@inetafrica/open-claudia 3.4.23 → 3.5.0

package/core/scheduler.js

@@ -48,6 +48,18 @@ const BUSY_DELAY_MS = 30 * 1000;
 const BUSY_NOTICE_AFTER_MS = 15 * 60 * 1000;
 // A watch's `check` command is capped so a hung poll can't wedge the tick.
 const WATCH_CHECK_TIMEOUT_MS = 30 * 1000;
+// A hanging check is itself a signal (24 Sep: the Phone health check timed out
+// twice and was only logged idle). This many timeouts in a row wake the agent
+// once, marked "check timing out"; the watch keeps polling, and any completed
+// check resets the count.
+const WATCH_TIMEOUT_ALARM_AFTER = 3;
+// setTimeout holds at most 2^31-1 ms (~24.8 days); a longer delay overflows
+// and fires at once (17 Sep: a 2028 reminder fired 61 s after it was set).
+// Far wakeups sleep in chunks of this size and re-plan until due.
+const MAX_TIMER_DELAY_MS = 2 ** 31 - 1 - 1000;
+// schedule-wakeup refuses a fire time further out than this: past it the
+// <when> is a typo or a mis-parse (one wakeup was set 1273 years out).
+const MAX_WAKEUP_HORIZON_MS = 10 * 365.25 * 24 * 60 * 60 * 1000;
 // Every watch carries a hard expiry so none can idle-poll forever: when the
 // deadline lapses with the check still failing, the next poll tick fires the
 // wake anyway (marked expired) instead of skipping silently.
@@ -61,6 +73,84 @@ function uniqueId(prefix = "occ") {
     : `${prefix}-${Date.now()}-${crypto.randomBytes(6).toString("hex")}`;
 }
 
+// ── watch-check environment ────────────────────────────────────────────────
+// A watch's `check` runs a shell command. It used to inherit `env:
+// process.env` — every secret the bot process holds (provider credentials,
+// bot tokens, the loopback token), so a staff member's check could read them
+// all. Build the env explicitly instead: keep the harmless shell essentials
+// and the Open Claudia config dir (so `open-claudia ...` resolves its config),
+// then drop anything that looks like a credential (a broad denylist pattern)
+// plus the known-secret names the provider env-isolation layer already
+// strips. A short-lived, creator-scoped run is stamped on top (below) so the
+// check's reusable tools still attribute to whoever created the watch.
+const WATCH_CHECK_ENV_KEEP = new Set([
+  "PATH", "HOME", "USER", "LOGNAME", "SHELL",
+  "LANG", "LANGUAGE", "LC_ALL", "LC_CTYPE", "TZ",
+  "TERM", "COLORTERM", "NO_COLOR", "FORCE_COLOR",
+  "TMPDIR", "TMP", "TEMP",
+  "OPEN_CLAUDIA_CONFIG_DIR",
+  "SystemRoot", "ComSpec", "PATHEXT", "WINDIR",
+]);
+const WATCH_CHECK_SECRET_PATTERN = /(TOKEN|SECRET|PASSWORD|PASSWD|API[_-]?KEY|APIKEY|OAUTH|CREDENTIAL|PRIVATE[_-]?KEY|ACCESS[_-]?KEY|CLIENT[_-]?SECRET|SESSION[_-]?KEY|BEARER)/i;
+let KNOWN_SECRET_ENV_KEYS = null;
+function knownSecretEnvKeys() {
+  if (KNOWN_SECRET_ENV_KEYS) return KNOWN_SECRET_ENV_KEYS;
+  const set = new Set();
+  try { for (const key of require("./providers/env").ALWAYS_STRIPPED_KEYS) set.add(key); } catch (_) {}
+  KNOWN_SECRET_ENV_KEYS = set;
+  return set;
+}
+function isSecretCheckEnvKey(key) {
+  if (WATCH_CHECK_ENV_KEEP.has(key)) return false;
+  if (knownSecretEnvKeys().has(key)) return true;
+  return WATCH_CHECK_SECRET_PATTERN.test(key);
+}
+function buildWatchCheckEnv(source, stamp = {}) {
+  const env = {};
+  for (const [key, value] of Object.entries(source || {})) {
+    if (value == null) continue;
+    if (isSecretCheckEnvKey(key)) continue;
+    env[key] = String(value);
+  }
+  for (const [key, value] of Object.entries(stamp)) {
+    if (value == null || value === "") continue;
+    env[key] = String(value);
+  }
+  return env;
+}
+
+// The principal a watch-check's short-lived run acts for: the job's creator,
+// resolved from its stored channel/user the same way runPrincipal resolves a
+// turn's speaker. Owner → the check attributes as the owner (unchanged); a
+// staff creator → the check runs at their level. Fail closed to non-owner.
+function watchCheckPrincipal(job) {
+  const adapterType = job && job.adapterType ? String(job.adapterType) : null;
+  const channelId = job && job.channelId != null ? String(job.channelId) : null;
+  const userId = job && job.userId != null ? String(job.userId) : null;
+  let owner = false;
+  let name = null;
+  let room = null;
+  if (adapterType && channelId) {
+    try {
+      const sp = require("./relationship").speakerFor(adapterType, channelId, userId);
+      owner = !!(sp && sp.isOwner === true);
+      name = (sp && sp.name) || null;
+      room = (sp && sp.room) || null;
+    } catch (_) { owner = false; }
+  }
+  return {
+    kind: "watch-check",
+    owner,
+    canonicalUserId: job && job.canonicalUserId ? String(job.canonicalUserId) : null,
+    name,
+    adapterId: job && job.adapter ? String(job.adapter) : null,
+    adapterType,
+    channelId,
+    userId,
+    room,
+  };
+}
+
 function parseFallbacks(value) {
   if (Array.isArray(value)) return [...new Set(value.map((item) => String(item).trim().toLowerCase()).filter(Boolean))];
   return [...new Set(String(value || "").split(",").map((item) => item.trim().toLowerCase()).filter(Boolean))];
@@ -75,9 +165,25 @@ function terminalRunSucceeded(result) {
 
 // A one-shot fires exactly once then is removed after a successful run: a
 // wakeup, or a watch (a cron carrying a shell `check`) created without repeat
-// polling. A repeat watch stays pending and keeps polling like any cron.
+// polling. A repeat watch stays pending and keeps polling like any cron, and
+// so does any watch whose fire only reported a hanging check.
 function isOneShot(job) {
-  return job.kind === "wakeup" || (!!job.check && !job.repeat);
+  return job.kind === "wakeup" || (!!job.check && !job.repeat && !job.watchCheckTimingOut);
+}
+
+// A repeating watch keeps polling on its schedule while a triggered delivery
+// waits for a busy room, waits for a retry after a failed or /stop-killed run,
+// or runs. New hits fold into that one delivery. Everything else parks on its
+// retry timer alone (24 Sep: the event-bus watch went unpolled for 7.5 h).
+function pollsWhilePending(job) {
+  return !!job?.check && !!job.repeat;
+}
+
+// The watch's trigger is latched and its delivery has not completed.
+function deliveryPending(job) {
+  return pollsWhilePending(job)
+    && job.watchTriggeredOccurrenceId === job.occurrenceId
+    && ["deferred", "failed", "running"].includes(job.status);
 }
 
 function providerIsRunnable(status) {
@@ -127,23 +233,49 @@ function createSchedulerService(dependencies = {}) {
   const timers = new Map();
   const checksInFlight = new Set();
   const firesInFlight = new Set();
+  // Jobs already on disk before the creator-binding fix carry no `createdBy`.
+  // We keep running them AS THEY ARE (their stored channel/user is what the
+  // fire path resolves the speaker from — the owner's own watches and wakeups
+  // must not silently break), but log the first time each fires so an audit
+  // can spot a pre-fix job that outranks a non-owner. Logged once per id/boot.
+  const loggedLegacyCreators = new Set();
+  function noteLegacyCreatorOnce(job) {
+    if (!job || job.createdBy || loggedLegacyCreators.has(job.id)) return;
+    loggedLegacyCreators.add(job.id);
+    try {
+      console.warn(`[scheduler] job ${job.id} (${job.kind}${job.check ? "/watch" : ""}) predates creator binding — running with its stored identity ${job.canonicalUserId || "?"} in ${job.adapterType || "?"}:${job.channelId || "?"}`);
+    } catch (_) { /* logging is best-effort */ }
+  }
   // Poll a watch's `check`: exit 0 → the watched condition is met, wake the
   // agent; non-zero → still idle, skip silently. Runs in the job's project
-  // dir with the process env, output discarded (exit code is the contract),
+  // dir with a HARDENED env — the bot's secrets are dropped (buildWatchCheckEnv)
+  // and a short-lived run is registered for the job's creator so reusable
+  // tools attribute correctly — output discarded (exit code is the contract),
   // hard-capped by WATCH_CHECK_TIMEOUT_MS. Injectable so tests stay hermetic.
   const runWatchCheck = dependencies.runWatchCheck || ((command, job) => new Promise((resolve) => {
     const cwd = (job && projectDescriptor(job).dir) || workspace || process.cwd();
+    const attest = require("./speaker-attest");
+    const checkRunId = uniqueId("watch-check");
+    let runAttest = "";
+    try { runAttest = attest.registerRun(checkRunId, watchCheckPrincipal(job)); } catch (_) { runAttest = ""; }
+    let lb = null;
+    try { lb = require("./loopback").info(); } catch (_) { lb = null; }
+    const stamp = { OC_RUN_ID: checkRunId, OC_RUN_ATTEST: runAttest };
