@inetafrica/open-claudia 3.0.35 → 3.0.40

package/core/recall/discoverer.js

@@ -217,14 +217,18 @@ function excerptFor(id, packsLib, entitiesLib) {
 }
 
 const WALKER_SYSTEM = [
-  "You are the recall walker for an assistant's long-term memory.",
+  "You are the recall ROUTER for an assistant's long-term memory.",
   "You are given the user's message, recent conversation, and candidate memory nodes (some matched by keyword, some pulled in by graph links).",
-  "Decide which nodes are GENUINELY relevant to what the user is doing now.",
+  "Your job is to route: decide which nodes GENUINELY bear on what the user is doing now, and how strongly.",
+  "You are a router, NOT a summarizer: never paraphrase, rewrite, or invent the contents of a node. The verbatim fact will be surfaced separately; your why is only a pointer to WHY the node is relevant.",
   "Keep graph-linked nodes ONLY if they actually bear on the task (e.g. a shared theme/commit-style that governs the thing being worked on). Drop incidental keyword overlaps.",
   "Some candidates are reusable tools (id starts `tool:`). Keep a tool ONLY if running it would actually help with THIS task; drop tools merely related by keyword.",
   "Some candidates are past-conversation episodes (id starts `episode:`). Keep one ONLY if that past exchange holds a decision, method, or outcome directly reusable for the current message — not mere topic overlap.",
-  "For each kept node write a terse why (≤12 words). Quote concrete facts verbatim; never invent.",
-  'Reply with ONLY a JSON array: [{"id":"pack:foo","why":"shared lime theme governs this app"}]. Use [] if none.',
+  "For each kept node give three fields:",
+  "  - id: the candidate's id, verbatim.",
+  "  - why: a terse pointer (≤12 words) to why it's relevant — quote a concrete anchor verbatim, never a paraphrase of the whole node.",
+  "  - score: an integer 0–100 for how strongly this node bears on THIS message. 100 = the message is directly about it; 60 = plausibly useful; below 50 = weak/incidental.",
+  'Reply with ONLY a JSON array: [{"id":"pack:foo","why":"shared lime theme governs this app","score":85}]. Use [] if none.',
 ].join("\n");
 
 // Run the walker model on the prompt. Prefer the warm (reused) process for
@@ -276,7 +280,7 @@ async function runWalker(prompt, options = {}) {
       items: {
         type: "object",
         required: ["id"],
-        properties: { id: { type: "string" }, why: { type: "string" } },
+        properties: { id: { type: "string" }, why: { type: "string" }, score: { type: "number" } },
       },
     },
     timeoutMs: WALKER_TIMEOUT_MS,
@@ -291,11 +295,47 @@ async function runWalker(prompt, options = {}) {
   };
 }
 
