@inetafrica/open-claudia 3.5.16 → 3.5.18

package/.env.example

@@ -70,6 +70,16 @@ USAGE_ALERT_RATE_MULTIPLIER=1.75
 USAGE_ALERT_BASELINE_TURNS=20
 USAGE_ALERT_MIN_BASELINE_TURNS=6
 USAGE_ALERT_COOLDOWN_MS=1800000
+# Plan limits (Claude Pro/Max, the ChatGPT plan behind Codex). Warn in the chat
+# when a window's use passes these percentages, once per window (off = never).
+LIMIT_WARN_PERCENTS=80,95
+# A message a usage limit stopped is picked up when the limit resets, unless
+# the person writes again first: on (default) | off.
+LIMIT_PICKUP=on
+# Seconds after the reset before it runs (default 120); a reset further out
+# than LIMIT_PICKUP_MAX_WAIT_H hours (default 192) is not waited for.
+LIMIT_PICKUP_DELAY_S=120
+LIMIT_PICKUP_MAX_WAIT_H=192
 MEMORY_RECALL_MAX_CHARS=9000
 # Default recall engine when a chat hasn't picked one with /engine: classic | discoverer
 RECALL_ENGINE=classic

package/CHANGELOG.md

@@ -1,5 +1,58 @@
 # Changelog
 
+## 3.5.18
+
+Usage limits (Sumeet, 7 Oct 15:00 EAT: "track usage and notify the user that they are going to hit their limit, if the limit is hit can the bot auto schedule to continue when the limit replenishes"; 15:14 EAT: "if the user sends it a message it cancels and if the session limit message comes up again it will just rearm").
+
+- **A message a usage limit stopped is picked up when the limit resets.** When Claude's 5-hour or weekly limit (or Codex's plan limit) stops a chat turn, the bot says which limit and when it resets ("⏳ Claude's weekly limit is used up, so I stopped here. I'll pick your message back up on Fri 9 Oct at 08:02, when it resets. If you write to me before then, I'll answer that instead and drop this.") and runs the message again 2 minutes after the reset (`LIMIT_PICKUP_DELAY_S`), in the same conversation, as the person who sent it, with "check what you already did; never repeat a send, push, deploy or write". One pick-up per person per conversation, kept in `limit-pickups.json` so it survives a restart. The person writing again in that conversation drops it (also when the guard holds that message), as do `/stop`, `/new` and `/end`; another person in a group does not. A run that hits a limit again arms it again with the same message, at most 5 times. Resets further out than `LIMIT_PICKUP_MAX_WAIT_H` (192 h) are not waited for. `LIMIT_PICKUP=off` only says when the limit resets. An unasked group reply that hits a limit posts nothing.
+- **The limit notice is never the reply.** Claude Code words a plan limit "You've hit your limit / session limit / weekly limit · resets …", which the old checks missed: the bot posted "Claude Code run failed: You've hit your session limit · resets 11:30am (Africa/Nairobi)", or the bare notice as if it were the answer (the tickets bot to a staff member, 7 Oct). The limit is now read from Claude Code's `rate_limit_event` (status `rejected`, the reset time) and its synthetic `rate_limit` message, which never streams as answer text; Codex's "You've hit your usage limit … try again at …" was already caught. The reset time comes from the event, else Codex's rollout, else the notice's own words.
+- **Warnings at 80% and 95%.** Claude Code reports each window's use on every run (`rate_limit_event.unifiedWindows`, a 0-1 fraction per 5-hour and weekly window); Codex in its rollout (its windows are named by length: on a Pro account the main one is weekly). After the reply that takes a window past 80% or 95%, the chat gets "⚠️ Claude: 82% of the 5-hour limit is used. It resets at 17:20." Once per window per percentage (`LIMIT_WARN_PERCENTS`, `off` for none); never to an outside contact, on a call or for an unasked group reply. Claude Code's own `allowed_warning` status is a pace warning (25% early in the week) and is not used.
+- **/usage shows the plan limits** ("Claude plan limits: 5-hour 57% (resets 17:20) · weekly 26% (resets Wed 14 Oct, 08:00)") and the waiting pick-up in this conversation.
+- **Tests:** `test-usage-limits.js`, `test-limit-pickup.js` (new); `test-provider-events.js`; the fake agent CLI gains a `usage-limit` scenario and `FAKE_AGENT_RATE_LIMIT_INFO`.
+
+Token diet for every bot (Sumeet, 8 Oct 08:19 EAT: "Let's roll it out to the fleet if we already seeing savings?"). On the owner's bot the 3.5.17 canary cut a typical reply from $8.72 to $4.03, and the cost per reply with compactions included by 48%, over 82 replies.
+
+- **The token diet is on by default.** Every conversation compacts at 200k, and before a cold resume over 120k, as listed conversations did in 3.5.17. `TOKEN_DIET_CONVERSATIONS=off` turns it off; a list of conversation keys still limits it to those.
+- **The compaction summary no longer dies on a tool call.** Claude runs it with `--max-turns 1`, and its prompt never said not to use tools: a model that checked a fact first used up the one turn and left no brief (4 of 24 compactions on 7-8 Oct, $35 for nothing). The prompt now says so, and a threshold compaction that does not complete logs why.
+- **A scheduled job's own conversation gets the same cap.** A watch, cron or wakeup resumes the conversation it was made in; once its thread had moved on, nothing compacted that conversation (the Kazee Bugs monitor's grew to 894k, $55 a wake). It is now compacted like its thread, before a cold run and after a run past the threshold, without touching the thread's live session. The usage ledger marks these compactions `scope: "job"`.
+- **Jobs follow their compactions.** The completed-compactions index keeps only the last 20, which the token diet fills in under a day, so jobs lost their way and resumed old, huge conversations (the PBX thread's wakeup and watch: 790k, $86 for two runs). The scheduler now also reads the lineage in the session history, and a recurring job remembers the session it last ran on.
