@stravica-ai/digital-operator-pa 0.1.60 → 0.1.62

package/dist/engineering-pa-cli/src/secrets/commands/backup.mjs

@@ -1,13 +1,30 @@
 // backup — render an HTML file containing the master key as a QR code
-// and open it in the default browser. Cleans up the temp HTML after 30s.
+// and open it in the default browser.
 //
 // The QR-generation JS is the same minified generator used in
 // onboarding.html, so the output looks identical. No browser automation,
 // no npm deps.
+//
+// The page holds the age secret key in plaintext, so the file lives on
+// disk only until the browser has read it (w-2026-10-17-dave-004). The
+// old cleanup was an unref()ed 30s timer, which never fired because
+// main() calls process.exit straight after the command returns: every
+// run left a `dave-key-backup-*` directory with the key in the OS temp
+// root. Now the command waits for the operator to confirm the page is
+// showing (Enter on a TTY), capped at BACKUP_FILE_MAX_LIFETIME_MS, then
+// wipes the file synchronously: overwrite with zeros of its own length,
+// fsync, unlink, remove the directory. The same wipe runs from the
+// finally block, a process 'exit' listener and SIGINT/SIGTERM/SIGHUP
+// handlers, so a throw, an early Ctrl+C or a process.exit anywhere in
+// the flow cannot leave the key behind. Only SIGKILL or a crash of the
+// host can.
 
-import { mkdtempSync, writeFileSync, existsSync, unlinkSync, readFileSync } from 'node:fs';
+import {
+  mkdtempSync, writeFileSync, existsSync, unlinkSync, readFileSync,
+  openSync, fstatSync, writeSync, fsyncSync, closeSync, rmSync,
+} from 'node:fs';
 import { join } from 'node:path';
-import { tmpdir } from 'node:os';
+import { tmpdir, constants as osConstants } from 'node:os';
 import { spawn } from 'node:child_process';
 import { defaultPaths, secretKeyFromKeyFile, VaultError } from '../vault.mjs';
 import { HTML_HEAD, QR_JS, HTML_TAIL } from './backup-template.mjs';
@@ -25,10 +42,105 @@ export function buildBackupHtml(secretKey, publicKey) {
   return HTML_HEAD + QR_JS + dataScript + HTML_TAIL;
 }
 