-// Judge candidates. Returns { kept: Map|null, costUsd, source, walkerMs } —
-// kept null means fail-open (walker off/failed/unparseable).
+// A walker score is an integer 0–100. Missing/garbage → 60: a neutral pass so
+// a parse hiccup never silently buries a node the walker meant to keep.
+function clampScore(v) {
+  const n = Number(v);
+  if (!Number.isFinite(n)) return 60;
+  return Math.max(0, Math.min(100, Math.round(n)));
+}
+
+// WS5: which co-kept pairs earn a weak warming bump. Co-KEPT (walker co-injected
+// them this turn) is noisier than co-OPEN (the model actually opened them), so
+// it warms only under three guards: both endpoints scored ≥ minScore (high-
+// confidence keeps), the pair contains ≥1 message-grounded (user-origin) seed —
+// never let two pure graph hops reinforce each other into a phantom edge — and
+// only the top `maxPairs` strongest pairs warm. Pack/entity graph nodes only
+// (tools and episodes are not graph nodes). Pure + deterministic, so it is
+// unit-tested without touching the graph. Returns [[a, b], ...].
+function cokeptPairs(keptIds, scoreById, groundedIds, { minScore = 60, maxPairs = 3 } = {}) {
+  if (!scoreById || !(scoreById.size >= 0)) return [];
+  const grounded = groundedIds instanceof Set ? groundedIds : new Set(groundedIds || []);
+  const eligible = [...keptIds].filter((id) =>
+    (id.startsWith("pack:") || id.startsWith("entity:")) &&
+    scoreById.has(id) && scoreById.get(id) >= minScore);
+  const pairs = [];
+  for (let i = 0; i < eligible.length; i++) {
+    for (let j = i + 1; j < eligible.length; j++) {
+      const a = eligible[i], b = eligible[j];
+      if (!grounded.has(a) && !grounded.has(b)) continue; // ≥1 message-grounded endpoint
+      pairs.push({ a, b, strength: scoreById.get(a) + scoreById.get(b) });
+    }
+  }
+  pairs.sort((x, y) => y.strength - x.strength || (x.a + "" + x.b).localeCompare(y.a + "" + y.b));
+  return pairs.slice(0, Math.max(0, maxPairs)).map((p) => [p.a, p.b]);
+}
+
+// Judge candidates. Returns { kept: Map|null, scores: Map|null, costUsd, source,
+// walkerMs } — kept/scores null means fail-open (walker off/failed/unparseable).
+// kept is id→why(string); scores is the parallel id→0-100 relevance from the
+// router, consumed by the injection score-gate and asymmetric warming.
 async function walk(userText, contextText, candidates, options = {}) {
   if (!WALKER_ENABLED || candidates.length === 0) {
-    return { kept: null, costUsd: null, source: "off", walkerMs: 0, provider: options.provider || null, model: null };
+    return { kept: null, scores: null, costUsd: null, source: "off", walkerMs: 0, provider: options.provider || null, model: null };
   }
   const lines = candidates.map((c) => {
     const tag = c.activated ? ` [linked via ${c.via || "graph"}]` : "";
@@ -309,26 +349,28 @@ async function walk(userText, contextText, candidates, options = {}) {
     "Candidate memory nodes:",
     ...lines,
     "",
-    'Reply ONLY with the JSON array of kept nodes and their why, e.g. [{"id":"' + candidates[0].id + '","why":"..."}].',
+    'Reply ONLY with the JSON array of kept nodes, each with id, why, and score (0–100), e.g. [{"id":"' + candidates[0].id + '","why":"...","score":80}].',
   ].join("\n");
   const t0 = Date.now();
   try {
     const { text, costUsd, source, provider, model } = await runWalker(prompt, options);
     const walkerMs = Date.now() - t0;
     const match = String(text || "").match(/\[[\s\S]*\]/);
-    if (!match) return { kept: null, costUsd, source, walkerMs, provider, model };
+    if (!match) return { kept: null, scores: null, costUsd, source, walkerMs, provider, model };
     const arr = JSON.parse(match[0]);
-    if (!Array.isArray(arr)) return { kept: null, costUsd, source, walkerMs, provider, model };
+    if (!Array.isArray(arr)) return { kept: null, scores: null, costUsd, source, walkerMs, provider, model };
     const known = new Set(candidates.map((c) => c.id));
     const out = new Map();
+    const scores = new Map();
     for (const item of arr) {
       if (item && typeof item.id === "string" && known.has(item.id)) {
         out.set(item.id, String(item.why || "").slice(0, 120));
+        scores.set(item.id, clampScore(item.score));
       }
     }
-    return { kept: out, costUsd, source, walkerMs, provider, model };
+    return { kept: out, scores, costUsd, source, walkerMs, provider, model };
   } catch (e) {
-    return { kept: null, costUsd: null, source: "failed", walkerMs: Date.now() - t0, provider: options.provider || null, model: null };
+    return { kept: null, scores: null, costUsd: null, source: "failed", walkerMs: Date.now() - t0, provider: options.provider || null, model: null };
   }
 }
 
@@ -491,6 +533,14 @@ async function run(ctx) {
   // the judge's verdict wins. Top-3 ranked candidates and episodes (no stable
   // history) always go to the judge.
   const cascadeOn = tier === "full" && tuning.get("cascade") !== "off";
+  // Score-gate config (WS4). When a relevance floor is set, the walker's real
+  // per-turn score decides injection — so the cascade must NOT auto-KEEP from
+  // history: a sticky pack's history score is always high and would re-leak the
+  // very irrelevant-recall defect the gate exists to fix. Auto-DROP still fires
+  // (dead nodes cost tokens and never help); would-be-keeps are routed to the
+  // judge instead, where they earn a real current-turn score and face the gate.
+  const minScore = tier === "full" ? tuning.get("minRelevanceScore") : 0;
+  const gateConfigured = minScore > 0;
   const autoKept = new Map(); // id -> canned why (honest provenance)
   const autoDropped = [];
   const shadowVerdicts = new Map(); // id -> auto verdict, also sent to judge
@@ -505,13 +555,16 @@ async function run(ctx) {
       const v = cascadeVerdict(st);
       if (!v) { judgeCands.push(c); continue; }
       if (Math.random() < SHADOW_RATE) { shadowVerdicts.set(c.id, v); judgeCands.push(c); continue; }
-      if (v === "keep") autoKept.set(c.id, `kept ${st.kept}/${st.seen} recent similar turns`);
-      else autoDropped.push(c.id);
+      if (v === "keep") {
+        if (gateConfigured) { judgeCands.push(c); continue; } // no history auto-keep under the gate — the judge scores it
+        autoKept.set(c.id, `kept ${st.kept}/${st.seen} recent similar turns`);
+      } else autoDropped.push(c.id);
     }
   }
 