+- **Tests:** `test-token-diet.js` (the default; job conversations end to end through the scheduler), `test-provider-compaction.js` (branch commit, the no-tools summary), `test-provider-scheduler.js` (history lineage, a job keeps its session); `test-usage-accounting.js` pins the classic thresholds with the diet off.
+
+## 3.5.17
+
+One combined release (Sumeet, 7 Oct 09:21 EAT): Release 1 below, the 7 Oct security fixes, and the dashboard and provider fixes found on 6 Oct. What people will notice: Codex bots start answering in groups when a message concerns them (their checks failed before), a file over 200 MB sent to a bot is refused, and a /dashboard link opens a Continue page first.
+
+Release 1, "reliable and lean" (Sumeet, 7 Oct: token diet approved 06:12 EAT, task-cleanup plan sections 2, 5 and 6 at 09:45, resuming interrupted work at 10:20). Fewer tokens re-read on every step, scheduled work that actually runs, a dream that reaches the owner, and work that survives a restart. The compaction changes are a canary: off until conversations are listed.
+
+- **Each conversation sees its own tasks.** A new task records the conversation it was made in (the thread, or the main timeline; a plan's subtasks follow the plan). The first turn of a session no longer gets the whole channel's task tree (90-123k characters on the owner's Kazee chat, where every thread shares one list): it gets this conversation's open tasks in full (at most 12, 6,000 characters), one line about the rest of the chat (count and the 5 most recent titles) and the pointer to `open-claudia task list`, at most 7,500 characters in all. Older tasks with no conversation count as "elsewhere". `task list` is unchanged.
+- **Team list and slash commands once per session.** They rode every turn (about 4.5k characters); now they come with the first turn of a session in each conversation (again after a restart, a new conversation or a compaction). Who is speaking and the formatting notes still come every turn.
+- **Token diet canary for compaction.** `TOKEN_DIET_CONVERSATIONS` (conversation keys as the usage ledger writes them, or `*`; empty = off) makes listed conversations compact at `TOKEN_DIET_COMPACT_TOKENS` (200k) instead of 380k, and compact before a turn that resumes them after the prompt cache expired (idle over `TOKEN_DIET_COLD_MINUTES`, 60) when their context is over `TOKEN_DIET_COLD_MIN_TOKENS` (120k); the turn then runs on the fresh session. `/compactwindow` still wins. Every compaction now leaves a usage-ledger record (`kind: "compaction"`, `compactReason`: threshold, cold-resume or manual, the context it replaced and what it cost), so before and after can be measured per conversation; the cost report and the dashboard keep counting turns only.
+- **The dream reports every task list.** The cold-task report read only the old Telegram list; it now covers every task list on the bot (task commands are owner-only, so they are all the owner's), at most 8 lines, each naming its list.
+- **Task archive, with a reason.** `open-claudia task archive <id> --reason "done: <proof>" | "replaced: <by what>" | "dropped: <who decided>" | "handed: <to whom>"` moves a task and its subtasks out of the list without losing them; `task restore <id>` brings them back with the same ids; `task archived [--limit N] [--search <text>]` lists them. Nothing archives by age, and `task done` is unchanged.
+- **Late crons still run.** node-cron skipped any run that started more than a second late, and the bot is often 2-3 seconds late at the top of a minute: the 04:00 dream ran on 7 of 14 nights and the 07:30 daily cron missed 6 and 7 Oct. Crons now tolerate `OC_CRON_LATE_TOLERANCE_MS` (10 min) and the dream `DREAM_LATE_TOLERANCE_MS` (3 h).
+- **The dream catches up.** If it has not run for more than 26 hours, it runs once now (checked at boot and hourly), never beside a running dream and at most once per 26 hours.
+- **The dream summary reaches the owner's main channel.** `DREAM_SUMMARY_TO` (`<adapter>:<channelId>`) if set, else the owner's primary channel from the people list, else Telegram as before. A Kazee-only owner never got it.
+- **A failing recurring job keeps its schedule.** One occurrence that failed five times used to disable a cron for good. Now that occurrence is recorded and skipped and the job runs again at its next time; one-shot wake-ups still give up.
+- **The owner hears when a job dies.** A wake-up or watch that gives up, or a cron occurrence that failed for good, posts one short message in its own conversation (or to the owner if that channel is gone): which job, the error code, and how to re-arm it.
+- **"No response requested." is not an answer.** A wake-up, cron or watch whose whole reply is that placeholder (Claude Code writes it into a session cut short by a restart) is re-run once, in the same session, with "Act on the prompt above now. Your first output must be a tool call or a real reply."
+- **New lessons reach running conversations.** A lesson learned after a conversation started is added to its next turn, once, under "New standing rules since this conversation started:".
