shadok-ai 0.17.40 → 0.17.42

package/dist/migrate-groups.d.ts

@@ -88,6 +88,57 @@ export declare function commonsOsUser(input: {
     migrated: boolean;
     mode: DeploymentMode;
 }): string | null;
+/**
+ * Repoint a cron `check` command from the OLD commons HOME's `.claude` tree to the
+ * NEW one, after migration moved the commons agent off `/root` to `/home/main`.
+ *
+ * Why this is needed at all: an agent that authored a monitoring script stored it
+ * (and hard-coded the guard path) under `$HOME/.claude/skills/.../scripts/` when
+ * its HOME was still `/root`. Since cron guards now run DROPPED as the commons
+ * `main` user (which cannot traverse `/root`, 0700), that absolute `/root/.claude`
+ * path is unreadable and the guard dies `check-failed` in silence. The migration
+ * relocates the `.claude` tree into the new HOME, so the reference must follow.
+ *
+ * The `<oldHome>/.claude` base is ALWAYS rewritten — the tree the migration moved —
+ * plus any extra RELATIVE prefix the caller passes (the `~/.shadok-ai/<dir>` script
+ * dirs a guard also names; see `shadokScriptDirs`). Every OTHER `/root/...` mention
+ * is left intact, so a reference to a dir that was NOT relocated keeps pointing at
+ * the original. Identity when the home did not move (mono-tenant, or old === new) or
+ * when either base is blank (never blank out a path). A `$HOME`-relative check is
+ * already portable and contains no absolute base to match, so it passes through
+ * untouched. Pure, so the boot self-heal that walks the cron file stays a thin
+ * caller — and the exact substitution is locked by test, the twin of
+ * `rewriteSkillsBase`.
+ */
+export declare function rewriteCronCheckHome(check: string, oldHome: string, newHome: string, extraRelPrefixes?: readonly string[]): string;
+/**
+ * Shadok's OWN directories under `~/.shadok-ai` — NEVER carried into the commons
+ * HOME by the stranded-script heal, even if a cron check names one. The credential
+ * stores (`ssh`, `users`, `secrets`) are the load-bearing entries: copying them
+ * into `/home/main` would hand every commons agent the SSH private key, the
+ * per-session signing keys and the account password hashes. The rest are internal
+ * per-instance state a guard has no business reading. A denylist (not an allowlist)
+ * on purpose: an operator/agent names its script dir whatever it likes (`scripts`,
+ * `checks`, `marketing`, …), and an allowlist would silently fail to heal a
+ * custom-named one — reintroducing the exact silent breakage this closes.
+ */
+export declare const SHADOK_INTERNAL_DIRS: readonly string[];
+/**
+ * The `~/.shadok-ai/<dir>` script directories a cron `check` references under the
+ * OLD commons HOME (`oldHome`, i.e. `/root`). These are operator/agent-authored
+ * monitoring scripts dropped straight under the data dir — a DIFFERENT location
+ * from `~/.claude/skills` (#419) that the HOME move also stranded: a dropped `main`
+ * guard cannot traverse `/root` (0700), so `/root/.shadok-ai/checks/x.sh` is
+ * unreadable exactly like a `/root/.claude` one, and the guard dies `check-failed`
+ * in silence.
+ *
+ * Returns the distinct RELATIVE prefixes (`".shadok-ai/checks"`, …), deduped and
+ * ready to feed `rewriteCronCheckHome`'s extra prefixes and `path.join`. Only the
+ * `<dir>/<something>` shape is matched (a segment that is a DIRECTORY, with a path
+ * component after it), so a top-level FILE (`/root/.shadok-ai/secrets.json`) is
+ * never caught; a dir on `SHADOK_INTERNAL_DIRS` is refused outright. Pure.
+ */
+export declare function shadokScriptDirs(check: string, oldHome: string): string[];
 /**
  * The running agents to respawn, as session ids — deduped, order preserved so
  * the caller cycles them ONE AT A TIME (the OAuth refresh-token race,

package/dist/migrate-groups.js

@@ -89,6 +89,105 @@ export function migrationPlan(input) {
 export function commonsOsUser(input) {
     return input.migrated && input.mode === "multi-tenant" ? COMMONS_USER : null;
 }
+/**
+ * Repoint a cron `check` command from the OLD commons HOME's `.claude` tree to the
+ * NEW one, after migration moved the commons agent off `/root` to `/home/main`.
