@inetafrica/open-claudia 3.0.3 → 3.0.4

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## v3.0.4 — surviving the second mount, keeping the crons
+
+- **A Kubernetes PVC remount no longer crashloops the bot.** The migration snapshot validator demanded exact owner-only modes (`0700` dirs, `0600` files). But kubelet's fsGroup ownership pass ORs group `rwX` + setgid onto every file and directory each time the volume is mounted — so the first v3 boot passed (snapshot created after the mount), and the **second pod recreation** hit `INVALID_MIGRATION_SNAPSHOT: migration snapshot has unsafe permissions` at boot and went CrashLoopBackOff. Every v3 pod on an fsGroup-mounted PVC was one recreation away from this (euvy hit it live on 2026-07-12 and needed a manual chmod rescue). Validation now rejects only world-access bits — group access is the pod's own supplemental group, not an exposure — while snapshots are still *created* `0700`/`0600`.
+- **Legacy crons adopt your saved defaults instead of dying in the archive.** Pre-provider-aware jobs carried no pinned provider or project — they fired with whatever the bot had active — so the v3 migration classified every one of them "no unambiguous project" and archive-disabled it, silently killing real production crons (euvy's 6-hourly Airbyte data-sync among them). The jobs migration now looks up the owning user's saved state (`settings.backend` and `currentSession` name/dir, in both the v3 `users` shape and the pre-v3 global shape), adopts those as the job's provider/project, and marks the record `legacyDefaultsApplied` — preserving the old fire-time behaviour instead of erasing it. Jobs pinned to a removed provider (Cursor) keep their pin, stay archived, and are never reassigned; a job whose owner has no saved defaults still archives safely.
+- **Re-reading the jobs store no longer rewrites stored nulls.** `Number(null)` is `0`, so the re-migration pass that runs on every read flipped `nextAttemptAt`/`lastFireAt` from `null` to epoch-`0` — harmless at runtime but a silent mutation on every load. Migration output is now byte-stable across passes.
+- **Agent-space / OpenClaw:** no new deps, no new env, no schema change; Docker image builds identically. New hermetic probes: fsGroup-mode tolerance (group bits pass, world bits still refused) in `test-provider-migration-backup.js`; legacy-defaults adoption, v2/v3 state shapes, Cursor guard, and migration idempotency in `test-provider-scheduler.js`.
+
 ## v3.0.3 — the lock-holder stands its ground
 
 - **A persistent 409 no longer restarts the bot.** v3.0.1 taught the poller to ride out short 409 conflicts but still `exit(1)` once a conflict outlived 2 minutes, on the theory that the survivor had to be a real second instance. In practice the rogue poller is lock-blind — a debugger-run dev checkout, a copy on another config dir, or another host on the same token — so the exit killed the *legitimate*, lock-holding service and launchd respawned it straight back into the same fight (five boot→409→exit cycles on 2026-07-12). The poller now never exits over a 409: it pauses 15s per retry, slows to 60s once the streak passes 2 minutes, sends the owner a throttled Telegram alert (max one per hour) naming the likely culprits, and posts an all-clear once the rogue goes away.

package/core/jobs.js

@@ -46,6 +46,14 @@ function clone(value) {
   return value === undefined ? undefined : structuredClone(value);
 }
 
+// Number(null) is 0, so a bare Number.isFinite gate rewrites stored nulls to
+// epoch timestamps on every re-migration pass.
+function finiteTimeOrNull(value) {
+  if (value === null || value === undefined) return null;
+  const number = Number(value);
+  return Number.isFinite(number) ? number : null;
+}
+
 function occurrenceId(job, options = {}) {
   if (nonEmpty(job.occurrenceId)) return nonEmpty(job.occurrenceId);
   const factory = options.occurrenceIdFactory || (() => (
@@ -155,9 +163,9 @@ function normalizeRunnableJob(record, options = {}) {
     disabled,
     attemptCount,
     maxAttempts,
-    nextAttemptAt: Number.isFinite(Number(record.nextAttemptAt)) ? Number(record.nextAttemptAt) : null,
+    nextAttemptAt: finiteTimeOrNull(record.nextAttemptAt),
     createdAt,
-    lastFireAt: Number.isFinite(Number(record.lastFireAt)) ? Number(record.lastFireAt) : null,
+    lastFireAt: finiteTimeOrNull(record.lastFireAt),
     lastFireOk: typeof record.lastFireOk === "boolean" ? record.lastFireOk : null,
     lastError: isRecord(record.lastError) ? clone(record.lastError) : null,
   };
@@ -169,6 +177,66 @@ function normalizeRunnableJob(record, options = {}) {
   return normalized;
 }
 
