fix: address unaddressed Codex review comments from #478 / #498 / #521

[buremba]

Summary

Sweeps a handful of unresolved Codex P1/P2 review threads from already-merged PRs (#478, #498, #521). Each call site below was verified against current main.

Changes

• task-scheduler.ts (feat(scheduler): unified TaskScheduler — replace setInterval maintenance loop #478) — start() previously logged + swallowed seedNextCronTick failures, so a transient DB hiccup at boot could leave a periodic task permanently idle until the next pod restart (no self-seed path). Now retries in the background at 5s / 15s / 60s before giving up.

• gateway/auth/mcp/proxy.ts (fix: harden lobu memory watcher reliability #498) — getToolAnnotations did not forward the worker JWT to fetchToolsForMcp, so uncached tools/list discovery for internal MCPs (lobu-memory) went upstream unauthenticated, returned an empty list, and silently bypassed requiresToolApproval (found=false was treated as "no approval needed"). Forwards auth.token / sessionToken through both call sites.

• gateway/auth/mcp/config-service.ts (fix: harden lobu memory watcher reliability #498) — getEffectiveAgentMcpServers previously deleted the lobu-memory entry whenever deriveLobuMemoryServer returned null (transient DB error, slug not yet resolvable). A manually configured lobu-memory server in agent settings would silently disappear. Now only drops the entry when it was derived (internal === true).

• cli/commands/dev.ts (feat(cli): non-interactive init, REPL chat, project link, beefier doctor #521) — Clears CodeQL clear-text-logging alerts (chore(main): release lobu 3.7.0 #228, fix(ci): initialize owletto-web submodule in landing deploy #229, fix: ship app.lobu.ai SPA + retire owletto.com defaults #230, feat(owletto): absorb skills, benchmarks, and dev scripts from owletto repo #231) by logging the validated portNum instead of the raw env-sourced port string.

Verified-already-fixed (no change)

• feat(scheduler): unified TaskScheduler — replace setInterval maintenance loop #478 orphan watcher reset already gates on claimed_at < now() - ORPHANED_CLAIM_THRESHOLD.
• feat(cli): align agent management with web API #491 lobu apply --url token resolution and per-context active org are already wired correctly.
• refactor(cli): merge owletto bin into lobu memory namespace #459 multi-tenant cli-token bypass and resolveServerUrl were addressed by later refactors (refactor: unify connection storage on agent_connections, drop chat_connections #506).
• feat(watchers): edit propagates across the group; snapshot version_id on runs #485 watcher version chain uses an advisory lock + WHERE watcher_id = groupId.

Test plan

• make build-packages is green
• Pre-commit Biome + tsc pass
• CI green
• Manual: confirm lobu run with invalid PORT still surfaces a helpful error
• Manual: confirm an internal MCP tool call still hits the approval gate when no grant exists

https://claude.ai/code/session_01NLSbCEn2nJijWa6ZzhixYz

---

Generated by Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 0% with 11 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
packages/cli/src/commands/dev.ts	0.00%	11 Missing ⚠️

📢 Thoughts on this report? Let us know!