@inetafrica/open-claudia 3.0.35 → 3.0.37

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## v3.0.37 — Silent background watches, and pasted secrets are accepted on any provider
+
+- **You can now arm a watch: a background poll that stays out of the chat and only wakes me when its condition is actually met.** A watch is just a cron carrying a shell `check` command — each tick runs the check with output discarded, and *only* an exit 0 wakes the agent (with a `🔔 Watch "<label>" triggered` notice and a normal reply). A non-zero exit is the idle case: nothing hits the chat, the poll's activity goes to an append-only `watch.log`, and the job stays pending for the next tick. Watches default to **one-shot** (fire once, then remove) so a matched condition can't spam you; add `--repeat` to keep polling. Create/manage from the CLI (`open-claudia watch-add "<check>" "<wake-prompt>" [--every "<cron>"] [--repeat]`, `watch-list`, `watch-remove`), and the owner can flip the global master switch with **`/watch on|off`** (watches are owner-gated because the check is raw shell). Rides the migration-verified jobs store untouched — `check`/`repeat` survive as extra fields, zero schema change.
+- **Pasting a credential into the chat now stores it out-of-band regardless of which provider is active.** Codex refuses secrets in its prompt, so a pasted key under the Codex backend used to be rejected — and being told to re-paste it through keyring commands *in the same chat* was no safer and plain annoying. A loose paste is now classified (`core/credential-detect.js`) and captured **before** the turn reaches the model: a Claude OAuth token → `.env`+vault, an OpenAI key → handed to the Codex CLI, a recognised service token → the operational keyring, an ambiguous long token → scrubbed from chat. Every captured secret is registered for redaction and the original message deleted. The capture is provider-agnostic and never forwards the secret to any model.
+- **Agent-space / OpenClaw:** no new deps, no new env, no schema change; Docker image builds FROM the existing `:base`. Covered by new `test-credential-capture.js` and watch probes in `test-provider-scheduler.js`. Existing pods pick this up on their next approved upgrade.
+
+## v3.0.36 — Picking a Claude model no longer forces a re-login
+
+- **Selecting any Claude model claimed Claude wasn't connected and started a login — even while Claude was working fine.** The model-button handler (and the `/login` picker) decided "connected?" from a shallow token probe (`getClaudeOAuthToken().value`) that only sees an OAuth token in `.env`, the process env, or an unlocked vault. Anyone whose Claude login lives in the Claude CLI's own credential store (the normal `claude` login, no bot token) therefore read as *disconnected*, so every model tap answered "Claude isn't connected yet. Starting login…". The re-login it launched (`claude auth login --claudeai`) never stores a bot token, so the shallow check stayed false and the prompt returned on the very next tap — an unbreakable loop.
+- **Both surfaces now resolve Claude's real auth state via `claudeProviderAuthStatus()`** — the same probe agent runs rely on, which counts a bot OAuth token *and* a `claude auth status` CLI-store login as authenticated. A model tap only starts a login when Claude is genuinely unauthenticated, mirroring the Codex branch beside it. Codex was never affected (it already checked `codex login status`). Cost: one `claude auth status` (~1s) on a model tap when no bot token exists — fine for a settings screen, and skipped entirely when a bot token is present.
+- **Agent-space / OpenClaw:** no new deps, no new env, no schema change; Docker image builds FROM the existing `:base`. Existing pods pick this up on their next approved upgrade.
+
 ## v3.0.35 — Spaces comments are readable rich text, not a run-on wall
 
 - **The bot's Spaces replies rendered as unreadable walls.** `buildCommentContent` posted the entire reply as one text node inside one paragraph. Spaces comments are TipTap/ProseMirror docs: inside a single text node newlines don't render, so paragraphs, numbered lists and `---` separators collapsed into one run-on blob — and the model's markdown (`**bold**`, `*italic*`, backticks) printed its asterisks literally.

package/bin/cli.js

@@ -306,6 +306,26 @@ switch (command) {
     require("./schedule").runCronRemove(args.slice(1));
     break;
   }
+  case "watch-add": {
+    require("./schedule").runWatchAdd(args.slice(1));
+    break;
+  }
+  case "watch-list": {
+    require("./schedule").runWatchList();
+    break;
+  }
+  case "watch-remove": {
+    require("./schedule").runWatchRemove(args.slice(1));
+    break;
+  }
+  case "watch-on": {
+    require("./schedule").runWatchToggle(true);
+    break;
+  }
+  case "watch-off": {
+    require("./schedule").runWatchToggle(false);
+    break;
+  }
 
   case "task": {
     require("./task").run(args.slice(1));
@@ -440,6 +460,10 @@ Background work (only inside an active bot-spawned task):
   open-claudia cron-add "<sched>" "<prompt>"       Recurring job pinned to the selected provider session
   open-claudia cron-list                           List all wakeups + crons on this channel
   open-claudia cron-remove <id>                    Remove a scheduled job
+  open-claudia watch-add "<check>" "<prompt>"      Silent monitor: poll a shell check, wake only when it exits 0
+  open-claudia watch-list                          List watches on this channel + master switch state
+  open-claudia watch-remove <id>                   Remove a watch
+  open-claudia watch-on | watch-off                Global master switch for all watches (owner)
   open-claudia task add|list|start|done|remove     Per-channel todo (survives restarts)
   open-claudia agent "<prompt>" [--role X] [--provider active|claude|codex]  Spawn a provider-isolated sub-agent
 

package/bin/schedule.js

@@ -15,8 +15,19 @@ Crons (recurring):
   open-claudia cron-list                         # all wakeups + crons for this channel
   open-claudia cron-remove <id>                  # remove by id from cron-list
 
-Each fire wakes the agent in the same channel and resumes the selected provider
-session captured when the schedule was created. Provider/project switches made
+Watches (silent background monitor — polls a shell check, wakes you only on a hit):
+  open-claudia watch-add "<check-cmd>" "<wake-prompt>" [--label "<label>"] [--every "<cron>"] [--repeat]
+    <check-cmd>: a shell command polled on a schedule (default every minute).
+                 exit 0 = condition met → wake the agent with <wake-prompt>.
+                 non-zero = still idle → nothing happens, nothing hits the chat.
+    --repeat: keep polling after it fires (default: fire once, then remove).
+  open-claudia watch-list                        # watches on this channel + master switch state
+  open-claudia watch-remove <id>                 # remove a watch by id
+  open-claudia watch-on / watch-off              # global master switch for ALL watches (owner)
+
+The poll itself never touches the chat — only a real trigger wakes the agent
+and produces a normal reply. Each fire resumes the selected provider session
+captured when the schedule/watch was created. Provider/project switches made
 later do not retarget already-scheduled work.
 `;
 
@@ -123,10 +134,68 @@ async function runCronRemove(args) {
   } catch (e) { console.error(e.message); process.exit(1); }
 }
 