+function readLegacyStateUsers(options = {}) {
+  if (options._legacyStateUsers !== undefined) return options._legacyStateUsers;
+  let users = null;
+  try {
+    if (!options.stateFile) throw new Error("no state file wired");
+    const raw = JSON.parse(fs.readFileSync(options.stateFile, "utf8"));
+    if (isRecord(raw)) {
+      // v3 state is { schemaVersion, users: { "<canonicalUserId>": {...} } };
+      // the pre-v3 file was one global user state at the top level.
+      users = isRecord(raw.users) ? raw.users : { "": raw };
+    }
+  } catch (_) {}
+  options._legacyStateUsers = users;
+  return users;
+}
+
+function legacyStateDefaultsFor(record, options = {}) {
+  const users = readLegacyStateUsers(options);
+  if (!users) return null;
+  const canonicalUserId = nonEmpty(record.canonicalUserId) || nonEmpty(options.defaultCanonicalUserId);
+  const user = (canonicalUserId && isRecord(users[canonicalUserId]) ? users[canonicalUserId] : null)
+    || (isRecord(users[""]) ? users[""] : null);
+  if (!user) return null;
+  const provider = nonEmpty(user.settings?.backend)?.toLowerCase() || null;
+  const session = isRecord(user.currentSession) ? user.currentSession : {};
+  return {
+    provider: provider && RUNNABLE_PROVIDERS.has(provider) ? provider : null,
+    project: nonEmpty(session.name),
+    projectDir: nonEmpty(session.dir),
+  };
+}
+
+// Pre-provider-aware jobs fired with whatever provider and project the bot had
+// active at fire time. Adopting the owning user's saved defaults preserves
+// that behaviour instead of archive-disabling every legacy cron. Jobs pinned
+// to a removed provider (Cursor) keep their pin and still archive.
+function applyLegacyDefaults(record, options = {}) {
+  if (!isRecord(record)) return record;
+  const provider = legacyProvider(record);
+  if (provider === "cursor") return record;
+  const hasProvider = !!provider;
+  const hasProject = !!nonEmpty(record.project);
+  if (hasProvider && hasProject) return record;
+  const defaults = legacyStateDefaultsFor(record, options);
+  if (!defaults) return record;
+  const next = clone(record);
+  let applied = false;
+  if (!hasProvider && defaults.provider) {
+    next.provider = defaults.provider;
+    applied = true;
+  }
+  if (!hasProject && defaults.project) {
+    next.project = defaults.project;
+    if (!nonEmpty(next.projectDir) && defaults.projectDir) next.projectDir = defaults.projectDir;
+    applied = true;
+  }
+  if (applied) next.legacyDefaultsApplied = true;
+  return next;
+}
+
 function migrationReason(record, options = {}) {
   const provider = legacyProvider(record);
   if (provider === "cursor") return "Pinned to removed provider Cursor Agent";
@@ -194,16 +262,18 @@ function normalizeArchived(record, options = {}) {
 }
 
 function migrateJobsDocument(raw, options = {}) {
-  const source = isRecord(raw) && raw.schemaVersion === JOBS_SCHEMA_VERSION
-    ? raw
-    : { jobs: Array.isArray(raw) ? raw : [], archived: [] };
+  const legacySource = !(isRecord(raw) && raw.schemaVersion === JOBS_SCHEMA_VERSION);
+  const source = legacySource
+    ? { jobs: Array.isArray(raw) ? raw : [], archived: [] }
+    : raw;
   const jobs = [];
   const archived = [];
 
   for (const record of Array.isArray(source.jobs) ? source.jobs : []) {
-    const normalized = normalizeRunnableJob(record, options);
+    const candidate = legacySource ? applyLegacyDefaults(record, options) : record;
+    const normalized = normalizeRunnableJob(candidate, options);
     if (normalized) jobs.push(normalized);
-    else archived.push(archiveLegacyJob(record, migrationReason(record, options), options));
+    else archived.push(archiveLegacyJob(candidate, migrationReason(candidate, options), options));
   }
   for (const record of Array.isArray(source.archived) ? source.archived : []) {
     const normalized = normalizeArchived(record, options);
@@ -281,6 +351,7 @@ function createJobsStore(options = {}) {
     defaultChannelId: defaults.channelId,
     defaultAdapter: defaults.adapter,
     defaultAdapterType: defaults.adapterType,
+    stateFile: options.stateFile || path.join(configDir, path.basename(STATE_FILE)),
     now: options.now,
     occurrenceIdFactory: options.occurrenceIdFactory,
   });

package/core/migration-backup.js

@@ -107,8 +107,13 @@ function assertRegularFile(filePath, code, label) {
   return stat;
 }
 
