@capybara-hq/kernel 0.1.0-rc.21 → 0.1.0-rc.22

package/dist/runtime/context/compaction.js

@@ -1,7 +1,7 @@
 import { renderBackgroundFinished } from "../../background/render.js";
 import { renderSubagentDelivery } from "../subagents/render.js";
 import { latestSummary } from "./build.js";
-import { senderTranscriptLabel } from "./run-context.js";
+import { scheduleHeader, senderTranscriptLabel } from "./run-context.js";
 import { toolsChangedText } from "./tool-changes.js";
 /** 压缩请求的标记：放在 system 中，便于识别（model-fake 据此返回摘要）。 */
 export const COMPACTION_MARKER = "CAPYBARA_COMPACTION";
@@ -106,9 +106,12 @@ function keepToolPairs(candidate, userIdx, boundary) {
 function transcriptLine(e) {
     switch (e.type) {
         case "user_message": {
-            const text = renderBlocks(e.payload.content);
-            if (!text)
+            const body = renderBlocks(e.payload.content);
+            if (!body)
                 return null;
+            // scheduled tasks spec §12: the header the request shows, so the summary keeps the origin
+            const schedule = e.payload.schedule;
+            const text = schedule === undefined ? body : `${scheduleHeader(schedule)} ${body}`;
             // run context spec §5: the sender as logged (older logs have none: unchanged)
             const sender = e.payload.sender;
             return sender !== undefined

package/dist/runtime/context/device-paths.d.ts

@@ -1,38 +1,60 @@
-import type { SandboxRoots } from "@capybara-hq/plugin-sdk";
+import type { SandboxRoots, SandboxTier } from "@capybara-hq/plugin-sdk";
 import type { ConversationEvent } from "../../conversations/events.js";
 /**
- * The `device_paths` event (environments spec §13.1, ruling R22): the first sandbox tool call
- * of every conversation records the instance's roots (the defaults included), and a later call
- * records them again whenever they differ from the conversation's latest recorded ones (a
- * connected machine's real paths, a mode switch back to the defaults). Model-visible: rendered at
- * its position as a system message; in the log, so it needs no `DriftReason`.
+ * The `device_paths` event (environments spec §13.1, ruling R22; sandbox dev tiers spec §11.5):
+ * the first sandbox tool call of every conversation records the instance's roots (the defaults
+ * included) and the device's sandbox level, and a later call records them again whenever they
+ * differ from the conversation's latest recorded ones (a connected machine's real paths, a mode
+ * switch back to the defaults, a tier or isolation change). Model-visible: rendered at its
+ * position as a system message; in the log, so it needs no `DriftReason`. Events recorded before
+ * tiers have no `tier` / `isolation` and render as they always did.
  */
-/** The system line of an `device_paths` event (model-visible, English). */
-export declare function devicePathsText(r: SandboxRoots): string;
+/** The sandbox level a device's commands run at (spec §11.5), as the model is told it. */
+export interface DeviceSandboxLevel {
+    tier: SandboxTier;
+    isolation: "sandbox" | "none";
+    /** `none`: the org's or the platform's sandbox network is off (every tier). */
+    network?: "none" | undefined;
+    /** A local device's localhost and unix sockets, as its machine reported them (absent: cloud). */
+    localhost?: "on" | "off-proxy-detected" | "off" | undefined;
+    unixSockets?: "roots" | "all-masked" | "off" | undefined;
+    /** The call is in a scheduled run without a person: nobody can approve a domain. */
+    unattended?: true | undefined;
+}
+/** The payload of a `device_paths` event; the level fields are absent on events before tiers. */
+export interface DevicePathsPayload extends Omit<DeviceSandboxLevel, "tier" | "isolation"> {
+    roots: SandboxRoots;
+    tier?: SandboxTier | undefined;
+    isolation?: "sandbox" | "none" | undefined;
+}
+/** The sandbox level line of a `device_paths` event (model-visible, English; spec §11.5). */
+export declare function sandboxLevelText(level: DeviceSandboxLevel): string;
+/** The level a payload records; undefined for an event recorded before tiers. */
+export declare function devicePathsLevel(p: DevicePathsPayload): DeviceSandboxLevel | undefined;
+/** The system message of a `device_paths` event (model-visible, English). */
+export declare function devicePathsText(p: DevicePathsPayload): string;
 /** Whether two sets of roots are the same paths. */
 export declare const sameRoots: (a: SandboxRoots, b: SandboxRoots) => boolean;
 /**
- * The idempotency key of an `device_paths` event for `r` that follows the conversation's
- * event at `prevSeq` (0: none). Unique per change (A → B → A gets three events), while parallel
- * calls that saw the same latest event write it once.
+ * The idempotency key of a `device_paths` event for `p` that follows the conversation's event at
+ * `prevSeq` (0: none). Unique per change (A → B → A gets three events), while parallel calls that
+ * saw the same latest event write it once.
  */
-export declare const devicePathsIdemKey: (r: SandboxRoots, prevSeq: number) => string;
+export declare const devicePathsIdemKey: (p: DevicePathsPayload, prevSeq: number) => string;
 /**
- * The `device_paths` event to append when a sandbox call holds an instance with `roots` and
- * the conversation's latest such event is `latest`; null when nothing changed.
+ * The `device_paths` event to append when a sandbox call holds an instance with `roots` in a
+ * device at `level`, and the conversation's latest such event is `latest`; null when nothing
+ * changed. Without a `level` (not known: test stubs, a replay of a call recorded before tiers)
+ * only the roots are compared and recorded.
  */
 export declare function devicePathsChange(latest: {
     seq: number;
-    payload: {
-        roots: SandboxRoots;
-    };
-} | undefined, roots: SandboxRoots, runId: string | undefined): {
+    payload: DevicePathsPayload;
+} | undefined, roots: SandboxRoots, runId: string | undefined, level?: DeviceSandboxLevel): {
     type: "device_paths";
     runId?: string;
     idemKey: string;
-    payload: {
-        roots: SandboxRoots;
-    };
+    payload: DevicePathsPayload;
 } | null;
 /** The latest `device_paths` event at or before `seq`; undefined without one. */
 export declare function devicePathsAt(events: readonly ConversationEvent[], seq: number): Extract<ConversationEvent, {

