. Adopting the owning user's saved defaults preserves
+// that behaviour instead of archive-disabling every legacy cron. Jobs pinned
+// to a removed provider (Cursor) keep their pin and still archive.
+function applyLegacyDefaults(record, options = {}) {
+  if (!isRecord(record)) return record;
+  const provider = legacyProvider(record);
+  if (provider === "cursor") return record;
+  const hasProvider = !!provider;
+  const hasProject = !!nonEmpty(record.project);
+  if (hasProvider && hasProject) return record;
+  const defaults = legacyStateDefaultsFor(record, options);
+  if (!defaults) return record;
+  const next = clone(record);
+  let applied = false;
+  if (!hasProvider && defaults.provider) {
+    next.provider = defaults.provider;
+    applied = true;
+  }
+  if (!hasProject && defaults.project) {
+    next.project = defaults.project;
+    if (!nonEmpty(next.projectDir) && defaults.projectDir) next.projectDir = defaults.projectDir;
+    applied = true;
+  }
+  if (applied) next.legacyDefaultsApplied = true;
+  return next;
+}
+
 function migrationReason(record, options = {}) {
   const provider = legacyProvider(record);
   if (provider === "cursor") return "Pinned to removed provider Cursor Agent";
@@ -194,16 +262,18 @@ function normalizeArchived(record, options = {}) {
 }
 
 function migrateJobsDocument(raw, options = {}) {
-  const source = isRecord(raw) && raw.schemaVersion === JOBS_SCHEMA_VERSION
-    ? raw
-    : { jobs: Array.isArray(raw) ? raw : [], archived: [] };
+  const legacySource = !(isRecord(raw) && raw.schemaVersion === JOBS_SCHEMA_VERSION);
+  const source = legacySource
+    ? { jobs: Array.isArray(raw) ? raw : [], archived: [] }
+    : raw;
   const jobs = [];
   const archived = [];
 
   for (const record of Array.isArray(source.jobs) ? source.jobs : []) {
-    const normalized = normalizeRunnableJob(record, options);
+    const candidate = legacySource ? applyLegacyDefaults(record, options) : record;
+    const normalized = normalizeRunnableJob(candidate, options);
     if (normalized) jobs.push(normalized);
-    else archived.push(archiveLegacyJob(record, migrationReason(record, options), options));
+    else archived.push(archiveLegacyJob(candidate, migrationReason(candidate, options), options));
   }
   for (const record of Array.isArray(source.archived) ? source.archived : []) {
     const normalized = normalizeArchived(record, options);
@@ -281,6 +351,7 @@ function createJobsStore(options = {}) {
     defaultChannelId: defaults.channelId,
     defaultAdapter: defaults.adapter,
     defaultAdapterType: defaults.adapterType,
+    stateFile: options.stateFile || path.join(configDir, path.basename(STATE_FILE)),
     now: options.now,
     occurrenceIdFactory: options.occurrenceIdFactory,
   });

package/core/migration-backup.js

@@ -107,8 +107,13 @@ function assertRegularFile(filePath, code, label) {
   return stat;
 }
 