-  const walkRes = await walk(userText, contextText || fullContext, judgeCands, { provider: provider || null });
+  const walkRes = await walk(userText, contextText || fullContext, judgeCands, { provider: provider || null, ...(ctx.walkerOptions || {}) });
   const whyById = walkRes.kept;
+  const scoreById = walkRes.scores; // parallel id→0-100 router relevance (null on fail-open)
 
   let shadowChecks = 0, shadowAgree = 0;
   if (whyById && shadowVerdicts.size) {
@@ -529,6 +582,19 @@ async function run(ctx) {
   // once kept 15 unjudged seeds including WiFi tools for a dream question). The
   // seeds tier keeps its classic contract: all user-origin keyword seeds.
   let whyMap = whyById ? new Map(whyById) : null;
+  // Score-gate on injection (WS4 keystone): drop any walker-kept node scoring
+  // below the relevance floor, so a weakly-linked node no longer gets injected.
+  // Only fires when the walker produced real scores (full tier, successful walk);
+  // fail-open (scores null) skips the gate. A successful walk that gates every
+  // node leaves an empty (non-null) whyMap → inject nothing, which is the
+  // correct signal "nothing was relevant" (NOT the fail-open seed fallback,
+  // which is reserved for a walk that never produced a verdict at all).
+  const gatedOut = [];
+  if (whyMap && gateConfigured && scoreById) {
+    for (const id of [...whyMap.keys()]) {
+      if (scoreById.has(id) && scoreById.get(id) < minScore) { whyMap.delete(id); gatedOut.push(id); }
+    }
+  }
   if (whyMap) for (const [id, why] of autoKept) whyMap.set(id, why);
   let keptIds;
   if (whyMap) {
@@ -570,8 +636,23 @@ async function run(ctx) {
   const finalPacks = packMatches.slice(0, packLimit);
   const finalEnts = entityMatches.slice(0, 4);
 
-  // 5: render via shared builders, then weave in the why-bullets.
-  let packBlock = buildPackBlock(finalPacks, budget);
+  // 5: render via shared builders, then weave in the why-bullets. Extractive
+  // mode (default on) surfaces the verbatim lines that matched this message from
+  // anywhere in each pack — the router already scored relevance; here we hand
+  // the model the actual facts, not just a Stance headline (Defect-A fix). Line
+  // hits come from the WS1 per-line search, scoped per final pack.
+  const extractiveOn = tuning.get("extractive") !== "off" && typeof packsLib.searchLines === "function";
+  let matchedLines = null;
+  if (extractiveOn && finalPacks.length) {
+    matchedLines = new Map();
+    for (const m of finalPacks) {
+      try {
+        const hits = packsLib.searchLines(userText, { dir: m.dir, k: 8 });
+        if (hits && hits.length) matchedLines.set(m.dir, hits);
+      } catch (e) { /* a pack with no line hits just shows Stance */ }
+    }
+  }
+  let packBlock = buildPackBlock(finalPacks, budget, extractiveOn ? { extractive: true, matchedLines } : {});
   const entityBlock = buildEntityBlock(finalEnts, budget);
   if (packBlock && whyMap) {
     const bullets = finalPacks
@@ -631,6 +712,25 @@ async function run(ctx) {
     episodeBlock = `\n\n## Past work that looks related\nFrom earlier conversations — verify before relying on it:\n${lines.join("\n")}\n`;
   }
 
+  // WS5: asymmetric co-kept warming (dark-launch OFF). Feed a weak Hebbian
+  // signal from the walker's co-injected, high-confidence, message-grounded
+  // keeps — a fraction of a real co-use bump. Best-effort: never breaks recall.
+  let cokeptWarmed = [];
+  if (tier === "full" && tuning.get("cokeptWarming") === "on" && scoreById && keptIds.size > 1) {
+    try {
+      const grounded = new Set([
+        ...packSeeds.filter((m) => m.origin === "user").map((m) => `pack:${m.dir}`),
+        ...entSeeds.filter((m) => m.origin === "user").map((m) => `entity:${m.slug}`),
+      ]);
+      cokeptWarmed = cokeptPairs(keptIds, scoreById, grounded, {
+        minScore: tuning.get("warmMinScore"),
+        maxPairs: tuning.get("cokeptMaxPairs"),
+      });
+      const amount = tuning.get("cokeptAmount");
+      for (const [a, b] of cokeptWarmed) graph.reinforce(a, b, amount);
+    } catch (e) { cokeptWarmed = []; }
+  }
+
   metrics.logTurn({
     engine: "discoverer",
     provider: walkRes.provider || provider || "",
@@ -640,10 +740,13 @@ async function run(ctx) {
     seeds: seedNodes,
     activated: [...activated.entries()].map(([id, a]) => ({ id, activation: a.activation, hop: a.hop })),
     cand: candidates.map((c) => ({ id: c.id, act: !!c.activated })),
-    kept: [...keptIds].map((id) => ({ id, why: whyMap ? whyMap.get(id) : "" })),
+    kept: [...keptIds].map((id) => ({ id, why: whyMap ? whyMap.get(id) : "", score: scoreById && scoreById.has(id) ? scoreById.get(id) : null })),
     auto: (autoKept.size || autoDropped.length || shadowChecks)
       ? { kept: [...autoKept.keys()], dropped: autoDropped, shadow: { checks: shadowChecks, agree: shadowAgree } }
       : null,
+    gate: gateConfigured ? { min: minScore, out: gatedOut } : undefined,
+    extracted: matchedLines && matchedLines.size ? [...matchedLines].map(([dir, hits]) => ({ dir, n: hits.length })) : undefined,
+    warmed: cokeptWarmed.length ? cokeptWarmed : undefined,
     gated: false,
     latencyMs: Date.now() - started,
     seedMs,
@@ -660,4 +763,4 @@ async function run(ctx) {
   };
 }
 
