@inetafrica/open-claudia 3.4.6 → 3.4.7

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## v3.4.7 — Keep scheduled follow-ups queued while the chat is busy
+
+- Scheduler: busy chats keep wakeups queued without consuming execution retries. Watch triggers and expiries are saved once, survive restart, and stop polling while delivery is pending. Concurrent callbacks cannot start overlapping runs; advisory notifications are attempted once per occurrence. Real execution failures retain bounded retries.
+
 ## v3.4.6 — Codex runs again: the gate stopped asking for the impossible
 
 - **Every Codex turn since Codex CLI 0.153.x failed with `OpenAI Codex is incompatible: Codex rejected the isolated PreToolUse configuration or could not disable uncovered tool transports`.** The mandatory tool-hook gate ran `codex features list` with our overrides and required `unified_exec` to read `false`. Codex 0.153.2, 0.153.3 and 0.153.4 all ignore `-c features.unified_exec=false` (the feature is locked on and `codex features list` reports `unified_exec stable true` regardless), so the gate refused the provider on every turn — the failure Sumeet hit right after switching to gpt-6-astra on 3.4.5.

package/core/scheduler.js

@@ -120,6 +120,7 @@ function createSchedulerService(dependencies = {}) {
   const admit = dependencies.admitRunContext || ((...args) => require("./runner").admitRunContext(...args));
   const timers = new Map();
   const checksInFlight = new Set();
+  const firesInFlight = new Set();
   // Poll a watch's `check`: exit 0 → the watched condition is met, wake the
   // agent; non-zero → still idle, skip silently. Runs in the job's project
   // dir with the process env, output discarded (exit code is the contract),
@@ -344,18 +345,15 @@ function createSchedulerService(dependencies = {}) {
   function markBusy(job) {
     const latest = jobsStore.get(job.id) || job;
     const busyDeferralCount = (latest.busyDeferralCount || 0) + 1;
-    const dead = busyDeferralCount >= (latest.maxAttempts || 1);
     const patch = {
-      status: dead ? "dead-letter" : "deferred",
-      disabled: dead,
+      status: "deferred",
+      disabled: false,
       busyDeferralCount,
-      nextAttemptAt: dead ? null : now() + busyDelayMs,
-      lastError: dead ? { code: "SCHEDULED_BUSY_EXHAUSTED", message: "Channel remained busy through every bounded deferral" } : null,
+      nextAttemptAt: now() + busyDelayMs,
     };
     const updated = jobsStore.update(job.id, patch) || { ...latest, ...patch };
-    if (!dead) armRetry(updated, busyDelayMs);
-    else unscheduleJob(job.id);
-    return { ok: false, deferred: !dead, status: updated.status, job: updated };
+    armRetry(updated, busyDelayMs);
+    return { ok: false, deferred: true, status: updated.status, job: updated };
   }
 
   async function settleSuccess(job, result, target) {
@@ -396,6 +394,10 @@ function createSchedulerService(dependencies = {}) {
       attemptCount: 0,
       busyDeferralCount: 0,
       nextAttemptAt: null,
+      watchTriggeredOccurrenceId: null,
+      watchTriggeredAt: null,
+      watchExpired: false,
+      advisoryOccurrenceId: null,
     });
     if (reset && timers.get(job.id)?.timeout) scheduleJob(reset);
     return reset
@@ -404,6 +406,14 @@ function createSchedulerService(dependencies = {}) {
   }
 
