@inetafrica/open-claudia 3.5.1 → 3.5.7

package/core/sandbox-probe.js

@@ -0,0 +1,78 @@
+"use strict";
+
+// Whether this host can run the sandbox Claude Code needs for
+// CLAUDE_CODE_SUBPROCESS_ENV_SCRUB (a staff turn's subprocesses never see the
+// AI service credentials). On Linux that is bubblewrap, which needs
+// unprivileged user namespaces. The fleet's containers have neither: no
+// bubblewrap, and seccomp blocks user namespaces. There, setting the scrub
+// makes Claude Code refuse to start, so every staff turn crashed
+// (network-bot on 3.5.1, 26 Sep 2026). Where the probe fails, a staff turn
+// runs as it did on 3.4.x: its subprocesses can see the AI credentials, as
+// they always could there. macOS has its own sandbox and keeps the scrub.
+//
+// OC_STAFF_ENV_SCRUB=on|off overrides the probe (default auto).
+
+const { spawnSync } = require("child_process");
+
+let cached = null;
+let logged = false;
+
+function firstLine(text) {
+  return String(text || "").trim().split("\n")[0].slice(0, 200);
+}
+
+/** One probe, no caching: { ok, reason }. Injectable for tests. */
+function probeSandbox({ platform = process.platform, env = process.env, spawn = spawnSync } = {}) {
+  const mode = String(env.OC_STAFF_ENV_SCRUB || "auto").trim().toLowerCase();
+  if (mode === "off") return { ok: false, reason: "OC_STAFF_ENV_SCRUB=off" };
+  if (mode === "on") return { ok: true, reason: "OC_STAFF_ENV_SCRUB=on" };
+  if (platform === "darwin") return { ok: true, reason: "macOS sandbox" };
+  if (platform !== "linux") return { ok: false, reason: `no sandbox on ${platform}` };
+  let r;
+  try {
+    r = spawn("bwrap", ["--ro-bind", "/", "/", "--dev", "/dev", "true"], {
+      timeout: 5000,
+      stdio: ["ignore", "ignore", "pipe"],
+      encoding: "utf8",
+    });
+  } catch (e) {
+    return { ok: false, reason: `bubblewrap could not run: ${e.message}` };
+  }
+  if (r.error) {
+    return {
+      ok: false,
+      reason: r.error.code === "ENOENT" ? "bubblewrap is not installed" : `bubblewrap could not run: ${r.error.code || r.error.message}`,
+    };
+  }
+  if (r.status !== 0) {
+    const why = firstLine(r.stderr);
+    return { ok: false, reason: `bubblewrap cannot make a sandbox here${why ? `: ${why}` : ` (exit ${r.status})`}` };
+  }
+  return { ok: true, reason: "bubblewrap works" };
+}
+
+/**
+ * The probe's answer for this process, asked once and remembered. The first
+ * answer is logged once, so a fleet bot's log says why the scrub is off.
+ */
+function staffEnvScrub(options) {
+  if (!cached) cached = probeSandbox(options);
+  if (!logged) {
+    logged = true;
+    const log = (options && options.log) || console.log;
+    log(`[guard] staff-turn credential scrub ${cached.ok ? "ON" : "OFF"} on this host: ${cached.reason}`);
+  }
+  return cached;
+}
+
+function _resetForTest() {
+  cached = null;
+  logged = false;
+}
+
+function _setForTest(answer) {
+  cached = answer;
+  logged = true;
+}
+
+module.exports = { probeSandbox, staffEnvScrub, _resetForTest, _setForTest };

package/core/scheduler.js

@@ -32,8 +32,10 @@ const {
   getProviderSession,
   getProviderSettings,
   getUserState,
+  peekLane,
+  laneBusy,
 } = require("./state");
-const { canonicalForChannel, conversationKeyFor } = require("./identity");
+const { canonicalForChannel, conversationKeyFor, parseConversationKey } = require("./identity");
 const { send: defaultSend } = require("./io");
 const { providerStatus: defaultProviderStatus } = require("./providers");
 const { redactSensitive } = require("./redact");
@@ -109,6 +111,13 @@ function buildWatchCheckEnv(source, stamp = {}, { owner = false } = {}) {
   return env;
 }
 
