@stravica-ai/digital-operator-pa 0.1.37 → 0.1.39

package/dist/engineering-pa-core/docs/tools/scheduler.md

@@ -108,7 +108,7 @@ The failure mode is silent: launchd records exit code 78 (`EX_CONFIG`), the Stan
 
 Proven live (w-2026-07-15-003, verified with `env -i`): cron's crond process provides a small fixed environment (`SHELL`, a narrow system `PATH` — `/usr/bin:/bin` — `HOME`, `LOGNAME`/`USER`), NOT a login shell's env. A schedule whose `command` relies on `pnpm`/`node` being on PATH via nvm silently fails to spawn once actually installed, even if it "worked" when tested from an interactive terminal.
 
-The generated cron line handles this for you automatically: `scheduler install` detects `$HOME/.nvm/nvm.sh` on the target AT INSTALL TIME and, if present, wraps the command in `bash -c ". $HOME/.nvm/nvm.sh && cd <workDir> && <command> >> /tmp/<agent>-<id>.log 2>&1"`. If no nvm install is found, the preamble is simply omitted — nothing to do for schedules that only need system binaries. `environment.*` values are emitted as `export VAR='val';` statements ahead of the command (not a bare `VAR='val' cd ...` prefix, which in POSIX shell only scopes to the `cd` builtin and never actually reaches the command after `&&` — a real, silent bug the old generator had).
+The generated cron line handles this for you automatically: `scheduler install` detects `$HOME/.nvm/nvm.sh` on the target AT INSTALL TIME and, if present, sources it inside the rendered chain. The generated cron line is `bash -c "{ date -u; . $HOME/.nvm/nvm.sh && cd <workDir> && <command>; } >> /tmp/<agent>-<id>.log 2>&1"` — the `{ ...; }` braces are load-bearing: without them the `>> log 2>&1` binds only to `<command>` and any earlier link failing (nvm-source, cd) sends its stderr to cron mail, which hosts with no MTA silently discard (w-2026-09-13-dave-042; 0.1.39 fix, smarthome01 crons fired but wrote no log 2026-09-09 -> 13). The leading `date -u` prints an ISO timestamp so a run that dies mid-chain still leaves dated evidence. If no nvm install is found, the preamble is simply omitted — nothing to do for schedules that only need system binaries. `environment.*` values are emitted as `export VAR='val';` statements ahead of the command (not a bare `VAR='val' cd ...` prefix, which in POSIX shell only scopes to the `cd` builtin and never actually reaches the command after `&&` — a real, silent bug the old generator had).
 
 `scheduler verify` now runs this EXACT generated line (not a bare `sched.command`), under cron's actual minimal environment — never the verifying shell's `process.env`. This is deliberate: the old verify path inherited the operator's full login-shell env, which reliably masked this whole bug class. If `verify` reports `ok` today, that's an honest signal the schedule will actually fire under real cron.
 

package/dist/engineering-pa-core/src/scheduler/install.mjs

@@ -354,7 +354,20 @@ export function buildCronCommand(sched, workDir, env, opts = {}) {
   const exportStmts = Object.entries(env)
     .map(([k, v]) => `export ${k}='${String(v).replace(/'/g, `'\\''`)}'; `)
     .join('');
-  const inner = `${preamble}${exportStmts}cd ${workDir} && ${sched.command} >> ${logPath} 2>&1`;
+  // Whole rendered chain is braced so `>> logPath 2>&1` binds to the group,
+  // not just the last simple command. Without the braces bash parses
+  // `A && B && cmd >> log 2>&1` with the redirect bound to `cmd` alone, so
+  // an nvm-source or `cd` failure earlier in the chain sends its stderr to
+  // cron mail (silently discarded on hosts with no MTA) and leaves the log
+  // file empty — the exact silent-failure class w-2026-09-13-dave-030 tracks
+  // (smarthome01 crons fired but never wrote a log line, 2026-09-09 -> 13).
+  // A leading `date -u` inside the group prints an ISO timestamp so a run
+  // that dies mid-chain still leaves dated evidence. No `$()` — cron passes
+  // the crontab line through /bin/sh -c '...' which parses the double-quoted
+  // bash-c argument and would eagerly expand $(...) at dispatch time, not
+  // at run time.
+  const chain = `date -u; ${preamble}${exportStmts}cd ${workDir} && ${sched.command}`;
+  const inner = `{ ${chain}; } >> ${logPath} 2>&1`;
   const wrapped = `bash -c "${inner.replace(/"/g, '\\"')}"`;
   return { inner, wrapped };
 }

