@gtc6244/immediacy-daemon 0.1.0

package/dist/src/hub.js

@@ -0,0 +1,92 @@
+/**
+ * Connection hub. Single-user, but more than one device may be attached at once
+ * (phone + tablet + a desktop client), so daemon→client events broadcast to all
+ * sockets.
+ *
+ * This is also the single send seam. With E2E on, each device pairs its own
+ * keypair, so there is no one global cipher: every socket carries its OWN codec
+ * (cleartext until it completes the `hello` handshake, then a NaCl box sealed to
+ * that device's key). Sends and broadcasts therefore encode per-socket.
+ */
+import { WebSocket } from "ws";
+import { make } from "./envelope.js";
+import { clearCodec } from "./crypto.js";
+export class Hub {
+    requireSealed;
+    /** Each attached socket and the codec its frames are (de)coded with. */
+    conns = new Map();
+    /**
+     * Sockets that asked to follow the daemon log (via `log.tail`). Live
+     * `log.event` frames go only here, so a phone that never opens a log view
+     * isn't fed a firehose. Membership is dropped when the socket detaches.
+     */
+    logSubscribers = new Set();
+    /**
+     * When true (E2E on), a socket that hasn't completed the `hello` handshake is
+     * still on the cleartext codec, so fanning a broadcast out to it would leak the
+     * payload to the Cloudflare edge in clear. In that mode we skip unsealed
+     * sockets on the broadcast paths — a device receives events only once it has
+     * sealed its channel. Point-to-point handshake replies still go via `send`.
+     */
+    constructor(requireSealed = false) {
+        this.requireSealed = requireSealed;
+    }
+    /** A socket whose channel is sealed to its device key (post-`hello`). */
+    sealed(socket) {
+        return !this.requireSealed || this.conns.get(socket) !== clearCodec;
+    }
+    add(socket) {
+        // New sockets start in cleartext; the `hello` handshake upgrades them to a
+        // per-device sealed codec when E2E is on.
+        this.conns.set(socket, clearCodec);
+    }
+    remove(socket) {
+        this.conns.delete(socket);
+        this.logSubscribers.delete(socket);
+    }
+    /** Follow the live daemon log on this socket (idempotent). */
+    subscribeLog(socket) {
+        if (this.conns.has(socket))
+            this.logSubscribers.add(socket);
+    }
+    /** Push a daemon→client message to just the log subscribers. */
+    broadcastLog(type, ws, payload) {
+        if (this.logSubscribers.size === 0)
+            return;
+        const env = make(type, ws, payload);
+        for (const socket of this.logSubscribers) {
+            const codec = this.conns.get(socket);
+            if (codec && socket.readyState === WebSocket.OPEN && this.sealed(socket)) {
+                socket.send(codec.encode(env));
+            }
+        }
+    }
+    /** The codec bound to a socket (cleartext if unknown/unpaired). */
+    codecFor(socket) {
+        return this.conns.get(socket) ?? clearCodec;
+    }
+    /** Bind a socket to a codec (called once the device's key is known). */
+    setCodec(socket, codec) {
+        if (this.conns.has(socket))
+            this.conns.set(socket, codec);
+    }
+    /** Send to one socket, sealed with that socket's own codec. */
+    send(socket, env) {
+        if (socket.readyState === WebSocket.OPEN)
+            socket.send(this.codecFor(socket).encode(env));
+    }
+    /** Build + send a daemon→client message to ONE socket (per-device streams). */
+    sendTo(socket, type, ws, payload) {
+        this.send(socket, make(type, ws, payload));
+    }
+    /** Build + broadcast a daemon→client message to every attached socket. */
+    broadcast(type, ws, payload) {
+        const env = make(type, ws, payload);
+        for (const [socket, codec] of this.conns) {
+            if (socket.readyState === WebSocket.OPEN && this.sealed(socket)) {
+                socket.send(codec.encode(env));
+            }
+        }
+    }
+}
+//# sourceMappingURL=hub.js.map