+// Hard cap on how long backup.html stays on disk when nobody confirms
+// the page is showing. The browser needs the file only for its first
+// read; the loaded page keeps working once the file is gone.
+export const BACKUP_FILE_MAX_LIFETIME_MS = 60_000;
+
+const WIPE_SIGNALS = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+
+/**
+ * Wipe the backup file and its directory, synchronously. Each step runs
+ * whatever the previous one did, so a missing file (a throw before the
+ * write) still removes the directory.
+ */
+export function wipeBackupDir(dir, htmlPath) {
+  try {
+    const fd = openSync(htmlPath, 'r+');
+    try {
+      const { size } = fstatSync(fd);
+      if (size > 0) {
+        const zeros = Buffer.alloc(size);
+        let written = 0;
+        while (written < size) written += writeSync(fd, zeros, written, size - written, written);
+        fsyncSync(fd);
+      }
+    } finally {
+      closeSync(fd);
+    }
+  } catch { /* never written, or already gone */ }
+  try { unlinkSync(htmlPath); } catch { /* already gone */ }
+  try { rmSync(dir, { recursive: true, force: true }); } catch { /* already gone */ }
+}
+
+/**
+ * Register the wipe on every way out of the process and return it. The
+ * returned function is idempotent and deregisters the listeners, so the
+ * finally block, the 'exit' listener and a signal can all call it.
+ */
+function armWipe(dir, htmlPath) {
+  let wiped = false;
+  const signalHandlers = new Map();
+  const wipe = () => {
+    if (wiped) return;
+    wiped = true;
+    process.removeListener('exit', wipe);
+    for (const [sig, handler] of signalHandlers) process.removeListener(sig, handler);
+    wipeBackupDir(dir, htmlPath);
+  };
+  process.on('exit', wipe);
+  for (const sig of WIPE_SIGNALS) {
+    const handler = () => {
+      wipe();
+      process.exit(128 + (osConstants.signals[sig] || 0));
+    };
+    signalHandlers.set(sig, handler);
+    process.on(sig, handler);
+  }
+  return wipe;
+}
+
+/**
+ * Hold the file until the operator says the page is showing (Enter, or
+ * end of input, on a TTY) or the cap passes. Without a TTY there is no
+ * one to confirm, so the cap alone applies. The timer is deliberately
+ * NOT unref()ed: the process must stay alive to run the wipe.
+ */
+function defaultWaitForBrowser({ maxLifetimeMs, stdin = process.stdin }) {
+  const interactive = Boolean(stdin && stdin.isTTY);
+  const seconds = Math.ceil(maxLifetimeMs / 1000);
+  if (interactive) {
+    console.log(`Press Enter as soon as the page is showing. That wipes the file from disk; the open page keeps working (do not reload it). The file is wiped after ${seconds}s either way.`);
+  } else {
+    console.log(`The file is wiped from disk in ${seconds}s; the open page keeps working (do not reload it).`);
+  }
+  return new Promise((resolve) => {
+    let timer = null;
+    const finish = () => {
+      clearTimeout(timer);
+      if (interactive) {
+        stdin.removeListener('data', finish);
+        stdin.removeListener('end', finish);
+        stdin.pause();
+      }
+      resolve();
+    };
+    timer = setTimeout(finish, maxLifetimeMs);
+    if (interactive) {
+      stdin.once('data', finish);
+      stdin.once('end', finish);
+      stdin.resume();
+    }
+  });
+}
+
 export async function runBackup(overrides = {}) {
   const paths = overrides.paths || defaultPaths(overrides);
   const opener = overrides.opener || defaultOpener;
-  const scheduleCleanup = overrides.scheduleCleanup ?? true;
+  const waitForBrowser = overrides.waitForBrowser || defaultWaitForBrowser;
+  const maxLifetimeMs = overrides.maxLifetimeMs ?? BACKUP_FILE_MAX_LIFETIME_MS;
+  // process.stdin is only touched by the default waiter, and only then.
+  const stdin = overrides.stdin;
 
   if (!existsSync(paths.keyFile)) {
     // Missing key is an operational failure (exit 2), not an "uninitialised"
@@ -53,19 +165,20 @@ export async function runBackup(overrides = {}) {
   const html = buildBackupHtml(secretKey, publicKey);
   const dir = mkdtempSync(join(tmpdir(), 'dave-key-backup-'));
   const htmlPath = join(dir, 'backup.html');
-  writeFileSync(htmlPath, html);
-
-  console.log('Opening master key backup in browser...');
-  console.log('IMPORTANT: Back up the key shown, then close the browser tab.');
+  // Armed before the first byte of key material reaches disk.
+  const wipe = armWipe(dir, htmlPath);
+  try {
+    writeFileSync(htmlPath, html, { mode: 0o600 });
 
-  opener(htmlPath);
+    console.log('Opening master key backup in browser...');
+    console.log('IMPORTANT: Back up the key shown, then close the browser tab.');
 