package/dist/engineering-pa-workspace/src/server.mjs

@@ -393,14 +393,24 @@ const server = createServer(async (req, res) => {
   // outer pass has already validated the Host header, so this call is
   // effectively the state-changing-method sweep.
   if (pathname.startsWith('/__api/') || pathname.startsWith('/api/')) {
-    const guard = checkRequestGuards(req, ALLOWED_HOSTS, ALLOWED_ORIGINS);
-    if (!guard.ok) {
-      warn('[workspace] guard refused ' + req.method + ' ' + pathname + ' (' + guard.reason + ')');
-      res.writeHead(guard.status, { 'Content-Type': 'text/plain; charset=utf-8' });
-      res.end('Forbidden');
-      return;
-    }
+    // Extension routes may opt into cross-origin acceptance via
+    // addRoute(..., { crossOrigin: true }). Look the route up before the
+    // state-changing sweep so an opted-in route can accept a POST from a
+    // foreign origin (e.g. the Dave Review bookmarklet firing on any web
+    // page). The outer per-request pass has already validated the Host
+    // header, so a crossOrigin route is still protected against DNS
+    // rebinding; it takes over Origin/CSRF policy through its own auth
+    // (a per-install token, in the case of the review submit route).
     const extRoute = extRoutes.find(r => r.method === req.method && r.pathname === pathname);
+    if (!extRoute || extRoute.crossOrigin !== true) {
+      const guard = checkRequestGuards(req, ALLOWED_HOSTS, ALLOWED_ORIGINS);
+      if (!guard.ok) {
+        warn('[workspace] guard refused ' + req.method + ' ' + pathname + ' (' + guard.reason + ')');
+        res.writeHead(guard.status, { 'Content-Type': 'text/plain; charset=utf-8' });
+        res.end('Forbidden');
+        return;
+      }
+    }
     if (extRoute) { extRoute.handler(req, res, url, REPO_ROOT); return; }
 
     // GET /__api/nav -- merged core + extension nav manifest, team-scoped to
@@ -577,13 +587,22 @@ async function loadExtensions() {
   try {
     const extApi = await import(extApiPath);
     if (typeof extApi.register === 'function') {
-      extApi.register(function addRoute(method, pathname, handler) {
+      extApi.register(function addRoute(method, pathname, handler, options) {
+        // options.crossOrigin === true opts this route out of the API-branch
+        // Origin/Sec-Fetch-Site sweep. The outer Host allowlist still runs
+        // on every request, so a crossOrigin route accepts requests from a
+        // foreign browser Origin as long as the Host addresses this
+        // workspace via one of its own allowlisted names. The extension
+        // owns auth (a per-install token, say) and its own CORS response.
+        // Default is unchanged: undefined/false keeps the full guard.
+        const opts = (options && typeof options === 'object') ? options : {};
+        const crossOrigin = opts.crossOrigin === true;
         const shadows = extRoutes.some(r => r.method === method && r.pathname === pathname);
         if (!shadows) {
           // Check if it shadows a core route (informational only).
-          log('[workspace] Extension route registered: ' + method + ' ' + pathname);
+          log('[workspace] Extension route registered: ' + method + ' ' + pathname + (crossOrigin ? ' [crossOrigin]' : ''));
         }
-        extRoutes.push({ method: method, pathname: pathname, handler: handler });
+        extRoutes.push({ method: method, pathname: pathname, handler: handler, crossOrigin: crossOrigin });
       });
     }
   } catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stravica-ai/digital-operator-pa",
-  "version": "0.1.37",
+  "version": "0.1.39",
   "description": "Digital Operator PA — single-bundled public package surface (bins + library) for the platform.",
   "type": "module",
   "main": "./index.mjs",