+- **Interrupted work picks up after a restart** (Sumeet, 7 Oct: "a way for interrupted threads and work to get resumed automatically"). When a chat turn starts, the bot notes it in a small journal file and removes the note when the turn ends, is stopped or fails. After a restart the bot reads what is left: a turn cut off less than 2 hours ago (`RESUME_MAX_AGE_MIN`) continues in the same conversation with "Picking up where I was cut off (restart at HH:MM)." and an instruction to check what was already done and never repeat a send, push, deploy or write (also when it was the conversation's first turn, or its session is lost: the work may be half done, so it is never replayed as the plain message); an older one is offered back with Continue / Drop buttons for a day; one that was already cut off twice is not run again and the owner is told. Messages that were waiting behind it run afterwards, in order. `RESUME_INTERRUPTED=off` turns this off; safe mode never resumes anything. Scheduled jobs keep their own retry and are never run twice.
+- **/stop no longer loses waiting messages.** Each message it drops comes back with a "Run it" button for a day.
+- **Planned restarts wait for running work.** On a restart, upgrade or rollout the bot stops starting new turns (a message sent then runs right after the restart) and gives running turns time to finish: up to `DRAIN_TIMEOUT_S` (60 s) on /restart, /upgrade and /downgrade, `DRAIN_SIGTERM_S` (6 s) on a rollout or launchd stop, whose sender kills the bot soon after (bot pods allow 15 s); the bot saves its state before it waits. Anything still running picks up after the restart.
+- **A pack is not re-sent for a metadata change.** A memory pack already in the session is injected again only when what it shows changed, not when its "applied on" stamp or parent bookkeeping moves.
+- **Security: a sender's file name stays inside the files folder.** Kazee and Telegram saved a document under the sender's own file name, so a name like `../auth.json` could overwrite the owner list. One helper (`core/safe-filename.js`) keeps the last path segment, drops control and odd characters, refuses hidden or empty names, caps the length and checks the result stays in the folder. A document the guard holds for the owner keeps its file for the approval.
+- **Security: Kazee media downloads are fenced and capped at 200 MB.** The adapter fetched any link a message carried, with no size limit. Now `KAZEE_MEDIA_HOSTS`, when set, is the exact list of hosts allowed; when unset, any public host is allowed but private, loopback and link-local addresses are refused (checked on every lookup answer, so the address cannot change in between); Kazee's own host is always allowed. Files stream to a `.part` file and stop at 200 MB (Kazee Chat's own limit) or 60 s idle; a failed or oversized download is deleted.
+- **Security: the dashboard escapes everything it shows.** Pending users' names, cron labels, session titles, logs, the soul text, config values and usage rows went into the page as HTML, so a Telegram name or cron label carrying markup ran as script in the owner's dashboard.
+- **Security: a bad `/otp/` link answers 400.** A malformed link threw inside the request handler and messaged the owner each time, no sign-in needed. Bad links get a short 400 page; any handler failure answers 500 and is logged.
+- **Fix: /dashboard links survive Kazee Chat's link previews.** Kazee Chat fetches every link in a message to build a preview, which used up the one-time sign-in link before anyone tapped it ("Link expired or already used", 6 Oct). The link now opens a Continue page; only pressing it (a POST) uses the link.
+- **Fix: the Users tab works.** Approve, deny and remove on the bot's dashboard and Agent Space's Users tab answered 404, because the sign-in routes above them took every `/api/auth/*` path.
+- **Fix: a conversation whose saved history is gone starts fresh.** Claude Code answers "No conversation found with session ID" when the session file is missing, and every turn of that conversation failed until someone sent /new (chat-spaces-bot, 6 Oct). The stale session is retired and the turn runs fresh.
+- **Fix: helper agents' notes stay out of the chat.** Text streamed by a helper agent (the Agent/Task tool) was posted as the bot's reply (a security audit's working notes reached the owner, 6 Oct); it now only counts toward spend.
+- **Fix: Codex bots' background checks pass OpenAI's strict schema rules.** Every utility schema broke strict mode (400 invalid_json_schema), so on Codex bots passive group replies, pack review, dedup, the dream, recall filtering and bot hand-off checks all failed. They work now, which is why Codex bots start answering in groups.
+- **Fix: reassurances are never standing rules.** The owner-rule detector took "Never mind, I found it." as a never-directive and saved it, and offered "Don't worry so much about that." as a rule. Sentences opening with don't worry, do not worry or never mind no longer form a rule.
+- **node-cron ^4.6.0.** 4.2.1 has no option to tolerate a late start, which the late-cron fix relies on (its fallback for old versions stays).
+- **Tests:** `test-task-injection.js`, `test-speaker-extras.js`, `test-token-diet.js`, `test-dream-tasks.js`, `test-task-archive.js`, `test-cron-tolerance.js`, `test-dream-schedule.js`, `test-job-failures.js`, `test-scheduled-placeholder.js`, `test-lessons-since.js`, `test-pack-reinject.js`, `test-turn-journal.js` (new); `test-thread-lanes.js`, `test-loopback-owner-gate.js` and `test-provider-scheduler.js` updated. The fake agent CLI gains a `[[placeholder]]` prompt marker. Security and fix tests: `test-safe-filename.js`, `test-media-filename-paths.js`, `test-router-document-guard.js`, `test-web-dashboard-escape.js`, `test-web-bad-requests.js`, `test-kazee-download-limit.js`, `test-web-auth-routes.js`, `test-web-otp-link-preview.js`, `test-codex-output-schema.js` (new); `test-kazee-context-media.js`, `test-provider-refusal-recovery.js`, `test-provider-events.js`, `test-provider-dream.js`, `test-provider-pack-review.js`, `test-guardrail.js` extended.
+
 ## 3.5.16
 