+// The chat thread a job answers in: stored on the job when it was created in a
+// thread, else read off its conversation key (older jobs, CLI-made jobs).
+function jobThreadId(job) {
+  if (!job) return null;
+  return job.threadId || parseConversationKey(job.project).threadId || null;
+}
+
 // The principal a watch-check's short-lived run acts for: the job's creator,
 // resolved from its stored channel/user the same way runPrincipal resolves a
 // turn's speaker. Owner → the check attributes as the owner (unchanged); a
@@ -136,6 +145,7 @@ function watchCheckPrincipal(job) {
     adapterId: job && job.adapter ? String(job.adapter) : null,
     adapterType,
     channelId,
+    threadId: jobThreadId(job),
     userId,
     room,
   };
@@ -299,8 +309,26 @@ function createSchedulerService(dependencies = {}) {
     return { name, dir: dir || workspace || process.cwd() };
   }
 
+  // The session of the main timeline of the room a thread job belongs to.
+  function roomMainSession(state, job) {
+    if (!jobThreadId(job)) return null;
+    const threadRoom = parseConversationKey(job.project).threadId ? parseConversationKey(job.project).roomKey : null;
+    const roomKey = threadRoom || (job.adapterType && job.channelId ? conversationKeyFor(job.adapterType, job.channelId) : null);
+    if (!roomKey || roomKey === job.project) return null;
+    return getProviderSession(state, job.provider, roomKey) || null;
+  }
+
   function resolveCompactionLineage(state, job) {
     let sessionId = job.sessionId || null;
+    // A thread job never resumes its room's MAIN session: a job made in a
+    // thread's first (forked) turn by an older build stored the main id, and
+    // resuming it would write the thread's wakeup into the main conversation,
+    // possibly beside a live main turn. Use the thread's own session instead.
+    const mainSession = sessionId ? roomMainSession(state, job) : null;
+    if (mainSession && sessionId === mainSession) {
+      const own = getProviderSession(state, job.provider, job.project);
+      sessionId = own && own !== mainSession ? own : null;
+    }
     if (!sessionId) return { sessionId: null, attachSession: true };
     const seen = new Set();
     while (sessionId && !seen.has(sessionId)) {
@@ -707,6 +735,9 @@ function createSchedulerService(dependencies = {}) {
       // shared session. Matches captured project.name (projectDescriptor(job).name)
       // so sameCapturedProject / getProjectKey resolve the right thread mid-run.
       conversationKey: projectDescriptor(job).name,
+      // A job made in a chat thread answers in that thread: its notice, its
+      // typing indicator and its reply all go back into the thread.
+      threadId: jobThreadId(job),
       // …but the thread is not the room. A job belongs to the room it was
       // created in and must answer under THAT room's provider; without this the
       // room overlay can't resolve and the run silently falls back to the
@@ -721,7 +752,15 @@ function createSchedulerService(dependencies = {}) {
     return runInChat(chat, async () => {
       noteLegacyCreatorOnce(job);
       const state = stateForUser(canonicalUserId);
-      if (state.runningProcess || state.preparingRun || state.isCompacting) {
+      // Busy means THIS job's conversation is running, compacting or has
+      // messages waiting; other conversations of the speaker may run meanwhile.
+      // The conversation it replies INTO counts too: a job whose project is not
+      // its chat's key (--project myrepo, a legacy basename) must not answer in
+      // a thread or timeline beside a live turn there.
+      const lane = peekLane(state, projectDescriptor(job).name);
+      const replyLane = peekLane(state, conversationKeyFor(adapter.type, job.channelId, jobThreadId(job)));
+      const occupied = (l) => laneBusy(l) || !!l?.messageQueue?.length;
+      if (occupied(lane) || occupied(replyLane)) {
         try { return markBusy(job); }
         catch (error) { return keepRetrying(job, error, busyDelayMs); }
       }
@@ -945,7 +984,9 @@ function createSchedulerService(dependencies = {}) {
     const sessionId = Object.prototype.hasOwnProperty.call(spec, "sessionId")
       ? spec.sessionId
       : getProviderSession(state, provider, project);
-    const originRunId = spec.originRunId || state.activeRunContext?.runId || null;
+    // Fall back to the run of the job's own conversation only: another
+    // thread's running turn is not where this job came from.
+    const originRunId = spec.originRunId || (project ? peekLane(state, project)?.activeRunContext?.runId : null) || null;
     const providerSettings = spec.providerSettings || getProviderSettings(state, provider);
     return {
       ...spec,
@@ -1072,6 +1113,7 @@ module.exports = {
   terminalRunSucceeded,
   buildWatchCheckEnv,
   watchCheckPrincipal,
+  jobThreadId,
   setAdapters,
   initScheduler,
   scheduleJob: service.scheduleJob,

package/core/side-chat.js

@@ -143,6 +143,23 @@ async function defaultDeliver(payload, store) {
   return execute();
 }
 