-module.exports = { name: "discoverer", run, runWalker, needsRecall, recallTier, walk, cascadeVerdict, scoutToolGaps, renderToolGaps, episodesAllowedForSpeaker };
+module.exports = { name: "discoverer", run, runWalker, needsRecall, recallTier, walk, cascadeVerdict, cokeptPairs, scoutToolGaps, renderToolGaps, episodesAllowedForSpeaker };

package/core/recall/kpi.js

@@ -16,6 +16,9 @@ function emptyBucket(v) {
     rescueTurns: 0, rescues: 0, walkerFailed: 0,
     latencyMsTotal: 0, costUsd: 0, autoKept: 0, autoDropped: 0,
     opens: 0, reviewerUses: 0, byTier: {},
+    // Pass-4 signals (WS0): walker relevance scores on kept nodes, score-gate
+    // activity, and co-kept warmings — the ruler for the accuracy/precision work.
+    keptScoreSum: 0, keptScoreN: 0, gateActiveTurns: 0, gateFiredTurns: 0, gatedNodes: 0, warmings: 0,
   };
 }
 
@@ -54,6 +57,14 @@ function scanLog() {
     const seedIds = new Set((rec.seeds || []).map((s) => s.id));
     const rescues = kept.filter((k) => !seedIds.has(k.id)).length;
     if (rescues > 0) { b.rescueTurns++; b.rescues += rescues; }
+    for (const k of kept) if (typeof k.score === "number") { b.keptScoreSum += k.score; b.keptScoreN++; }
+    if (rec.gate) {
+      b.gateActiveTurns++;
+      const out = (rec.gate.out || []).length;
+      b.gatedNodes += out;
+      if (out > 0) b.gateFiredTurns++;
+    }
+    if (Array.isArray(rec.warmed)) b.warmings += rec.warmed.length;
     if (rec.auto) {
       b.autoKept += (rec.auto.kept || []).length;
       b.autoDropped += (rec.auto.dropped || []).length;
@@ -91,6 +102,10 @@ function aggregate() {
       walkerFailPct: pct(b.walkerFailed, b.turns - b.gated),
       autoKept: b.autoKept,
       autoDropped: b.autoDropped,
+      avgKeptScore: b.keptScoreN ? Math.round(b.keptScoreSum / b.keptScoreN) : null,
+      gatedNodes: b.gatedNodes,
+      gateFiredPct: pct(b.gateFiredTurns, b.gateActiveTurns),
+      warmings: b.warmings,
     });
   }
   rows.sort((a, b) => (a.from || "").localeCompare(b.from || ""));
@@ -107,6 +122,9 @@ function renderTable(rows) {
     ["turns", (r) => String(r.turns)],
     ["rescue", (r) => (r.rescuePct == null ? "—" : r.rescuePct + "%")],
     ["noise", (r) => (r.noisePct == null ? "—" : r.noisePct + "%")],
+    ["relevance", (r) => (r.avgKeptScore == null ? "—" : String(r.avgKeptScore))],
+    ["gate", (r) => (r.gateFiredPct == null ? "—" : `${r.gateFiredPct}% / ${r.gatedNodes}`)],
+    ["warm", (r) => String(r.warmings || 0)],
     ["avg", (r) => (r.avgLatencyMs / 1000).toFixed(1) + "s"],
     ["gated", (r) => (r.gatedPct == null ? "—" : r.gatedPct + "%")],
     ["$ / turn", (r) => "$" + r.costPerTurnUsd.toFixed(3)],
@@ -177,6 +195,8 @@ function htmlReport() {
     barChart("Average recall latency", rows.map((r) => ({ label: label(r), value: r.avgLatencyMs / 1000 })), { fmt: (v) => v.toFixed(1) + "s" }),
     barChart("Recall cost per turn", rows.map((r) => ({ label: label(r), value: r.costPerTurnUsd })), { fmt: (v) => "$" + v.toFixed(3) }),
     barChart("Gated turns — pleasantries skipped for free", rows.map((r) => ({ label: label(r), value: r.gatedPct })), { fmt: (v) => Math.round(v) + "%", max: 100 }),
+    barChart("Average relevance of kept memories — walker score 0–100 (higher = the model kept more clearly-relevant nodes)",
+      rows.map((r) => ({ label: label(r), value: r.avgKeptScore })), { fmt: (v) => Math.round(v), max: 100 }),
     barChart("Walker failure rate", rows.map((r) => ({ label: label(r), value: r.walkerFailPct })), { fmt: (v) => Math.round(v) + "%", max: 100 }),
   ].filter(Boolean).map((s) => `<div class="card">${s}</div>`).join("\n");
 