+async function runWatchAdd(args) {
+  if (args.length < 2 || args[0] === "--help") { console.log(HELP); process.exit(args[0] === "--help" ? 0 : 2); }
+  const rest = args.slice();
+  const label = takeFlag(rest, "label");
+  const schedule = takeFlag(rest, "every");
+  const project = takeFlag(rest, "project");
+  const repeatIdx = rest.indexOf("--repeat");
+  const repeat = repeatIdx >= 0;
+  if (repeat) rest.splice(repeatIdx, 1);
+  const check = rest[0];
+  const prompt = rest.slice(1).join(" ");
+  if (!check || !prompt) { console.error("Usage: watch-add \"<check-cmd>\" \"<wake-prompt>\" [--every \"<cron>\"] [--repeat]"); process.exit(2); }
+  try {
+    const request = { check, prompt, repeat, label: label || prompt.slice(0, 60) };
+    if (schedule) request.schedule = schedule;
+    if (project) request.project = project;
+    const res = await postJson("watch-add", request);
+    console.log(`Added watch ${res.job.id} (${repeat ? "repeating" : "one-shot"}, polls "${res.job.schedule}"). Silent until the check passes.`);
+    process.exit(0);
+  } catch (e) { console.error(e.message); process.exit(1); }
+}
+
+async function runWatchList() {
+  try {
+    const res = await postJson("watch-list", {});
+    const list = res.watches || [];
+    console.log(`Watches: master switch is ${res.enabled ? "ON" : "OFF"}.`);
+    if (list.length === 0) { console.log("No watches on this channel."); process.exit(0); }
+    for (const w of list) {
+      const mode = w.repeat ? "repeating" : "one-shot";
+      console.log(`${w.id}  ${mode}  polls "${w.schedule}"  check: ${w.check}  → ${w.label || "(no label)"}`);
+    }
+    process.exit(0);
+  } catch (e) { console.error(e.message); process.exit(1); }
+}
+
+async function runWatchRemove(args) {
+  const id = args[0];
+  if (!id) { console.error("Usage: watch-remove <id>"); process.exit(2); }
+  try {
+    const res = await postJson("watch-remove", { id });
+    console.log(res.ok ? `Removed watch ${id}.` : `Not found: ${id}.`);
+    process.exit(res.ok ? 0 : 1);
+  } catch (e) { console.error(e.message); process.exit(1); }
+}
+
+async function runWatchToggle(enabled) {
+  try {
+    const res = await postJson("watch-toggle", { enabled });
+    console.log(`Watches ${res.enabled ? "ENABLED" : "DISABLED"} globally.`);
+    process.exit(0);
+  } catch (e) { console.error(e.message); process.exit(1); }
+}
+
 module.exports = {
   HELP,
   runScheduleWakeup,
   runCronAdd,
   runCronList,
   runCronRemove,
+  runWatchAdd,
+  runWatchList,
+  runWatchRemove,
+  runWatchToggle,
 };

package/core/actions.js

@@ -28,7 +28,7 @@ const jobs = require("./jobs");
 const scheduler = require("./scheduler");
 const { sideChatCoordinator } = require("./side-chat");
 const {
-  getClaudeOAuthToken, runClaudeAuthCommand, runCodexLoginStatus, runCodexDeviceLogin,
+  claudeProviderAuthStatus, runClaudeAuthCommand, runCodexLoginStatus, runCodexDeviceLogin,
 } = require("./auth-flow");
 
 const REMOVED_PROVIDER_CALLBACK_MESSAGE = "This button is from an older Open Claudia release. Cursor Agent support has been removed. Open /backend to choose Claude Code or OpenAI Codex.";
@@ -335,7 +335,7 @@ async function handleAction(envelope) {
     const beLabel = provider.label;
     // Auth-aware: if the chosen provider isn't connected, start its login flow
     // now. The model is already set, so once auth completes the user is on it.
-    if (be === "claude" && !getClaudeOAuthToken().value) {
+    if (be === "claude" && claudeProviderAuthStatus().state !== "authenticated") {
       if (!isChatOwner(envelope.channelId)) { await send("Claude isn't connected and only the owner can sign it in."); return; }
       await send(`Set to ${model}, but Claude isn't connected yet. Starting login — open the URL I send, then paste the code here.`);
       await runClaudeAuthCommand(["auth", "login", "--claudeai"], "Claude login");

package/core/auth-flow.js

@@ -393,12 +393,14 @@ function codexAuthHelp(reason = "Codex authentication failed") {
 }
 
 // Quick "is this provider usable non-interactively" check for the unified
-// /login model picker. Claude is cheap (token presence is what the bot relies
-// on). Codex spawns `codex login status` once — fine for a setup screen.
+// /login model picker. Each provider resolves its real auth state once (Claude
+// via a bot token or the CLI credential store; Codex via `codex login status`)
+// — fine for a setup screen, and it stops a CLI-store login from looking
+// disconnected.
 function providerAuthStatus() {
   const binary = codexExecutable();
   return {
-    claude: !!getClaudeOAuthToken().value,
+    claude: claudeProviderAuthStatus().state === "authenticated",
     codex: binary ? runCodexLoginStatus().ok : false,
   };
 }

package/core/credential-detect.js

@@ -0,0 +1,55 @@
+"use strict";
+
+// Pure classification of a pasted chat message into a credential disposition.
+// No side effects — the router performs the actual store/delete/confirm. Kept
+// standalone (no requires) so it can be unit-tested without loading the
+// router's dependency graph, and so the ordering rules live in one place.
+//
+// Disposition kinds:
+//   claude  — a Claude Code OAuth token   → saved to .env + vault
+//   openai  — an OpenAI API key           → handed to the Codex CLI
+//   keyring — another recognised secret   → operational keyring (name provided)
+//   scrub   — an ambiguous long token     → delete from chat but still answer
+//   none    — ordinary text               — leave the message alone
+//
+// A recognised service prefix is claimed BEFORE the generic long-opaque Claude
+// heuristic, otherwise a long GitHub/GitLab token would be mistaken for a
+// Claude token. sk-ant- is claimed before the generic OpenAI sk- shape.
+
+function classifyPastedCredential(raw) {
+  const text = String(raw || "").trim();
+  if (!text) return { kind: "none" };
+
+  if (/^sk-ant-[A-Za-z0-9._-]+$/.test(text)) return { kind: "claude" };
+  if (/^sk-(?:proj-)?[A-Za-z0-9._-]{20,}$/.test(text)) return { kind: "openai" };
+
+  const byPrefix = [
+    [/^glpat-[A-Za-z0-9._-]{8,}$/, "gitlab_token"],
+    [/^(?:ghp_|gho_|github_pat_)[A-Za-z0-9._-]{8,}$/, "github_token"],
+    [/^(?:xoxb-|xoxp-)[A-Za-z0-9-]{8,}$/, "slack_token"],
+    [/^AKIA[0-9A-Z]{8,}$/, "aws_access_key_id"],
+    [/^AIza[0-9A-Za-z._-]{10,}$/, "google_api_key"],
+  ];
+  for (const [re, name] of byPrefix) if (re.test(text)) return { kind: "keyring", name, value: text };
+
+  // A labelled secret ("token: <value>", "Bearer <value>") — only when the
+  // value is a single secret-shaped token, so "key: the answer is 42" is left
+  // as ordinary text rather than swallowed.
+  const labeled = text.match(/^(Bearer)\s+(\S{12,})$/i)
+    || text.match(/^(token|key|secret|password)\s*:\s*(\S{12,})$/i);
+  if (labeled) {
+    const name = labeled[1].toLowerCase() === "bearer" ? "bearer_token" : labeled[1].toLowerCase();
+    return { kind: "keyring", name, value: labeled[2] };
+  }
+
+  // Long opaque token with no sk- prefix → Claude OAuth token shape.
+  if (!/^sk-/.test(text) && text.length >= 80 && /^[A-Za-z0-9._=-]+$/.test(text)) return { kind: "claude" };
+
+  // Ambiguous long single token: scrub it from the chat (it may be a secret)
+  // but let the turn proceed so the agent can still respond.
+  if (/^[A-Za-z0-9_-]{20,}$/.test(text)) return { kind: "scrub" };
+
+  return { kind: "none" };
+}
+
+module.exports = { classifyPastedCredential };

package/core/handlers.js

@@ -2105,6 +2105,79 @@ register({
   },
 });
 