+// Side chats are per (speaker, conversation): a speaker's threads each get
+// their own side answer, and /stop in one conversation cancels only its own.
+// A bare canonical id (no lane) addresses every conversation of the speaker.
+const LANE_SEP = "\u0000";
+function sideChatKey(canonicalUserId, laneKey = null) {
+  return laneKey ? `${canonicalUserId}${LANE_SEP}${laneKey}` : String(canonicalUserId);
+}
+function keyMatches(key, canonicalUserId, laneKey = null) {
+  if (laneKey) return key === sideChatKey(canonicalUserId, laneKey);
+  const user = String(canonicalUserId);
+  return key === user || key.startsWith(`${user}${LANE_SEP}`);
+}
+function requestLaneKey(request) {
+  const runContext = request?.originalRunContext || request?.runContext || null;
+  return runContext?.laneKey || runContext?.project?.name || null;
+}
+
 class SideChatCoordinator {
   constructor(options = {}) {
     this.runSideChat = options.runSideChat || ((request) => require("./runner").runSideChatRequest(request));
@@ -163,28 +180,39 @@ class SideChatCoordinator {
     return this.modeReader() === "agent";
   }
 
-  isActive(canonicalUserId) {
-    return this.activeByUser.has(String(canonicalUserId));
+  isActive(canonicalUserId, laneKey = null) {
+    return [...this.activeByUser.keys()].some((key) => keyMatches(key, canonicalUserId, laneKey));
   }
 
-  attachProcess(canonicalUserId, proc) {
+  attachProcess(canonicalUserId, proc, laneKey = null) {
     if (!proc) return;
     let resolveDone;
     const done = new Promise((resolve) => { resolveDone = resolve; });
     const settle = () => resolveDone();
     proc.once("close", settle);
     proc.once("error", settle);
-    this.processByUser.set(String(canonicalUserId), { proc, done });
+    this.processByUser.set(sideChatKey(canonicalUserId, laneKey), { proc, done });
   }
 
-  detachProcess(canonicalUserId, proc) {
-    const key = String(canonicalUserId);
+  detachProcess(canonicalUserId, proc, laneKey = null) {
+    const key = sideChatKey(canonicalUserId, laneKey);
     const entry = this.processByUser.get(key);
     if (!proc || entry?.proc === proc) this.processByUser.delete(key);
   }
 
-  async cancel(canonicalUserId) {
-    const key = String(canonicalUserId);
+  // Cancel the side chat of one conversation (laneKey), or of every
+  // conversation of the speaker when no lane is named.
+  async cancel(canonicalUserId, laneKey = null) {
+    if (!laneKey) {
+      const keys = new Set([...this.activeByUser.keys(), ...this.processByUser.keys()]
+        .filter((key) => keyMatches(key, canonicalUserId)));
+      const outcomes = await Promise.all([...keys].map((key) => this.cancelKey(key)));
+      return outcomes.some(Boolean);
+    }
+    return this.cancelKey(sideChatKey(canonicalUserId, laneKey));
+  }
+
+  async cancelKey(key) {
     const active = this.activeByUser.get(key);
     if (active) this.cancelledRequests.add(active.token);
     const entry = this.processByUser.get(key);
@@ -208,8 +236,8 @@ class SideChatCoordinator {
   }
 
   async cancelAll() {
-    const users = new Set([...this.activeByUser.keys(), ...this.processByUser.keys()]);
-    const outcomes = await Promise.all([...users].map((canonicalUserId) => this.cancel(canonicalUserId)));
+    const keys = new Set([...this.activeByUser.keys(), ...this.processByUser.keys()]);
+    const outcomes = await Promise.all([...keys].map((key) => this.cancelKey(key)));
     return outcomes.filter(Boolean).length;
   }
 
@@ -258,7 +286,7 @@ class SideChatCoordinator {
 
   async respond(input = {}) {
     const request = this.makePending(input);
-    const userKey = String(request.canonicalUserId);
+    const userKey = sideChatKey(request.canonicalUserId, requestLaneKey(request));
     if (this.activeByUser.has(userKey)) {
       try {
         const delivery = await this.deliver({
@@ -343,4 +371,5 @@ module.exports = {
   createSideChatRequest,
   readRuntimeMode,
   sideChatCoordinator,
+  sideChatKey,
 };

package/core/speaker-attest.js

@@ -88,6 +88,8 @@ function principalOf(principal = {}) {
     adapterId: text(principal.adapterId),
     adapterType: text(principal.adapterType),
     channelId: text(principal.channelId),
+    // The chat thread the run answers in (null: the channel's main timeline).
+    threadId: text(principal.threadId),
     userId: text(principal.userId),
     room: text(principal.room),
     purpose: text(principal.purpose),