-  if (scheduleCleanup) {
-    // Detach a lightweight cleaner so the CLI can exit.
-    setTimeout(() => {
-      try { unlinkSync(htmlPath); } catch { /* ignore */ }
-    }, 30000).unref?.();
+    opener(htmlPath);
+    await waitForBrowser({ htmlPath, maxLifetimeMs, stdin });
+  } finally {
+    wipe();
   }
+  console.log('Backup file wiped from disk.');
 
   return { htmlPath, html };
 }

package/dist/engineering-pa-cli/src/secrets/vault.mjs

@@ -11,7 +11,7 @@
 
 import { spawn } from 'node:child_process';
 import { homedir } from 'node:os';
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync, unlinkSync, chmodSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync, chmodSync, rmSync } from 'node:fs';
 import { join, dirname, resolve, basename, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { mkdtempSync } from 'node:fs';
@@ -1155,8 +1155,8 @@ export async function sopsEncrypt(paths, pubKey, obj) {
   // the vault's own .sops.yaml matches (path_regex: \.enc\.json$). If the
   // suffix doesn't match, sops errors with "no matching creation rules".
   const tmpFile = join(tmp, 'secrets.enc.json');
-  writeFileSync(tmpFile, JSON.stringify(obj, null, 2) + '\n');
   try {
+    writeFileSync(tmpFile, JSON.stringify(obj, null, 2) + '\n');
     // --config pins the sops config to the vault's own .sops.yaml so sops
     // doesn't walk up from CWD and hit an unrelated ambient .sops.yaml
     // (e.g. an older vault's config at a higher directory).
@@ -1168,7 +1168,10 @@ export async function sopsEncrypt(paths, pubKey, obj) {
     }
     writeFileSync(paths.secretsFile, stdout);
   } finally {
-    try { unlinkSync(tmpFile); } catch { /* ignore */ }
+    // Remove the whole mkdtemp directory, not just the plaintext file:
+    // unlinking the file alone left one empty vault-XXXXXX directory under
+    // the OS temp root per encrypt (w-2026-10-15-dave-013).
+    try { rmSync(tmp, { recursive: true, force: true }); } catch { /* ignore */ }
   }
 }
 
@@ -1224,8 +1227,8 @@ export async function decryptStoreForWrite(paths) {
 export async function sopsEncryptScoped(paths, obj) {
   const tmp = mkdtempSync(join(tmpdir(), 'vault-'));
   const tmpFile = join(tmp, basename(paths.secretsFile));
-  writeFileSync(tmpFile, JSON.stringify(obj, null, 2) + '\n');
   try {
+    writeFileSync(tmpFile, JSON.stringify(obj, null, 2) + '\n');
     const { code, stdout, stderr } = await runCmd('sops', ['--config', paths.sopsConfig, '--encrypt', tmpFile], {
       env: { SOPS_AGE_KEY_FILE: paths.keyFile },
     });
@@ -1234,7 +1237,8 @@ export async function sopsEncryptScoped(paths, obj) {
     }
     writeFileSync(paths.secretsFile, stdout);
   } finally {
-    try { unlinkSync(tmpFile); } catch { /* ignore */ }
+    // Same as sopsEncrypt: the directory goes too, on every path.
+    try { rmSync(tmp, { recursive: true, force: true }); } catch { /* ignore */ }
   }
 }
 

package/dist/engineering-pa-core/docs/tools/distill.md

@@ -56,14 +56,16 @@ any file changes distill produced.
 
 ### Model selection
 
-The sweep passes `--model claude-opus-4-7` explicitly (operator ruling
-2026-07-29). Before the pin, no `--model` was passed and the Librarian
+The sweep passes `--model claude-opus-5-5` explicitly (operator ruling
+2026-07-29 for the pin). Before the pin, no `--model` was passed and the Librarian
 inherited whatever the host CLI defaulted to -- so the model running the
 sweep was an accident of host configuration, and a host-side default bump
 silently changed sweep behaviour across the estate. The pin makes the
-choice deliberate. The reasoning behind 4.7 specifically: it follows
-briefs better than 4.8/5 in estate experience, and brief-following
-matters more for a scripted sweep than raw capability.
+choice deliberate. The pinned model follows the estate model ladder:
+`claude-opus-5-5` is the base model from the 2026-10-16 operator ruling.
+It replaced `claude-opus-4-7` (now deprecated), which was first picked
+because it followed briefs better than 4.8/5 in estate experience, and
+brief-following matters more for a scripted sweep than raw capability.
 