-function assertPrivateMode(stat, expectedMask, code, label) {
-  if (process.platform !== "win32" && (stat.mode & 0o777) !== expectedMask) {
+function assertPrivateMode(stat, code, label) {
+  // Kubernetes fsGroup ownership management ORs group rw(x) + setgid onto
+  // every file and directory each time the volume is mounted, so an exact
+  // owner-only mode check crashloops the second boot on any fsGroup-mounted
+  // PVC. Group access is the pod's own supplemental group; only world access
+  // is a real exposure.
+  if (process.platform !== "win32" && (stat.mode & 0o007) !== 0) {
     throw migrationError(code, `${label} has unsafe permissions`);
   }
 }
@@ -596,18 +601,18 @@ function validateMigrationSnapshot(snapshotDir, options = {}) {
   if (!snapshotStat.isDirectory() || snapshotStat.isSymbolicLink()) {
     throw migrationError("INVALID_MIGRATION_SNAPSHOT", "migration snapshot must be a real directory");
   }
-  assertPrivateMode(snapshotStat, 0o700, "INVALID_MIGRATION_SNAPSHOT", "migration snapshot");
+  assertPrivateMode(snapshotStat, "INVALID_MIGRATION_SNAPSHOT", "migration snapshot");
   const originalsStat = fs.lstatSync(path.join(resolvedSnapshot, "originals"));
   if (!originalsStat.isDirectory() || originalsStat.isSymbolicLink()) {
     throw migrationError("INVALID_MIGRATION_SNAPSHOT", "migration originals directory is invalid");
   }
-  assertPrivateMode(originalsStat, 0o700, "INVALID_MIGRATION_SNAPSHOT", "migration originals directory");
+  assertPrivateMode(originalsStat, "INVALID_MIGRATION_SNAPSHOT", "migration originals directory");
   const manifestPath = path.join(resolvedSnapshot, MANIFEST_FILE);
   const hashPath = path.join(resolvedSnapshot, MANIFEST_HASH_FILE);
   const manifestStat = assertRegularFile(manifestPath, "INVALID_MIGRATION_MANIFEST", "migration manifest");
   const manifestHashStat = assertRegularFile(hashPath, "INVALID_MIGRATION_MANIFEST", "migration manifest checksum");
-  assertPrivateMode(manifestStat, 0o600, "INVALID_MIGRATION_MANIFEST", "migration manifest");
-  assertPrivateMode(manifestHashStat, 0o600, "INVALID_MIGRATION_MANIFEST", "migration manifest checksum");
+  assertPrivateMode(manifestStat, "INVALID_MIGRATION_MANIFEST", "migration manifest");
+  assertPrivateMode(manifestHashStat, "INVALID_MIGRATION_MANIFEST", "migration manifest checksum");
   const manifestBytes = fs.readFileSync(manifestPath);
   const expectedManifestHash = fs.readFileSync(hashPath, "utf8").trim();
   if (!/^[a-f0-9]{64}$/.test(expectedManifestHash) || sha256(manifestBytes) !== expectedManifestHash) {
@@ -625,7 +630,7 @@ function validateMigrationSnapshot(snapshotDir, options = {}) {
     }
     if (!fs.existsSync(filePath)) throw migrationError("BACKUP_CHECKSUM_MISMATCH", `backup file is missing: ${entry.path}`);
     const stat = assertRegularFile(filePath, "BACKUP_CHECKSUM_MISMATCH", `backup file ${entry.path}`);
-    assertPrivateMode(stat, 0o600, "BACKUP_CHECKSUM_MISMATCH", `backup file ${entry.path}`);
+    assertPrivateMode(stat, "BACKUP_CHECKSUM_MISMATCH", `backup file ${entry.path}`);
     const bytes = fs.readFileSync(filePath);
     if (stat.size !== entry.size || bytes.length !== entry.size || sha256(bytes) !== entry.sha256) {
       throw migrationError("BACKUP_CHECKSUM_MISMATCH", `backup checksum verification failed: ${entry.path}`);

