shraga 0.1.44 → 0.1.46

package/defaults/system-prompt.md

@@ -39,7 +39,11 @@ The workspace (`data/workspace/`) has two scopes. Full architecture: `defaults/w
 
 - Be direct and concise. Answer succinctly.
 - Always respond with a brief verbal acknowledgment before making tool calls. For example: "Let me check that" or "Looking into it." This makes the conversation feel natural, especially in chat interfaces where tool calls aren't visible.
-- Do NOT spawn sub-agents.
+- Do NOT spawn sub-agents. This gates the `Agent`/`Task` tool ONLY. External CLI processes you launch
+  with `Bash` (`agentx`, `claude -p`, `cursor-agent`, …) are not sub-agents and are never blocked by this
+  rule — when a skill documents a Bash launch, use it.
+- Never abort a task on a *suspected* capability or permission block. Load the relevant skill and actually
+  attempt the documented path first; report the real error, not an assumed one.
 - Do NOT read large dump files — use targeted queries with limits.
 - When using MCP tools, prefer small queries (limitToLast=5) over broad fetches.
 - When running scripts or shell commands, always show the output (or a meaningful summary if very long) as text in your response. The user cannot see tool results unless they toggle Details — your text output is the only thing they see by default.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shraga",
-  "version": "0.1.44",
+  "version": "0.1.46",
   "description": "The teammate you delegate coding to — a self-hostable, multi-user AI coding agent web UI (Claude Code, with a pluggable engine seam).",
   "type": "module",
   "main": "./src/index.ts",

package/src/server/data-sync.ts

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync, statSync } from 'node:fs';
 import path from 'node:path';
+import { hostname } from 'node:os';
 import { DATA_DIR } from './paths.ts';
 import { emitEvent } from './events/bus.ts';
 import { runTextQuery } from './sdk-utils.ts';
@@ -18,6 +19,15 @@ export class DataSyncOptions {
    * A real deployment must ALSO set DATA_SYNC_ENABLE=1. Dev/verify boots never sync/push.
    */
   enabled = process.env.DATA_SYNC_ENABLE === '1' || process.env.DATA_SYNC_ENABLE === 'true';
+  /**
+   * Owner-facing alerts are a PROD side effect, so only the designated single-writer instance
+   * (the same one that fires schedules) may DM owners. A dev laptop legitimately syncs the shared
+   * data repo, but it also shares .env's APP_NAME, OWNERS and the Slack bot token — so its alerts
+   * are indistinguishable from the box's. Past incident 2026-08-20: a laptop pinned to an older
+   * shraga re-sent a merge-conflict alert for a bug already fixed AND deployed on the box, and the
+   * DM gave no way to tell which instance sent it. Suppressed alerts are still logged locally.
+   */
+  notify = process.env.DATA_SYNC_SCHEDULER_ACTIVE === 'true';
 }
 
 export class DataSync {
@@ -550,6 +560,12 @@ export class DataSync {
   }
 
   private async notifyOwners(text: string): Promise<void> {
+    if (!this.options.notify) {
+      // Not the authoritative instance — log it so a dev run still surfaces the problem locally,
+      // but never DM owners (see DataSyncOptions.notify).
+      console.warn(`${TAG} notification suppressed (not the authoritative instance):\n${text}`);
+      return;
+    }
     // No Slack coupling here — resolve owner contacts and publish a deploy notice on the event bus.
     // The Slack feature (slackFeature) subscribes and DMs each owner. Owner resolution uses the
     // contacts store only, so data-sync stays transport-agnostic.
@@ -562,7 +578,10 @@ export class DataSync {
       console.warn(`${TAG} No owners (OWNERS env) with Slack IDs found, skipping notification`);
       return;
     }
-    emitEvent('data-sync', { kind: 'deploy', owners, text });
+    // Stamp the sender: every owner alert must name the instance it came from, so "is this back?"
+    // is answerable without log archaeology across hosts.
+    const from = `${this.options.deploymentId || 'shraga'}@${hostname()}`;
+    emitEvent('data-sync', { kind: 'deploy', owners, text: `${text}\n\n_from ${from}_` });
   }
 
   /**