 Override per host or per run with the `DISTILL_MODEL` environment
 variable:

package/dist/engineering-pa-core/docs/tools/scheduler.md

@@ -108,10 +108,12 @@ The failure mode is silent: launchd records exit code 78 (`EX_CONFIG`), the Stan
 
 Proven live (w-2026-07-15-003, verified with `env -i`): cron's crond process provides a small fixed environment (`SHELL`, a narrow system `PATH`; `/usr/bin:/bin`; `HOME`, `LOGNAME`/`USER`), NOT a login shell's env. A schedule whose `command` relies on `pnpm`/`node` being on PATH via nvm silently fails to spawn once actually installed, even if it "worked" when tested from an interactive terminal.
 
-The generated cron line handles this for you automatically: `scheduler install` detects `$HOME/.nvm/nvm.sh` on the target AT INSTALL TIME and, if present, sources it inside the rendered chain. The generated cron line is `bash -c "{ date -u; . $HOME/.nvm/nvm.sh && cd <workDir> && <command>; } >> /tmp/<agent>-<id>.log 2>&1"`; the `{ ...; }` braces are load-bearing: without them the `>> log 2>&1` binds only to `<command>` and any earlier link failing (nvm-source, cd) sends its stderr to cron mail, which hosts with no MTA silently discard (w-2026-09-13-dave-042; 0.1.39 fix, smarthome01 crons fired but wrote no log 2026-09-09 -> 13). The leading `date -u` prints an ISO timestamp so a run that dies mid-chain still leaves dated evidence. If no nvm install is found, the preamble is simply omitted; nothing to do for schedules that only need system binaries. `environment.*` values are emitted as `export VAR='val';` statements ahead of the command (not a bare `VAR='val' cd ...` prefix, which in POSIX shell only scopes to the `cd` builtin and never actually reaches the command after `&&`; a real, silent bug the old generator had).
+The generated cron line handles this for you automatically: `scheduler install` detects `$HOME/.nvm/nvm.sh` on the target AT INSTALL TIME and, if present, sources it inside the rendered chain. The generated cron line is `bash -c '{ date -u; . $HOME/.nvm/nvm.sh && cd <workDir> && <command>; } >> /tmp/<agent>-<id>.log 2>&1'`; the `{ ...; }` braces are load-bearing: without them the `>> log 2>&1` binds only to `<command>` and any earlier link failing (nvm-source, cd) sends its stderr to cron mail, which hosts with no MTA silently discard (w-2026-09-13-dave-042; 0.1.39 fix, smarthome01 crons fired but wrote no log 2026-09-09 -> 13). The leading `date -u` prints an ISO timestamp so a run that dies mid-chain still leaves dated evidence. If no nvm install is found, the preamble is simply omitted; nothing to do for schedules that only need system binaries. `environment.*` values are emitted as `export VAR='val';` statements ahead of the command (not a bare `VAR='val' cd ...` prefix, which in POSIX shell only scopes to the `cd` builtin and never actually reaches the command after `&&`; a real, silent bug the old generator had).
 
 `scheduler verify` now runs this EXACT generated line (not a bare `sched.command`), under cron's actual minimal environment; never the verifying shell's `process.env`. This is deliberate: the old verify path inherited the operator's full login-shell env, which reliably masked this whole bug class. If `verify` reports `ok` today, that's an honest signal the schedule will actually fire under real cron.
 