+    if (lb && lb.url) { stamp.OC_SEND_URL = lb.url; stamp.OC_SEND_TOKEN = lb.token; }
+    const env = buildWatchCheckEnv(process.env, stamp);
     let settled = false;
     const finish = (code, timedOut) => {
       if (settled) return;
       settled = true;
       try { clearTimer(timer); } catch (_) {}
+      try { attest.endRun(checkRunId); } catch (_) {}
       resolve({ code, timedOut: !!timedOut });
     };
     let child;
     try {
-      child = spawn("sh", ["-c", String(command)], { cwd, env: process.env, stdio: "ignore" });
+      child = spawn("sh", ["-c", String(command)], { cwd, env, stdio: "ignore" });
     } catch (error) {
+      try { attest.endRun(checkRunId); } catch (_) {}
       return resolve({ code: 127, timedOut: false });
     }
     const timer = setTimer(() => { try { child.kill("SIGKILL"); } catch (_) {} finish(124, true); }, WATCH_CHECK_TIMEOUT_MS);
@@ -288,16 +420,37 @@ function createSchedulerService(dependencies = {}) {
     return null;
   }
 
+  // What a repeating watch's polls saw while its delivery waited.
+  function pendingPollNote(job) {
+    const hits = Number(job.watchExtraHits) || 0;
+    const lastHitAt = Number(job.watchLastHitAt) || 0;
+    const lastClearAt = Number(job.watchLastClearAt) || 0;
+    if (!hits && !lastClearAt) return null;
+    const at = (ms) => new Date(ms).toISOString();
+    const seen = [];
+    if (hits) seen.push(`the check passed ${hits} more time${hits === 1 ? "" : "s"}, the latest at ${at(lastHitAt)}`);
+    seen.push(lastClearAt > lastHitAt
+      ? `its latest run, at ${at(lastClearAt)}, did not pass, so the condition may have cleared`
+      : "the condition was still true at the latest check");
+    return `[This watch kept polling while this delivery waited (queued at ${at(Number(job.watchTriggeredAt) || now())}): ${seen.join("; ")}.]`;
+  }
+
   function wrappedPrompt(job, target) {
     const firedAt = new Date(now()).toISOString();
     const expired = !!(job.check && job.watchExpired);
+    const timingOut = !!(job.check && !expired && job.watchCheckTimingOut);
     const header = job.check
-      ? (expired ? "Watch expired" : "Watch triggered")
+      ? (expired ? "Watch expired" : timingOut ? "Watch check timing out" : "Watch triggered")
       : job.kind === "cron" ? "Scheduled cron" : "Scheduled wakeup";
     const lines = [`[${header} "${job.label}" fired at ${firedAt}; occurrence ${job.occurrenceId}]`];
     if (expired) {
       lines.push("[This watch reached its timeout without its check ever passing — the watched condition did NOT happen. This is a deadline wake-up, not a trigger: investigate why the condition never became true, and arm a new watch if it is still worth waiting for.]");
     }
+    if (timingOut) {
+      lines.push(`[This watch's check timed out ${WATCH_TIMEOUT_ALARM_AFTER} times in a row (each run is capped at ${WATCH_CHECK_TIMEOUT_MS / 1000} s), so the watched condition could not be read. That is itself a signal: find out why the check hangs. This is not a trigger, and the watch keeps polling.]`);
+    }
+    const polled = job.check ? pendingPollNote(job) : null;
+    if (polled) lines.push(polled);
     if (target.fallbackFrom) {
       lines.push(`[Archived provider-neutral brief: the originating ${target.fallbackFrom} provider is unavailable. Its native session is not being resumed; this explicitly configured fallback starts fresh.]`);
     } else if (target.revertedFrom) {
@@ -317,14 +470,36 @@ function createSchedulerService(dependencies = {}) {
     timers.delete(id);
   }
 