package/core/single-instance.js

@@ -17,30 +17,46 @@ function pidAlive(pid) {
 
 function acquireSingleInstanceLock({ configDir, name = "bot" }) {
   const lockPath = path.join(configDir, `${name}.lock`);
-  try {
-    const prev = JSON.parse(fs.readFileSync(lockPath, "utf8"));
-    if (prev && prev.pid && prev.pid !== process.pid && pidAlive(prev.pid)) {
-      return { acquired: false, holder: prev, lockPath };
-    }
-    // Missing, corrupt, own-pid, or dead-pid (stale after SIGKILL): claim it.
-  } catch (e) {}
-  fs.writeFileSync(lockPath, JSON.stringify({
+  const payload = JSON.stringify({
     pid: process.pid,
     startedAt: new Date().toISOString(),
     entrypoint: process.argv[1] || "",
-  }));
-  let released = false;
-  const release = () => {
-    if (released) return;
-    released = true;
+  });
+  // O_EXCL creation is the only atomic claim the filesystem offers. The old
+  // read-check-then-write had a TOCTOU hole: two processes booting together
+  // (launchd respawn racing a manual start) could both read "stale" and both
+  // write, each believing it held the lock. Now a stale/corrupt lock is
+  // unlinked and the claim retried; only a wx-create that succeeds counts.
+  for (let attempt = 0; attempt < 5; attempt++) {
     try {
-      const cur = JSON.parse(fs.readFileSync(lockPath, "utf8"));
-      // Never delete a lock a successor already owns.
-      if (cur && cur.pid === process.pid) fs.unlinkSync(lockPath);
-    } catch (e) {}
-  };
-  process.on("exit", release);
-  return { acquired: true, lockPath, release };
+      fs.writeFileSync(lockPath, payload, { flag: "wx" });
+      let released = false;
+      const release = () => {
+        if (released) return;
+        released = true;
+        try {
+          const cur = JSON.parse(fs.readFileSync(lockPath, "utf8"));
+          // Never delete a lock a successor already owns.
+          if (cur && cur.pid === process.pid) fs.unlinkSync(lockPath);
+        } catch (e) {}
+      };
+      process.on("exit", release);
+      return { acquired: true, lockPath, release };
+    } catch (e) {
+      if (e.code !== "EEXIST") throw e;
+    }
+    let prev = null;
+    try { prev = JSON.parse(fs.readFileSync(lockPath, "utf8")); } catch (e) {}
+    if (prev && prev.pid && prev.pid !== process.pid && pidAlive(prev.pid)) {
+      return { acquired: false, holder: prev, lockPath };
+    }
+    // Corrupt, own-pid, or dead-pid (stale after SIGKILL): clear and retry.
+    try { fs.unlinkSync(lockPath); } catch (e) {}
+  }
+  // Five claim attempts lost to contenders — treat it as someone else's lock.
+  let holder = null;
+  try { holder = JSON.parse(fs.readFileSync(lockPath, "utf8")); } catch (e) {}
+  return { acquired: false, holder, lockPath };
 }
 
 module.exports = { acquireSingleInstanceLock, pidAlive };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.0.2",
+  "version": "3.0.4",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {

package/test-provider-dream.js

@@ -124,6 +124,9 @@ async function providerProbe(kind) {
   const { createUtilityAgentService } = require("./core/utility-agent");
   const utility = createUtilityAgentService({
     registry: registryFor(provider),
+    // This probe models a global/nightly dream with no active chat. Do not let
+    // the parent Open Claudia process's OC_PROVIDER leak into provider choice.
+    activeProvider: () => null,
     env: {
       UTILITY_PROVIDER: "active",
       DEFAULT_PROVIDER: kind,

package/test-provider-language.js

@@ -32,10 +32,11 @@ assert.doesNotMatch(setup, /Your Claude Code bot is connected|Description=Claude
 
 const pkg = JSON.parse(read("package.json"));
 assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
-// 3.0.2 approved by Sumeet 2026-07-12 ("Yeh do it and push it out" — peak
-// context metric restored, Telegram long-message chunking so dream summaries
-// deliver; CHANGELOG documents it as v3.0.2).
-assert.strictEqual(pkg.version, "3.0.2", "release version must remain unchanged without explicit approval");
+// 3.0.4 approved by Sumeet 2026-07-12 ("1 yes it's important for that Cron to
+// work 2. Same" + "Ok do it" — fsGroup-tolerant snapshot validation so v3 pods
+// stop crashlooping on PVC remounts, and legacy cron migration adopts the
+// owning user's saved provider/project defaults instead of archive-disabling).
+assert.strictEqual(pkg.version, "3.0.4", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }

package/test-provider-migration-backup.js

@@ -378,6 +378,52 @@ function sourceChangeProbe() {
   }
 }
 
+function fsGroupToleranceProbe() {
+  if (process.platform === "win32") return;
+  const root = tempRoot("fsgroup");
+  try {
+    const configDir = installFixture("claude-only", root);
+    const opts = options(configDir);
+    const snapshot = ensureMigrationSnapshot(opts);
+
+    // Simulate the kubelet fsGroup ownership pass: group rwX + setgid ORed
+    // onto every directory and group rw onto every file at each pod mount.
+    const applyFsGroup = (target) => {
+      const stat = fs.lstatSync(target);
+      if (stat.isDirectory()) {
+        fs.chmodSync(target, (stat.mode & 0o777) | 0o2070);
+        for (const entry of fs.readdirSync(target)) applyFsGroup(path.join(target, entry));
+      } else {
+        fs.chmodSync(target, (stat.mode & 0o777) | 0o060);
+      }
+    };
+    applyFsGroup(snapshot.snapshotDir);
+    assert.strictEqual(fs.statSync(snapshot.snapshotDir).mode & 0o7777, 0o2770);
+
+    const validated = validateMigrationSnapshot(snapshot.snapshotDir, { sources: opts.sources, verifySources: true });
+    assert.strictEqual(validated.ok, true, "group bits from a k8s fsGroup mount must not invalidate the snapshot");
+    const reused = ensureMigrationSnapshot(opts);
+    assert.strictEqual(reused.reused, true, "fsGroup-touched snapshot is reused at boot, not rejected");
+
+    fs.chmodSync(manifestFile(snapshot.snapshotDir), 0o664);
+    assert.throws(
+      () => validateMigrationSnapshot(snapshot.snapshotDir),
+      (error) => error.code === "INVALID_MIGRATION_MANIFEST" && /unsafe permissions/.test(error.message),
+      "world-readable manifest must still be rejected",
+    );
+    fs.chmodSync(manifestFile(snapshot.snapshotDir), 0o660);
+
+    fs.chmodSync(snapshot.snapshotDir, 0o2775);
+    assert.throws(
+      () => validateMigrationSnapshot(snapshot.snapshotDir),
+      (error) => error.code === "INVALID_MIGRATION_SNAPSHOT" && /unsafe permissions/.test(error.message),
+      "world-accessible snapshot dir must still be rejected",
+    );
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
 function integrationAndDocsProbe() {
   const bot = fs.readFileSync(path.join(__dirname, "bot.js"), "utf8");
   const scheduler = fs.readFileSync(path.join(__dirname, "core", "scheduler.js"), "utf8");
@@ -420,5 +466,6 @@ activationProbe();
 rollbackProbe();
 sourceChangeProbe();
 rawByteProbe();
+fsGroupToleranceProbe();
 integrationAndDocsProbe();
 console.log("provider migration backup OK");

package/test-provider-scheduler.js

@@ -84,6 +84,90 @@ function migrationProbe(jobsApi) {
   assert.deepStrictEqual(rerun, cursor, "jobs migration must be idempotent");
 }
 