+// ── Watch (silent background monitor) ──────────────────────────────
+// A watch is a cron carrying a shell `check`. The scheduler polls the check
+// silently — nothing reaches the chat — and wakes the agent with `prompt`
+// only when the check exits 0. Owner-only: the check is arbitrary shell on
+// the bot host.
+
+register({
+  name: "watch", description: "Silent background monitor: poll a shell check, ping you only on a hit", args: "[add \"<check>\" \"<prompt>\" [repeat] | remove <#> | on | off]", ownerOnly: true,
+  handler: async (env, { tail }) => {
+    if (!ownerEnv(env)) return send("Owner only — a watch runs shell commands on my host.");
+    const channelWatches = () => jobs.listForChannel(env.adapter.id, env.channelId).filter((j) => !!j.check);
+
+    if (!tail) {
+      const list = channelWatches();
+      const master = scheduler.watchesEnabled() ? "ON" : "OFF";
+      if (list.length === 0) {
+        return send([
+          `No watches. Master switch: ${master}.`,
+          "",
+          "A watch silently polls a shell check and only pings you when it passes — nothing hits the chat until then.",
+          "",
+          'Add: /watch add "<check-cmd>" "<wake-prompt>"',
+          'e.g. /watch add "curl -sf https://myapp/health || exit 1" "myapp health check failed — take a look"',
+          "Add `repeat` at the end to keep polling after it fires (default: one-shot).",
+        ].join("\n"));
+      }
+      return send(
+        `Watches (master switch: ${master}):\n\n` +
+        list.map((w, i) => `${i + 1}. ${w.label} — polls "${w.schedule}"${w.repeat ? " (repeating)" : " (one-shot)"}\n   check: ${w.check}`).join("\n") +
+        "\n\nRemove: /watch remove <#>\nToggle all: /watch on | /watch off",
+      );
+    }
+
+    if (/^on$/i.test(tail)) {
+      scheduler.setWatchesEnabled(true);
+      return send("✅ Watches ENABLED. Existing watches resume polling.");
+    }
+    if (/^off$/i.test(tail)) {
+      scheduler.setWatchesEnabled(false);
+      return send("⏸️ Watches DISABLED globally. Polling is paused and nothing will fire until /watch on. Your watches are kept.");
+    }
+
+    const addMatch = tail.match(/^add\s+"([^"]+)"\s+"([^"]+)"(?:\s+(repeat))?$/i);
+    if (addMatch) {
+      const job = scheduler.addWatch({
+        adapter: env.adapter.id,
+        adapterType: env.adapter.type,
+        channelId: String(env.channelId),
+        canonicalUserId: env.canonicalUserId,
+        project: "Workspace",
+        projectDir: WORKSPACE,
+        check: addMatch[1],
+        prompt: addMatch[2],
+        label: addMatch[2].slice(0, 50),
+        source: "user",
+        repeat: !!addMatch[3],
+      });
+      return send(`👁️ Watching (${addMatch[3] ? "repeating" : "one-shot"}, polls "${job.schedule}"). I'll stay quiet until the check passes, then ping you.`);
+    }
+
+    const removeMatch = tail.match(/^remove\s+(\d+)$/);
+    if (removeMatch) {
+      const list = channelWatches();
+      const idx = parseInt(removeMatch[1], 10) - 1;
+      if (idx < 0 || idx >= list.length) return send("Invalid number.");
+      const removed = scheduler.removeJob(list[idx].id);
+      return send(`Removed watch: ${removed ? removed.label : "(unknown)"}`);
+    }
+
+    send('Usage: /watch | /watch add "<check-cmd>" "<wake-prompt>" [repeat] | /watch remove <#> | /watch on | /watch off');
+  },
+});
+
 // ── Channels ───────────────────────────────────────────────────────
 
 register({

package/core/loopback.js

@@ -74,6 +74,7 @@ function readBodyToFile(req, dest) {
 const SEND_KINDS = new Set(["send-file", "send-voice", "send-photo"]);
 const JSON_KINDS = new Set([
   "schedule-wakeup", "cron-add", "cron-remove", "job-list",
+  "watch-add", "watch-list", "watch-remove", "watch-toggle",
   "task-add", "task-plan", "task-update", "task-remove", "task-list", "task-get", "task-tree", "task-clear-completed",
   "people-list", "people-show", "people-add", "people-note", "people-link", "people-unlink",
   "people-remove", "people-set-primary",
@@ -238,6 +239,57 @@ async function handleJson(req, res, url, kind) {
     return reply(res, 200, { ok: true, jobs: list, archived });
   }
 
+  // A watch is a cron carrying a shell `check`; the scheduler polls the check
+  // silently and only wakes the agent (with `prompt`) when it exits 0.
+  if (kind === "watch-add") {
+    if (!payload.check || !payload.prompt) return reply(res, 400, { error: "missing check/prompt" });
+    const job = scheduler.addWatch({
+      adapter: adapterId,
+      adapterType: adapter.type,
+      channelId,
+      canonicalUserId: payload.canonicalUserId || null,
+      userId: payload.userId || null,
+      provider: payload.provider || null,
+      providerSettings: payload.providerSettings || {},
+      project: payload.project || null,
+      projectDir: payload.projectDir || null,
+      check: String(payload.check),
+      prompt: String(payload.prompt),
+      label: String(payload.label || payload.prompt).slice(0, 60),
+      schedule: payload.schedule ? String(payload.schedule) : undefined,
+      repeat: !!payload.repeat,
+      source: payload.source || "agent",
+      sessionId: payload.sessionId || null,
+      previousSessionId: payload.previousSessionId || null,
+      originRunId: payload.originRunId || null,
+      sessionLineage: {
+        originRunId: payload.originRunId || null,
+        originSessionId: payload.sessionId || null,
+        previousSessionId: payload.previousSessionId || null,
+        originProject: payload.originProject || payload.project || null,
+      },
+    });
+    return reply(res, 200, { ok: true, job });
+  }
+
+  if (kind === "watch-list") {
+    const list = jobsStore.listForChannel(adapterId, channelId).filter((job) => !!job.check);
+    return reply(res, 200, { ok: true, watches: list, enabled: scheduler.watchesEnabled() });
+  }
+
+  if (kind === "watch-remove") {
+    const id = payload.id || url.searchParams.get("id");
+    if (!id) return reply(res, 400, { error: "missing id" });
+    const removed = scheduler.removeJob(id);
+    return reply(res, removed ? 200 : 404, { ok: !!removed, removed });
+  }
+
+  if (kind === "watch-toggle") {
+    if (typeof payload.enabled !== "boolean") return reply(res, 400, { error: "missing enabled boolean" });
+    const enabled = scheduler.setWatchesEnabled(payload.enabled);
+    return reply(res, 200, { ok: true, enabled });
+  }
+
   if (kind === "task-add") {
     if (!payload.content) return reply(res, 400, { error: "missing content" });
     try {