-function assertPrivateMode(stat, expectedMask, code, label) {
-  if (process.platform !== "win32" && (stat.mode & 0o777) !== expectedMask) {
+function assertPrivateMode(stat, code, label) {
+  // Kubernetes fsGroup ownership management ORs group rw(x) + setgid onto
+  // every file and directory each time the volume is mounted, so an exact
+  // owner-only mode check crashloops the second boot on any fsGroup-mounted
+  // PVC. Group access is the pod's own supplemental group; only world access
+  // is a real exposure.
+  if (process.platform !== "win32" && (stat.mode & 0o007) !== 0) {
     throw migrationError(code, `${label} has unsafe permissions`);
   }
 }
@@ -596,18 +601,18 @@ function validateMigrationSnapshot(snapshotDir, options = {}) {
   if (!snapshotStat.isDirectory() || snapshotStat.isSymbolicLink()) {
     throw migrationError("INVALID_MIGRATION_SNAPSHOT", "migration snapshot must be a real directory");
   }
-  assertPrivateMode(snapshotStat, 0o700, "INVALID_MIGRATION_SNAPSHOT", "migration snapshot");
+  assertPrivateMode(snapshotStat, "INVALID_MIGRATION_SNAPSHOT", "migration snapshot");
   const originalsStat = fs.lstatSync(path.join(resolvedSnapshot, "originals"));
   if (!originalsStat.isDirectory() || originalsStat.isSymbolicLink()) {
     throw migrationError("INVALID_MIGRATION_SNAPSHOT", "migration originals directory is invalid");
   }
-  assertPrivateMode(originalsStat, 0o700, "INVALID_MIGRATION_SNAPSHOT", "migration originals directory");
+  assertPrivateMode(originalsStat, "INVALID_MIGRATION_SNAPSHOT", "migration originals directory");
   const manifestPath = path.join(resolvedSnapshot, MANIFEST_FILE);
   const hashPath = path.join(resolvedSnapshot, MANIFEST_HASH_FILE);
   const manifestStat = assertRegularFile(manifestPath, "INVALID_MIGRATION_MANIFEST", "migration manifest");
   const manifestHashStat = assertRegularFile(hashPath, "INVALID_MIGRATION_MANIFEST", "migration manifest checksum");
-  assertPrivateMode(manifestStat, 0o600, "INVALID_MIGRATION_MANIFEST", "migration manifest");
-  assertPrivateMode(manifestHashStat, 0o600, "INVALID_MIGRATION_MANIFEST", "migration manifest checksum");
+  assertPrivateMode(manifestStat, "INVALID_MIGRATION_MANIFEST", "migration manifest");
+  assertPrivateMode(manifestHashStat, "INVALID_MIGRATION_MANIFEST", "migration manifest checksum");
   const manifestBytes = fs.readFileSync(manifestPath);
   const expectedManifestHash = fs.readFileSync(hashPath, "utf8").trim();
   if (!/^[a-f0-9]{64}$/.test(expectedManifestHash) || sha256(manifestBytes) !== expectedManifestHash) {
@@ -625,7 +630,7 @@ function validateMigrationSnapshot(snapshotDir, options = {}) {
     }
     if (!fs.existsSync(filePath)) throw migrationError("BACKUP_CHECKSUM_MISMATCH", `backup file is missing: ${entry.path}`);
     const stat = assertRegularFile(filePath, "BACKUP_CHECKSUM_MISMATCH", `backup file ${entry.path}`);
-    assertPrivateMode(stat, 0o600, "BACKUP_CHECKSUM_MISMATCH", `backup file ${entry.path}`);
+    assertPrivateMode(stat, "BACKUP_CHECKSUM_MISMATCH", `backup file ${entry.path}`);
     const bytes = fs.readFileSync(filePath);
     if (stat.size !== entry.size || bytes.length !== entry.size || sha256(bytes) !== entry.sha256) {
       throw migrationError("BACKUP_CHECKSUM_MISMATCH", `backup checksum verification failed: ${entry.path}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.0.3",
+  "version": "3.0.4",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {

package/test-provider-dream.js

@@ -124,6 +124,9 @@ async function providerProbe(kind) {
   const { createUtilityAgentService } = require("./core/utility-agent");
   const utility = createUtilityAgentService({
     registry: registryFor(provider),
+    // This probe models a global/nightly dream with no active chat. Do not let
+    // the parent Open Claudia process's OC_PROVIDER leak into provider choice.
+    activeProvider: () => null,
     env: {
       UTILITY_PROVIDER: "active",
       DEFAULT_PROVIDER: kind,