package/dist/runtime/context/device-paths.js

@@ -1,38 +1,121 @@
 import { createHash } from "node:crypto";
-/**
- * The `device_paths` event (environments spec §13.1, ruling R22): the first sandbox tool call
- * of every conversation records the instance's roots (the defaults included), and a later call
- * records them again whenever they differ from the conversation's latest recorded ones (a
- * connected machine's real paths, a mode switch back to the defaults). Model-visible: rendered at
- * its position as a system message; in the log, so it needs no `DriftReason`.
- */
-/** The system line of an `device_paths` event (model-visible, English). */
-export function devicePathsText(r) {
-    return `This device's directories: workspace ${r.workspace}, skills ${r.skills} (read only), temporary files ${r.tmp}. Use these paths in commands and tool calls.`;
+/** The roots line of a `device_paths` event (model-visible, English). */
+const rootsText = (r) => `This device's directories: workspace ${r.workspace}, skills ${r.skills} (read only), temporary files ${r.tmp}. Use these paths in commands and tool calls.`;
+const TIER_NAMES = {
+    strict: "strict",
+    dev: "development",
+    open: "open",
+};
+/** What a domain outside the reachable ones needs: the user's approval, unless nobody is there. */
+const otherDomains = (unattended) => unattended
+    ? "approvals are not available in a scheduled run, so other domains stay blocked."
+    : "other domains need the user's approval.";
+/** Local servers and unix sockets in `dev` / `open` (a cloud instance has both). */
+function localText(level) {
+    const { localhost, unixSockets } = level;
+    if (localhost === undefined || unixSockets === undefined) {
+        return "Local servers and unix sockets work.";
+    }
+    const servers = localhost === "on"
+        ? "Local servers work"
+        : localhost === "off-proxy-detected"
+            ? "Local servers are blocked on this machine because a local proxy was detected (the user can allow them on the device)"
+            : "Local servers are blocked";
+    const sockets = unixSockets === "roots"
+        ? "unix sockets work under the device's directories only"
+        : unixSockets === "all-masked"
+            ? "unix sockets work inside the device's container only"
+            : "unix sockets are blocked";
+    return `${servers}; ${sockets}.`;
+}
+/** The sandbox level line of a `device_paths` event (model-visible, English; spec §11.5). */
+export function sandboxLevelText(level) {
+    if (level.isolation === "none") {
+        return "Sandbox level: open, without a sandbox. Commands run directly on the user's computer as the user, with their files, credentials and network; be careful with anything that deletes files or sends data out.";
+    }
+    const head = `Sandbox level: ${TIER_NAMES[level.tier]}.`;
+    if (level.network === "none") {
+        return `${head} The network is switched off for this organization: no domain is reachable and approval requests cannot change that.`;
+    }
+    const unattended = level.unattended === true;
+    switch (level.tier) {
+        case "strict":
+            return `${head} Only the organization's allowed domains are reachable; ${otherDomains(unattended)}`;
+        case "dev":
+            return `${head} Package registries and common developer hosts are reachable; ${otherDomains(unattended)} ${localText(level)}`;
+        case "open":
+            return `${head} Any public address is reachable. ${localText(level)}`;
+    }
 }
+/** The level a payload records; undefined for an event recorded before tiers. */
+export function devicePathsLevel(p) {
+    if (p.tier === undefined)
+        return undefined;
+    return {
+        tier: p.tier,
+        isolation: p.isolation ?? "sandbox",
+        ...(p.network !== undefined && { network: p.network }),
+        ...(p.localhost !== undefined && { localhost: p.localhost }),
+        ...(p.unixSockets !== undefined && { unixSockets: p.unixSockets }),
+        ...(p.unattended === true && { unattended: true }),
+    };
+}
+/** The system message of a `device_paths` event (model-visible, English). */
+export function devicePathsText(p) {
+    const roots = rootsText(p.roots);
+    const level = devicePathsLevel(p);
+    return level === undefined ? roots : `${roots}\n${sandboxLevelText(level)}`;
+}
+/** The fields of a level, in a fixed order (absent ones left out). */
+const levelKey = (l) => l === undefined
+    ? []
+    : [
+        l.tier,
+        l.isolation,
+        ...(l.network !== undefined ? [`network:${l.network}`] : []),
+        ...(l.localhost !== undefined ? [`localhost:${l.localhost}`] : []),
+        ...(l.unixSockets !== undefined ? [`unixSockets:${l.unixSockets}`] : []),
+        ...(l.unattended === true ? ["unattended"] : []),
+    ];
 /** Whether two sets of roots are the same paths. */
 export const sameRoots = (a, b) => a.workspace === b.workspace && a.skills === b.skills && a.tmp === b.tmp;
 /**
- * The idempotency key of an `device_paths` event for `r` that follows the conversation's
- * event at `prevSeq` (0: none). Unique per change (A → B → A gets three events), while parallel
- * calls that saw the same latest event write it once.
+ * The idempotency key of a `device_paths` event for `p` that follows the conversation's event at
+ * `prevSeq` (0: none). Unique per change (A → B → A gets three events), while parallel calls that
+ * saw the same latest event write it once.
  */
-export const devicePathsIdemKey = (r, prevSeq) => `device_paths:${createHash("sha256")
-    .update(JSON.stringify([r.workspace, r.skills, r.tmp]))
+export const devicePathsIdemKey = (p, prevSeq) => `device_paths:${createHash("sha256")
+    .update(JSON.stringify([
+    p.roots.workspace,
+    p.roots.skills,
+    p.roots.tmp,
+    ...levelKey(devicePathsLevel(p)),
+]))
     .digest("hex")
     .slice(0, 16)}:${prevSeq}`;
 /**
- * The `device_paths` event to append when a sandbox call holds an instance with `roots` and
- * the conversation's latest such event is `latest`; null when nothing changed.
+ * The `device_paths` event to append when a sandbox call holds an instance with `roots` in a
+ * device at `level`, and the conversation's latest such event is `latest`; null when nothing
+ * changed. Without a `level` (not known: test stubs, a replay of a call recorded before tiers)
+ * only the roots are compared and recorded.
  */
-export function devicePathsChange(latest, roots, runId) {
-    if (latest && sameRoots(latest.payload.roots, roots))
+export function devicePathsChange(latest, roots, runId, level) {
+    if (latest &&
+        sameRoots(latest.payload.roots, roots) &&
+        (level === undefined ||
+            JSON.stringify(levelKey(devicePathsLevel(latest.payload))) ===
+                JSON.stringify(levelKey(level)))) {
         return null;
+    }
+    const payload = {
+        roots: { workspace: roots.workspace, skills: roots.skills, tmp: roots.tmp },
+        ...(level !== undefined && devicePathsLevel({ roots, ...level })),
+    };
     return {
         type: "device_paths",
         ...(runId !== undefined && { runId }),
-        idemKey: devicePathsIdemKey(roots, latest?.seq ?? 0),
-        payload: { roots: { workspace: roots.workspace, skills: roots.skills, tmp: roots.tmp } },
+        idemKey: devicePathsIdemKey(payload, latest?.seq ?? 0),
+        payload,
     };
 }
 /** The latest `device_paths` event at or before `seq`; undefined without one. */

package/dist/runtime/context/run-context.d.ts

@@ -16,6 +16,15 @@ export declare const RUN_CONTEXT_DESCRIPTION_MAX = 200;
 export declare const SENDER_NAME_MAX = 80;
 /** A sender's name as logged: one line, at most {@link SENDER_NAME_MAX} code points. */
 export declare const sanitizeSenderName: (name: string) => string;
+/**
+ * The English header of a scheduled task's message (scheduled tasks spec §12):
+ * `[Scheduled task "<name>", run for <local time>]`, from the marker fields fixed in the log, so a
+ * later rename of the task never changes a rebuilt request. The name is one line, JSON-quoted.
+ */
+export declare const scheduleHeader: (m: {
+    taskName: string;
+    localTime: string;
+}) => string;
 /** An agent's description as a snapshot carries it; empty → undefined. */
 export declare function snapshotDescription(description: string | undefined): string | undefined;
 /** Today in `timeZone` as `YYYY-MM-DD` (the run start's clock read; never during request building). */

package/dist/runtime/context/run-context.js

@@ -16,6 +16,14 @@ function oneLine(text, max, ellipsis) {
 }
 /** A sender's name as logged: one line, at most {@link SENDER_NAME_MAX} code points. */
 export const sanitizeSenderName = (name) => oneLine(name, SENDER_NAME_MAX, false);
+/** The longest task name a schedule header shows, in code points. */
+const SCHEDULE_NAME_MAX = 200;
+/**
+ * The English header of a scheduled task's message (scheduled tasks spec §12):
+ * `[Scheduled task "<name>", run for <local time>]`, from the marker fields fixed in the log, so a
+ * later rename of the task never changes a rebuilt request. The name is one line, JSON-quoted.
+ */
+export const scheduleHeader = (m) => `[Scheduled task ${JSON.stringify(oneLine(m.taskName, SCHEDULE_NAME_MAX, true))}, run for ${oneLine(m.localTime, 64, false)}]`;
 /** An agent's description as a snapshot carries it; empty → undefined. */
 export function snapshotDescription(description) {
     if (description === undefined)

package/dist/runtime/context/skills.d.ts

@@ -37,9 +37,22 @@ export declare const SKILL_TEXTS: SkillTexts;
 export declare const SKILLS_CATALOG_HEADER: string;
 /** 目录里每个技能描述最多的码点数（超出确定地截断；`Skill` 仍返回完整正文）。 */
 export declare const CATALOG_DESCRIPTION_MAX_CHARS = 300;
+/** 一行：`- <name>: <description>`（描述折叠成一行并截断）。 */
+export declare const catalogLine: (s: Pick<CatalogSkill, "name" | "description">) => string;
+/**
+ * The heading of the name-only entries of a listing (skills default-on spec §7): the entries a
+ * snapshot recorded past the catalog budget (`nameOnly`). Every listing (the system catalog, a
+ * change notice's new or updated skills, the current catalog after a compaction) puts them after
+ * its described lines under this heading, names in code point order joined by ", ". Introduced
+ * with phase 2: no request before it has a name-only entry, so the legacy texts need no copy.
+ */
+export declare const MORE_SKILLS_HEADER: string;
 /** 第一份目录（进 system 缓存段），按名字排序。 */
 export declare function skillsCatalogText(skills: readonly CatalogSkill[], texts?: SkillTexts): string;
-/** 两份快照是否相同（按 id、版本、名字、描述与来源）。顺序无关。 */
+/**
+ * 两份快照是否相同（按 id、版本、名字、描述与来源）。顺序无关。 Also by `nameOnly` (absent = false):
+ * an entry crossing the catalog budget writes a new snapshot and reads as updated.
+ */
 export declare function sameSkills(a: readonly CatalogSkill[], b: readonly CatalogSkill[]): boolean;
 /**
  * Two pinned lists are the same: id, version and source in order (absent = []). Bodies follow the

package/dist/runtime/context/skills.js

@@ -28,13 +28,40 @@ function shortDescription(d) {
         : `${cps.slice(0, CATALOG_DESCRIPTION_MAX_CHARS - 1).join("")}…`;
 }
 /** 一行：`- <name>: <description>`（描述折叠成一行并截断）。 */
-const line = (s) => `- ${s.name}: ${shortDescription(s.description)}`;
-const lines = (skills) => [...skills].sort(byName).map(line).join("\n");
+export const catalogLine = (s) => `- ${s.name}: ${shortDescription(s.description)}`;
+/**
+ * The heading of the name-only entries of a listing (skills default-on spec §7): the entries a
+ * snapshot recorded past the catalog budget (`nameOnly`). Every listing (the system catalog, a
+ * change notice's new or updated skills, the current catalog after a compaction) puts them after
+ * its described lines under this heading, names in code point order joined by ", ". Introduced
+ * with phase 2: no request before it has a name-only entry, so the legacy texts need no copy.
+ */
+export const MORE_SKILLS_HEADER = `More skills (names only; call ${SKILL_LOAD} with the name to read one):`;
+/**
+ * The listing of `skills`: the described ones as `- <name>: <description>` lines sorted by name,
+ * then the name-only ones under {@link MORE_SKILLS_HEADER}. Without name-only entries (every
+ * snapshot before phase 2) it is exactly the described lines, as before.
+ */
+function lines(skills) {
+    const described = skills.filter((s) => s.nameOnly !== true);
+    const nameOnly = skills.filter((s) => s.nameOnly === true);
+    const head = [...described].sort(byName).map(catalogLine).join("\n");
+    if (nameOnly.length === 0)
+        return head;
+    const more = `${MORE_SKILLS_HEADER}\n${[...nameOnly]
+        .sort(byName)
+        .map((s) => s.name)
+        .join(", ")}`;
+    return head === "" ? more : `${head}\n${more}`;
+}
 /** 第一份目录（进 system 缓存段），按名字排序。 */
 export function skillsCatalogText(skills, texts = SKILL_TEXTS) {
     return `${texts.skillsCatalogHeader}\n${lines(skills)}`;
 }
-/** 两份快照是否相同（按 id、版本、名字、描述与来源）。顺序无关。 */
+/**
+ * 两份快照是否相同（按 id、版本、名字、描述与来源）。顺序无关。 Also by `nameOnly` (absent = false):
+ * an entry crossing the catalog budget writes a new snapshot and reads as updated.
+ */
 export function sameSkills(a, b) {
     if (a.length !== b.length)
         return false;
@@ -47,7 +74,8 @@ export function sameSkills(a, b) {
             p.version === s.version &&
             p.name === s.name &&
             p.description === s.description &&
-            p.source === s.source);
+            p.source === s.source &&
+            (p.nameOnly ?? false) === (s.nameOnly ?? false));
     });
 }
 /**
@@ -94,7 +122,10 @@ function catalogChanges(prev, next, pinnedIds) {
         return (p !== undefined &&
             p.name === s.name &&
             !pinnedIds?.has(s.id) &&
-            (p.version !== s.version || p.description !== s.description || p.source !== s.source));
+            (p.version !== s.version ||
+                p.description !== s.description ||
+                p.source !== s.source ||
+                (p.nameOnly ?? false) !== (s.nameOnly ?? false)));
     });
     return { added, updated, removed };
 }

package/dist/runtime/maintenance.d.ts

@@ -5,6 +5,7 @@ import { ScheduledRuns } from "../infra/schedule/scheduled-runs.js";
 import type { KernelLogger } from "../log.js";
 import { DirectorySync } from "../orgs/directory-sync.js";
 import { SandboxService } from "../sandbox/sandbox.service.js";
+import { ScheduledTaskFirer } from "../schedules/fire.js";
 import { ToolDrift } from "../tools/drift.js";
 import { RunQueue } from "./run-queue.js";
 import { Waits } from "./waits.js";
@@ -16,7 +17,7 @@ export declare const MAINTENANCE_CONCURRENCY = 5;
  * each one-off job by name to its domain (`wait-timeout` → {@link Waits}, `sandbox-destroy-for` and
  * `sandbox-reset-files` → {@link SandboxService}, `drift-connector` → {@link ToolDrift}, `directory-sync` →
  * {@link DirectorySync}, `bg-wake` → {@link RunQueue.ensureRun}, `owned-plugin-cleanup` →
- * {@link OwnedPluginCleanup}). The name of a periodic job (a `@LockedCron` / `@LockedInterval` job,
+ * {@link OwnedPluginCleanup}, `sched-fire` → {@link ScheduledTaskFirer}). The name of a periodic job (a `@LockedCron` / `@LockedInterval` job,
  * such as `sandbox-suspend-idle`) runs that job's body once ({@link ScheduledRuns.runNow}), as the
  * maintenance handlers did when those jobs were schedulers on this queue: an operator's or a
  * test's one-off run, not a second schedule (decision R23 of the Nest kernel spec). Any other
@@ -29,10 +30,11 @@ export declare class MaintenanceProcessor extends WorkerHost<Worker> {
     private readonly directory;
     private readonly runs;
     private readonly ownedCleanup;
+    private readonly scheduledTasks;
     private readonly scheduled;
     private readonly log;
     private readonly queue;
-    constructor(waits: Pick<Waits, "processTimeout">, sandbox: Pick<SandboxService, "destroyDevice" | "resetFileSystem">, drift: Pick<ToolDrift, "check">, directory: Pick<DirectorySync, "runSyncJob">, runs: Pick<RunQueue, "ensureRun">, ownedCleanup: Pick<OwnedPluginCleanup, "run">, scheduled: Pick<ScheduledRuns, "runNow">, log: Pick<KernelLogger, "error" | "warn">, queue: Pick<Queue, "removeJobScheduler">);
+    constructor(waits: Pick<Waits, "processTimeout">, sandbox: Pick<SandboxService, "destroyDevice" | "resetFileSystem">, drift: Pick<ToolDrift, "check">, directory: Pick<DirectorySync, "runSyncJob">, runs: Pick<RunQueue, "ensureRun">, ownedCleanup: Pick<OwnedPluginCleanup, "run">, scheduledTasks: Pick<ScheduledTaskFirer, "fire">, scheduled: Pick<ScheduledRuns, "runNow">, log: Pick<KernelLogger, "error" | "warn">, queue: Pick<Queue, "removeJobScheduler">);
     /**
      * Removes the retired job schedulers (`RETIRED_SCHEDULER_IDS`, runtime/retired-schedulers.ts): every fixed-period
      * maintenance job is a `@LockedCron` / `@LockedInterval` now. Idempotent; called once when a

package/dist/runtime/maintenance.js

@@ -24,6 +24,8 @@ import { OrgsModule } from "../orgs/orgs.module.js";
 import { runSandboxDestroyFor, runSandboxResetFiles, SANDBOX_DESTROY_FOR_JOB, SANDBOX_RESET_FILES_JOB, } from "../sandbox/jobs.js";
 import { SandboxModule } from "../sandbox/sandbox.module.js";
 import { SandboxService } from "../sandbox/sandbox.service.js";
+import { ScheduledTaskFireModule, ScheduledTaskFirer } from "../schedules/fire.js";
+import { SCHED_FIRE_JOB } from "../schedules/job-ids.js";
 import { ToolDrift } from "../tools/drift.js";
 import { DRIFT_CONNECTOR_JOB } from "../tools/job-ids.js";
 import { ToolsModule } from "../tools/tools.module.js";
@@ -40,7 +42,7 @@ export const MAINTENANCE_CONCURRENCY = 5;
  * each one-off job by name to its domain (`wait-timeout` → {@link Waits}, `sandbox-destroy-for` and
  * `sandbox-reset-files` → {@link SandboxService}, `drift-connector` → {@link ToolDrift}, `directory-sync` →
  * {@link DirectorySync}, `bg-wake` → {@link RunQueue.ensureRun}, `owned-plugin-cleanup` →
- * {@link OwnedPluginCleanup}). The name of a periodic job (a `@LockedCron` / `@LockedInterval` job,
+ * {@link OwnedPluginCleanup}, `sched-fire` → {@link ScheduledTaskFirer}). The name of a periodic job (a `@LockedCron` / `@LockedInterval` job,
  * such as `sandbox-suspend-idle`) runs that job's body once ({@link ScheduledRuns.runNow}), as the
  * maintenance handlers did when those jobs were schedulers on this queue: an operator's or a
  * test's one-off run, not a second schedule (decision R23 of the Nest kernel spec). Any other
@@ -53,10 +55,11 @@ let MaintenanceProcessor = class MaintenanceProcessor extends WorkerHost {
     directory;
     runs;
     ownedCleanup;
+    scheduledTasks;
     scheduled;
     log;
     queue;
-    constructor(waits, sandbox, drift, directory, runs, ownedCleanup, scheduled, log, queue) {
+    constructor(waits, sandbox, drift, directory, runs, ownedCleanup, scheduledTasks, scheduled, log, queue) {
         super();
         this.waits = waits;
         this.sandbox = sandbox;
@@ -64,6 +67,7 @@ let MaintenanceProcessor = class MaintenanceProcessor extends WorkerHost {
         this.directory = directory;
         this.runs = runs;
         this.ownedCleanup = ownedCleanup;
+        this.scheduledTasks = scheduledTasks;
         this.scheduled = scheduled;
         this.log = log;
         this.queue = queue;
@@ -113,6 +117,10 @@ let MaintenanceProcessor = class MaintenanceProcessor extends WorkerHost {
             case OWNED_PLUGIN_CLEANUP_JOB:
                 await this.ownedCleanup.run(job.data.itemId);
                 return;
+            // one task run of a scheduled task (scheduled tasks spec §6)
+            case SCHED_FIRE_JOB:
+                await this.scheduledTasks.fire(job.data.taskRunId);
+                return;
             default:
                 if (await this.scheduled.runNow(job.name))
                     return;
@@ -140,9 +148,10 @@ MaintenanceProcessor = __decorate([
     __param(3, Inject(DirectorySync)),
     __param(4, Inject(RunQueue)),
     __param(5, Inject(OwnedPluginCleanup)),
-    __param(6, Inject(ScheduledRuns)),
-    __param(7, Inject(KERNEL_LOGGER)),
-    __param(8, Inject(getQueueToken(MAINTENANCE_QUEUE_NAME)))
+    __param(6, Inject(ScheduledTaskFirer)),
+    __param(7, Inject(ScheduledRuns)),
+    __param(8, Inject(KERNEL_LOGGER)),
+    __param(9, Inject(getQueueToken(MAINTENANCE_QUEUE_NAME)))
 ], MaintenanceProcessor);
 export { MaintenanceProcessor };
 /**
@@ -164,6 +173,8 @@ MaintenanceModule = __decorate([
             OrgsModule,
             // the removed org plugins' cleanup and its daily sweep (worker-only through this module)
             OwnedPluginCleanupModule,
+            // the scheduled task fire job and the scanner (worker-only through this module)
+            ScheduledTaskFireModule,
             QueueModule.registerQueue(MAINTENANCE_QUEUE_NAME),
         ],
         providers: [

package/dist/runtime/run-finish.d.ts

@@ -1,6 +1,7 @@
 import { type AppendEvent, EventLog } from "../conversations/event-log.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
+import { ScheduledTaskRunTracker } from "../schedules/run-tracker.js";
 /** 运行的终态。 */
 export type TerminalStatus = "completed" | "failed" | "aborted";
 export declare const TERMINAL_STATUSES: ReadonlySet<string>;
@@ -31,7 +32,11 @@ export declare class RunFinish {
     private readonly kdb;
     private readonly eventLog;
     readonly txHost: TransactionHost;
-    constructor(kdb: KernelDb, eventLog: EventLog, txHost: TransactionHost);
+    /** A scheduled task's run follows its kernel run's end in the same transaction (spec §6). */
+    private readonly taskRuns;
+    constructor(kdb: KernelDb, eventLog: EventLog, txHost: TransactionHost, 
+    /** A scheduled task's run follows its kernel run's end in the same transaction (spec §6). */
+    taskRuns: Pick<ScheduledTaskRunTracker, "onRunFinished">);
     /**
      * 在调用方的事务内写运行的终态：会话行锁 → 运行仍未结束才写终态事件、推进 `consumed_seq`、更新 `runs.status`。
      * 返回终态事件的 seq；运行已是终态（例如已被其他副本标记失败）→ 返回 null，什么都不写。

package/dist/runtime/run-finish.js

@@ -14,6 +14,7 @@ import { pauseQueueIn } from "../conversations/queue.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
+import { ScheduledTaskRunTracker } from "../schedules/run-tracker.js";
 export const TERMINAL_STATUSES = new Set([
     "completed",
     "failed",
@@ -27,10 +28,14 @@ let RunFinish = class RunFinish {
     kdb;
     eventLog;
     txHost;
-    constructor(kdb, eventLog, txHost) {
+    taskRuns;
+    constructor(kdb, eventLog, txHost, 
+    /** A scheduled task's run follows its kernel run's end in the same transaction (spec §6). */
+    taskRuns) {
         this.kdb = kdb;
         this.eventLog = eventLog;
         this.txHost = txHost;
+        this.taskRuns = taskRuns;
     }
     /**
      * 在调用方的事务内写运行的终态：会话行锁 → 运行仍未结束才写终态事件、推进 `consumed_seq`、更新 `runs.status`。
@@ -76,6 +81,7 @@ let RunFinish = class RunFinish {
             .set({ status: a.status, finished_at: sql `now()` })
             .where("id", "=", a.runId)
             .execute();
+        await this.taskRuns.onRunFinished(a.runId, a.status, failureMessage(a.event));
         // a failed or stopped run pauses the queued messages until the person resumes (spec §5.7)
         if (a.status !== "completed")
             await pauseQueueIn(t, a.conversationId);
@@ -102,9 +108,17 @@ RunFinish = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),
     __param(1, Inject(EventLog)),
-    __param(2, Inject(TransactionHost))
+    __param(2, Inject(TransactionHost)),
+    __param(3, Inject(ScheduledTaskRunTracker))
 ], RunFinish);
 export { RunFinish };
+/** The message of a `run_failed` event's error, for the task run (undefined otherwise). */
+function failureMessage(event) {
+    if (event.type !== "run_failed")
+        return undefined;
+    const m = event.payload?.error?.message;
+    return typeof m === "string" ? m : undefined;
+}
 /**
  * After a terminal event committed: notify the log, and for a failed or stopped run also send
  * `changed: queue` (the queue may have paused).

package/dist/runtime/run-queue.js

@@ -22,6 +22,8 @@ import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KernelEvents } from "../infra/events/kernel-events.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { linkStartedRunIn, unlinkRunIn } from "../schedules/run-tracker.js";
+import { scheduledTaskRunAt } from "../schedules/unattended.js";
 import { ToolPipeline } from "../tools/pipeline.js";
 import { KyselyCheckpointSaver } from "./checkpointer.js";
 import { ConversationLock } from "./conversation-lock.js";
@@ -364,6 +366,9 @@ let RunQueue = class RunQueue {
         if (agent.deleted_at !== null)
             return null;
         const runId = randomUUID();
+        // scheduled tasks spec §4: a task's message makes the run unattended; a wake inherits it
+        // from the run that produced its event; a person's message never does
+        const taskRunId = await scheduledTaskRunAt(t, conversationId, trigger.seq);
         await t
             .insertInto("runs")
             .values({
@@ -376,8 +381,12 @@ let RunQueue = class RunQueue {
             // a chat conversation always has its person-triggered run before any wake (a wake event
             // comes from a run of it or of its tree); null would only make the wake run its own window
             budget_run_id: isWake ? await budgetWindowOf(t, conversationId) : null,
+            scheduled_task_run_id: taskRunId,
         })
             .execute();
+        // the task run its message started follows this run from now on (spec §6)
+        if (taskRunId !== null)
+            await linkStartedRunIn(t, taskRunId, runId, conversationId);
         return { runId, jobId, kind: "chat" };
     }
     /**
@@ -460,6 +469,8 @@ let RunQueue = class RunQueue {
             trigger_account_id: wake.triggerAccountId,
             trigger_seq: wake.seq,
             budget_run_id: await budgetWindowOf(t, rootId),
+            // a parent's message or a wake: unattended when the run behind it was (scheduled tasks §4)
+            scheduled_task_run_id: await scheduledTaskRunAt(t, conversationId, wake.seq),
         })
             .execute();
         return { runId, jobId, kind: "subagent" };
@@ -706,11 +717,16 @@ let RunQueue = class RunQueue {
             .catch((err) => this.log.warn("checkpoint delete failed", { runId, err }));
     }
     async deleteQueued(runId) {
-        await this.db
+        const gone = await this.db
             .deleteFrom("runs")
             .where("id", "=", runId)
             .where("status", "=", "queued")
-            .execute();
+            .returning("scheduled_task_run_id")
+            .executeTakeFirst();
+        // its scheduled task run waits for the message's next run again
+        if (gone?.scheduled_task_run_id != null) {
+            await unlinkRunIn(this.db, gone.scheduled_task_run_id, runId);
+        }
     }
 };
 __decorate([
@@ -722,6 +738,9 @@ __decorate([
 __decorate([
     Transactional({ propagation: "requires_new" })
 ], RunQueue.prototype, "repairOrphanIn", null);
+__decorate([
+    Transactional()
+], RunQueue.prototype, "deleteQueued", null);
 RunQueue = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),