package/core/router.js

@@ -22,8 +22,10 @@ const {
   clearPendingClaudeAuth, clearPendingCodexAuth,
   sendClaudeAuthStatusSummary, sendCodexAuthStatusSummary,
 } = require("./auth-flow");
-const { redactSensitive } = require("./redact");
+const { redactSensitive, registerSecrets } = require("./redact");
 const { MAX_FILE_SIZE, MAX_VOICE_SIZE, FILES_DIR } = require("./config");
+const keyring = require("./keyring");
+const { classifyPastedCredential } = require("./credential-detect");
 const channelWizard = require("./channel-wizard");
 require("./handlers"); // side-effect: register slash commands
 
@@ -272,6 +274,51 @@ async function handleDocument(envelope) {
   } catch (err) { await send(`Failed: ${err.message}`); }
 }
 
+// Provider-agnostic capture of a credential pasted into chat with no auth
+// flow active. Before v3.0.37 such a paste was merely deleted and then still
+// forwarded to the model — which, under Codex, refused it as a policy
+// violation. Now the router classifies it and stores it out-of-band (Claude
+// token → .env/vault, OpenAI key → Codex CLI, other recognised secrets →
+// operational keyring), deletes the message, confirms, and stops. The model
+// never sees the secret. Returns true when it fully handled the message
+// (caller must stop), false to let the turn proceed normally.
+async function captureLooseCredential(text, envelope) {
+  const disposition = classifyPastedCredential(text);
+  switch (disposition.kind) {
+    case "claude": {
+      await deleteMessage(envelope.messageId);
+      registerSecrets(text);
+      saveClaudeOAuthToken(text);
+      await send(`Saved your Claude token to .env${vault.isUnlocked() ? " and vault" : ""} and deleted your message so it isn't left in chat. Restart with /restart so I pick it up.`);
+      return true;
+    }
+    case "openai": {
+      await deleteMessage(envelope.messageId);
+      registerSecrets(text);
+      const result = await saveCodexApiKeyWithCli(text);
+      await send(result.ok
+        ? "Saved your OpenAI API key via the Codex CLI and deleted your message. I never printed it."
+        : `Deleted your message, but the Codex CLI couldn't store that key: ${redactSensitive(result.output).slice(-400)}`);
+      return true;
+    }
+    case "keyring": {
+      await deleteMessage(envelope.messageId);
+      registerSecrets(disposition.value);
+      keyring.set(disposition.name, disposition.value);
+      await send(`Stored that secret in the operational keyring as \`${disposition.name}\` and deleted your message. Manage it with /keyring.`);
+      return true;
+    }
+    case "scrub": {
+      // Ambiguous long token: strip it from the chat but let the turn proceed
+      // (it may be an id/arg the agent legitimately needs to act on).
+      await deleteMessage(envelope.messageId);
+      return false;
+    }
+    default:
+      return false;
+  }
+}
+
 async function handleText(envelope) {
   if (isDuplicate(envelope)) return;
   const state = currentState();
@@ -448,17 +495,14 @@ async function handleText(envelope) {
   }
 
   const text = envelope.text || "";
+
+  // Loose credential paste with no auth flow active: store it out-of-band and
+  // stop, instead of forwarding a secret to the model (Codex refuses those).
+  if (await captureLooseCredential(text.trim(), envelope)) return;
+
   const runContext = admitRunContext(text, state.currentSession.dir, envelope.messageId, { purpose: "foreground" });
   const attachments = [];
   const imagePaths = [];
-  const credPatterns = [
-    /^(sk-ant-|sk-|glpat-|ghp_|gho_|github_pat_|xoxb-|xoxp-|AKIA|AIza)/,
-    /^[A-Za-z0-9_-]{20,}$/,
-    /^(Bearer |token:|key:|secret:|password:)/i,
-  ];
-  if (credPatterns.some((p) => p.test(text.trim()))) {
-    await deleteMessage(envelope.messageId);
-  }
 
   let prompt = text;
   const reply = envelope.reply;

package/core/scheduler.js

@@ -10,6 +10,8 @@ const crypto = require("crypto");
 const fs = require("fs");
 const path = require("path");
 const cron = require("node-cron");
+const { spawn } = require("child_process");
+const CONFIG_DIR = require("../config-dir");
 
 const {
   CRONS_FILE,
@@ -34,6 +36,10 @@ const { redactSensitive } = require("./redact");
 const MISSED_WAKEUP_GRACE_MS = 60 * 60 * 1000;
 const RETRY_DELAY_MS = 30 * 1000;
 const BUSY_DELAY_MS = 30 * 1000;
+// A watch's `check` command is capped so a hung poll can't wedge the tick.
+const WATCH_CHECK_TIMEOUT_MS = 30 * 1000;
+const WATCH_LOG_FILE = process.env.OPEN_CLAUDIA_WATCH_LOG_FILE || path.join(CONFIG_DIR, "watch.log");
+const WATCHES_ENABLED_FILE = process.env.OPEN_CLAUDIA_WATCHES_ENABLED_FILE || path.join(CONFIG_DIR, "watches-enabled");
 
 function uniqueId(prefix = "occ") {
   return typeof crypto.randomUUID === "function"
@@ -53,6 +59,13 @@ function terminalRunSucceeded(result) {
   return true;
 }
 
+// A one-shot fires exactly once then is removed after a successful run: a
+// wakeup, or a watch (a cron carrying a shell `check`) created without repeat
+// polling. A repeat watch stays pending and keeps polling like any cron.
+function isOneShot(job) {
+  return job.kind === "wakeup" || (!!job.check && !job.repeat);
+}
+
 function providerIsRunnable(status) {
   if (!status || status.availability?.state !== "available") return false;
   if (status.compatibility?.state === "incompatible") return false;
@@ -96,6 +109,30 @@ function createSchedulerService(dependencies = {}) {
   const runInProvider = dependencies.runAgent || ((...args) => require("./runner").runAgent(...args));
   const admit = dependencies.admitRunContext || ((...args) => require("./runner").admitRunContext(...args));
   const timers = new Map();
+  const checksInFlight = new Set();
+  // Poll a watch's `check`: exit 0 → the watched condition is met, wake the
+  // agent; non-zero → still idle, skip silently. Runs in the job's project
+  // dir with the process env, output discarded (exit code is the contract),
+  // hard-capped by WATCH_CHECK_TIMEOUT_MS. Injectable so tests stay hermetic.
+  const runWatchCheck = dependencies.runWatchCheck || ((command, job) => new Promise((resolve) => {
+    const cwd = (job && projectDescriptor(job).dir) || workspace || process.cwd();
+    let settled = false;
+    const finish = (code, timedOut) => {
+      if (settled) return;
+      settled = true;
+      try { clearTimer(timer); } catch (_) {}
+      resolve({ code, timedOut: !!timedOut });
+    };
+    let child;
+    try {
+      child = spawn("sh", ["-c", String(command)], { cwd, env: process.env, stdio: "ignore" });
+    } catch (error) {
+      return resolve({ code: 127, timedOut: false });
+    }
+    const timer = setTimer(() => { try { child.kill("SIGKILL"); } catch (_) {} finish(124, true); }, WATCH_CHECK_TIMEOUT_MS);
+    child.on("close", (code) => finish(code == null ? 1 : code, false));
+    child.on("error", () => finish(127, false));
+  }));
   let adapters = Array.isArray(dependencies.adapters) ? dependencies.adapters.slice() : [];
 