 Watch a bot's browser live (Sumeet, 6 Oct: "can that show the browser like a see my computer view?", then "yeh go ahead"). Also carries 3.5.14 and 3.5.15, which never reached the bots: the 3.5.15 build kept failing on a timing-sensitive test, fixed here. Canary on the sales and tickets bots, then the fleet.

package/README.md

@@ -439,6 +439,7 @@ All stored in `~/.open-claudia/`:
 | `TELEGRAM_CHAT_ID` | Yes* | Comma-separated authorized chat IDs |
 | `CHANNELS` | No | Channels to start: `telegram`, `kazee`, or `telegram,kazee` (default `telegram`) |
 | `KAZEE_URL` / `KAZEE_BOT_TOKEN` / `KAZEE_BOT_USER_ID` / `KAZEE_OWNER_USER_ID` | Kazee only | Kazee Chat connection |
+| `KAZEE_MEDIA_HOSTS` | No | Comma-separated hosts (or URLs) Kazee serves file links from. When set, files are fetched only from these and the `KAZEE_URL` host. When unset, any public host works but private, loopback and link-local addresses are refused. Files stop at 200 MB either way |
 | `WORKSPACE` | Yes | Path to your projects directory |
 | `CLAUDE_PATH` / `CODEX_PATH` | No | Optional paths to provider CLIs (auto-detected if in PATH) |
 | `DEFAULT_PROVIDER` | No | Foreground default (`claude` or `codex`); blank deterministically chooses the first compatible provider |
@@ -452,6 +453,9 @@ All stored in `~/.open-claudia/`:
 | `USAGE_ALERT_CONTEXT_TOKENS` | No | With alerts on: alert when one completed turn's context tokens exceed this ceiling (default `120000`, `off` disables) |
 | `USAGE_ALERT_RATE_MULTIPLIER` | No | With alerts on: alert when the latest context-token rate exceeds the recent baseline by this multiple (default `1.75`, `off` disables) |
 | `USAGE_ALERT_BASELINE_TURNS` / `USAGE_ALERT_MIN_BASELINE_TURNS` / `USAGE_ALERT_COOLDOWN_MS` | No | Tune token-rate baseline size, minimum sample size, and alert cooldown |
+| `LIMIT_WARN_PERCENTS` | No | Plan-limit warnings in the chat: comma-separated percentages of a 5-hour or weekly window (default `80,95`, `off` disables). Each is said once per window, after the reply that crossed it; never to an outside contact |
+| `LIMIT_PICKUP` | No | `on` (default) or `off`. A message a Claude or Codex usage limit stopped is picked up when the limit resets; the person writing again in that conversation, `/stop`, `/new` or `/end` drops it, and a new limit hit arms it again |
+| `LIMIT_PICKUP_DELAY_S` / `LIMIT_PICKUP_MAX_WAIT_H` | No | Seconds after the reset before the pick-up runs (default `120`); resets further out than this many hours (default `192`) are not waited for |
 | `MEMORY_RECALL_MAX_CHARS` | No | Hard cap for auto-injected pack/entity memory per turn (default `9000`, `off` disables auto recall injection) |
 | `RECALL_ENGINE` | No | Default recall engine when a chat hasn't set one via `/engine` (`classic` or `discoverer`, default `discoverer`) |
 | `RECALL_GRAPH_DB` / `RECALL_METRICS` | No | Override the discoverer graph DB path; `off` on metrics disables per-turn recall logging |

package/bin/cli.js

@@ -648,7 +648,7 @@ Background work (only inside an active bot-spawned task):
   open-claudia watch-list                          List watches on this channel + master switch state
   open-claudia watch-remove <id>                   Remove a watch
   open-claudia watch-on | watch-off                Global master switch for all watches (owner)
-  open-claudia task add|list|start|done|remove     Per-channel todo (survives restarts)
+  open-claudia task add|list|start|done|remove|archive|restore  Per-channel todo (survives restarts)
   open-claudia agent "<prompt>" [--role X] [--provider active|claude|codex]  Spawn a provider-isolated sub-agent
 
 Cluster control (self-management of this bot's own deployment via the broker):

package/bin/task.js

@@ -17,6 +17,10 @@ Per-channel todo list with optional plan/subtask hierarchy.
                                          # a plan won't complete while any subtask is still open
   open-claudia task remove <id>          # removing a plan removes its subtasks
   open-claudia task clear-completed      # prune any leftover completed entries
+  open-claudia task archive <id> --reason "<how it closed>"  # move a plan/task (and its subtasks) out of the list
+        reason (required): "done: <proof>" | "replaced: <by what>" | "dropped: <who decided>" | "handed: <to whom>"
+  open-claudia task restore <id>         # bring an archived task back, same id
+  open-claudia task archived [--limit N] [--search <text>]  # archived tasks, most recent first
 
 Use plans for any work with 3+ distinct steps. Mark subtasks in_progress
 as you start them and done as you finish, so a resumed turn or a new
@@ -166,6 +170,50 @@ async function runClearCompleted() {
   } catch (e) { console.error(e.message); process.exit(1); }
 }
 
+async function runArchive(args) {
+  const reason = takeFlag(args, "reason");
+  const id = args[0];
+  if (!id || !reason) {
+    console.error('Usage: task archive <id> --reason "done: <proof>" | "replaced: <by what>" | "dropped: <who decided>" | "handed: <to whom>"');
+    process.exit(2);
+  }
+  try {
+    const res = await postJson("task-archive", { id, reason });
+    if (!res.ok) { console.error(`Not found: ${id}`); process.exit(1); }
+    const extra = res.alsoArchived ? ` (and ${res.alsoArchived} subtask${res.alsoArchived === 1 ? "" : "s"})` : "";
+    console.log(`Archived ${id}${extra}. Restore with: open-claudia task restore ${id}`);
+    process.exit(0);
+  } catch (e) { console.error(e.message); process.exit(1); }
+}
+
+async function runRestore(args) {
+  const id = args[0];
+  if (!id) { console.error("Usage: task restore <id>"); process.exit(2); }
+  try {
+    const res = await postJson("task-restore", { id });
+    if (!res.ok) { console.error(`Not in the archive: ${id}`); process.exit(1); }
+    const extra = res.alsoRestored ? ` (and ${res.alsoRestored} subtask${res.alsoRestored === 1 ? "" : "s"})` : "";
+    console.log(`Restored ${id}${extra}.`);
+    process.exit(0);
+  } catch (e) { console.error(e.message); process.exit(1); }
+}
+
+async function runArchived(args) {
+  const limit = takeFlag(args, "limit");
+  const search = takeFlag(args, "search");
+  try {
+    const res = await postJson("task-archived", { ...(limit ? { limit: Number(limit) } : {}), ...(search ? { search } : {}) });
+    const list = res.tasks || [];
+    if (list.length === 0) { console.log("No archived tasks."); process.exit(0); }
+    for (const t of list) {
+      const when = t.archivedAt ? new Date(t.archivedAt).toISOString().slice(0, 10) : "?";
+      console.log(`${statusMark(t)} ${t.content}    (${t.id}) · archived ${when} · ${t.closedReason || "?"}: ${t.reason || ""}`);
+      (t.children || []).forEach((c) => console.log(`    ${statusMark(c)} ${c.content}    (${c.id})`));
+    }
+    process.exit(0);
+  } catch (e) { console.error(e.message); process.exit(1); }
+}
+
 async function run(args) {
   const sub = args[0];
   const rest = args.slice(1);
@@ -180,6 +228,9 @@ async function run(args) {
     case "pending": return runUpdate(rest, "pending");
     case "remove": case "rm": return runRemove(rest);
     case "clear-completed": case "clear": return runClearCompleted();
+    case "archive": return runArchive(rest);
+    case "restore": return runRestore(rest);
+    case "archived": return runArchived(rest);
     default:
       console.error(`Unknown task subcommand: ${sub}`);
       console.log(HELP);