@@ -191,8 +211,9 @@ function htmlReport() {
 
   const tierRows = rows.map((r) => {
     const t = Object.entries(r.byTier).map(([k, v]) => `${k}: ${v.turns}× @ ${(v.avgMs / 1000).toFixed(1)}s`).join(" · ") || "—";
+    const rel = `${r.avgKeptScore == null ? "—" : r.avgKeptScore} / ${r.gateFiredPct == null ? "—" : r.gateFiredPct + "%·" + r.gatedNodes} / ${r.warmings || 0}`;
     return `<tr><td>${esc(r.v)}</td><td>${esc(r.from)}→${esc(r.to)}</td><td>${r.turns}</td><td>${t}</td>` +
-      `<td>${r.opens} / ${r.reviewerUses}</td><td>${r.autoKept} / ${r.autoDropped}</td><td>${esc(r.models.join(", ") || "—")}</td></tr>`;
+      `<td>${r.opens} / ${r.reviewerUses}</td><td>${r.autoKept} / ${r.autoDropped}</td><td>${esc(rel)}</td><td>${esc(r.models.join(", ") || "—")}</td></tr>`;
   }).join("\n");
 
   return `<!doctype html>
@@ -212,7 +233,7 @@ th{color:#8b98a5;font-weight:600}
 ${charts}
 ${trendChart ? `<div class="card">${trendChart}</div>` : ""}
 <div class="card"><table>
-<tr><th>version</th><th>window</th><th>turns</th><th>latency by tier</th><th>opens / reviewer</th><th>cascade kept / dropped</th><th>walker model</th></tr>
+<tr><th>version</th><th>window</th><th>turns</th><th>latency by tier</th><th>opens / reviewer</th><th>cascade kept / dropped</th><th>relevance / gate·nodes / warm</th><th>walker model</th></tr>
 ${tierRows}
 </table></div>
 </body></html>`;

package/core/recall/tuning.js

@@ -18,6 +18,24 @@ const KNOBS = {
   seedsTierMaxWords: { def: 4, min: 2, max: 6, env: "RECALL_SEEDS_TIER_MAX_WORDS" },
   decayHalfLifeDays: { def: 60, min: 10, max: 90, env: "RECALL_DECAY_HALF_LIFE_DAYS" },
   cascade: { def: "on", values: ["on", "off"], env: "RECALL_CASCADE" },
+  // Extractive on-open injection: surface Stance verbatim + the actual lines
+  // that matched this message (from anywhere in the pack), not just a headline.
+  extractive: { def: "on", values: ["on", "off"], env: "RECALL_EXTRACTIVE" },
+  // Injection score-gate (keystone): a walker-kept node scoring below this floor
+  // (0–100) is not injected. Set 0 to disable the gate entirely (and restore
+  // history-based cascade auto-keep). Default 55 = drop weak/incidental links.
+  minRelevanceScore: { def: 55, min: 0, max: 100, env: "RECALL_MIN_RELEVANCE_SCORE" },
+  // Asymmetric co-kept warming (WS5). Co-OPEN (the model actually opened the
+  // nodes) warms at full strength; co-KEPT (the walker co-injected them) is a
+  // weaker, noisier signal. Dark-launched OFF: it writes persistent graph state,
+  // so it can't be validated in a single test session — flip it on deliberately.
+  cokeptWarming: { def: "off", values: ["on", "off"], env: "RECALL_COKEPT_WARMING" },
+  // How much a co-kept pair bumps its `related` edge (vs 1.0 for a real co-use).
+  cokeptAmount: { def: 0.15, min: 0, max: 1, env: "RECALL_COKEPT_AMOUNT" },
+  // Only co-kept nodes scoring at/above this floor warm — high-confidence keeps.
+  warmMinScore: { def: 60, min: 0, max: 100, env: "RECALL_WARM_MIN_SCORE" },
+  // Cap on how many (strongest) co-kept pairs warm per turn.
+  cokeptMaxPairs: { def: 3, min: 1, max: 10, env: "RECALL_COKEPT_MAX_PAIRS" },
 };
 