   async function fireJob(idOrJob, options = {}) {
+    const id = typeof idOrJob === "string" ? idOrJob : idOrJob?.id;
+    if (firesInFlight.has(id)) return { ok: false, status: "running", skipped: true, inFlight: true };
+    firesInFlight.add(id);
+    try { return await executeJob(idOrJob, options); }
+    finally { firesInFlight.delete(id); }
+  }
+
+  async function executeJob(idOrJob, options = {}) {
     const requested = typeof idOrJob === "string" ? jobsStore.get(idOrJob) : idOrJob;
     let job = requested?.id && jobsStore.get(requested.id) ? jobsStore.get(requested.id) : requested;
     if (!job) return { ok: false, status: "missing" };
@@ -423,7 +433,7 @@ function createSchedulerService(dependencies = {}) {
     // runs the check and only wakes the agent when it exits 0. A non-zero exit
     // is the normal idle case: skip silently, mark nothing, leave the job
     // pending so the next tick polls again. Never marks failure; never chats.
-    if (job.check) {
+    if (job.check && job.watchTriggeredOccurrenceId !== job.occurrenceId) {
       if (!watchesEnabled()) {
         logWatch(job, "skipped (watches disabled globally)");
         return { ok: false, status: "watch-disabled", skipped: true };
@@ -443,27 +453,30 @@ function createSchedulerService(dependencies = {}) {
           logWatch(job, check && check.timedOut ? "idle (check timed out)" : `idle (check exit ${check ? check.code : "?"})`);
           return { ok: false, status: "watch-idle", skipped: true };
         }
-        logWatch(job, `expired without firing (check exit ${check ? check.code : "?"}) — waking agent`);
         // Expiry ends the watch's window: one-shot removal even for --repeat
         // (the woken agent re-arms if still wanted). Persisted so a retry of a
         // failed expiry fire keeps the same semantics across restarts.
-        try {
-          const marked = jobsStore.update(job.id, { repeat: false, watchExpired: true });
-          if (marked) job = marked;
-          else { job.repeat = false; job.watchExpired = true; }
-        } catch (_) { job.repeat = false; job.watchExpired = true; }
+        job = { ...job, repeat: false, watchExpired: true };
       } else {
-        logWatch(job, "triggered (check passed) — waking agent");
-        if (job.watchExpired) {
-          // A prior expiry fire failed and the condition came true before the
-          // retry: report it as a real trigger, not an expiry.
-          try {
-            const cleared = jobsStore.update(job.id, { watchExpired: false });
-            if (cleared) job = cleared;
-            else job.watchExpired = false;
-          } catch (_) { job.watchExpired = false; }
-        }
+        job = { ...job, watchExpired: false };
       }
+      // Latch the condition before admission or notification. Delivery retries
+      // and restarts must not run the check again or change an expiry's meaning.
+      try {
+        const marked = jobsStore.update(job.id, {
+          status: "deferred",
+          nextAttemptAt: now(),
+          repeat: job.repeat,
+          watchExpired: job.watchExpired,
+          watchTriggeredOccurrenceId: job.occurrenceId,
+          watchTriggeredAt: now(),
+        });
+        if (!marked) throw new Error("watch trigger could not be persisted");
+        job = marked;
+      } catch (error) {
+        return { ok: false, status: "failed", error: stableFailure(error) };
+      }
+      logWatch(job, job.watchExpired ? "expired without firing — delivery queued" : "triggered (check passed) — delivery queued");
     }
 
     const adapter = resolveAdapter(job);
@@ -557,7 +570,14 @@ function createSchedulerService(dependencies = {}) {
         : target.fallbackFrom
           ? `\n⚠️ ${target.fallbackFrom} is unavailable — running on fallback ${target.provider}.`
           : "";
-      try { await send(`${advisory}${providerNote}`); } catch (_) { /* advisory only */ }
+      if (job.advisoryOccurrenceId !== job.occurrenceId) {
+        // At-most-once advisory: persist before sending so a restart cannot
+        // repeat it. A crash between these steps may omit this optional notice.
+        try {
+          if (!jobsStore.update(job.id, { advisoryOccurrenceId: job.occurrenceId })) throw new Error("advisory marker could not be persisted");
+          await send(`${advisory}${providerNote}`);
+        } catch (_) { /* advisory only */ }
+      }
       let result;
       try { result = await runInProvider(prompt, runContext.cwd, null, { ...runOptions, runContext }); }
       catch (error) {

package/docs/PROVIDER_MIGRATION.md

@@ -64,4 +64,8 @@ The pointer, provider-tagged history lineage, and tuple-scoped usage checkpoint
 
 Scheduled work uses a versioned `{schemaVersion, jobs, archived}` document. Every runnable occurrence stores its canonical user, channel, project, provider, provider-settings snapshot, native session lineage, origin run, and stable occurrence ID. A fresh foreground turn can create a job before its native session is known; terminal session persistence binds that job by origin run ID. Compaction descendants are followed only when recorded lineage proves the relationship, and an older scheduled branch cannot replace an unrelated live session pointer.
 