package/bot.js

@@ -123,6 +123,16 @@ function persist() {
 async function gracefulShutdown(signal) {
   console.log(`Received ${signal}, shutting down gracefully...`);
   try { stopScheduler(); } catch (e) {}
+  // Save first: whoever sent SIGTERM kills the process soon after (bot pods
+  // allow 15 s, launchd 20 s), and the drain below must not cost the save.
+  persist();
+  // Planned restart (rollout, launchd stop): no new turns; running ones get
+  // DRAIN_SIGTERM_S (6) to finish, the rest stay journaled and resume after
+  // boot (core/turn-journal).
+  try {
+    const journal = require("./core/turn-journal");
+    await journal.drain({ timeoutMs: journal.sigtermDrainTimeoutMs() });
+  } catch (e) { require("./core/turn-journal").markShuttingDown(); }
   try { loopback.stop(); } catch (e) {}
   const sideCleanup = sideChatCoordinator.cancelAll().catch(() => 0);
   const memoryCleanup = require("./core/pack-review")
@@ -362,6 +372,22 @@ async function safeModeBoot() {
     }
   }
 
+  // Turns cut short by the last restart resume (or are offered back), and
+  // messages that were queued behind them are restored in order.
+  try {
+    const resumed = await require("./core/turn-journal").resumeInterrupted(adapters);
+    if (resumed.resumed.length || resumed.asked.length || resumed.refused.length || resumed.restored) {
+      console.log(`Interrupted turns: ${resumed.resumed.length} resumed, ${resumed.asked.length} offered, ${resumed.refused.length} not resumed, ${resumed.restored} queued restored`);
+    }
+  } catch (e) { console.error("interrupted-turn resume failed:", e.message); }
+
+  // Messages a usage limit stopped are picked up when the limit resets
+  // (core/limit-pickup.js): a timer for each one still waiting.
+  try {
+    const waiting = require("./core/limit-pickup").start(adapters);
+    if (waiting.length) console.log(`Limit pick-ups waiting: ${waiting.length}`);
+  } catch (e) { console.error("limit pick-up start failed:", e.message); }
+
   // Kazee Cards: snoozed owner decisions are asked again when due.
   try { require("./core/cards").startDecisionPump(registry); } catch (e) { console.error("Decision pump start failed:", e.message); }
 

package/channels/kazee/adapter.js

@@ -8,10 +8,13 @@ const path = require("path");
 const https = require("https");
 const http = require("http");
 const crypto = require("crypto");
+const dns = require("dns");
+const net = require("net");
 const { pipeline } = require("stream/promises");
 const { Transform } = require("stream");
 const { URL } = require("url");
 const { TEMP_DIR, FILES_DIR } = require("../../core/config");
+const { safeJoin } = require("../../core/safe-filename");
 const { canonicalForChannel } = require("../../core/identity");
 const { inlineKeyboardToPortable } = require("../types");
 const { createKazeeSocket } = require("./socket");
@@ -129,14 +132,72 @@ const MIME_EXT = {
   "application/zip": ".zip",
 };
 