+function legacyDefaultsProbe(jobsApi) {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "open-claudia-legacy-defaults-"));
+  try {
+    const baseDefaults = {
+      defaultCanonicalUserId: "telegram:fixture",
+      defaultChannelId: "fixture-channel",
+      defaultAdapter: "telegram-fixture",
+      defaultAdapterType: "telegram",
+      now: () => 1_720_000_000_000,
+      occurrenceIdFactory: (job) => `occ-${job.id}`,
+    };
+    const legacyCron = {
+      id: "legacy-orphan-cron",
+      kind: "cron",
+      schedule: "0 */6 * * *",
+      prompt: "run the production sync",
+      canonicalUserId: "telegram:100",
+      channelId: "chan-100",
+      adapter: "telegram-fixture",
+      adapterType: "telegram",
+    };
+
+    const v3State = path.join(temp, "state-v3.json");
+    fs.writeFileSync(v3State, JSON.stringify({
+      schemaVersion: 3,
+      users: {
+        "telegram:100": {
+          settings: { backend: "codex" },
+          currentSession: { name: "data-sync-runner", dir: "/workspace/data-sync-runner" },
+        },
+      },
+    }));
+    const adopted = jobsApi.migrateJobsDocument([{ ...legacyCron }], { ...baseDefaults, stateFile: v3State });
+    assert.deepStrictEqual(adopted.archived, [], "legacy cron with saved user defaults must stay runnable");
+    assert.strictEqual(adopted.jobs.length, 1);
+    assert.strictEqual(adopted.jobs[0].provider, "codex");
+    assert.strictEqual(adopted.jobs[0].project, "data-sync-runner");
+    assert.strictEqual(adopted.jobs[0].projectDir, "/workspace/data-sync-runner");
+    assert.strictEqual(adopted.jobs[0].legacyDefaultsApplied, true);
+    assert.strictEqual(adopted.jobs[0].disabled, false);
+
+    const rerun = jobsApi.migrateJobsDocument(adopted, { ...baseDefaults, stateFile: v3State });
+    assert.deepStrictEqual(rerun, adopted, "legacy defaults adoption must be idempotent");
+
+    const pinned = jobsApi.migrateJobsDocument(
+      [{ ...legacyCron, id: "legacy-provider-pinned", provider: "claude" }],
+      { ...baseDefaults, stateFile: v3State },
+    );
+    assert.strictEqual(pinned.jobs[0].provider, "claude", "explicit legacy provider must win over the saved default");
+    assert.strictEqual(pinned.jobs[0].project, "data-sync-runner");
+    assert.strictEqual(pinned.jobs[0].legacyDefaultsApplied, true);
+
+    const v2State = path.join(temp, "state-v2.json");
+    fs.writeFileSync(v2State, JSON.stringify({
+      settings: { backend: "claude" },
+      currentSession: { name: "alpha", dir: "/workspace/alpha" },
+    }));
+    const globalShape = jobsApi.migrateJobsDocument([{ ...legacyCron }], { ...baseDefaults, stateFile: v2State });
+    assert.strictEqual(globalShape.jobs.length, 1, "pre-v3 global state shape must supply defaults");
+    assert.strictEqual(globalShape.jobs[0].provider, "claude");
+    assert.strictEqual(globalShape.jobs[0].project, "alpha");
+    assert.strictEqual(globalShape.jobs[0].legacyDefaultsApplied, true);
+
+    const cursor = jobsApi.migrateJobsDocument(
+      [{ ...legacyCron, id: "legacy-cursor-cron", sessionKey: "cursorSessionId" }],
+      { ...baseDefaults, stateFile: v3State },
+    );
+    assert.deepStrictEqual(cursor.jobs, [], "Cursor-pinned jobs must not adopt defaults");
+    assert.strictEqual(cursor.archived[0].provider, "cursor");
+    assert.strictEqual(cursor.archived[0].project, null, "archived Cursor evidence must stay pristine");
+    assert.ok(!cursor.archived[0].legacyDefaultsApplied);
+    assert.match(cursor.archived[0].archiveReason, /removed provider/i);
+
+    const noState = jobsApi.migrateJobsDocument(
+      [{ ...legacyCron }],
+      { ...baseDefaults, stateFile: path.join(temp, "missing.json") },
+    );
+    assert.deepStrictEqual(noState.jobs, [], "without saved defaults the legacy cron still archives");
+    assert.match(noState.archived[0].archiveReason, /provider/i);
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+}
+
 function migrationIntegrationProbe(jobsApi, migrationApi) {
   const temp = fs.mkdtempSync(path.join(os.tmpdir(), "open-claudia-jobs-migration-"));
   try {
@@ -669,6 +753,7 @@ async function main() {
   assert.strictEqual(typeof schedulerApi.createSchedulerService, "function");
 
   migrationProbe(jobsApi);
+  legacyDefaultsProbe(jobsApi);
   migrationIntegrationProbe(jobsApi, migrationApi);
   await immutableTerminalProbe(schedulerApi.createSchedulerService);
   await duplicateFireProbe(schedulerApi.createSchedulerService);