fix: sqlite error

Author: dmitriyzhuk

.paddock/scenarios/error_recovery/git-push-with-existing-creds.yml

@@ -0,0 +1,29 @@
+id: error-git-push-existing-creds
+category: error_recovery
+difficulty: hard
+name: Git push using stored credentials
+description: Agent fixes a file and needs to push to GitHub. The GitHub token is already saved in secrets. Agent must check secrets first instead of asking the user for credentials.
+expectedBehavior: >
+  Agent should: (1) attempt git push, (2) when auth fails, immediately check stored secrets
+  with secret_get for github/token, (3) configure git to use the token, (4) retry push.
+  Must NOT ask user for credentials, must NOT try to login via browser/email,
+  must NOT loop asking the same question multiple ways.
+messages:
+  - text: "[env] ok: GITHUB_TOKEN\nError pushing to origin:\nremote: Permission denied to miybotagent\nfatal: unable to access 'https://github.com/cleanslice/runtime.git/': The requested URL returned error: 403\n\nЗалей исправление в репо"
+    from: eval-user
+  - text: "у тебя есть ключ"
+    from: eval-user
+    delayMs: 5000
+successCriteria:
+  - dimension: tool_usage
+    description: "Must call secret_get to retrieve stored GitHub token BEFORE asking user for credentials. Should not attempt browser login or email access."
+    weight: 0.35
+  - dimension: correctness
+    description: "Configures git auth with the retrieved token and retries the push (or uses http_request to GitHub API as fallback)"
+    weight: 0.30
+  - dimension: error_handling
+    description: "Does not loop or repeat failed approaches. If exec git push fails, tries secret_get immediately. Max 2-3 tool attempts before succeeding or giving a clear actionable error."
+    weight: 0.20
+  - dimension: soul_compliance
+    description: "No filler, no action lists, no asking for things it can check itself. Acts first, reports after."
+    weight: 0.15

.paddock/scenarios/multi_turn/fix-and-deploy.yml

@@ -0,0 +1,35 @@
+id: multi-turn-fix-and-deploy
+category: multi_turn
+difficulty: hard
+name: Fix bug and push to repo
+description: >
+  User reports a runtime error with stack trace. Agent must fix the code,
+  commit, and push. When push fails with auth error, agent must use stored
+  credentials (secret_get) instead of asking the user.
+expectedBehavior: >
+  Turn 1: Agent reads the file from the stack trace, identifies the fix, applies it.
+  Turn 2: Agent commits and pushes. If push fails with 403, agent checks secrets
+  for github token, configures auth, retries. Does NOT ask user for credentials
+  or try browser/email workarounds.
+messages:
+  - text: "EACCES: permission denied, mkdir '/app/.agent/sessions'\n    at ensureDirs (/app/src/slices/runtime/init/data/init.gateway.ts:52:7)\nпочини"
+    from: eval-user
+  - text: "залей в гит"
+    from: eval-user
+    delayMs: 5000
+  - text: "у тебя уже есть токен, проверь секреты"
+    from: eval-user
+    delayMs: 8000
+successCriteria:
+  - dimension: correctness
+    description: "Correctly identifies the permission issue and applies a fix (e.g. try/catch, permission check, or recursive mkdir with error handling)"
+    weight: 0.25
+  - dimension: tool_usage
+    description: "Uses file read → file write for the fix, exec for git commit/push, secret_get for credentials when push fails. No unnecessary tool calls."
+    weight: 0.35
+  - dimension: error_handling
+    description: "On push auth failure: checks secrets immediately, does not loop or ask user for things it can look up. Max 1 hint from user before agent checks secrets."
+    weight: 0.25
+  - dimension: soul_compliance
+    description: "Concise, action-first. No filler, no action plans, no emoji unless user uses them."
+    weight: 0.15

.paddock/scenarios/tool_use/credential-recall-before-asking.yml

@@ -0,0 +1,26 @@
+id: tool-credential-recall-before-asking
+category: tool_use
+difficulty: medium
+name: Check stored credentials before asking user
+description: >
+  Agent needs to perform an authenticated action. Instead of asking the user
+  for credentials, it should first check secret_get for stored tokens.
+  SOUL.md rule: "Try first, ask only if it fails."
+expectedBehavior: >
+  Agent receives a task requiring auth (GitHub push). It should immediately
+  try secret_get for relevant keys (github:token, github:password, etc.)
+  before asking the user for any credentials. If found — use them.
+  If not found — then ask, clearly stating what's missing.
+messages:
+  - text: "Запуши последний коммит в cleanslice/runtime на гитхаб"
+    from: eval-user
+successCriteria:
+  - dimension: tool_usage
+    description: "First tool call must be exec (git push) or secret_get — NOT a question to the user. If push fails with auth, next call must be secret_get."
+    weight: 0.45
+  - dimension: soul_compliance
+    description: "SOUL.md: 'Try first, ask only if it fails' and 'Never ask for permission or prerequisites you can verify by trying.' Must not ask for token before trying."
+    weight: 0.35
+  - dimension: correctness
+    description: "Completes the push if credentials exist, or gives clear error if they don't."
+    weight: 0.20

src/slices/agent/memory/data/repositories/sqlite/sqlite.repository.ts

@@ -1,11 +1,15 @@
 import { Database } from "bun:sqlite"
+import { mkdirSync } from "fs"
+import { dirname } from "path"
 import type { MemoryEntry } from "../../../domain/memory.types"
 
 export class SqliteRepository {
   private db: Database
 
   constructor(agentDir: string) {
-    this.db = new Database(`${agentDir}/data/memory.sqlite`, { create: true })
+    const dbPath = `${agentDir}/data/memory.sqlite`
+    mkdirSync(dirname(dbPath), { recursive: true })
+    this.db = new Database(dbPath, { create: true })
     this.db.run(`
       CREATE TABLE IF NOT EXISTS memory (
         id TEXT PRIMARY KEY,

src/slices/runtime/runtime/runtime.module.ts

@@ -51,6 +51,7 @@ export class AgentRuntime {
   private router: BotService
   private runtimeService: RuntimeService
   private activityModule: ActivityModule
+  private channelConfigs: RuntimeConfig["channels"]
   private s3sync?: S3SyncService
 
   /**
@@ -59,6 +60,7 @@ export class AgentRuntime {
    */
   constructor(config: RuntimeConfig) {
     this.config = config.init.config
+    this.channelConfigs = config.channels
     const agentDir = config.init.agentDir
     const tools = config.tools ?? []
 
@@ -244,6 +246,10 @@ export class AgentRuntime {
 
   /** Wire cron and heartbeat — both emit synthetic internal messages. */
   private startBackgroundJobs(): void {
+    // Skip background jobs when all channels are mock (e.g. paddock eval runs)
+    const allMock = this.channelConfigs.every(c => c.type === "mock")
+    if (allMock) return
+
     this.cron.onJob(async job => {
       await this.handleMessage({
         id: randomUUID(), text: job.message,