+// Inbound media never goes past 200 MB. With KAZEE_MEDIA_HOSTS set (comma-
+// separated hosts or URLs), files are fetched only from those hosts and Kazee
+// itself (KAZEE_URL). Without it, Kazee's presigned links on its storage host
+// keep working: any public host is allowed, but never a private, loopback or
+// link-local address (checked when connecting), so a crafted link cannot
+// point the bot at internal services.
+const MAX_DOWNLOAD_BYTES = 200 * 1024 * 1024;
+const DOWNLOAD_IDLE_MS = 60 * 1000;
+
+function mediaHostList(mediaHosts) {
+  return (Array.isArray(mediaHosts) ? mediaHosts : String(mediaHosts || "").split(","))
+    .map((raw) => String(raw || "").trim())
+    .filter(Boolean);
+}
+
+function mediaHostSet(url, mediaHosts) {
+  const hosts = new Set();
+  for (const entry of [url, ...mediaHostList(mediaHosts)]) {
+    try { hosts.add((entry.includes("://") ? new URL(entry).host : entry).toLowerCase()); } catch (_) {}
+  }
+  return hosts;
+}
+
+const NON_PUBLIC = new net.BlockList();
+for (const [address, prefix] of [
+  ["0.0.0.0", 8], ["10.0.0.0", 8], ["100.64.0.0", 10], ["127.0.0.0", 8], ["169.254.0.0", 16],
+  ["172.16.0.0", 12], ["192.0.0.0", 24], ["192.168.0.0", 16], ["198.18.0.0", 15], ["224.0.0.0", 4], ["240.0.0.0", 4],
+]) NON_PUBLIC.addSubnet(address, prefix, "ipv4");
+for (const [address, prefix] of [["::", 128], ["::1", 128], ["fc00::", 7], ["fe80::", 10], ["ff00::", 8]]) {
+  NON_PUBLIC.addSubnet(address, prefix, "ipv6");
+}
+
+function isPublicAddress(address) {
+  const family = net.isIP(String(address || ""));
+  if (!family) return false;
+  const mapped = family === 6 && /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(address);
+  if (mapped) return !NON_PUBLIC.check(mapped[1], "ipv4");
+  return !NON_PUBLIC.check(address, family === 6 ? "ipv6" : "ipv4");
+}
+
+// dns.lookup for http(s).get that refuses names resolving to a non-public
+// address. It runs when connecting, so the answer cannot change in between.
+function publicOnlyLookup(hostname, options, callback) {
+  dns.lookup(hostname, options, (err, address, family) => {
+    if (err) return callback(err);
+    const answers = Array.isArray(address) ? address : [{ address, family }];
+    if (answers.some((a) => !isPublicAddress(a.address))) {
+      console.error(`Kazee download refused: ${hostname} resolves to a non-public address`);
+      return callback(Object.assign(new Error(`${hostname} resolves to a non-public address`), { code: "EMEDIAHOST" }));
+    }
+    callback(null, address, family);
+  });
+}
+
 class KazeeAdapter {
-  constructor({ id = "kazee", url, token, ownerUserId, botUserId, passiveGate = null, spawnUtilityAgent = null }) {
+  constructor({ id = "kazee", url, token, ownerUserId, botUserId, mediaHosts = "", passiveGate = null, spawnUtilityAgent = null }) {
     this.id = id;
     this.type = "kazee";
     // KAZEE_URL is the root host (socket.io lives at /). REST routes are
     // mounted under /api on chat-central; we prepend that internally.
     this.url = url.replace(/\/$/, "");
     this.apiBase = this.url + "/api";
+    this._mediaHosts = mediaHostSet(this.url, mediaHosts);
+    this._mediaHostsListed = mediaHostList(mediaHosts).length > 0;
+    try { this._kazeeHost = new URL(this.url).host.toLowerCase(); } catch (_) { this._kazeeHost = ""; }
+    this._maxDownloadBytes = MAX_DOWNLOAD_BYTES;
     this.token = token;
     this.ownerUserId = ownerUserId || "";
     this.botUserId = botUserId || null;
@@ -1593,16 +1654,48 @@ class KazeeAdapter {
     const baseDir = media.type === "document" ? FILES_DIR : TEMP_DIR;
     const keepName = media.type === "document" && media.fileName;
     const nameSuffix = keepName && !path.extname(media.fileName) && ext !== ".bin" ? ext : "";
+    const generated = `kz-${Date.now()}-${crypto.randomBytes(4).toString("hex")}${ext}`;
     const localPath = keepName
-      ? path.join(baseDir, media.fileName + nameSuffix)
-      : path.join(baseDir, `kz-${Date.now()}-${crypto.randomBytes(4).toString("hex")}${ext}`);
+      ? safeJoin(baseDir, media.fileName + nameSuffix, generated)
+      : path.join(baseDir, generated);
     await this._downloadUrl(url, localPath);
     return localPath;
   }
 
+  // The parsed URL when it may be fetched; otherwise logs why and throws.
+  _checkedMediaUrl(raw) {
+    let url = null;
+    try { url = new URL(String(raw)); } catch (_) {}
+    if (!url || !["https:", "http:"].includes(url.protocol) || url.username || url.password) {
+      console.error("Kazee download refused: not an http(s) media URL");
+      throw new Error("Invalid media URL");
+    }
+    const host = url.host.toLowerCase();
+    if (this._mediaHostsListed) {
+      if (!this._mediaHosts.has(host)) {
+        console.error(`Kazee download refused: ${host} is not a Kazee media host (allowed: KAZEE_URL's host and KAZEE_MEDIA_HOSTS)`);
+        throw new Error(`${host} is not a Kazee media host`);
+      }
+    } else if (host !== this._kazeeHost) {
+      // Names are checked when connecting (publicOnlyLookup); IP literals never look up.
+      const literal = url.hostname.replace(/^\[|\]$/g, "");
+      if (net.isIP(literal) && !isPublicAddress(literal)) {
+        console.error(`Kazee download refused: ${host} is a non-public address`);
+        throw new Error(`${host} is a non-public address`);
+      }
+    }
+    return url;
+  }
+
+  // Request options for a checked media URL: without a KAZEE_MEDIA_HOSTS list,
+  // anything but Kazee's own host must resolve to public addresses only.
+  _mediaRequestOptions(url) {
+    if (this._mediaHostsListed || url.host.toLowerCase() === this._kazeeHost) return {};
+    return { lookup: publicOnlyLookup };
+  }
+
   async _downloadContextMedia(media) {
-    const url = new URL(media.fileId);
-    if (!["https:", "http:"].includes(url.protocol) || url.username || url.password) throw new Error("Invalid media URL");
+    const url = this._checkedMediaUrl(media.fileId);
     const candidateExt = path.extname(media.fileName || url.pathname).toLowerCase();
     const ext = /^\.[a-z0-9]{1,8}$/.test(candidateExt) ? candidateExt : MIME_EXT[media.mimeType] || ".bin";
     const key = crypto.createHash("sha256").update(media.contextKey).digest("hex");
@@ -1619,7 +1712,7 @@ class KazeeAdapter {
     const timer = setTimeout(() => req?.destroy(new Error("Media download timed out")), Math.min(media.timeoutMs || 8000, 8000));
     try {
       const res = await new Promise((resolve, reject) => {
-        req = (url.protocol === "https:" ? https : http).get(url, resolve);
+        req = (url.protocol === "https:" ? https : http).get(url, this._mediaRequestOptions(url), resolve);
         req.on("error", reject);
       });
       if (res.statusCode !== 200 || Number(res.headers["content-length"]) > maxBytes) {
@@ -1741,21 +1834,37 @@ class KazeeAdapter {
     });
   }
 