-Wakeups and crons wait for terminal provider completion, transcript/usage/session persistence, and required delivery. A one-shot receives a durable success marker before deletion. Busy or failed occurrences retain their occurrence ID and bounded attempt state across restart; exhaustion and wakeups outside the missed-fire grace window remain visible as disabled dead letters. Provider fallback is empty by default. When `PROVIDER_FALLBACKS` is explicitly configured, a fallback starts a fresh provider session with an archived provider-neutral brief and never receives another provider's native session ID. Legacy `crons.json` remains byte-for-byte untouched after its ambiguous records are copied into the disabled archive.
+Wakeups and crons wait for terminal provider completion, transcript/usage/session persistence, and required delivery. A one-shot receives a durable success marker before deletion. Busy occurrences retain their occurrence ID across restart and wait until the chat is idle, without consuming execution attempts or expiring under the missed-fire grace window. Genuine execution failures still have bounded retries; exhaustion and wakeups never admitted within the missed-fire grace window remain visible as disabled dead letters.
+
+A watch persists its trigger (or expiry) before delivery and does not poll its check again while that occurrence is pending. Repeat watches resume polling only after successful delivery advances the occurrence. An in-process guard prevents overlapping callbacks from starting the same occurrence, even when a run lasts longer than its retry delay. Advisory notifications are marked before sending and attempted at most once per occurrence across retries/restarts; a crash between marking and sending can omit this optional notice. An interrupted provider run may still retry with the same occurrence ID if no durable success marker exists; this is not an exactly-once guarantee for external side effects. Previously dead-lettered jobs are not automatically revived because their queued actions may now be stale.
+
+Provider fallback is empty by default. When `PROVIDER_FALLBACKS` is explicitly configured, a fallback starts a fresh provider session with an archived provider-neutral brief and never receives another provider's native session ID. Legacy `crons.json` remains byte-for-byte untouched after its ambiguous records are copied into the disabled archive.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.4.6",
+  "version": "3.4.7",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {

package/test-provider-language.js

@@ -463,7 +463,8 @@ assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
 // Codex turn. Live probe: unified-exec shell calls still reach PreToolUse as
 // tool_name "Bash" and the deny gate caught the probe, so the gate no longer
 // requires unified_exec off. Push approved by Sumeet before release.
-assert.strictEqual(pkg.version, "3.4.6", "release version must remain unchanged without explicit approval");
+// 3.4.7: owner approved scheduler fix and push on 2026-09-05.
+assert.strictEqual(pkg.version, "3.4.7", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }

package/test-provider-scheduler.js

@@ -633,6 +633,88 @@ async function busyRestartAndMissedProbe(createSchedulerService) {
   assert.strictEqual(missedTimers.length, 1, "a missed wakeup gets exactly one startup attempt");
 }
 