 let _cache = null;

package/core/router.js

@@ -22,8 +22,10 @@ const {
   clearPendingClaudeAuth, clearPendingCodexAuth,
   sendClaudeAuthStatusSummary, sendCodexAuthStatusSummary,
 } = require("./auth-flow");
-const { redactSensitive } = require("./redact");
+const { redactSensitive, registerSecrets } = require("./redact");
 const { MAX_FILE_SIZE, MAX_VOICE_SIZE, FILES_DIR } = require("./config");
+const keyring = require("./keyring");
+const { classifyPastedCredential } = require("./credential-detect");
 const channelWizard = require("./channel-wizard");
 require("./handlers"); // side-effect: register slash commands
 
@@ -272,6 +274,51 @@ async function handleDocument(envelope) {
   } catch (err) { await send(`Failed: ${err.message}`); }
 }
 
+// Provider-agnostic capture of a credential pasted into chat with no auth
+// flow active. Before v3.0.37 such a paste was merely deleted and then still
+// forwarded to the model — which, under Codex, refused it as a policy
+// violation. Now the router classifies it and stores it out-of-band (Claude
+// token → .env/vault, OpenAI key → Codex CLI, other recognised secrets →
+// operational keyring), deletes the message, confirms, and stops. The model
+// never sees the secret. Returns true when it fully handled the message
+// (caller must stop), false to let the turn proceed normally.
+async function captureLooseCredential(text, envelope) {
+  const disposition = classifyPastedCredential(text);
+  switch (disposition.kind) {
+    case "claude": {
+      await deleteMessage(envelope.messageId);
+      registerSecrets(text);
+      saveClaudeOAuthToken(text);
+      await send(`Saved your Claude token to .env${vault.isUnlocked() ? " and vault" : ""} and deleted your message so it isn't left in chat. Restart with /restart so I pick it up.`);
+      return true;
+    }
+    case "openai": {
+      await deleteMessage(envelope.messageId);
+      registerSecrets(text);
+      const result = await saveCodexApiKeyWithCli(text);
+      await send(result.ok
+        ? "Saved your OpenAI API key via the Codex CLI and deleted your message. I never printed it."
+        : `Deleted your message, but the Codex CLI couldn't store that key: ${redactSensitive(result.output).slice(-400)}`);
+      return true;
+    }
+    case "keyring": {
+      await deleteMessage(envelope.messageId);
+      registerSecrets(disposition.value);
+      keyring.set(disposition.name, disposition.value);
+      await send(`Stored that secret in the operational keyring as \`${disposition.name}\` and deleted your message. Manage it with /keyring.`);
+      return true;
+    }
+    case "scrub": {
+      // Ambiguous long token: strip it from the chat but let the turn proceed
+      // (it may be an id/arg the agent legitimately needs to act on).
+      await deleteMessage(envelope.messageId);
+      return false;
+    }
+    default:
+      return false;
+  }
+}
+
 async function handleText(envelope) {
   if (isDuplicate(envelope)) return;
   const state = currentState();
@@ -448,17 +495,14 @@ async function handleText(envelope) {
   }
 
   const text = envelope.text || "";
+
+  // Loose credential paste with no auth flow active: store it out-of-band and
+  // stop, instead of forwarding a secret to the model (Codex refuses those).
+  if (await captureLooseCredential(text.trim(), envelope)) return;
+
   const runContext = admitRunContext(text, state.currentSession.dir, envelope.messageId, { purpose: "foreground" });
   const attachments = [];
   const imagePaths = [];
-  const credPatterns = [
-    /^(sk-ant-|sk-|glpat-|ghp_|gho_|github_pat_|xoxb-|xoxp-|AKIA|AIza)/,
-    /^[A-Za-z0-9_-]{20,}$/,
-    /^(Bearer |token:|key:|secret:|password:)/i,
-  ];
-  if (credPatterns.some((p) => p.test(text.trim()))) {
-    await deleteMessage(envelope.messageId);
-  }
 
   let prompt = text;
   const reply = envelope.reply;

package/core/scheduler.js

@@ -10,6 +10,8 @@ const crypto = require("crypto");
 const fs = require("fs");
 const path = require("path");
 const cron = require("node-cron");
+const { spawn } = require("child_process");
+const CONFIG_DIR = require("../config-dir");
 