package/test-provider-language.js

@@ -32,10 +32,11 @@ assert.doesNotMatch(setup, /Your Claude Code bot is connected|Description=Claude
 
 const pkg = JSON.parse(read("package.json"));
 assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
-// 3.0.3 approved by Sumeet 2026-07-12 ("Yes please" to patching the double-
-// poller bug as v3.0.3 — atomic single-instance lock, 409 handler never exits
-// while holding the lock, throttled owner alert; CHANGELOG documents it).
-assert.strictEqual(pkg.version, "3.0.3", "release version must remain unchanged without explicit approval");
+// 3.0.4 approved by Sumeet 2026-07-12 ("1 yes it's important for that Cron to
+// work 2. Same" + "Ok do it" — fsGroup-tolerant snapshot validation so v3 pods
+// stop crashlooping on PVC remounts, and legacy cron migration adopts the
+// owning user's saved provider/project defaults instead of archive-disabling).
+assert.strictEqual(pkg.version, "3.0.4", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }

package/test-provider-migration-backup.js

@@ -378,6 +378,52 @@ function sourceChangeProbe() {
   }
 }
 
+function fsGroupToleranceProbe() {
+  if (process.platform === "win32") return;
+  const root = tempRoot("fsgroup");
+  try {
+    const configDir = installFixture("claude-only", root);
+    const opts = options(configDir);
+    const snapshot = ensureMigrationSnapshot(opts);
+
+    // Simulate the kubelet fsGroup ownership pass: group rwX + setgid ORed
+    // onto every directory and group rw onto every file at each pod mount.
+    const applyFsGroup = (target) => {
+      const stat = fs.lstatSync(target);
+      if (stat.isDirectory()) {
+        fs.chmodSync(target, (stat.mode & 0o777) | 0o2070);
+        for (const entry of fs.readdirSync(target)) applyFsGroup(path.join(target, entry));
+      } else {
+        fs.chmodSync(target, (stat.mode & 0o777) | 0o060);
+      }
+    };
+    applyFsGroup(snapshot.snapshotDir);
+    assert.strictEqual(fs.statSync(snapshot.snapshotDir).mode & 0o7777, 0o2770);
+
+    const validated = validateMigrationSnapshot(snapshot.snapshotDir, { sources: opts.sources, verifySources: true });
+    assert.strictEqual(validated.ok, true, "group bits from a k8s fsGroup mount must not invalidate the snapshot");
+    const reused = ensureMigrationSnapshot(opts);
+    assert.strictEqual(reused.reused, true, "fsGroup-touched snapshot is reused at boot, not rejected");
+
+    fs.chmodSync(manifestFile(snapshot.snapshotDir), 0o664);
+    assert.throws(
+      () => validateMigrationSnapshot(snapshot.snapshotDir),
+      (error) => error.code === "INVALID_MIGRATION_MANIFEST" && /unsafe permissions/.test(error.message),
+      "world-readable manifest must still be rejected",
+    );
+    fs.chmodSync(manifestFile(snapshot.snapshotDir), 0o660);
+
+    fs.chmodSync(snapshot.snapshotDir, 0o2775);
+    assert.throws(
+      () => validateMigrationSnapshot(snapshot.snapshotDir),
+      (error) => error.code === "INVALID_MIGRATION_SNAPSHOT" && /unsafe permissions/.test(error.message),
+      "world-accessible snapshot dir must still be rejected",
+    );
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
 function integrationAndDocsProbe() {
   const bot = fs.readFileSync(path.join(__dirname, "bot.js"), "utf8");
   const scheduler = fs.readFileSync(path.join(__dirname, "core", "scheduler.js"), "utf8");
@@ -420,5 +466,6 @@ activationProbe();
 rollbackProbe();
 sourceChangeProbe();
 rawByteProbe();
+fsGroupToleranceProbe();
 integrationAndDocsProbe();
 console.log("provider migration backup OK");

package/test-provider-scheduler.js

@@ -84,6 +84,90 @@ function migrationProbe(jobsApi) {
   assert.deepStrictEqual(rerun, cursor, "jobs migration must be idempotent");
 }
 