   function setAdapters(list) {
@@ -186,7 +223,7 @@ function createSchedulerService(dependencies = {}) {
 
   function wrappedPrompt(job, target) {
     const firedAt = new Date(now()).toISOString();
-    const header = job.kind === "cron" ? "Scheduled cron" : "Scheduled wakeup";
+    const header = job.check ? "Watch triggered" : job.kind === "cron" ? "Scheduled cron" : "Scheduled wakeup";
     if (target.fallbackFrom) {
       return [
         `[${header} "${job.label}" fired at ${firedAt}; occurrence ${job.occurrenceId}]`,
@@ -270,7 +307,7 @@ function createSchedulerService(dependencies = {}) {
     catch (error) { return { ok: false, status: "failed", error: stableFailure(error), result }; }
     if (!marked) return { ok: false, status: "failed", error: { code: "JOB_PERSIST_FAILED", message: "Scheduled success marker was not persisted" }, result };
 
-    if (job.kind === "wakeup") {
+    if (isOneShot(job)) {
       try {
         const removed = jobsStore.remove(job.id);
         if (!removed) throw new Error("successful one-shot could not be removed after its durable success marker");
@@ -308,12 +345,34 @@ function createSchedulerService(dependencies = {}) {
     if (job.status === "running" && Number(job.nextAttemptAt || 0) > now()) {
       return { ok: false, status: "running", skipped: true, inFlight: true };
     }
-    if (job.status === "succeeded" && job.kind === "wakeup") {
+    if (job.status === "succeeded" && isOneShot(job)) {
       try { jobsStore.remove(job.id); } catch (_) {}
       unscheduleJob(job.id);
       return { ok: true, status: "succeeded", finalized: true };
     }
 
+    // Watch poll gate. A watch is a cron carrying a shell `check`; each tick
+    // runs the check and only wakes the agent when it exits 0. A non-zero exit
+    // is the normal idle case: skip silently, mark nothing, leave the job
+    // pending so the next tick polls again. Never marks failure; never chats.
+    if (job.check) {
+      if (!watchesEnabled()) {
+        logWatch(job, "skipped (watches disabled globally)");
+        return { ok: false, status: "watch-disabled", skipped: true };
+      }
+      if (checksInFlight.has(job.id)) return { ok: false, status: "watch-checking", skipped: true };
+      checksInFlight.add(job.id);
+      let check;
+      try { check = await runWatchCheck(job.check, job); }
+      catch (_) { check = { code: 1, timedOut: false }; }
+      finally { checksInFlight.delete(job.id); }
+      if (!check || check.code !== 0) {
+        logWatch(job, check && check.timedOut ? "idle (check timed out)" : `idle (check exit ${check ? check.code : "?"})`);
+        return { ok: false, status: "watch-idle", skipped: true };
+      }
+      logWatch(job, "triggered (check passed) — waking agent");
+    }
+
     const adapter = resolveAdapter(job);
     if (!adapter) {
       try { return markFailure(job, { code: "SCHEDULED_ADAPTER_UNAVAILABLE", message: "Saved channel adapter is unavailable" }); }
@@ -385,7 +444,7 @@ function createSchedulerService(dependencies = {}) {
         return { ok: false, status: "failed", error: stableFailure(error) };
       }
 
-      try { await send(`Wakeup: ${job.label}`); } catch (_) { /* advisory only */ }
+      try { await send(job.check ? `🔔 Watch "${job.label}" triggered` : `Wakeup: ${job.label}`); } catch (_) { /* advisory only */ }
       let result;
       try { result = await runInProvider(prompt, runContext.cwd, null, { ...runOptions, runContext }); }
       catch (error) {
@@ -403,7 +462,7 @@ function createSchedulerService(dependencies = {}) {
   function scheduleJob(job) {
     unscheduleJob(job.id);
     if (!job || job.disabled || ["archived", "dead-letter"].includes(job.status)) return false;
-    if (job.status === "succeeded" && job.kind === "wakeup") {
+    if (job.status === "succeeded" && isOneShot(job)) {
       try { jobsStore.remove(job.id); } catch (_) {}
       return false;
     }
@@ -514,6 +573,41 @@ function createSchedulerService(dependencies = {}) {
     return job;
   }
 
+  // Global master switch for all watches (owner's /watch off). Absent file →
+  // enabled (default ON). Only the poll gate consults it; wakeups/crons are
+  // untouched.
+  function watchesEnabled() {
+    try { return fs.readFileSync(WATCHES_ENABLED_FILE, "utf8").trim() !== "off"; }
+    catch (_) { return true; }
+  }
+
+  function setWatchesEnabled(on) {
+    try { fs.writeFileSync(WATCHES_ENABLED_FILE, on ? "on" : "off"); } catch (_) {}
+    return !!on;
+  }
+
+  // Append-only audit of watch poll activity. NEVER sent to chat — this is the
+  // whole point of a watch: the polling stays out of the conversation, only a
+  // real trigger wakes the agent and surfaces in chat.
+  function logWatch(job, event) {
+    const line = `[${new Date(now()).toISOString()}] job=${job.id} label=${JSON.stringify(job.label || "")} ${event}\n`;
+    try { fs.appendFileSync(WATCH_LOG_FILE, line); } catch (_) {}
+  }
+
+  // A watch is a cron carrying a shell `check`; it rides the migration-verified
+  // jobs store untouched (check/repeat survive normalizeRunnableJob as extra
+  // fields). Default schedule polls every minute; default is one-shot.
+  function addWatch(spec) {
+    return addJob({
+      ...spec,
+      kind: "cron",
+      schedule: spec.schedule || "* * * * *",
+      check: String(spec.check || "").trim(),
+      repeat: !!spec.repeat,
+      label: spec.label || String(spec.prompt || "watch").slice(0, 60),
+    });
+  }
+
   function removeJob(id) {
     unscheduleJob(id);
     return jobsStore.remove(id);
@@ -529,6 +623,9 @@ function createSchedulerService(dependencies = {}) {
     scheduleJob,
     unscheduleJob,
     addJob,
+    addWatch,
+    watchesEnabled,
+    setWatchesEnabled,
     removeJob,
     stopAll,
     fireJob,
@@ -561,6 +658,9 @@ module.exports = {
   scheduleJob: service.scheduleJob,
   unscheduleJob: service.unscheduleJob,
   addJob: service.addJob,
+  addWatch: service.addWatch,
+  watchesEnabled: service.watchesEnabled,
+  setWatchesEnabled: service.setWatchesEnabled,
   removeJob: service.removeJob,
   stopAll: service.stopAll,
   fireJob: service.fireJob,

package/core/system-prompt.js

@@ -241,6 +241,12 @@ Wake-ups and crons (real schedulers, not hallucinations — use them instead of
 - \`open-claudia cron-list\` — list all wakeups + crons on this channel.
 - \`open-claudia cron-remove <id>\` — cancel one.
 