-  _downloadUrl(url, localPath) {
-    return new Promise((resolve, reject) => {
-      const lib = url.startsWith("https:") ? https : http;
-      const out = fs.createWriteStream(localPath);
-      lib.get(url, (res) => {
-        if (res.statusCode && res.statusCode >= 400) {
-          out.destroy();
-          reject(new Error(`Download ${url} → ${res.statusCode}`));
-          return;
-        }
-        res.pipe(out);
-        out.on("finish", () => { out.close(); resolve(); });
-      }).on("error", reject);
-    });
+  // Streams to a .part file next to localPath, counting bytes; over the cap
+  // (declared or actual) or idle too long, it aborts and deletes the part.
+  async _downloadUrl(rawUrl, localPath) {
+    const url = this._checkedMediaUrl(rawUrl);
+    const maxBytes = this._maxDownloadBytes;
+    const tooBig = () => new Error(`Kazee media exceeds the ${Math.round(maxBytes / 1024 / 1024)} MB size limit`);
+    const partial = `${localPath}.${crypto.randomUUID()}.part`;
+    let req;
+    try {
+      const res = await new Promise((resolve, reject) => {
+        req = (url.protocol === "https:" ? https : http).get(url, this._mediaRequestOptions(url), resolve);
+        req.on("error", reject);
+        req.setTimeout(DOWNLOAD_IDLE_MS, () => req.destroy(new Error("Kazee download stalled")));
+      });
+      if (res.statusCode < 200 || res.statusCode >= 300) {
+        res.resume();
+        throw new Error(`Download from ${url.host} → ${res.statusCode}`);
+      }
+      if (Number(res.headers["content-length"]) > maxBytes) { res.destroy(); throw tooBig(); }
+      let bytes = 0;
+      await pipeline(res, new Transform({ transform(chunk, enc, done) {
+        bytes += chunk.length;
+        done(bytes > maxBytes ? tooBig() : null, chunk);
+      } }), fs.createWriteStream(partial, { flags: "wx" }));
+      fs.renameSync(partial, localPath);
+    } catch (e) {
+      req?.destroy();
+      try { fs.unlinkSync(partial); } catch (_) {}
+      throw e;
+    }
   }
 }
 
-module.exports = { KazeeAdapter };
+module.exports = { KazeeAdapter, isPublicAddress, publicOnlyLookup };

package/channels/telegram/adapter.js

@@ -8,6 +8,7 @@ const path = require("path");
 const https = require("https");
 const TelegramBot = require("node-telegram-bot-api");
 const { TEMP_DIR, FILES_DIR, CONFIG_DIR } = require("../../core/config");
+const { safeJoin } = require("../../core/safe-filename");
 const { canonicalForChannel } = require("../../core/identity");
 const { portableToInlineKeyboard } = require("../types");
 const { telegramHtml, htmlToPlain, splitMessage } = require("./format");
@@ -701,9 +702,10 @@ class TelegramAdapter {
         : media.type === "video" ? ".mp4"
         : ".bin");
     const baseDir = media.type === "document" ? FILES_DIR : TEMP_DIR;
+    const generated = `tg-${Date.now()}${ext}`;
     const localPath = media.type === "document" && media.fileName
-      ? path.join(baseDir, media.fileName)
-      : path.join(baseDir, `tg-${Date.now()}${ext}`);
+      ? safeJoin(baseDir, media.fileName, generated)
+      : path.join(baseDir, generated);
     await new Promise((resolve, reject) => {
       const out = fs.createWriteStream(localPath);
       https.get(fileUrl, (res) => { res.pipe(out); out.on("finish", () => { out.close(); resolve(); }); }).on("error", reject);

package/core/actions.js

@@ -910,6 +910,14 @@ async function handleAction(envelope) {
         `\nVerification settles identity only; permissions still come from mandates and rules.`
     );
   }
+  // Interrupted-turn offers (core/turn-journal): Continue / Drop a turn cut
+  // off by a restart, or run a message /stop dropped.
+  if (d.startsWith("rsm:")) {
+    return require("./turn-journal").handleResumeAction(d, envelope, { isOwner: isChatOwner(envelope.channelId) });
+  }
+  if (d.startsWith("rq:")) {
+    return require("./turn-journal").handleRunDropped(d, envelope, { isOwner: isChatOwner(envelope.channelId) });
+  }
   if (d.startsWith("grd:")) {
     // Guardrail capture buttons (Track C). Owner-only: standing rules layer
     // above lessons and are never editable by an external speaker.