+**Quoting and `%` (w-2026-10-17-dave-006, 0.1.62).** cron hands the command field to `/bin/sh -c`, so the `bash -c` wrapper is single-quoted, with any single quote inside rendered as `'\''` (the same rule the systemd backend uses for `ExecStart`). sh therefore passes the inner script to bash untouched and every `$(...)`, `$1` and `${VAR}` is expanded by bash after the `cd`, not by sh in the cron user's HOME. The old double-quoted wrapper let sh expand them first (smarthome01 workspace-refresh failed 162 of 162 runs with `fatal: ambiguous argument 'origin/'`). cron also turns an unescaped `%` into a newline and feeds the rest of the line to stdin, so every `%` in the rendered line is written as `\%`; cron strips the backslash before sh sees it. `scheduler verify` on the cron backend runs the rendered command the way cron does: it takes the full `bash -c '...'` string, undoes the `\%` escaping, and executes it through `/bin/sh -c` from the working directory, so a quoting or `%` defect shows up in verify. Write schedule `command` strings exactly as you would type them into bash in the working directory: no `\$` or `\%` workarounds. Lines installed by 0.1.61 or earlier keep the double-quoted form until the schedule is re-installed; `list`, `remove` and `install` match both forms by the trailing `# <agent>-<id>` tag. The systemd backend does not escape `%` in `ExecStart`, so systemd still reads `%` as a unit specifier there.
+
 ### Verify your schedule before walking away
 
 After installing a schedule, run `verify.mjs` to confirm the command actually launches under the installed env. The verify deliberately uses the same env-derivation logic as the installer, so it catches the env-mismatch class of bugs (narrow PATH, missing HOME, etc.) before the job's first scheduled fire; instead of finding out two weeks later from a stale audit log.

package/dist/engineering-pa-core/src/distill/prompt.mjs

@@ -81,13 +81,16 @@ export const DISTILL_PROMPT = buildDistillPrompt();
 // 2026-07-29). Before this pin, claudeArgs passed no `--model`, so the
 // Librarian inherited whatever the host CLI happened to default to -- the
 // model choice was an accident of host config, and a host-side default bump
-// silently changed sweep behaviour. The pin makes the choice deliberate:
-// claude-opus-4-7 follows briefs better than 4.8/5 in estate experience,
-// which matters more for a scripted sweep than raw capability.
+// silently changed sweep behaviour. The pin makes the choice deliberate.
+// The pinned model follows the estate model ladder: claude-opus-5-5 is the
+// base model from the 2026-10-16 operator ruling. It replaced claude-opus-4-7
+// (now deprecated), which was first picked because it followed briefs better
+// than 4.8/5, and brief-following matters more for a scripted sweep than raw
+// capability.
 //
 // Override per host or per run via the DISTILL_MODEL environment variable
 // (documented in docs/tools/distill.md).
-export const DEFAULT_DISTILL_MODEL = 'claude-opus-4-7';
+export const DEFAULT_DISTILL_MODEL = 'claude-opus-5-5';
 
 export function resolveDistillModel(env = process.env) {
   const override = env.DISTILL_MODEL;