+  // Drop only a job's delivery (retry) timer; a watch's poll schedule stays.
+  function clearDeliveryTimer(id) {
+    const timer = timers.get(id);
+    if (!timer?.timeout) return;
+    try { clearTimer(timer.timeout); } catch (_) {}
+    if (timer.stop) timers.set(id, { stop: timer.stop });
+    else timers.delete(id);
+  }
+
   function armRetry(job, delay = null) {
-    unscheduleJob(job.id);
-    if (job.disabled || job.status === "dead-letter" || job.status === "succeeded") return;
+    if (job.disabled || job.status === "dead-letter" || job.status === "succeeded") return unscheduleJob(job.id);
+    if (pollsWhilePending(job)) clearDeliveryTimer(job.id);
+    else unscheduleJob(job.id);
     const wait = delay === null
       ? Math.max(0, Number(job.nextAttemptAt || now()) - now())
       : Math.max(0, delay);
     const timeout = setTimer(() => fireJob(job.id, { reason: "retry" }), wait);
-    timers.set(job.id, { timeout });
+    timers.set(job.id, { ...timers.get(job.id), timeout });
+  }
+
+  // A jobs-store write that throws (a full disk, a torn journal) must not
+  // strand a queued delivery: the retry stays armed in memory and the next
+  // attempt re-reads the store. Such a throw used to return with no timer,
+  // so the delivery was never tried again (21 and 23 Sep: watch alarms that
+  // triggered during long turns were never delivered).
+  function keepRetrying(job, error, delay = retryDelayMs) {
+    const failure = stableFailure(error);
+    try { armRetry(job, delay); } catch (_) {}
+    if (job.check) logWatch(job, `delivery bookkeeping failed (${failure.code}) — retrying in ${Math.round(delay / 1000)} s`);
+    return { ok: false, status: "failed", error: failure };
   }
 