+Watches (a silent background monitor — poll a condition WITHOUT waking every tick; wake only when it actually happens). Use this instead of a minute-by-minute cron whenever you'd otherwise fire a turn just to check "is it done yet?" and stay quiet most times:
+- \`open-claudia watch-add "<check-cmd>" "<wake-prompt>"\` — the scheduler polls \`<check-cmd>\` as a shell command (default every minute). The poll is SILENT: nothing reaches the chat while the check keeps failing. The instant \`<check-cmd>\` exits 0, you wake in this same conversation with \`<wake-prompt>\`, exactly like a wakeup. Non-zero exit = still waiting = nothing happens. Default is ONE-SHOT (fires once, then removes itself); add \`--repeat\` to keep polling after each hit. \`--every "<5-field cron>"\` changes the poll cadence.
+- \`open-claudia watch-list\` / \`open-claudia watch-remove <id>\` — inspect/cancel watches on this channel.
+- The owner has a global master switch: \`/watch off\` pauses ALL watch polling (and \`/watch on\` resumes). If \`watch-list\` shows the switch OFF, watches won't fire until it's back on.
+- Example: after kicking off a long external job, \`open-claudia watch-add "test -f /tmp/build-done || exit 1" "the build finished — verify and report"\` beats a wakeup guess, because it fires the moment it's actually done, not on a fixed timer. (Never use a watch to poll harness-tracked work you started — that notifies you automatically. Watches are for EXTERNAL state the harness can't see.)
+
 The selected coding-agent provider may expose native scheduling tools. Do NOT use those for Open Claudia wakeups or crons: a provider runs as a per-turn subprocess, so its timers do not belong to the long-running bot. Only the \`open-claudia\` CLI commands above are authoritative and survive.
 
 Persistent todo list with plans + subtasks (per channel; survives compaction and restart).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.0.35",
+  "version": "3.0.37",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {
@@ -9,7 +9,7 @@
   "scripts": {
     "setup": "node setup.js",
     "start": "node bot.js",
-    "pretest": "node test-provider-fixture.js && node test-provider-core-prompt.js && node test-provider-prompt-parity.js && node test-provider-env-isolation.js && node test-provider-resume-parity.js && node test-provider-bootstrap.js && node test-provider-registry.js && node test-provider-stream-decoder.js && node test-provider-events.js && node test-provider-claude.js && node test-provider-codex.js && node test-provider-runner.js && node test-provider-run-lifecycle.js && node test-provider-gateway.js && node test-provider-side-chat.js && node test-single-runtime.js && node test-provider-migration-backup.js && node test-provider-state-migration.js && node test-provider-session-history.js && node test-provider-session-commands.js && node test-provider-compaction.js && node test-provider-scheduler.js && node test-cursor-removal.js && node test-utility-provider-policy.js && node test-provider-subagent.js && node test-provider-recall.js && node test-provider-pack-review.js && node test-memory-mutation-queue.js && node test-provider-dream.js && node test-provider-enforcer.js && node test-provider-tool-hooks.js && node test-provider-boot-matrix.js && node test-provider-capabilities.js && node test-provider-language.js && node test-provider-coupling-audit.js && node test-provider-parity-e2e.js && node test-kazee-channel-health.js && node test-prompt-budget.js && node test-agency-ledger.js && node test-agency-deliberate.js && node test-guardrail.js && node test-spaces-comment-content.js",
+    "pretest": "node test-provider-fixture.js && node test-provider-core-prompt.js && node test-provider-prompt-parity.js && node test-provider-env-isolation.js && node test-provider-resume-parity.js && node test-provider-bootstrap.js && node test-provider-registry.js && node test-provider-stream-decoder.js && node test-provider-events.js && node test-provider-claude.js && node test-provider-codex.js && node test-provider-runner.js && node test-provider-run-lifecycle.js && node test-provider-gateway.js && node test-provider-side-chat.js && node test-single-runtime.js && node test-provider-migration-backup.js && node test-provider-state-migration.js && node test-provider-session-history.js && node test-provider-session-commands.js && node test-provider-compaction.js && node test-provider-scheduler.js && node test-credential-capture.js && node test-cursor-removal.js && node test-utility-provider-policy.js && node test-provider-subagent.js && node test-provider-recall.js && node test-provider-pack-review.js && node test-memory-mutation-queue.js && node test-provider-dream.js && node test-provider-enforcer.js && node test-provider-tool-hooks.js && node test-provider-boot-matrix.js && node test-provider-capabilities.js && node test-provider-language.js && node test-provider-coupling-audit.js && node test-provider-parity-e2e.js && node test-kazee-channel-health.js && node test-prompt-budget.js && node test-agency-ledger.js && node test-agency-deliberate.js && node test-guardrail.js && node test-spaces-comment-content.js",
     "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-usage-accounting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-evolution.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-approval-async.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-unified-identity.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-queue-routing.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-persona-packs.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-speaker-persona.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-persona-pipeline.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-relationship-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-relationship.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-enforcer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-identity-prune.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-kazee-message-id.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-delivery-contract.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-run-lock.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-web-sessions.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-poll-recovery.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-409-grace.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-conflict-heal-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-single-instance.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-streaming-split.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-spaces-autoenable.js"
   },
   "files": [
@@ -95,6 +95,7 @@
     "test-provider-session-commands.js",
     "test-provider-compaction.js",
     "test-provider-scheduler.js",
+    "test-credential-capture.js",
     "test-cursor-removal.js",
     "test-utility-provider-policy.js",
     "test-provider-subagent.js",

