Replace cron daemon with supercronic (#35)

[nickopris]

The cron mechanism is not reliable inside DevPanel containers. Watch .devpanel/crontab with supercronic instead of installing/starting the cron daemon and mutating the www crontab in place.

Resolves #35

[Copilot]

Pull request overview

This PR updates the DevPanel container cron strategy to be more reliable by removing the cron daemon setup and instead running supercronic to watch a versioned .devpanel/crontab file for the AI Dashboard scheduled jobs.

Changes:

• Remove cron package installation/startup and crontab mutation logic.
• Add supercronic bootstrap logic to run as a background watcher of .devpanel/crontab.
• Add a committed .devpanel/crontab containing the AI Dashboard schedules.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.devpanel/custom_package_installer.sh	Removes cron daemon management and starts supercronic to watch a project crontab file.
.devpanel/crontab	Introduces a tracked cron schedule file consumed by supercronic.

Comments suppressed due to low confidence (3)

.devpanel/custom_package_installer.sh:56

• The supercronic install path relies on curl, but the script doesn’t ensure curl is present and also doesn’t fail fast if the download fails (this file doesn’t use set -e). If curl is missing or GitHub is unreachable, cron setup will be skipped without an obvious error. Install curl if needed and explicitly error out on download failure.

  # Install supercronic.
  if ! command -v supercronic >/dev/null 2>&1; then
    curl -fsSL "https://github.com/aptible/supercronic/releases/latest/download/supercronic-linux-$(dpkg --print-architecture)" \
      -o /usr/local/bin/supercronic
    chmod +x /usr/local/bin/supercronic
  fi

.devpanel/custom_package_installer.sh:55

• This downloads an executable binary from the internet and installs it without any integrity verification (checksum/signature) and uses the moving latest URL. That’s a supply-chain risk for builds. Consider pinning a specific release version and validating a published SHA256 before chmod/execution.

  if ! command -v supercronic >/dev/null 2>&1; then
    curl -fsSL "https://github.com/aptible/supercronic/releases/latest/download/supercronic-linux-$(dpkg --print-architecture)" \
      -o /usr/local/bin/supercronic
    chmod +x /usr/local/bin/supercronic

.devpanel/custom_package_installer.sh:63

• runuser -u "${SUDO_USER:-$USER}" can end up starting supercronic as root in DevPanel, which would make all scheduled jobs run as root (different from the previous crontab -u www behavior) and can create root-owned files under the app (e.g., .logs/*). Start supercronic as the www user to match prior behavior and avoid privilege escalation.

    if ! pgrep -f "supercronic -inotify ${APP_ROOT}/\.devpanel/crontab" >/dev/null 2>&1; then
      echo "Starting supercronic to watch ${APP_ROOT}/.devpanel/crontab"
      runuser -u "${SUDO_USER:-$USER}" -- supercronic -inotify "$APP_ROOT/.devpanel/crontab" &
    fi

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.