+async function durablePendingProbe(createSchedulerService, jobsApi) {
+  const configDir = fs.mkdtempSync(path.join(os.tmpdir(), "oc-pending-restart-"));
+  let clock = 1_720_000_000_500;
+  const openStore = () => jobsApi.createJobsStore({ configDir, jobsFile: path.join(configDir, "jobs.json"), now: () => clock });
+  const success = { ok: true, status: "succeeded", delivery: { ok: true } };
+  try {
+    for (const kind of ["wakeup", "watch", "expiry"]) {
+      const store = openStore();
+      store.add(baseJob({ id: kind, ...(kind === "wakeup" ? {} : {
+        kind: "cron", schedule: "* * * * *", check: "fixture-check", repeat: true,
+        expiresAt: kind === "expiry" ? clock - 1 : clock + 1000,
+      }) }));
+      let checks = 0;
+      const h = schedulerHarness(createSchedulerService, [], {
+        jobsStore: store, now: () => clock,
+        runWatchCheck: async () => { checks++; return { code: kind === "expiry" ? 1 : 0 }; },
+      });
+      h.state.runningProcess = { pid: 1 };
+      for (let tick = 0; tick < 12; tick++) {
+        clock += 60 * 60 * 1000;
+        const result = await h.service.fireJob(kind);
+        assert.strictEqual(result.deferred, true, "hours of busy time must remain queued");
+      }
+      assert.strictEqual(store.get(kind).attemptCount, 0);
+      assert.strictEqual(store.get(kind).disabled, false);
+      assert.strictEqual(checks, kind === "wakeup" ? 0 : 1);
+      assert.strictEqual(h.sends.length, 0);
+      h.service.stopAll();
+
+      // Reopen the real on-disk store and construct a new scheduler, as boot does.
+      const reloaded = openStore();
+      const terminal = deferred();
+      const restarted = schedulerHarness(createSchedulerService, [], {
+        jobsStore: reloaded, now: () => clock, outcomes: [terminal.promise, success],
+        runWatchCheck: async () => { throw new Error("pending watch must not poll after restart"); },
+      });
+      restarted.service.init();
+      const firing = restarted.scheduled[0].fn();
+      await nextTurn();
+      clock += 60 * 60 * 1000;
+      assert.strictEqual((await restarted.service.fireJob(kind)).inFlight, true, "long runs cannot re-enter after retry delay");
+      assert.strictEqual(restarted.runCalls.length, 1);
+      assert.strictEqual(restarted.sends.length, 1);
+      if (kind === "expiry") assert.match(restarted.runCalls[0].prompt, /Watch expired/);
+      terminal.resolve(success);
+      await firing;
+      if (kind === "watch") {
+        assert.strictEqual(reloaded.get(kind).status, "pending");
+        assert.strictEqual(reloaded.get(kind).watchTriggeredOccurrenceId, null);
+        restarted.service.removeJob(kind);
+      } else assert.strictEqual(reloaded.get(kind), null);
+      restarted.service.stopAll();
+      const finalBoot = schedulerHarness(createSchedulerService, [], { jobsStore: openStore(), now: () => clock });
+      finalBoot.service.init();
+      assert.strictEqual(finalBoot.scheduled.length, 0, "successful one-shot cannot replay on restart");
+    }
+
+    const store = openStore();
+    store.add(baseJob({ id: "failure", kind: "cron", schedule: "* * * * *", check: "fixture" }));
+    const failed = schedulerHarness(createSchedulerService, [], {
+      jobsStore: store, now: () => clock,
+      runWatchCheck: async () => ({ code: 0 }), outcomes: [{ ok: false, error: { code: "FIXTURE_FAILED" } }],
+    });
+    await failed.service.fireJob("failure");
+    failed.service.stopAll();
+    clock += 2000;
+    const retry = schedulerHarness(createSchedulerService, [], {
+      jobsStore: openStore(), now: () => clock,
+      runWatchCheck: async () => { throw new Error("do not recheck"); },
+      outcomes: [{ ok: false }, { ok: false }],
+    });
+    await retry.service.fireJob("failure");
+    await retry.service.fireJob("failure");
+    assert.strictEqual(retry.jobsStore.get("failure").status, "dead-letter", "real failures retain bounded retries");
+    assert.strictEqual(retry.jobsStore.get("failure").attemptCount, 3);
+    assert.strictEqual(retry.sends.length, 0, "advisory is not repeated across failure/restart");
+    retry.service.stopAll();
+  } finally {
+    fs.rmSync(configDir, { recursive: true, force: true });
+  }
+}
+
 async function unavailableAndFallbackProbe(createSchedulerService) {
   const noFallback = schedulerHarness(createSchedulerService, [baseJob({ id: "unavailable" })], {
     providerStatus: () => ({ availability: { state: "missing" }, auth: { state: "not_checked" } }),
@@ -960,6 +1042,7 @@ async function main() {
   await failureAndRetryProbe(schedulerApi.createSchedulerService);
   await detachedHistoricalBranchProbe(schedulerApi.createSchedulerService);
   await busyRestartAndMissedProbe(schedulerApi.createSchedulerService);
+  await durablePendingProbe(schedulerApi.createSchedulerService, jobsApi);
   await unavailableAndFallbackProbe(schedulerApi.createSchedulerService);
   await cronOccurrenceProbe(schedulerApi.createSchedulerService);
   await watchGateProbe(schedulerApi.createSchedulerService);