 const {
   CRONS_FILE,
@@ -34,6 +36,10 @@ const { redactSensitive } = require("./redact");
 const MISSED_WAKEUP_GRACE_MS = 60 * 60 * 1000;
 const RETRY_DELAY_MS = 30 * 1000;
 const BUSY_DELAY_MS = 30 * 1000;
+// A watch's `check` command is capped so a hung poll can't wedge the tick.
+const WATCH_CHECK_TIMEOUT_MS = 30 * 1000;
+const WATCH_LOG_FILE = process.env.OPEN_CLAUDIA_WATCH_LOG_FILE || path.join(CONFIG_DIR, "watch.log");
+const WATCHES_ENABLED_FILE = process.env.OPEN_CLAUDIA_WATCHES_ENABLED_FILE || path.join(CONFIG_DIR, "watches-enabled");
 
 function uniqueId(prefix = "occ") {
   return typeof crypto.randomUUID === "function"
@@ -53,6 +59,13 @@ function terminalRunSucceeded(result) {
   return true;
 }
 
+// A one-shot fires exactly once then is removed after a successful run: a
+// wakeup, or a watch (a cron carrying a shell `check`) created without repeat
+// polling. A repeat watch stays pending and keeps polling like any cron.
+function isOneShot(job) {
+  return job.kind === "wakeup" || (!!job.check && !job.repeat);
+}
+
 function providerIsRunnable(status) {
   if (!status || status.availability?.state !== "available") return false;
   if (status.compatibility?.state === "incompatible") return false;
@@ -96,6 +109,30 @@ function createSchedulerService(dependencies = {}) {
   const runInProvider = dependencies.runAgent || ((...args) => require("./runner").runAgent(...args));
   const admit = dependencies.admitRunContext || ((...args) => require("./runner").admitRunContext(...args));
   const timers = new Map();
+  const checksInFlight = new Set();
+  // Poll a watch's `check`: exit 0 → the watched condition is met, wake the
+  // agent; non-zero → still idle, skip silently. Runs in the job's project
+  // dir with the process env, output discarded (exit code is the contract),
+  // hard-capped by WATCH_CHECK_TIMEOUT_MS. Injectable so tests stay hermetic.
+  const runWatchCheck = dependencies.runWatchCheck || ((command, job) => new Promise((resolve) => {
+    const cwd = (job && projectDescriptor(job).dir) || workspace || process.cwd();
+    let settled = false;
+    const finish = (code, timedOut) => {
+      if (settled) return;
+      settled = true;
+      try { clearTimer(timer); } catch (_) {}
+      resolve({ code, timedOut: !!timedOut });
+    };
+    let child;
+    try {
+      child = spawn("sh", ["-c", String(command)], { cwd, env: process.env, stdio: "ignore" });
+    } catch (error) {
+      return resolve({ code: 127, timedOut: false });
+    }
+    const timer = setTimer(() => { try { child.kill("SIGKILL"); } catch (_) {} finish(124, true); }, WATCH_CHECK_TIMEOUT_MS);
+    child.on("close", (code) => finish(code == null ? 1 : code, false));
+    child.on("error", () => finish(127, false));
+  }));
   let adapters = Array.isArray(dependencies.adapters) ? dependencies.adapters.slice() : [];
 
   function setAdapters(list) {
@@ -186,7 +223,7 @@ function createSchedulerService(dependencies = {}) {
 
   function wrappedPrompt(job, target) {
     const firedAt = new Date(now()).toISOString();
-    const header = job.kind === "cron" ? "Scheduled cron" : "Scheduled wakeup";
+    const header = job.check ? "Watch triggered" : job.kind === "cron" ? "Scheduled cron" : "Scheduled wakeup";
     if (target.fallbackFrom) {
       return [
         `[${header} "${job.label}" fired at ${firedAt}; occurrence ${job.occurrenceId}]`,
@@ -270,7 +307,7 @@ function createSchedulerService(dependencies = {}) {
     catch (error) { return { ok: false, status: "failed", error: stableFailure(error), result }; }
     if (!marked) return { ok: false, status: "failed", error: { code: "JOB_PERSIST_FAILED", message: "Scheduled success marker was not persisted" }, result };
 
-    if (job.kind === "wakeup") {
+    if (isOneShot(job)) {
       try {
         const removed = jobsStore.remove(job.id);
         if (!removed) throw new Error("successful one-shot could not be removed after its durable success marker");
@@ -308,12 +345,34 @@ function createSchedulerService(dependencies = {}) {
     if (job.status === "running" && Number(job.nextAttemptAt || 0) > now()) {
       return { ok: false, status: "running", skipped: true, inFlight: true };
     }
-    if (job.status === "succeeded" && job.kind === "wakeup") {
+    if (job.status === "succeeded" && isOneShot(job)) {
       try { jobsStore.remove(job.id); } catch (_) {}
       unscheduleJob(job.id);
       return { ok: true, status: "succeeded", finalized: true };
     }
 