+ *
+ * Why this is needed at all: an agent that authored a monitoring script stored it
+ * (and hard-coded the guard path) under `$HOME/.claude/skills/.../scripts/` when
+ * its HOME was still `/root`. Since cron guards now run DROPPED as the commons
+ * `main` user (which cannot traverse `/root`, 0700), that absolute `/root/.claude`
+ * path is unreadable and the guard dies `check-failed` in silence. The migration
+ * relocates the `.claude` tree into the new HOME, so the reference must follow.
+ *
+ * The `<oldHome>/.claude` base is ALWAYS rewritten — the tree the migration moved —
+ * plus any extra RELATIVE prefix the caller passes (the `~/.shadok-ai/<dir>` script
+ * dirs a guard also names; see `shadokScriptDirs`). Every OTHER `/root/...` mention
+ * is left intact, so a reference to a dir that was NOT relocated keeps pointing at
+ * the original. Identity when the home did not move (mono-tenant, or old === new) or
+ * when either base is blank (never blank out a path). A `$HOME`-relative check is
+ * already portable and contains no absolute base to match, so it passes through
+ * untouched. Pure, so the boot self-heal that walks the cron file stays a thin
+ * caller — and the exact substitution is locked by test, the twin of
+ * `rewriteSkillsBase`.
+ */
+export function rewriteCronCheckHome(check, oldHome, newHome, extraRelPrefixes = []) {
+    if (!check || !oldHome || !newHome || oldHome === newHome)
+        return check;
+    let out = check;
+    for (const rel of [".claude", ...extraRelPrefixes]) {
+        out = out.split(oldHome + "/" + rel).join(newHome + "/" + rel);
+    }
+    return out;
+}
+/** Escape a string for literal use inside a `RegExp`. */
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * Shadok's OWN directories under `~/.shadok-ai` — NEVER carried into the commons
+ * HOME by the stranded-script heal, even if a cron check names one. The credential
+ * stores (`ssh`, `users`, `secrets`) are the load-bearing entries: copying them
+ * into `/home/main` would hand every commons agent the SSH private key, the
+ * per-session signing keys and the account password hashes. The rest are internal
+ * per-instance state a guard has no business reading. A denylist (not an allowlist)
+ * on purpose: an operator/agent names its script dir whatever it likes (`scripts`,
+ * `checks`, `marketing`, …), and an allowlist would silently fail to heal a
+ * custom-named one — reintroducing the exact silent breakage this closes.
+ */
+export const SHADOK_INTERNAL_DIRS = [
+    "app",
+    "browsers",
+    "channels",
+    "config",
+    "crons",
+    "files",
+    "keys",
+    "ledger",
+    "locks",
+    "media",
+    "peers",
+    "pilotctl",
+    "profiles",
+    "run",
+    "secrets",
+    "self",
+    "ssh",
+    "tail",
+    "tokens",
+    "users",
+    "whisper",
+    "worktrees",
+    "wt",
+];
+/**
+ * The `~/.shadok-ai/<dir>` script directories a cron `check` references under the
+ * OLD commons HOME (`oldHome`, i.e. `/root`). These are operator/agent-authored
+ * monitoring scripts dropped straight under the data dir — a DIFFERENT location
+ * from `~/.claude/skills` (#419) that the HOME move also stranded: a dropped `main`
+ * guard cannot traverse `/root` (0700), so `/root/.shadok-ai/checks/x.sh` is
+ * unreadable exactly like a `/root/.claude` one, and the guard dies `check-failed`
+ * in silence.
+ *
+ * Returns the distinct RELATIVE prefixes (`".shadok-ai/checks"`, …), deduped and
+ * ready to feed `rewriteCronCheckHome`'s extra prefixes and `path.join`. Only the
+ * `<dir>/<something>` shape is matched (a segment that is a DIRECTORY, with a path
+ * component after it), so a top-level FILE (`/root/.shadok-ai/secrets.json`) is
+ * never caught; a dir on `SHADOK_INTERNAL_DIRS` is refused outright. Pure.
+ */
+export function shadokScriptDirs(check, oldHome) {
+    if (!check || !oldHome)
+        return [];
+    const re = new RegExp(escapeRegExp(oldHome + "/.shadok-ai/") + "([^/\\s'\"]+)/", "g");
+    const out = new Set();
+    for (let m = re.exec(check); m; m = re.exec(check)) {
+        const seg = m[1];
+        if (SHADOK_INTERNAL_DIRS.includes(seg))
+            continue;
+        out.add(".shadok-ai/" + seg);
+    }
+    return [...out];
+}
 /**
  * The running agents to respawn, as session ids — deduped, order preserved so
  * the caller cycles them ONE AT A TIME (the OAuth refresh-token race,

package/dist/migrate-groups.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrate-groups.js","sourceRoot":"","sources":["../src/migrate-groups.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;kDACkD;AAClD,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AAEnC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,sBAAsB,CAAC;AAuB5D;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,KAK7B;IACC,IAAI,KAAK,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAE/C,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,0BAA0B,GAAa,EAAE,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAChC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,iBAAiB,GAAG,KAAK,CAAC,cAAc;SAC3C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC;SAClE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEpB,OAAO;QACL,iBAAiB,EAAE,IAAI;QACvB,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,IAAI;QACjB,0BAA0B;QAC1B,mBAAmB,EAAE,IAAI;QACzB,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,KAAkD;IAC9E,OAAO,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW,CAAC,QAAkD;IAC5E,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAuCD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAmB,EAAE,IAAmB;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,MAAM,GAAG,IAAI,CAAC;IAElB,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,OAAgB,EAAE,EAA8B,EAAE,IAAa,EAAiB,EAAE;QAClH,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,CAAC;YACX,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,YAAY,IAAI,oCAAqC,CAAW,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;YACtF,IAAI,IAAI;gBAAE,MAAM,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;IAEF,GAAG,CAAC,0EAA0E,CAAC,CAAC;IAEhF,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,gFAAgF;IAChF,6EAA6E;IAC7E,gFAAgF;IAChF,wEAAwE;IACxE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,MAAM,IAAI,CAAC,QAAQ,GAAG,CAAC,MAAM,sDAAsD,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9H,CAAC;IAED,uDAAuD;IACvD,MAAM,IAAI,CAAC,4BAA4B,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAC/F,MAAM,IAAI,CAAC,gCAAgC,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;IAC5F,MAAM,IAAI,CAAC,qCAAqC,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAEtG,qEAAqE;IACrE,MAAM,IAAI,CAAC,yBAAyB,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;IACxF,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACtD,MAAM,IAAI,CAAC,+BAA+B,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/G,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzC,MAAM,IAAI,CAAC,gCAAgC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,IAAI,CAAC,uCAAuC,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAE/G,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,GAAG,CAAC,yFAAyF,CAAC,CAAC;QACjG,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,uCAAwC,CAAW,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,iGAAiG,CAAC,CAAC;IACzG,CAAC;AACH,CAAC"}
+{"version":3,"file":"migrate-groups.js","sourceRoot":"","sources":["../src/migrate-groups.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;kDACkD;AAClD,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AAEnC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,sBAAsB,CAAC;AAuB5D;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,KAK7B;IACC,IAAI,KAAK,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAE/C,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,0BAA0B,GAAa,EAAE,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAChC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,iBAAiB,GAAG,KAAK,CAAC,cAAc;SAC3C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC;SAClE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEpB,OAAO;QACL,iBAAiB,EAAE,IAAI;QACvB,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,IAAI;QACjB,0BAA0B;QAC1B,mBAAmB,EAAE,IAAI;QACzB,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,KAAkD;IAC9E,OAAO,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAa,EACb,OAAe,EACf,OAAe,EACf,gBAAgB,GAAsB,EAAE;IAExC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,gBAAgB,CAAC,EAAE,CAAC;QACnD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,KAAK;IACL,UAAU;IACV,UAAU;IACV,QAAQ;IACR,OAAO;IACP,OAAO;IACP,MAAM;IACN,QAAQ;IACR,OAAO;IACP,OAAO;IACP,OAAO;IACP,UAAU;IACV,UAAU;IACV,KAAK;IACL,SAAS;IACT,MAAM;IACN,KAAK;IACL,MAAM;IACN,QAAQ;IACR,OAAO;IACP,SAAS;IACT,WAAW;IACX,IAAI;CACL,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,OAAe;IAC7D,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,OAAO,GAAG,cAAc,CAAC,GAAG,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACjD,GAAG,CAAC,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW,CAAC,QAAkD;IAC5E,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAuCD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAmB,EAAE,IAAmB;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,MAAM,GAAG,IAAI,CAAC;IAElB,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,OAAgB,EAAE,EAA8B,EAAE,IAAa,EAAiB,EAAE;QAClH,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,CAAC;YACX,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,YAAY,IAAI,oCAAqC,CAAW,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;YACtF,IAAI,IAAI;gBAAE,MAAM,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;IAEF,GAAG,CAAC,0EAA0E,CAAC,CAAC;IAEhF,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,gFAAgF;IAChF,6EAA6E;IAC7E,gFAAgF;IAChF,wEAAwE;IACxE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,MAAM,IAAI,CAAC,QAAQ,GAAG,CAAC,MAAM,sDAAsD,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9H,CAAC;IAED,uDAAuD;IACvD,MAAM,IAAI,CAAC,4BAA4B,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAC/F,MAAM,IAAI,CAAC,gCAAgC,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;IAC5F,MAAM,IAAI,CAAC,qCAAqC,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAEtG,qEAAqE;IACrE,MAAM,IAAI,CAAC,yBAAyB,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;IACxF,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACtD,MAAM,IAAI,CAAC,+BAA+B,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/G,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzC,MAAM,IAAI,CAAC,gCAAgC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,IAAI,CAAC,uCAAuC,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAE/G,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,GAAG,CAAC,yFAAyF,CAAC,CAAC;QACjG,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,uCAAwC,CAAW,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,iGAAiG,CAAC,CAAC;IACzG,CAAC;AACH,CAAC"}

package/dist/server.js

@@ -34,7 +34,7 @@ import { readGroundAt } from "./ground.js";
 import { homeGreetingBrief } from "./greeting.js";
 import { ensureSshIdentity } from "./ssh.js";
 import { accountsEnabled, deploymentMode, probeCanProvision } from "./capability.js";
-import { migrationPlan, runMigration, respawnPlan, commonsOsUser, COMMONS_USER, MIGRATION_MARKER_FILE, } from "./migrate-groups.js";
+import { migrationPlan, runMigration, respawnPlan, commonsOsUser, COMMONS_USER, MIGRATION_MARKER_FILE, rewriteCronCheckHome, shadokScriptDirs, } from "./migrate-groups.js";
 import { relayOAuthCallback } from "./oauth-relay.js";
 import { openBrowser } from "./open-browser.js";
 import { parseSkillMeta, prepromptParts, prepromptFingerprint, stalenessReasons, LEGACY_FINGERPRINT, } from "./preprompt.js";
@@ -3011,6 +3011,100 @@ async function ensureGroupsProvisioned() {
     // of trusted directories in one write each, so none strands on the trust
     // dialog when the resume storm rebuilds a wiped (ephemeral) group HOME.
     preseedGroupHomes();
+    // And heal the commons agent's own helper scripts + cron guards, which the HOME
+    // move off /root left stranded (see below).
+    await healCommonsStrandedScripts();
+}
+/**
+ * Boot self-heal for the commons agent's OWN helper scripts and cron guards after
+ * its HOME moved off `/root` to `/home/main`. A cron guard runs DROPPED as the
+ * commons `main` user, which cannot traverse `/root` (0700) — so ANY absolute
+ * `/root/...` path it names (script or sibling state file) is unreadable and the
+ * guard dies `check-failed` in silence (measured on a live instance: monitoring
+ * crons stuck, "son script est sous /root"). New agents are fine (their HOME is
+ * already `/home/main`); this is the one-way carry for what predates the move.
+ *
+ * Two kinds of stranded location, both relocated here and then repointed:
+ *  1. `~/.claude/skills` — the subtree `migChownTreeToCommons` skipped, where an
+ *     agent keeps the custom monitoring scripts it authored (#419).
+ *  2. `~/.shadok-ai/<dir>` — operator/agent script dirs dropped straight under the
+ *     data dir (`checks`, `scripts`, `marketing`, …), discovered from the cron
+ *     checks that name them. `shadokScriptDirs` denylists shadok's own state and
+ *     credential stores, so a key/secret dir is NEVER copied into `/home/main`.
+ *
+ * Runs on EVERY capable boot, independent of the migration marker (the twin of
+ * the reprovision reconciler above), so an ALREADY-migrated instance self-heals on
+ * the next update rather than needing a hand fix. Idempotent and best-effort: a
+ * failure here must never take down boot, and a re-run finds the copy already done
+ * (`cp -rn`, non-clobber) and the checks already rewritten (identity). No-op unless
+ * the HOME actually moved (mono-tenant / pre-migration: old === new).
+ */
+async function healCommonsStrandedScripts() {
+    if (DEPLOYMENT_MODE !== "multi-tenant")
+        return;
+    const oldHome = os.homedir();
+    const newHome = homeForUser(COMMONS_USER, GROUP_HOME_BASE);
+    if (!newHome || newHome === oldHome)
+        return; // not migrated off /root → nothing moved
+    const owner = `${COMMONS_USER}:${COMMONS_USER}`;
+    // Carry one relative tree <oldHome>/<rel> → <newHome>/<rel>, non-clobber, owned
+    // by `main`. The parent is `install -d`'d too so `~/.shadok-ai` exists in the new
+    // HOME. No-op when the source is absent.
+    const copyTree = async (rel) => {
+        const src = path.join(oldHome, rel);
+        if (!fs.existsSync(src))
+            return;
+        const dst = path.join(newHome, rel);
+        await runPrivileged("install", ["-d", "-o", COMMONS_USER, "-g", COMMONS_USER, path.dirname(dst)]);
+        await runPrivileged("install", ["-d", "-o", COMMONS_USER, "-g", COMMONS_USER, dst]);
+        await runPrivileged("cp", ["-rn", `${src}/.`, `${dst}/`], { timeoutMs: TREE_OP_TIMEOUT_MS });
+        await runPrivileged("chown", ["-R", owner, dst], { timeoutMs: TREE_OP_TIMEOUT_MS });
+    };
+    // Load once; the same list feeds the dir discovery AND the rewrite below.
+    let crons = [];
+    try {
+        crons = loadCrons();
+    }
+    catch (e) {
+        console.error(`heal: reading crons failed (best-effort): ${e?.message ?? e}`);
+    }
+    // The ~/.shadok-ai/<dir> script dirs the guards name, deduped (never a
+    // credential/state dir — shadokScriptDirs denylists those).
+    const scriptDirs = [
+        ...new Set(crons.flatMap((c) => (c.check ? shadokScriptDirs(c.check, oldHome) : []))),
+    ];
+    // 1) Relocate the skills subtree the migration skipped, plus every discovered
+    //    ~/.shadok-ai script dir. Each copy is independent and best-effort.
+    for (const rel of [path.join(".claude", "skills"), ...scriptDirs]) {
+        try {
+            await copyTree(rel);
+        }
+        catch (e) {
+            console.error(`heal: relocating commons ~/${rel} failed (best-effort): ${e?.message ?? e}`);
+        }
+    }
+    // 2) Repoint this instance's cron guards: the .claude base AND the relocated
+    //    ~/.shadok-ai script dirs. A /root path that was NOT relocated stays intact.
+    try {
+        let changed = false;
+        for (const c of crons) {
+            if (!c.check)
+                continue;
+            const next = rewriteCronCheckHome(c.check, oldHome, newHome, scriptDirs);
+            if (next !== c.check) {
+                c.check = next;
+                changed = true;
+            }
+        }
+        if (changed) {
+            saveCrons(crons);
+            console.log(`heal: repointed cron guard path(s) from ${oldHome} → ${newHome} ` +
+                `(.claude${scriptDirs.length ? ", " + scriptDirs.join(", ") : ""})`);
+        }
+    }
+    catch (e) {
+        console.error(`heal: rewriting cron guard paths failed (best-effort): ${e?.message ?? e}`);
+    }
 }
 /** Step 1 — create the non-root commons user `main` (+ HOME). Idempotent. */
 async function migCreateCommonsUser() {