package/core/config.js

@@ -126,6 +126,25 @@ const CLAUDE_PATH = configuredProviderPath("claude");
 const CODEX_PATH = config.CODEX_PATH || null;
 const AUTO_COMPACT_TOKENS = parseInt(config.AUTO_COMPACT_TOKENS || process.env.AUTO_COMPACT_TOKENS || "380000", 10);
 const MIN_COMPACT_INTERVAL_MS = parseInt(config.MIN_COMPACT_INTERVAL_MS || process.env.MIN_COMPACT_INTERVAL_MS || "1800000", 10);
+// Token diet, on for every conversation by default since 3.5.18 (the 3.5.17
+// canary halved the cost of a reply on the owner's bot). TOKEN_DIET_CONVERSATIONS
+// is "*" (all), a comma-separated list of conversation keys as the usage
+// ledger's `project` field writes them (e.g. kazee:<room>#thread:<root>), or
+// "off". A listed conversation compacts at TOKEN_DIET_COMPACT_TOKENS instead of
+// AUTO_COMPACT_TOKENS, and is compacted before a turn that resumes it after
+// TOKEN_DIET_COLD_MINUTES idle (the prompt cache has expired, so the whole
+// context would be re-written) when its context exceeds TOKEN_DIET_COLD_MIN_TOKENS.
+const TOKEN_DIET_SETTING = String(config.TOKEN_DIET_CONVERSATIONS || process.env.TOKEN_DIET_CONVERSATIONS || "*").trim();
+const TOKEN_DIET_CONVERSATIONS = /^(off|none)$/i.test(TOKEN_DIET_SETTING)
+  ? []
+  : TOKEN_DIET_SETTING.split(",").map((s) => s.trim()).filter(Boolean);
+const TOKEN_DIET_COMPACT_TOKENS = parseInt(config.TOKEN_DIET_COMPACT_TOKENS || process.env.TOKEN_DIET_COMPACT_TOKENS || "200000", 10);
+const TOKEN_DIET_COLD_MINUTES = parseInt(config.TOKEN_DIET_COLD_MINUTES || process.env.TOKEN_DIET_COLD_MINUTES || "60", 10);
+const TOKEN_DIET_COLD_MIN_TOKENS = parseInt(config.TOKEN_DIET_COLD_MIN_TOKENS || process.env.TOKEN_DIET_COLD_MIN_TOKENS || "120000", 10);
+// How late a cron occurrence may start and still run (node-cron otherwise drops
+// a run more than 1 s late). Daily/user crons: 10 min; the nightly dream: 3 h.
+const CRON_LATE_TOLERANCE_MS = parseInt(config.OC_CRON_LATE_TOLERANCE_MS || process.env.OC_CRON_LATE_TOLERANCE_MS || "600000", 10);
+const DREAM_LATE_TOLERANCE_MS = parseInt(config.DREAM_LATE_TOLERANCE_MS || process.env.DREAM_LATE_TOLERANCE_MS || "10800000", 10);
 const PROJECT_TRANSCRIPTS = configTruthy(config.PROJECT_TRANSCRIPTS || process.env.PROJECT_TRANSCRIPTS, true);
 // Unified multi-channel identity. Default ON: the owner's Telegram, Kazee and
 // voice channels resolve to one canonical person, sharing one state, session,
@@ -243,7 +262,7 @@ function loadChannels() {
       channels.push({
         id,
         type: "kazee",
-        opts: { url, token, ownerUserId, botUserId },
+        opts: { url, token, ownerUserId, botUserId, mediaHosts: config.KAZEE_MEDIA_HOSTS || "" },
       });
     } else if (type === "spaces") {
       // Conversational plane for Kazee Spaces. Bot authenticates with its own
@@ -374,6 +393,8 @@ module.exports = {
   resolvedCodexPath,
   AUTO_COMPACT_TOKENS,
   MIN_COMPACT_INTERVAL_MS,
+  TOKEN_DIET_CONVERSATIONS, TOKEN_DIET_COMPACT_TOKENS, TOKEN_DIET_COLD_MINUTES, TOKEN_DIET_COLD_MIN_TOKENS,
+  CRON_LATE_TOLERANCE_MS, DREAM_LATE_TOLERANCE_MS,
   PROJECT_TRANSCRIPTS,
   UNIFIED_IDENTITY,
   TRANSCRIPT_MAX_ENTRY_CHARS,

package/core/cost-report.js

@@ -38,6 +38,9 @@ function aggregate(records) {
     byProject: new Map(),
   };
   for (const r of records) {
+    // Compaction records (kind "compaction") are not turns; their own cost
+    // sits in compactionUsage.
+    if (r.kind === "compaction") continue;
     agg.turns += 1;
     const cost = Number(r.costUsd) || 0;
     agg.costUsd += cost;

package/core/cron-schedule.js

@@ -0,0 +1,59 @@
+// Cron scheduling that tolerates a late start.
+//
+// node-cron drops an occurrence whose heartbeat fires late: 4.6.0 skips any run
+// more than DEFAULT_MISSED_EXECUTION_TOLERANCE (1000 ms) late, and 4.2.1 (the
+// version package-lock pins) misses it outright, because the late second no
+// longer matches the expression's seconds field. The bot is often 2-3 s late
+// at the top of a minute, so the 04:00 dream ran on 7 of 14 nights and daily
+// crons were skipped. 4.6+ takes a `missedExecutionTolerance` option; for
+// versions without it, a missed execution is run here, once, when the latest
+// slot it belongs to is still within the tolerance (the task's own
+// timeMatcher finds that slot; an occurrence never runs twice).
+
+const cron = require("node-cron");
+
+function scheduleTolerant(expression, callback, opts = {}) {
+  const cronLib = opts.cron || cron;
+  const now = opts.now || Date.now;
+  const toleranceMs = Number.isFinite(opts.toleranceMs) && opts.toleranceMs >= 0 ? opts.toleranceMs : 0;
+  const label = opts.label || expression;
+  const noOverlap = opts.noOverlap === true;
+  let lastSlot = -Infinity;
+  let running = 0;
+
+  const invoke = async (slot, context) => {
+    if (slot <= lastSlot) return undefined; // this occurrence already ran
+    if (noOverlap && running > 0) return undefined;
+    lastSlot = slot;
+    running += 1;
+    try { return await callback(context); }
+    finally { running -= 1; }
+  };
+
+  const options = { missedExecutionTolerance: toleranceMs };
+  if (noOverlap) options.noOverlap = true;
+  const task = cronLib.schedule(expression, (context) => {
+    const date = context && context.date instanceof Date ? context.date : new Date(now());
+    // The slot is the matched time, whole seconds.
+    return invoke(Math.floor(date.getTime() / 1000) * 1000, context);
+  }, options);
+
+  const matcher = task && task.timeMatcher && typeof task.timeMatcher.match === "function" ? task.timeMatcher : null;
+  if (task && typeof task.on === "function" && matcher && toleranceMs > 0) {
+    const stepMs = String(expression).trim().split(/\s+/).length >= 6 ? 1000 : 60000;
+    task.on("execution:missed", () => {
+      const at = now();
+      let slot = Math.floor(at / stepMs) * stepMs;
+      for (; slot >= at - toleranceMs; slot -= stepMs) {
+        if (matcher.match(new Date(slot))) break;
+      }
+      if (slot < at - toleranceMs || slot <= lastSlot) return;
+      console.log(`[cron] ${label}: running the ${new Date(slot).toISOString()} occurrence ${Math.round((at - slot) / 1000)}s late (tolerance ${Math.round(toleranceMs / 1000)}s)`);
+      Promise.resolve(invoke(slot, { date: new Date(slot), late: true }))
+        .catch((error) => console.error(`[cron] ${label}: late run failed: ${error?.message || error}`));
+    });
+  }
+  return task;
+}
+
+module.exports = { scheduleTolerant };