   function markFailure(job, failure, options = {}) {
@@ -367,7 +542,7 @@ function createSchedulerService(dependencies = {}) {
     armRetry(updated, busyDelayMs);
     if (noticeDue) {
       const minutes = Math.floor(waited / 60000);
-      const what = updated.watchExpired ? "timed out" : "triggered";
+      const what = updated.watchExpired ? "timed out" : updated.watchCheckTimingOut ? "raised a check-timeout alarm" : "triggered";
       try {
         Promise.resolve(send(`⏳ Watch "${updated.label}" ${what} ${minutes} min ago and is waiting for the current run to end. /stop ends that run so the watch can go.`)).catch(() => {});
       } catch (_) { /* a notice only */ }
@@ -416,6 +591,10 @@ function createSchedulerService(dependencies = {}) {
       watchTriggeredOccurrenceId: null,
       watchTriggeredAt: null,
       watchExpired: false,
+      watchCheckTimingOut: false,
+      watchExtraHits: 0,
+      watchLastHitAt: null,
+      watchLastClearAt: null,
       advisoryOccurrenceId: null,
     });
     if (reset && timers.get(job.id)?.timeout) scheduleJob(reset);
@@ -440,6 +619,10 @@ function createSchedulerService(dependencies = {}) {
       return { ok: false, status: job.status, skipped: true };
     }
     if (job.status === "running" && Number(job.nextAttemptAt || 0) > now()) {
+      // fireJob already turned away a fire in flight here, so this lease was
+      // left by an earlier process: look again when it lapses. Returning with
+      // no timer stranded the job until the next restart.
+      armRetry(job);
       return { ok: false, status: "running", skipped: true, inFlight: true };
     }
     if (job.status === "succeeded" && isOneShot(job)) {
@@ -469,15 +652,28 @@ function createSchedulerService(dependencies = {}) {
         // persisted before expiry existed (no expiresAt) keep polling forever.
         const expiresAt = Number(job.expiresAt || 0);
         if (!(expiresAt > 0 && now() >= expiresAt)) {
-          logWatch(job, check && check.timedOut ? "idle (check timed out)" : `idle (check exit ${check ? check.code : "?"})`);
-          return { ok: false, status: "watch-idle", skipped: true };
+          // Timeouts in a row; a completed check resets the count. Only the
+          // WATCH_TIMEOUT_ALARM_AFTER-th wakes the agent, so a check that stays
+          // hung alarms once rather than on every later poll.
+          const timedOut = !!check?.timedOut;
+          const previous = Number(job.watchTimeoutStreak) || 0;
+          const streak = timedOut ? previous + 1 : 0;
+          if (streak !== WATCH_TIMEOUT_ALARM_AFTER) {
+            if (streak !== previous) {
+              try { jobsStore.update(job.id, { watchTimeoutStreak: streak }); } catch (_) { /* best effort */ }
+            }
+            logWatch(job, timedOut ? `idle (check timed out, ${streak} in a row)` : `idle (check exit ${check ? check.code : "?"})`);
+            return { ok: false, status: "watch-idle", skipped: true };
+          }
+          job = { ...job, watchExpired: false, watchCheckTimingOut: true, watchTimeoutStreak: streak };
+        } else {
+          // Expiry ends the watch's window: one-shot removal even for --repeat
+          // (the woken agent re-arms if still wanted). Persisted so a retry of a
+          // failed expiry fire keeps the same semantics across restarts.
+          job = { ...job, repeat: false, watchExpired: true, watchCheckTimingOut: false };
         }
-        // Expiry ends the watch's window: one-shot removal even for --repeat
-        // (the woken agent re-arms if still wanted). Persisted so a retry of a
-        // failed expiry fire keeps the same semantics across restarts.
-        job = { ...job, repeat: false, watchExpired: true };
       } else {
-        job = { ...job, watchExpired: false };
+        job = { ...job, watchExpired: false, watchCheckTimingOut: false, watchTimeoutStreak: 0 };
       }
       // Latch the condition before admission or notification. Delivery retries
       // and restarts must not run the check again or change an expiry's meaning.
@@ -487,6 +683,8 @@ function createSchedulerService(dependencies = {}) {
           nextAttemptAt: now(),
           repeat: job.repeat,
           watchExpired: job.watchExpired,
+          watchCheckTimingOut: job.watchCheckTimingOut,
+          watchTimeoutStreak: Number(job.watchTimeoutStreak) || 0,
           watchTriggeredOccurrenceId: job.occurrenceId,
           watchTriggeredAt: now(),
         });
@@ -495,13 +693,15 @@ function createSchedulerService(dependencies = {}) {
       } catch (error) {
         return { ok: false, status: "failed", error: stableFailure(error) };
       }
-      logWatch(job, job.watchExpired ? "expired without firing — delivery queued" : "triggered (check passed) — delivery queued");
+      logWatch(job, job.watchExpired ? "expired without firing — delivery queued"
+        : job.watchCheckTimingOut ? `check timed out ${WATCH_TIMEOUT_ALARM_AFTER} times in a row — delivery queued`
+          : "triggered (check passed) — delivery queued");
     }
 
     const adapter = resolveAdapter(job);
     if (!adapter) {
       try { return markFailure(job, { code: "SCHEDULED_ADAPTER_UNAVAILABLE", message: "Saved channel adapter is unavailable" }); }
-      catch (error) { return { ok: false, status: "failed", error: stableFailure(error) }; }
+      catch (error) { return keepRetrying(job, error); }
     }
     const canonicalUserId = job.canonicalUserId || canonicalForChannel(adapter.type, job.channelId);
     const userId = String(job.userId || (adapter.type === "telegram" ? job.channelId : canonicalUserId || job.channelId || ""));
@@ -528,10 +728,11 @@ function createSchedulerService(dependencies = {}) {
     };
 