+    // Watch poll gate. A watch is a cron carrying a shell `check`; each tick
+    // runs the check and only wakes the agent when it exits 0. A non-zero exit
+    // is the normal idle case: skip silently, mark nothing, leave the job
+    // pending so the next tick polls again. Never marks failure; never chats.
+    if (job.check) {
+      if (!watchesEnabled()) {
+        logWatch(job, "skipped (watches disabled globally)");
+        return { ok: false, status: "watch-disabled", skipped: true };
+      }
+      if (checksInFlight.has(job.id)) return { ok: false, status: "watch-checking", skipped: true };
+      checksInFlight.add(job.id);
+      let check;
+      try { check = await runWatchCheck(job.check, job); }
+      catch (_) { check = { code: 1, timedOut: false }; }
+      finally { checksInFlight.delete(job.id); }
+      if (!check || check.code !== 0) {
+        logWatch(job, check && check.timedOut ? "idle (check timed out)" : `idle (check exit ${check ? check.code : "?"})`);
+        return { ok: false, status: "watch-idle", skipped: true };
+      }
+      logWatch(job, "triggered (check passed) — waking agent");
+    }
+
     const adapter = resolveAdapter(job);
     if (!adapter) {
       try { return markFailure(job, { code: "SCHEDULED_ADAPTER_UNAVAILABLE", message: "Saved channel adapter is unavailable" }); }
@@ -385,7 +444,7 @@ function createSchedulerService(dependencies = {}) {
         return { ok: false, status: "failed", error: stableFailure(error) };
       }
 
-      try { await send(`Wakeup: ${job.label}`); } catch (_) { /* advisory only */ }
+      try { await send(job.check ? `🔔 Watch "${job.label}" triggered` : `Wakeup: ${job.label}`); } catch (_) { /* advisory only */ }
       let result;
       try { result = await runInProvider(prompt, runContext.cwd, null, { ...runOptions, runContext }); }
       catch (error) {
@@ -403,7 +462,7 @@ function createSchedulerService(dependencies = {}) {
   function scheduleJob(job) {
     unscheduleJob(job.id);
     if (!job || job.disabled || ["archived", "dead-letter"].includes(job.status)) return false;
-    if (job.status === "succeeded" && job.kind === "wakeup") {
+    if (job.status === "succeeded" && isOneShot(job)) {
       try { jobsStore.remove(job.id); } catch (_) {}
       return false;
     }
@@ -514,6 +573,41 @@ function createSchedulerService(dependencies = {}) {
     return job;
   }
 
+  // Global master switch for all watches (owner's /watch off). Absent file →
+  // enabled (default ON). Only the poll gate consults it; wakeups/crons are
+  // untouched.
+  function watchesEnabled() {
+    try { return fs.readFileSync(WATCHES_ENABLED_FILE, "utf8").trim() !== "off"; }
+    catch (_) { return true; }
+  }
+
+  function setWatchesEnabled(on) {
+    try { fs.writeFileSync(WATCHES_ENABLED_FILE, on ? "on" : "off"); } catch (_) {}
+    return !!on;
+  }
+
+  // Append-only audit of watch poll activity. NEVER sent to chat — this is the
+  // whole point of a watch: the polling stays out of the conversation, only a
+  // real trigger wakes the agent and surfaces in chat.
+  function logWatch(job, event) {
+    const line = `[${new Date(now()).toISOString()}] job=${job.id} label=${JSON.stringify(job.label || "")} ${event}\n`;
+    try { fs.appendFileSync(WATCH_LOG_FILE, line); } catch (_) {}
+  }
+
+  // A watch is a cron carrying a shell `check`; it rides the migration-verified
+  // jobs store untouched (check/repeat survive normalizeRunnableJob as extra
+  // fields). Default schedule polls every minute; default is one-shot.
+  function addWatch(spec) {
+    return addJob({
+      ...spec,
+      kind: "cron",
+      schedule: spec.schedule || "* * * * *",
+      check: String(spec.check || "").trim(),
+      repeat: !!spec.repeat,
+      label: spec.label || String(spec.prompt || "watch").slice(0, 60),
+    });
+  }
+
   function removeJob(id) {
     unscheduleJob(id);
     return jobsStore.remove(id);
@@ -529,6 +623,9 @@ function createSchedulerService(dependencies = {}) {
     scheduleJob,
     unscheduleJob,
     addJob,
+    addWatch,
+    watchesEnabled,
+    setWatchesEnabled,
     removeJob,
     stopAll,
     fireJob,
@@ -561,6 +658,9 @@ module.exports = {
   scheduleJob: service.scheduleJob,
   unscheduleJob: service.unscheduleJob,
   addJob: service.addJob,
+  addWatch: service.addWatch,
+  watchesEnabled: service.watchesEnabled,
+  setWatchesEnabled: service.setWatchesEnabled,
   removeJob: service.removeJob,
   stopAll: service.stopAll,
   fireJob: service.fireJob,