package/test-credential-capture.js

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+
+"use strict";
+
+// Loose credential capture: a pasted secret must be stored out-of-band and the
+// turn stopped BEFORE the message reaches the model — regardless of which
+// provider is active. This is the Codex complaint: Codex refuses secrets in its
+// prompt, so the harness has to intercept the paste itself rather than forward
+// it. Two layers are covered here:
+//   1. the pure classifier (core/credential-detect.js) — the decision logic
+//   2. the router wiring (core/router.js) — capture precedes admitRunContext and
+//      each disposition routes to the right sink, provider-agnostically.
+
+const assert = require("assert");
+const fs = require("fs");
+const path = require("path");
+
+const root = __dirname;
+const { classifyPastedCredential } = require("./core/credential-detect");
+
+function classifierProbe() {
+  const kind = (text) => classifyPastedCredential(text).kind;
+
+  // Claude OAuth: the sk-ant- prefix and the long opaque no-sk shape.
+  assert.strictEqual(kind("sk-ant-oat01-" + "A".repeat(40)), "claude");
+  assert.strictEqual(kind("x".repeat(80)), "claude", "long opaque token with no sk- prefix reads as a Claude token");
+  assert.strictEqual(kind("A1b2C3d4_" + "e".repeat(80)), "claude");
+
+  // OpenAI API keys go to the Codex CLI — the whole point of the fix.
+  assert.strictEqual(kind("sk-" + "a".repeat(40)), "openai");
+  assert.strictEqual(kind("sk-proj-" + "b".repeat(40)), "openai");
+
+  // Recognised service prefixes are claimed before the generic Claude heuristic.
+  const keyring = (text) => {
+    const d = classifyPastedCredential(text);
+    return `${d.kind}:${d.name}`;
+  };
+  assert.strictEqual(keyring("glpat-" + "x".repeat(20)), "keyring:gitlab_token");
+  assert.strictEqual(keyring("ghp_" + "x".repeat(36)), "keyring:github_token");
+  assert.strictEqual(keyring("github_pat_" + "x".repeat(40)), "keyring:github_token");
+  assert.strictEqual(keyring("xoxb-" + "1".repeat(20)), "keyring:slack_token");
+  assert.strictEqual(keyring("AKIA" + "ABCDEFGH1234"), "keyring:aws_access_key_id");
+  assert.strictEqual(keyring("AIza" + "a".repeat(30)), "keyring:google_api_key");
+
+  // A long sk-ant- token must win over the generic long-opaque Claude branch,
+  // and over the OpenAI sk- shape.
+  assert.strictEqual(kind("sk-ant-" + "z".repeat(90)), "claude");
+
+  // Labelled single-token secrets land in the keyring with a derived name.
+  const labelled = classifyPastedCredential("token: " + "s".repeat(24));
+  assert.strictEqual(labelled.kind, "keyring");
+  assert.strictEqual(labelled.name, "token");
+  assert.strictEqual(labelled.value, "s".repeat(24));
+  assert.strictEqual(classifyPastedCredential("Bearer " + "t".repeat(24)).name, "bearer_token");
+
+  // A label followed by prose is ordinary text, not a swallowed secret.
+  assert.strictEqual(kind("key: the answer is 42"), "none");
+
+  // Ambiguous medium-length single token → scrub from chat, but let the turn run.
+  assert.strictEqual(kind("A1b2C3d4E5f6G7h8I9j0"), "scrub");
+
+  // Ordinary conversation and empties are left completely alone.
+  assert.strictEqual(kind("hey can you check the deploy status"), "none");
+  assert.strictEqual(kind("what colour are the fish?"), "none");
+  assert.strictEqual(kind(""), "none");
+  assert.strictEqual(kind("   "), "none");
+  assert.strictEqual(kind("short"), "none");
+  assert.strictEqual(kind(null), "none");
+}
+
+function routerWiringProbe() {
+  const source = fs.readFileSync(path.join(root, "core", "router.js"), "utf8");
+
+  // The classifier is imported and driven through a single capture funnel.
+  assert.match(source, /classifyPastedCredential/, "router must use the pure classifier");
+  assert.match(source, /async function captureLooseCredential/, "router must define the capture funnel");
+
+  // Capture must run — and short-circuit the turn — BEFORE the model is admitted,
+  // so a pasted secret never becomes part of a provider prompt.
+  const captureIdx = source.indexOf("if (await captureLooseCredential(");
+  const admitIdx = source.indexOf("admitRunContext(text,");
+  assert.ok(captureIdx > 0, "handleText must call captureLooseCredential");
+  assert.ok(admitIdx > 0, "handleText must still admit ordinary turns");
+  assert.ok(captureIdx < admitIdx, "credential capture must precede admitRunContext so secrets never reach the model");
+
+  // Capture is provider-agnostic: it must not branch on the active backend/provider.
+  const fnStart = source.indexOf("async function captureLooseCredential");
+  const fnEnd = source.indexOf("\nasync function handleText", fnStart);
+  const fnBody = source.slice(fnStart, fnEnd);
+  assert.ok(fnEnd > fnStart, "captureLooseCredential body must be locatable");
+  assert.ok(!/settings\.backend|state\.settings|activeProvider|currentProvider/.test(fnBody),
+    "credential capture must not depend on which provider is active");
+
+  // Each disposition routes to its sink, and every stored secret is redaction-
+  // registered and deleted from the chat.
+  assert.match(fnBody, /saveClaudeOAuthToken\(/, "claude paste → save Claude OAuth token");
+  assert.match(fnBody, /saveCodexApiKeyWithCli\(/, "openai paste → hand to Codex CLI");
+  assert.match(fnBody, /keyring\.set\(/, "recognised secret → operational keyring");
+  assert.match(fnBody, /registerSecrets\(/, "captured secrets are registered for redaction");
+  assert.match(fnBody, /deleteMessage\(/, "captured secrets are deleted from the chat");
+}
+
+function main() {
+  classifierProbe();
+  routerWiringProbe();
+  console.log("credential capture OK");
+}
+
+main();

package/test-provider-language.js

@@ -32,15 +32,21 @@ assert.doesNotMatch(setup, /Your Claude Code bot is connected|Description=Claude
 
 const pkg = JSON.parse(read("package.json"));
 assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
-// 3.0.35 approved by Sumeet 2026-07-17 ("yes will this also ship the issue of
-// new lines not showing properly?"): Spaces comments become real ProseMirror
-// docs. buildCommentContent used to post the whole reply as ONE text node in
-// ONE paragraph, so TipTap collapsed every newline and printed markdown
-// asterisks literally — the unreadable-wall screenshot from the euvy bot
-// thread. Now markdown converts to paragraphs/hardBreaks, bold/italic/code
-// marks, bullet/ordered lists, headings, code blocks and dividers — all node
-// types verified present in the Spaces editor schema.
-assert.strictEqual(pkg.version, "3.0.35", "release version must remain unchanged without explicit approval");
+// 3.0.36 approved by Sumeet 2026-07-17 ("One bug is when you change model to a
+// Claude it asks you to sign in again" → "Go ahead"): picking a Claude model no
+// longer forces a re-login. The model-button handler and the /login picker
+// judged "connected?" from a shallow token probe (getClaudeOAuthToken) that
+// only sees .env/process-env/vault tokens, so a Claude CLI-store login read as
+// disconnected and every tap restarted login — a loop, since that login stores
+// no bot token. Both now use claudeProviderAuthStatus() (honours a bot token
+// AND a `claude auth status` CLI-store login), matching the Codex branch.
+// 3.0.37 approved by Sumeet 2026-07-17 ("when done please push out the new
+// version"): adds silent background watches (a cron carrying a shell `check`
+// that only wakes the agent on exit 0, owner-gated via /watch) and
+// provider-agnostic loose-credential capture (a pasted secret is stored
+// out-of-band and the turn stopped before the model — Codex refuses secrets in
+// its prompt, so the harness intercepts the paste itself).
+assert.strictEqual(pkg.version, "3.0.37", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }

package/test-provider-scheduler.js

@@ -10,6 +10,14 @@ const path = require("path");
 const root = __dirname;
 const fixturesRoot = path.join(root, "test-fixtures", "migrations");
 