     return runInChat(chat, async () => {
+      noteLegacyCreatorOnce(job);
       const state = stateForUser(canonicalUserId);
       if (state.runningProcess || state.preparingRun || state.isCompacting) {
         try { return markBusy(job); }
-        catch (error) { return { ok: false, status: "failed", error: stableFailure(error) }; }
+        catch (error) { return keepRetrying(job, error, busyDelayMs); }
       }
 
       const target = executionTarget(job, state);
@@ -541,7 +742,7 @@ function createSchedulerService(dependencies = {}) {
             code: "SCHEDULED_PROVIDER_UNAVAILABLE",
             message: `Saved provider ${job.provider} is unavailable and no explicit fallback is configured`,
           });
-        } catch (error) { return { ok: false, status: "failed", error: stableFailure(error) }; }
+        } catch (error) { return keepRetrying(job, error); }
       }
 
       const project = projectDescriptor(job);
@@ -559,8 +760,14 @@ function createSchedulerService(dependencies = {}) {
         scheduledJobId: job.id,
         originRunId: job.originRunId || null,
       };
-      // Admission is synchronous and precedes all notification delivery.
-      const runContext = admit(prompt, project.dir, null, runOptions);
+      // Admission is synchronous and precedes all notification delivery. A
+      // refusal is a failed attempt, never a rejection that drops the job.
+      let runContext;
+      try { runContext = admit(prompt, project.dir, null, runOptions); }
+      catch (error) {
+        try { return markFailure(job, error); }
+        catch (persistError) { return keepRetrying(job, persistError); }
+      }
 
       let running;
       try {
@@ -575,11 +782,13 @@ function createSchedulerService(dependencies = {}) {
         });
         if (!running) throw new Error("scheduled attempt could not be persisted");
       } catch (error) {
-        return { ok: false, status: "failed", error: stableFailure(error) };
+        return keepRetrying(job, error);
       }
 
       const advisory = job.check
-        ? (job.watchExpired ? `⏰ Watch "${job.label}" timed out without triggering — waking anyway` : `🔔 Watch "${job.label}" triggered`)
+        ? (job.watchExpired ? `⏰ Watch "${job.label}" timed out without triggering — waking anyway`
+          : job.watchCheckTimingOut ? `⚠️ Watch "${job.label}": its check timed out ${WATCH_TIMEOUT_ALARM_AFTER} times in a row`
+            : `🔔 Watch "${job.label}" triggered`)
         : `Wakeup: ${job.label}`;
       // Say so when the run is NOT on the provider this room is set to: an
       // unexplained error from a provider the room never selected is worse than
@@ -601,16 +810,70 @@ function createSchedulerService(dependencies = {}) {
       try { result = await runInProvider(prompt, runContext.cwd, null, { ...runOptions, runContext }); }
       catch (error) {
         try { return markFailure(running, error, { attemptAlreadyCounted: true }); }
-        catch (persistError) { return { ok: false, status: "failed", error: stableFailure(persistError) }; }
+        catch (persistError) { return keepRetrying(running, persistError); }
       }
       if (!terminalRunSucceeded(result)) {
         try { return markFailure(running, result, { attemptAlreadyCounted: true }); }
-        catch (error) { return { ok: false, status: "failed", error: stableFailure(error), result }; }
+        catch (error) { return { ...keepRetrying(running, error), result }; }
       }
       return settleSuccess(running, result, target);
     });
   }
 