package/dist/engineering-pa-core/src/scheduler/install.mjs

@@ -371,16 +371,24 @@ export function defaultCronLogPath(sched) {
 
 /**
  * Build the INNER shell script a cron entry (or a `scheduler verify` run
- * simulating one) actually executes, plus the `bash -c "<inner>"`
- * wrapper string. Kept separate from the inner content so `verify` can
- * run the exact same inner script via `spawn('bash', ['-c', inner], ...)`
- * — an argv array, never a re-parsed/re-split string — while `install`
- * embeds the wrapper form into the crontab line.
+ * simulating one) actually executes, the `bash -c '<inner>'` wrapper
+ * string, and the crontab command field (the wrapper with every `%`
+ * escaped as `\%`).
  *
- * Shape (matches the real house pattern, e.g.
- * `bash -c ". $HOME/.nvm/nvm.sh && cd /home/thefoot/dave-v2 && pnpm exec
- * pa knowledge eval --format line >> /tmp/dave-knowledge-eval-daily.log
- * 2>&1" # dave-knowledge-eval-daily`):
+ * The wrapper is single-quoted, embedded single quotes rendered as
+ * `'\''`, exactly like the systemd backend's ExecStart. cron hands the
+ * command field to `/bin/sh -c`; inside the old double-quoted form sh
+ * expanded every `$(...)`, `$N` and `${VAR}` in the cron user's HOME
+ * before bash ever ran (smarthome01 workspace-refresh, w-2026-10-17-dave-006).
+ * Single quotes hand the inner script to bash untouched.
+ *
+ * cron turns an unescaped `%` into a newline and feeds the rest of the
+ * line to stdin, so `cronField` escapes every `%` as `\%`; cron strips
+ * the backslash before sh sees the line. `wrapped` is the string sh
+ * receives after that unescaping, which is what `verify` runs.
+ *
+ * Shape: `bash -c '{ date -u; [. $HOME/.nvm/nvm.sh && ]cd <workDir> &&
+ * <command>; } >> <log> 2>&1'`:
  *
  *   [. $HOME/.nvm/nvm.sh && ]<export VAR='val'; >*cd <workDir> && <command> >> <logPath> 2>&1
  *
@@ -397,7 +405,7 @@ export function defaultCronLogPath(sched) {
  * @param {object} [opts]
  * @param {boolean} [opts.hasNvm]
  * @param {string} [opts.logPath]
- * @returns {{ inner: string, wrapped: string }}
+ * @returns {{ inner: string, wrapped: string, cronField: string }}
  */
 /**
  * When the schedule's argv[0] is a bare `node`, swap in the absolute
@@ -444,14 +452,31 @@ export function buildCronCommand(sched, workDir, env, opts = {}) {
   // file empty — the exact silent-failure class w-2026-09-13-dave-030 tracks
   // (smarthome01 crons fired but never wrote a log line, 2026-09-09 -> 13).
   // A leading `date -u` inside the group prints an ISO timestamp so a run
-  // that dies mid-chain still leaves dated evidence. No `$()` — cron passes
-  // the crontab line through /bin/sh -c '...' which parses the double-quoted
-  // bash-c argument and would eagerly expand $(...) at dispatch time, not
-  // at run time.
+  // that dies mid-chain still leaves dated evidence.
   const chain = `date -u; ${preamble}${exportStmts}cd ${workDir} && ${resolvedCommand}`;
   const inner = `{ ${chain}; } >> ${logPath} 2>&1`;
-  const wrapped = `bash -c "${inner.replace(/"/g, '\\"')}"`;
-  return { inner, wrapped };
+  const wrapped = `bash -c '${inner.replace(/'/g, `'\\''`)}'`;
+  return { inner, wrapped, cronField: escapeCronPercent(wrapped) };
+}
+
+/**
+ * Escape every `%` as `\%` for a crontab command field. cron otherwise
+ * treats `%` as a newline and sends the remainder to the command's stdin.
+ * @param {string} s
+ * @returns {string}
+ */
+export function escapeCronPercent(s) {
+  return s.replace(/%/g, '\\%');
+}
+
+/**
+ * Undo cron's own `\%` unescaping, yielding the string cron passes to
+ * `/bin/sh -c`. Inverse of escapeCronPercent.
+ * @param {string} s
+ * @returns {string}
+ */
+export function unescapeCronPercent(s) {
+  return s.replace(/\\%/g, '%');
 }
 
 /**
@@ -465,8 +490,8 @@ export function buildCronCommand(sched, workDir, env, opts = {}) {
  */
 export function buildCronLine(sched, workDir, env, opts = {}) {
   const tag = `${schedAgent(sched)}-${sched.id}`;
-  const { wrapped } = buildCronCommand(sched, workDir, env, opts);
-  return `${sched.schedule} ${wrapped} # ${tag}`;
+  const { cronField } = buildCronCommand(sched, workDir, env, opts);
+  return `${sched.schedule} ${cronField} # ${tag}`;
 }
 