+// Keep watch state off the real ~/.open-claudia during the run. scheduler.js
+// reads these paths from env at require time, so they must be set before main()
+// pulls in ./core/scheduler.
+const watchTmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "oc-watch-test-"));
+process.env.OPEN_CLAUDIA_WATCH_LOG_FILE = path.join(watchTmpDir, "watch.log");
+process.env.OPEN_CLAUDIA_WATCHES_ENABLED_FILE = path.join(watchTmpDir, "watches-enabled");
+const watchesEnabledFile = process.env.OPEN_CLAUDIA_WATCHES_ENABLED_FILE;
+
 function readFixture(name, file = "jobs.json") {
   return JSON.parse(fs.readFileSync(path.join(fixturesRoot, name, file), "utf8"));
 }
@@ -423,6 +431,7 @@ function schedulerHarness(createSchedulerService, seed, options = {}) {
     retryDelayMs: 1000,
     busyDelayMs: 250,
     missedGraceMs: 60 * 60 * 1000,
+    ...(options.runWatchCheck ? { runWatchCheck: options.runWatchCheck } : {}),
   });
   return { service, jobsStore, scheduled, admissions, runCalls, sends, state };
 }
@@ -727,6 +736,78 @@ function loopbackMetadataProbe(runner, loopbackClient) {
   }
 }
 
+async function watchGateProbe(createSchedulerService) {
+  const successOutcome = () => ({
+    ok: true,
+    status: "succeeded",
+    persistence: { transcript: { ok: true }, usage: { ok: true }, session: { ok: true } },
+    delivery: { ok: true },
+  });
+  const watchJob = (overrides = {}) => baseJob({
+    id: "watch-1",
+    kind: "cron",
+    schedule: "* * * * *",
+    fireAt: undefined,
+    occurrenceId: "watch-occurrence",
+    check: "true",
+    repeat: false,
+    label: "disk watch",
+    ...overrides,
+  });
+
+  // Failing check → idle skip: agent never wakes, nothing hits chat, job stays pending.
+  const idle = schedulerHarness(createSchedulerService, [watchJob({ id: "watch-idle" })], {
+    runWatchCheck: async () => ({ code: 1, timedOut: false }),
+    outcomes: [successOutcome()],
+  });
+  const idleResult = await idle.service.fireJob("watch-idle");
+  assert.strictEqual(idleResult.status, "watch-idle");
+  assert.strictEqual(idleResult.skipped, true);
+  assert.strictEqual(idle.runCalls.length, 0, "failed check must not wake the agent");
+  assert.strictEqual(idle.sends.length, 0, "idle poll never touches chat");
+  const idleJob = idle.jobsStore.get("watch-idle");
+  assert.ok(idleJob, "idle watch is left in the store");
+  assert.strictEqual(idleJob.status, "pending", "idle watch stays pending for the next tick");
+
+  // Passing check → wakes agent once with the Watch header; one-shot watch is removed after firing.
+  const fired = schedulerHarness(createSchedulerService, [watchJob({ id: "watch-fire" })], {
+    runWatchCheck: async () => ({ code: 0, timedOut: false }),
+    outcomes: [successOutcome()],
+  });
+  const firedResult = await fired.service.fireJob("watch-fire");
+  assert.strictEqual(firedResult.ok, true);
+  assert.strictEqual(firedResult.status, "succeeded");
+  assert.strictEqual(fired.runCalls.length, 1, "passing check wakes the agent exactly once");
+  assert.match(fired.runCalls[0].prompt, /Watch triggered/, "watch fire carries the Watch triggered header");
+  assert.strictEqual(fired.jobsStore.get("watch-fire"), null, "one-shot watch is removed after firing");
+
+  // Repeat watch → fires but survives with a fresh occurrence so the next tick polls again.
+  const repeating = schedulerHarness(createSchedulerService, [watchJob({ id: "watch-repeat", repeat: true })], {
+    runWatchCheck: async () => ({ code: 0, timedOut: false }),
+    outcomes: [successOutcome()],
+  });
+  await repeating.service.fireJob("watch-repeat");
+  assert.strictEqual(repeating.runCalls.length, 1);
+  const repeatJob = repeating.jobsStore.get("watch-repeat");
+  assert.ok(repeatJob, "repeat watch survives firing");
+  assert.strictEqual(repeatJob.status, "pending");
+  assert.strictEqual(repeatJob.occurrenceId, "next-occ-1", "repeat watch advances to a new occurrence");
+
+  // Global master switch OFF → skip before the check even runs.
+  fs.writeFileSync(watchesEnabledFile, "off");
+  let checkRan = false;
+  const disabled = schedulerHarness(createSchedulerService, [watchJob({ id: "watch-off" })], {
+    runWatchCheck: async () => { checkRan = true; return { code: 0, timedOut: false }; },
+    outcomes: [successOutcome()],
+  });
+  const disabledResult = await disabled.service.fireJob("watch-off");
+  assert.strictEqual(disabledResult.status, "watch-disabled");
+  assert.strictEqual(disabledResult.skipped, true);
+  assert.strictEqual(checkRan, false, "disabled watches never run their check");
+  assert.strictEqual(disabled.runCalls.length, 0);
+  fs.rmSync(watchesEnabledFile, { force: true });
+}
+
 function staticSchedulingProbe() {
   const files = [
     "core/jobs.js",
@@ -742,6 +823,13 @@ function staticSchedulingProbe() {
     assert.ok(!/\bsessionKey\b/.test(source[file]), `${file} must not use the removed sessionKey scheduling field`);
   }
   assert.match(source["bin/cli.js"], /selected provider session/i);
+
+  // Watch feature must be wired end to end: gate → loopback → CLI surfaces.
+  assert.match(source["core/scheduler.js"], /job\.check/, "scheduler must gate firing on a watch check");
+  assert.match(source["core/scheduler.js"], /watchesEnabled/, "scheduler must consult the global watch switch");
+  assert.match(source["core/loopback.js"], /watch-add/, "loopback must route watch-add");
+  assert.match(source["bin/schedule.js"], /runWatchAdd/, "schedule CLI must expose watch-add");
+  assert.match(source["bin/cli.js"], /watch-add/, "cli must dispatch watch-add");
 }
 
 async function main() {
@@ -762,9 +850,11 @@ async function main() {
   await busyRestartAndMissedProbe(schedulerApi.createSchedulerService);
   await unavailableAndFallbackProbe(schedulerApi.createSchedulerService);
   await cronOccurrenceProbe(schedulerApi.createSchedulerService);
+  await watchGateProbe(schedulerApi.createSchedulerService);
   creationEnrichmentProbe(schedulerApi.createSchedulerService);
   loopbackMetadataProbe(require("./core/runner"), require("./bin/loopback-client"));
   staticSchedulingProbe();
+  try { fs.rmSync(watchTmpDir, { recursive: true, force: true }); } catch (_) {}
   console.log("provider scheduler OK");
 }