+  // Poll a repeating watch whose delivery is still pending. Nothing new is
+  // queued: a hit is counted into that delivery (its prompt says so), a
+  // completed miss is noted as a possible clear, a timeout is only logged.
+  async function pollPendingWatch(job) {
+    if (!watchesEnabled()) {
+      logWatch(job, "skipped (watches disabled globally)");
+      return { ok: false, status: "watch-disabled", skipped: true };
+    }
+    if (checksInFlight.has(job.id)) return { ok: false, status: "watch-checking", skipped: true };
+    checksInFlight.add(job.id);
+    let check;
+    try { check = await runWatchCheck(job.check, job); }
+    catch (_) { check = { code: 1, timedOut: false }; }
+    finally { checksInFlight.delete(job.id); }
+    try {
+      const latest = jobsStore.get(job.id);
+      // The delivery may have finished while the check ran; the result then
+      // belongs to no pending occurrence.
+      if (!latest || latest.occurrenceId !== job.occurrenceId || !deliveryPending(latest)) {
+        return { ok: false, status: "watch-idle", skipped: true };
+      }
+      if (check?.timedOut) {
+        logWatch(latest, "idle (check timed out) — delivery still pending");
+        return { ok: false, status: "watch-idle", skipped: true };
+      }
+      const hit = check?.code === 0;
+      const extraHits = (Number(latest.watchExtraHits) || 0) + (hit ? 1 : 0);
+      jobsStore.update(job.id, {
+        ...(hit ? { watchExtraHits: extraHits, watchLastHitAt: now() } : { watchLastClearAt: now() }),
+        ...(latest.watchTimeoutStreak ? { watchTimeoutStreak: 0 } : {}),
+      });
+      logWatch(latest, hit
+        ? `triggered again (check passed) — folded into the pending delivery (${extraHits} more)`
+        : `idle (check exit ${check ? check.code : "?"}) — delivery still pending`);
+      return { ok: false, status: hit ? "watch-folded" : "watch-idle", skipped: true, extraHits };
+    } catch (error) {
+      return { ok: false, status: "failed", error: stableFailure(error) };
+    }
+  }
+
+  // A cron's schedule. A pending job fires on each tick; a repeating watch
+  // whose delivery is still pending is only polled.
+  function armCron(job) {
+    if (!validateCron(job.schedule)) return false;
+    const task = scheduleCron(job.schedule, () => {
+      const current = jobsStore.get(job.id);
+      if (!current || current.disabled) return;
+      if (current.status === "pending") fireJob(current.id, { reason: "cron" });
+      else if (deliveryPending(current)) pollPendingWatch(current);
+    });
+    timers.set(job.id, { stop: () => task.stop?.() });
+    return true;
+  }
+
   function scheduleJob(job) {
     unscheduleJob(job.id);
     if (!job || job.disabled || ["archived", "dead-letter"].includes(job.status)) return false;
@@ -619,6 +882,7 @@ function createSchedulerService(dependencies = {}) {
       return false;
     }
     if (["failed", "deferred", "running"].includes(job.status)) {
+      if (pollsWhilePending(job)) armCron(job);
       armRetry(job, Math.max(0, Number(job.nextAttemptAt || now()) - now()));
       return true;
     }
@@ -636,20 +900,20 @@ function createSchedulerService(dependencies = {}) {
         } catch (_) {}
         return false;
       }
-      const timeout = setTimer(() => fireJob(job.id, { reason: fireAt < now() ? "missed" : "timer" }), Math.max(0, fireAt - now()));
+      const wait = Math.max(0, fireAt - now());
+      // Too far out for one timer: sleep a chunk, then re-plan from the store.
+      const timeout = wait > MAX_TIMER_DELAY_MS
+        ? setTimer(() => {
+          try {
+            const current = jobsStore.get(job.id);
+            if (current) scheduleJob(current);
+          } catch (_) { /* init() re-plans on the next boot */ }
+        }, MAX_TIMER_DELAY_MS)
+        : setTimer(() => fireJob(job.id, { reason: fireAt < now() ? "missed" : "timer" }), wait);
       timers.set(job.id, { timeout });
       return true;
     }
-    if (job.kind === "cron") {
-      if (!validateCron(job.schedule)) return false;
-      const task = scheduleCron(job.schedule, () => {
-        const current = jobsStore.get(job.id);
-        if (!current || current.disabled || current.status !== "pending") return;
-        fireJob(current.id, { reason: "cron" });
-      });
-      timers.set(job.id, { stop: () => task.stop?.() });
-      return true;
-    }
+    if (job.kind === "cron") return armCron(job);
     return false;
   }
 