 function installCron(sched, workDir) {

package/dist/engineering-pa-core/src/scheduler/verify.mjs

@@ -36,6 +36,7 @@ import {
   resolveEnvironment,
   withLaunchdDefaults,
   buildCronCommand,
+  unescapeCronPercent,
   detectNvm,
   schedAgent,
 } from './install.mjs';
@@ -250,8 +251,12 @@ export function runVerifyArgv(bin, args, workDir, env, timeoutMs) {
  * For backend === 'cron', this does NOT run `sched.command` directly — it
  * builds the exact GENERATED inner cron script (via install.mjs's
  * `buildCronCommand`, the same function `scheduler install` uses to write
- * the actual crontab line) and runs THAT via `bash -c` with an exact argv
- * array (never a re-split string). This is the "verification is honest
+ * the actual crontab line) and runs it the way cron does: the crontab
+ * command field (`bash -c '...'`, `%` escaped as `\%`) has cron's own
+ * `\%` unescaping undone and is handed to `/bin/sh -c` as one argv
+ * element, from the working directory. Running the inner script under
+ * bash directly would skip the sh pass that cron performs, so quoting or
+ * `%` defects in the wrapper could never show (w-2026-10-17-dave-006). This is the "verification is honest
  * about cron reality" fix: verifying `sched.command` alone, under an env
  * that inherits the verifying process's PATH, never exercised the nvm
  * preamble or the minimal-PATH reality a real cron invocation faces —
@@ -269,7 +274,7 @@ export function runVerifyArgv(bin, args, workDir, env, timeoutMs) {
  *   `/tmp/<agent>-<id>-verify.log` — distinct from the INSTALLED
  *   schedule's own `/tmp/<agent>-<id>.log`, so a verify run never
  *   clobbers/interleaves with real cron output).
- * @returns {Promise<{ result: 'ok' | 'fail-exit' | 'fail-spawn' | 'fail-timeout', exitCode: number, sched: object, backend: string, env: Record<string,string>, workDir: string, run: object }>}
+ * @returns {Promise<{ result: 'ok' | 'fail-exit' | 'fail-spawn' | 'fail-timeout', exitCode: number, sched: object, backend: string, env: Record<string,string>, workDir: string, run: object, argv: string[] | null }>}
  */
 export async function verify(scheduleFile, opts = {}) {
   const sched = readSchedule(scheduleFile);
@@ -287,12 +292,14 @@ export async function verify(scheduleFile, opts = {}) {
   const env = computeBackendEnv(sched, backend);
 
   let run;
+  let argv = null;
   if (backend === 'cron') {
     const explicit = resolveEnvironment(sched);
     const hasNvm = opts.hasNvm ?? detectNvm();
     const logPath = opts.cronLogPath ?? `/tmp/${schedAgent(sched)}-${sched.id}-verify.log`;
-    const { inner } = buildCronCommand(sched, workDir, explicit, { hasNvm, logPath });
-    run = await runVerifyArgv('bash', ['-c', inner], workDir, env, timeoutMs);
+    const { cronField } = buildCronCommand(sched, workDir, explicit, { hasNvm, logPath });
+    argv = ['/bin/sh', '-c', unescapeCronPercent(cronField)];
+    run = await runVerifyArgv(argv[0], argv.slice(1), workDir, env, timeoutMs);
   } else {
     run = await runVerify(sched.command, workDir, env, timeoutMs);
   }
@@ -313,7 +320,7 @@ export async function verify(scheduleFile, opts = {}) {
     exitCode = 2;
   }
 
-  return { result, exitCode, sched, backend, env, workDir, run };
+  return { result, exitCode, sched, backend, env, workDir, run, argv };
 }
 
 // ── CLI entry point ──────────────────────────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stravica-ai/digital-operator-pa",
-  "version": "0.1.60",
+  "version": "0.1.62",
   "description": "Digital Operator PA: single-bundled public package surface (bins + library) for the platform.",
   "type": "module",
   "main": "./index.mjs",