+function legacyDefaultsProbe(jobsApi) {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "open-claudia-legacy-defaults-"));
+  try {
+    const baseDefaults = {
+      defaultCanonicalUserId: "telegram:fixture",
+      defaultChannelId: "fixture-channel",
+      defaultAdapter: "telegram-fixture",
+      defaultAdapterType: "telegram",
+      now: () => 1_720_000_000_000,
+      occurrenceIdFactory: (job) => `occ-${job.id}`,
+    };
+    const legacyCron = {
+      id: "legacy-orphan-cron",
+      kind: "cron",
+      schedule: "0 */6 * * *",
+      prompt: "run the production sync",
+      canonicalUserId: "telegram:100",
+      channelId: "chan-100",
+      adapter: "telegram-fixture",
+      adapterType: "telegram",
+    };
+
+    const v3State = path.join(temp, "state-v3.json");
+    fs.writeFileSync(v3State, JSON.stringify({
+      schemaVersion: 3,
+      users: {
+        "telegram:100": {
+          settings: { backend: "codex" },
+          currentSession: { name: "data-sync-runner", dir: "/workspace/data-sync-runner" },
+        },
+      },
+    }));
+    const adopted = jobsApi.migrateJobsDocument([{ ...legacyCron }], { ...baseDefaults, stateFile: v3State });
+    assert.deepStrictEqual(adopted.archived, [], "legacy cron with saved user defaults must stay runnable");
+    assert.strictEqual(adopted.jobs.length, 1);
+    assert.strictEqual(adopted.jobs[0].provider, "codex");
+    assert.strictEqual(adopted.jobs[0].project, "data-sync-runner");
+    assert.strictEqual(adopted.jobs[0].projectDir, "/workspace/data-sync-runner");
+    assert.strictEqual(adopted.jobs[0].legacyDefaultsApplied, true);
+    assert.strictEqual(adopted.jobs[0].disabled, false);
+
+    const rerun = jobsApi.migrateJobsDocument(adopted, { ...baseDefaults, stateFile: v3State });
+    assert.deepStrictEqual(rerun, adopted, "legacy defaults adoption must be idempotent");
+
+    const pinned = jobsApi.migrateJobsDocument(
+      [{ ...legacyCron, id: "legacy-provider-pinned", provider: "claude" }],
+      { ...baseDefaults, stateFile: v3State },
+    );
+    assert.strictEqual(pinned.jobs[0].provider, "claude", "explicit legacy provider must win over the saved default");
+    assert.strictEqual(pinned.jobs[0].project, "data-sync-runner");
+    assert.strictEqual(pinned.jobs[0].legacyDefaultsApplied, true);
+
+    const v2State = path.join(temp, "state-v2.json");
+    fs.writeFileSync(v2State, JSON.stringify({
+      settings: { backend: "claude" },
+      currentSession: { name: "alpha", dir: "/workspace/alpha" },
+    }));
+    const globalShape = jobsApi.migrateJobsDocument([{ ...legacyCron }], { ...baseDefaults, stateFile: v2State });
+    assert.strictEqual(globalShape.jobs.length, 1, "pre-v3 global state shape must supply defaults");
+    assert.strictEqual(globalShape.jobs[0].provider, "claude");
+    assert.strictEqual(globalShape.jobs[0].project, "alpha");
+    assert.strictEqual(globalShape.jobs[0].legacyDefaultsApplied, true);
+
+    const cursor = jobsApi.migrateJobsDocument(
+      [{ ...legacyCron, id: "legacy-cursor-cron", sessionKey: "cursorSessionId" }],
+      { ...baseDefaults, stateFile: v3State },
+    );
+    assert.deepStrictEqual(cursor.jobs, [], "Cursor-pinned jobs must not adopt defaults");
+    assert.strictEqual(cursor.archived[0].provider, "cursor");
+    assert.strictEqual(cursor.archived[0].project, null, "archived Cursor evidence must stay pristine");
+    assert.ok(!cursor.archived[0].legacyDefaultsApplied);
+    assert.match(cursor.archived[0].archiveReason, /removed provider/i);
+
+    const noState = jobsApi.migrateJobsDocument(
+      [{ ...legacyCron }],
+      { ...baseDefaults, stateFile: path.join(temp, "missing.json") },
+    );
+    assert.deepStrictEqual(noState.jobs, [], "without saved defaults the legacy cron still archives");
+    assert.match(noState.archived[0].archiveReason, /provider/i);
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+}
+
 function migrationIntegrationProbe(jobsApi, migrationApi) {
   const temp = fs.mkdtempSync(path.join(os.tmpdir(), "open-claudia-jobs-migration-"));
   try {
@@ -669,6 +753,7 @@ async function main() {
   assert.strictEqual(typeof schedulerApi.createSchedulerService, "function");
 
   migrationProbe(jobsApi);
+  legacyDefaultsProbe(jobsApi);
   migrationIntegrationProbe(jobsApi, migrationApi);
   await immutableTerminalProbe(schedulerApi.createSchedulerService);
   await duplicateFireProbe(schedulerApi.createSchedulerService);