@@ -809,9 +1073,15 @@ module.exports = {
   RETRY_DELAY_MS,
   BUSY_DELAY_MS,
   DEFAULT_WATCH_TIMEOUT_MS,
+  WATCH_TIMEOUT_ALARM_AFTER,
+  MAX_TIMER_DELAY_MS,
+  MAX_WAKEUP_HORIZON_MS,
   createSchedulerService,
   parseFallbacks,
   terminalRunSucceeded,
+  buildWatchCheckEnv,
+  isSecretCheckEnvKey,
+  watchCheckPrincipal,
   setAdapters,
   initScheduler,
   scheduleJob: service.scheduleJob,

package/core/speaker-attest.js

@@ -53,4 +53,85 @@ function verify(canonicalUserId, attest) {
   try { return crypto.timingSafeEqual(a, b); } catch (e) { return false; }
 }
 
-module.exports = { mint, verify };
+// ── Run attestation ─────────────────────────────────────────────────────────
+// The id attest above says "the runner stamped this canonical id". It is not
+// bound to a run: a copy lifted from another process's environment stays valid
+// for the whole boot. And the CLIs that decided the speaker locally (tool,
+// keyring, entity) read OC_CHANNEL_* from their own env, so a shell that
+// simply unset or rewrote those variables was treated as the owner.
+//
+// A run attestation binds a LIVE run to the principal it acts for, decided in
+// the bot process: the runner registers every agent run it spawns
+// (runId -> principal) and stamps OC_RUN_ID + OC_RUN_ATTEST into the run's
+// env; the loopback answers "who is this?" only for a registered, still-live
+// run whose attest matches. Anything else (no attest, a wrong one, a run that
+// has ended, a detached process that outlived its turn) is UNATTRIBUTED, and
+// unattributed never carries owner powers.
+const RUN_TTL_MS = 12 * 60 * 60 * 1000;
+const runs = new Map();
+
+function runSignature(runId) {
+  return crypto.createHmac("sha256", secret()).update(`run\0${runId}`).digest("hex");
+}
+
+function principalOf(principal = {}) {
+  // Bot-internal work with no speaker (compaction, owner jobs) acts for the
+  // owner; a run is guarded exactly when it acts for someone who is not.
+  const owner = principal.owner === true;
+  const text = (value) => (value == null || value === "" ? null : String(value));
+  return {
+    kind: text(principal.kind) || "turn",
+    owner,
+    guarded: !owner,
+    canonicalUserId: text(principal.canonicalUserId),
+    name: text(principal.name),
+    adapterId: text(principal.adapterId),
+    adapterType: text(principal.adapterType),
+    channelId: text(principal.channelId),
+    userId: text(principal.userId),
+    room: text(principal.room),
+    purpose: text(principal.purpose),
+  };
+}
+
+function pruneRuns(now = Date.now()) {
+  for (const [id, record] of runs) {
+    if (now - record.registeredAt > RUN_TTL_MS) runs.delete(id);
+  }
+}
+
+// Returns the attest to stamp as OC_RUN_ATTEST. Re-registering a run (a retry
+// of the same runId) replaces its principal.
+function registerRun(runId, principal = {}) {
+  const id = String(runId || "");
+  if (!id) return "";
+  pruneRuns();
+  runs.set(id, { ...principalOf(principal), runId: id, registeredAt: Date.now() });
+  return runSignature(id);
+}
+
+function endRun(runId) {
+  runs.delete(String(runId || ""));
+}
+
+// The principal of a live run whose attest matches, or null (fail closed).
+function verifyRun(runId, attest) {
+  const id = String(runId || "");
+  const sig = String(attest || "");
+  if (!id || !sig) return null;
+  const record = runs.get(id);
+  if (!record) return null;
+  if (Date.now() - record.registeredAt > RUN_TTL_MS) { runs.delete(id); return null; }
+  const a = Buffer.from(sig, "utf-8");
+  const b = Buffer.from(runSignature(id), "utf-8");
+  if (a.length !== b.length) return null;
+  try { if (!crypto.timingSafeEqual(a, b)) return null; } catch (e) { return null; }
+  return { ...record };
+}
+
+function liveRuns() {
+  pruneRuns();
+  return Array.from(runs.values(), (record) => ({ ...record }));
+}
+
+module.exports = { mint, verify, registerRun, endRun, verifyRun, liveRuns, principalOf };