@inetafrica/open-claudia 3.0.31 → 3.0.33

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## v3.0.33 — Full sudo inside the pod (re-cut of v3.0.32; the pin guard bit us again)
+
+- **`claudia` now has `NOPASSWD:ALL` sudo in the pod image.** The rebuilt `:base` widens the baked sudoers from the old command allow-list to full passwordless sudo, so the agent can install packages and operate inside its own container like a normal machine. This pairs with agent-space's IaaS-style security-policy system: the blast radius is fenced at the pod's NetworkPolicy (egress/ingress presets, DB-rendered), not by crippling the user inside the container.
+- **Re-cut of v3.0.32.** That tag bumped `package.json` but not the version pin in `test-provider-language.js`, so `pretest` asserted 3.0.31, the **build** job failed, and the **docker** job was skipped — nothing published, `:latest` stayed on 3.0.31. Identical payload here with the pin bumped. (Same failure mode as v3.0.30 → v3.0.31.)
+- **Agent-space / OpenClaw:** no new deps, no new env, no schema change; Docker image builds FROM the rebuilt full-sudo `:base`. Existing pods pick this up on their next approved upgrade.
+
 ## v3.0.31 — Re-cut of the approval-card release (the version-pin guard bit us)
 
 - **Same feature payload as v3.0.30, this time it builds.** The v3.0.30 tag's build failed before publishing anything. `test-provider-language.js` pins the release version and asserts it "must remain unchanged without explicit approval" — a deliberate gate so every bump is consciously acknowledged in the same commit. `package.json` was bumped to 3.0.30 but that pin wasn't, so `pretest` asserted 3.0.29, the **build** job failed, and the **docker** job was skipped (no npm publish, no image — `:base` never entered it). The pin now tracks the release, so the build goes green.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.0.31",
+  "version": "3.0.33",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {

package/test-provider-language.js

@@ -32,20 +32,16 @@ assert.doesNotMatch(setup, /Your Claude Code bot is connected|Description=Claude
 
 const pkg = JSON.parse(read("package.json"));
 assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
-// 3.0.31 approved by Sumeet 2026-07-16 ("push out a new version"): re-cuts the
-// v3.0.30 approval-card UX after that tag's build tripped THIS guard — the pin
-// below wasn't bumped alongside package.json, so pretest asserted 3.0.29 and the
-// build failed (docker skipped, nothing published). The UX rework: the owner's
-// approval card now shows "From <name>: <ask>" plus the proposed reply/action
-// (inbound text + speaker name threaded through context -> escalate -> approval
-// record). Approve/Deny edits the card in place (fresh-message fallback when the
-// adapter can't edit). "Make a rule" approves + delivers, then asks "just <name>
-// or everyone?" -> saved to the per-person mandate or a new owner-editable global
-// guardrails store (external-guardrails.md, /guardrails command). The enforcer
-// now vets every external reply against three layers: hardcoded security floor /
-// global guardrails / per-person mandate. No autonomy change: default-deny
-// stands, the guard still fails closed, and only the owner can create rules.
-assert.strictEqual(pkg.version, "3.0.31", "release version must remain unchanged without explicit approval");
+// 3.0.33 approved by Sumeet 2026-07-16 ("build and push it all out"): full-sudo
+// pod image — the rebuilt :base widens claudia's sudoers from a command
+// allow-list to NOPASSWD:ALL so the agent can operate its own container like a
+// normal machine (pairs with agent-space's IaaS-style security policy, which
+// fences the blast radius at the NetworkPolicy instead of crippling the user).
+// Re-cut of v3.0.32, whose build tripped THIS guard again — package.json was
+// bumped but the pin below wasn't, so pretest asserted 3.0.31, the build job
+// failed, docker was skipped, and nothing was published (same failure mode as
+// v3.0.30 -> v3.0.31).
+assert.strictEqual(pkg.version, "3.0.33", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }