shraga 0.1.39 → 0.1.41

package/defaults/skills/garden.md

@@ -131,9 +131,16 @@ Write to `data/workspace/garden-reports/{YYYY-MM-DD}.md`:
 
 The full report is the audit trail. Raw agent reports let you verify the diagnosis. Diff previews let you verify the prescription. Skipped findings let you verify the triage.
 
+### Check auto-apply preference
+
+Read `data/workspace/preferences/garden.json` (if present). This is the owner's standing instruction and **overrides the default approval gate** — check it before deciding whether to stop and wait.
+
+- `{"autoApply": true, ...}` → **Phase 4 applies automatically**, no waiting. Only proposals whose `Risk` is `none` or `low` auto-apply; anything `medium`/`high`, or involving conflicting sources / a judgment call, still goes to DM-and-wait regardless of the flag (per the file's own `note` on what still needs Elya).
+- Missing file, or `autoApply` absent/false → default gate applies: propose, DM, and **STOP** (below).
+
 ### Send Slack DM to owners
 
-Send a DM to each owner (from `<known_contacts>` with Slack IDs) using `post_slack_message`:
+Send a DM to each owner (from `<known_contacts>` with Slack IDs) using `post_slack_message`. Adjust wording based on the auto-apply check above:
 
 ```
 🌱 Knowledge Garden — {date}
@@ -152,17 +159,21 @@ Full audit trail: data/workspace/garden-reports/{date}.md
    Diff: -{removed summary} +{added summary}
 
 Skipped {N} lower-priority findings (see report).
-Reply with numbers to approve (e.g. "1,3") or "all".
 ```
 
-**STOP here. Do not apply changes. Wait for user approval.**
+If autoApply: append `Auto-applying #1, #2 (risk: none/low). Nothing needs your review this run.` — or, if something is held back — `Applied #1 automatically. #2 needs your call (risk: medium / conflicting sources) — reply with the number to approve.`
+If not autoApply: append `Reply with numbers to approve (e.g. "1,3") or "all".` and **STOP here. Do not apply changes. Wait for user approval.**
+
+## Phase 4: Apply
+
+**If autoApply (per the check above):** apply every proposed change with `Risk: none` or `Risk: low` immediately, in the same run — no waiting. Hold back anything `medium`/`high` risk and DM as described above.
 
-## Phase 4: Apply (only when user approves)
+**If not autoApply:** apply only when the user replies with numbers (e.g. "1,3") or "all".
 
-When the user replies with numbers (e.g. "1,3") or "all":
+Either way:
 
 1. Load the report from `data/workspace/garden-reports/{date}.md`
-2. Apply only the approved changes using Edit tool
+2. Apply the approved/qualifying changes using Edit tool
 3. Commit:
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shraga",
-  "version": "0.1.39",
+  "version": "0.1.41",
   "description": "The teammate you delegate coding to — a self-hostable, multi-user AI coding agent web UI (Claude Code, with a pluggable engine seam).",
   "type": "module",
   "main": "./src/index.ts",

package/src/server/scheduler/engine.ts

@@ -78,6 +78,18 @@ export function start(broadcast: Broadcast): void {
       s.lastRun.error = 'interrupted by server restart';
     }
     if (!s.enabled) { s.nextRun = undefined; continue; }
+    // A one-off that already ran must never be armed again. It is normally DELETED on success,
+    // but schedules.json is a whole-file JSON array shared by this process and by humans over
+    // git — a conflicting rebase, or data-sync's union-merge conflict resolver, can bring the
+    // deleted entry back. If its `at` is still in the future the past-due guard below cannot
+    // see it, and a completed campaign send would go out twice. Refuse it here instead.
+    const ranBefore = oneShotAlreadyRan(s);
+    if (ranBefore) {
+      console.warn(`[scheduler] ⚠️ refusing to re-arm completed one-off ${s.id} ("${s.name}") — ${ranBefore}. Disabled; delete it or create a new schedule.`);
+      s.enabled = false;
+      s.nextRun = undefined;
+      continue;
+    }
     const next = computeNextRun(s.trigger);
     if (next === null) {
       if (s.trigger.kind === 'once') s.enabled = false;
@@ -164,6 +176,10 @@ export function getSchedule(id: string): Schedule | undefined {
 export function upsertSchedule(s: Schedule): { ok: true; schedule: Schedule } | { ok: false; error: string } {
   const err = validateTrigger(s.trigger);
   if (err) return { ok: false, error: err };
+  // Same guard as boot: re-adding a spent one-off under its old id is a resurrection, not an
+  // edit. A genuinely new job gets a new id.
+  const ranBefore = oneShotAlreadyRan(s);
+  if (ranBefore) return { ok: false, error: `This one-off schedule already ran — ${ranBefore}. Create a new schedule instead of re-adding this one.` };
   if (s.onMissed !== undefined && !MISSED_POLICIES.includes(s.onMissed)) {
     return { ok: false, error: `Invalid onMissed "${s.onMissed}" (expected ${MISSED_POLICIES.join(' | ')})` };
   }
@@ -361,6 +377,31 @@ export function resumeRun(scheduleId: string, sessionId: string, prompt: string)
 
 // ── Internals ───────────────────────────────────────────────────────────────
 
+/**
+ * Evidence that a `once` schedule has ALREADY had its single run — i.e. this entry is a
+ * resurrection of one the engine deleted on success, not a new job. Returns a human-readable
+ * reason, or null when the schedule is not a spent one-off.
+ *
+ * Two independent witnesses, because neither survives everything:
+ *  - the completion marker (data/scheduler/completions/<id>.json), which is per-id, gitignored
+ *    and local to the firing instance — so a git merge can never carry it away, but a rebuilt
+ *    data dir loses it;
+ *  - the entry's own `lastRun.status === 'ok'`, which travels inside schedules.json — so it
+ *    survives a wiped data dir, but only if the resurrected copy is from after that run.
+ */
+function oneShotAlreadyRan(s: Schedule): string | null {
+  if (s.trigger.kind !== 'once') return null;
+  const marker = readCompletionMarker(s.id);
+  // `completedAt` is the last SUCCESSFUL completion, and 0 when there has never been one. A
+  // marker is also written at fire time (`markRunStarted`) and on failure
+  // (`recordAttemptOutcome`), so its mere existence proves only an attempt. A future-dated
+  // one-off whose manual test-run errored has a marker but has never sent — retiring it would
+  // cancel a send that never happened, and report it as completed at epoch 0.
+  if (marker && marker.completedAt > 0) return `it completed at ${new Date(marker.completedAt).toISOString()} (${marker.triggeredBy})`;
+  if (s.lastRun?.status === 'ok') return `its own lastRun records a successful run at ${new Date(s.lastRun.at).toISOString()}`;
+  return null;
+}
+
 const MISSED_POLICIES: MissedPolicy[] = ['run', 'skip', 'offer'];
 
 function refuse(reason: RunRefusal, message: string): RunOutcome {

package/src/server/slack/questions.ts

@@ -43,6 +43,13 @@ function buildBlocks(id: string, questions: AskQuestion[]): unknown[] {
   return blocks;
 }
 
+/** Replace a question message's blocks with a final state, so its buttons stop looking live. */
+async function retire(p: Pending, text: string) {
+  if (!p.messageTs) return;
+  await slackPost('chat.update', { channel: p.channel, ts: p.messageTs, text, blocks: [{ type: 'section', text: { type: 'mrkdwn', text } }] }, p.useUserToken)
+    .catch((err) => console.error(`${PREFIX} retire failed:`, (err as Error)?.message));
+}
+
 /** Build a QuestionHandler bound to a Slack channel/thread for the current turn. */
 export function makeSlackQuestionHandler(ctx: Ctx): QuestionHandler {
   return async (id, questions) => {
@@ -55,7 +62,12 @@ export function makeSlackQuestionHandler(ctx: Ctx): QuestionHandler {
     console.log(`${PREFIX} posted question ${id} (${questions.length}q) to ${ctx.channel}`);
     return new Promise<QuestionAnswers | null>((resolve) => {
       const timer = setTimeout(() => {
-        if (pending.delete(id)) { console.log(`${PREFIX} ${id} timed out`); resolve(null); }
+        const p = pending.get(id);
+        if (!p) return;
+        pending.delete(id);
+        console.log(`${PREFIX} ${id} timed out`);
+        void retire(p, '⌛ This question expired — I went ahead without an answer. Reply in the thread to steer me.');
+        resolve(null);
       }, TTL_MS);
       pending.set(id, { ...ctx, resolve, questions, messageTs: res.ts, timer });
     });
@@ -98,14 +110,22 @@ export async function handleSlackInteraction(payload: any): Promise<boolean> {
   if (!submit) return false;
   const id = submit.value as string;
   const p = pending.get(id);
-  if (!p) return false;
+  if (!p) {
+    // Expired or lost to a restart: the buttons are still clickable but nothing is listening.
+    // Silence reads as a broken app, so always answer the click.
+    console.warn(`${PREFIX} submit for unknown/expired question ${id}`);
+    const channel = payload.channel?.id;
+    if (channel && userId) {
+      await slackPost('chat.postEphemeral', { channel, user: userId, text: '⌛ That question is no longer active (expired or I restarted). Just reply in the thread and I\'ll pick it up.' })
+        .catch((err) => console.error(`${PREFIX} ephemeral failed:`, (err as Error)?.message));
+    }
+    return false;
+  }
   pending.delete(id);
   clearTimeout(p.timer);
   const answers = parseAnswers(payload.state?.values, p.questions);
-  if (p.messageTs) {
-    const summary = Object.entries(answers).map(([q, a]) => `• *${q}* — ${Array.isArray(a) ? a.join(', ') : a}`).join('\n') || '_(no selection)_';
-    await slackPost('chat.update', { channel: p.channel, ts: p.messageTs, text: '✅ Got your answers.', blocks: [{ type: 'section', text: { type: 'mrkdwn', text: `✅ Got your answers:\n${summary}` } }] }, p.useUserToken).catch(() => {});
-  }
+  const summary = Object.entries(answers).map(([q, a]) => `• *${q}* — ${Array.isArray(a) ? a.join(', ') : a}`).join('\n') || '_(no selection)_';
+  await retire(p, `✅ Got your answers:\n${summary}`);
   console.log(`${PREFIX} resolved question ${id} (${Object.keys(answers).length} answered)`);
   p.resolve(Object.keys(answers).length ? answers : null);
   return true;