package/dist/src/hub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub.js","sourceRoot":"","sources":["../../src/hub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,UAAU,EAAc,MAAM,aAAa,CAAC;AAErD,MAAM,OAAO,GAAG;IAiBM;IAhBpB,wEAAwE;IAChE,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C;;;;OAIG;IACK,cAAc,GAAG,IAAI,GAAG,EAAa,CAAC;IAE9C;;;;;;OAMG;IACH,YAAoB,gBAAgB,KAAK;QAArB,kBAAa,GAAb,aAAa,CAAQ;IAAG,CAAC;IAE7C,yEAAyE;IACjE,MAAM,CAAC,MAAiB;QAC9B,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC;IACtE,CAAC;IAED,GAAG,CAAC,MAAiB;QACnB,2EAA2E;QAC3E,0CAA0C;QAC1C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,CAAC,MAAiB;QACtB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,8DAA8D;IAC9D,YAAY,CAAC,MAAiB;QAC5B,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IAED,gEAAgE;IAChE,YAAY,CAAwB,IAAO,EAAE,EAAiB,EAAE,OAAsB;QACpF,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QACpC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,KAAK,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,QAAQ,CAAC,MAAiB;QACxB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC;IAC9C,CAAC;IAED,wEAAwE;IACxE,QAAQ,CAAC,MAAiB,EAAE,KAAY;QACtC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED,+DAA+D;IAC/D,IAAI,CAAC,MAAiB,EAAE,GAAa;QACnC,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,+EAA+E;IAC/E,MAAM,CACJ,MAAiB,EACjB,IAAO,EACP,EAAiB,EACjB,OAAsB;QAEtB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,0EAA0E;IAC1E,SAAS,CAAwB,IAAO,EAAE,EAAiB,EAAE,OAAsB;QACjF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QACpC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/src/index.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Daemon entrypoint.
+ *
+ * Env config (nothing sensitive in source):
+ *   DAEMON_PORT   default 8787       — local port cloudflared dials
+ *   DAEMON_HOST   default 127.0.0.1  — loopback for the tunnel; 0.0.0.0 to let
+ *                                      an Android emulator reach it via 10.0.2.2
+ *   AGENT_MODE    claude | mock      — real headless Claude (default) vs scripted
+ *   Provider API keys — managed live from the app (settings.set, persisted to
+ *                       ~/.immediacy/credentials.json) and also seedable from
+ *                       env: ANTHROPIC_API_KEY (Claude), OPENAI_API_KEY (Codex),
+ *                       OPENROUTER_API_KEY (OpenRouter). A stored key wins over
+ *                       env; with no key, Claude/Codex fall back to their cached
+ *                       subscription login (SSO) and OpenRouter fails auth.
+ *                       OPENROUTER_BASE_URL overrides that endpoint
+ *                       (default https://openrouter.ai/api). CREDENTIALS_FILE
+ *                       overrides the store path.
+ *   E2E           1 to enable the NaCl box layer (needs a paired peer key)
+ *   PEER_PUBLIC_KEY  base64 of the client's public key (dev pairing shortcut)
+ *   WORKTREE_ROOT, STATE_FILE, KEYS_FILE, PEER_FILE — storage overrides
+ */
+export {};

package/dist/src/index.js

@@ -0,0 +1,56 @@
+/**
+ * Daemon entrypoint.
+ *
+ * Env config (nothing sensitive in source):
+ *   DAEMON_PORT   default 8787       — local port cloudflared dials
+ *   DAEMON_HOST   default 127.0.0.1  — loopback for the tunnel; 0.0.0.0 to let
+ *                                      an Android emulator reach it via 10.0.2.2
+ *   AGENT_MODE    claude | mock      — real headless Claude (default) vs scripted
+ *   Provider API keys — managed live from the app (settings.set, persisted to
+ *                       ~/.immediacy/credentials.json) and also seedable from
+ *                       env: ANTHROPIC_API_KEY (Claude), OPENAI_API_KEY (Codex),
+ *                       OPENROUTER_API_KEY (OpenRouter). A stored key wins over
+ *                       env; with no key, Claude/Codex fall back to their cached
+ *                       subscription login (SSO) and OpenRouter fails auth.
+ *                       OPENROUTER_BASE_URL overrides that endpoint
+ *                       (default https://openrouter.ai/api). CREDENTIALS_FILE
+ *                       overrides the store path.
+ *   E2E           1 to enable the NaCl box layer (needs a paired peer key)
+ *   PEER_PUBLIC_KEY  base64 of the client's public key (dev pairing shortcut)
+ *   WORKTREE_ROOT, STATE_FILE, KEYS_FILE, PEER_FILE — storage overrides
+ */
+import { startServer } from "./server.js";
+import { loadOrCreateKeypair, loadPeers } from "./crypto.js";
+import { migrateStateDir } from "./migrate-state-dir.js";
+// Rename legacy ~/.agent-tether → ~/.immediacy before any state path is read.
+migrateStateDir();
+const port = Number(process.env.DAEMON_PORT ?? 8787);
+const host = process.env.DAEMON_HOST ?? "127.0.0.1";
+const agentMode = (process.env.AGENT_MODE ?? "claude").toLowerCase();
+const e2e = process.env.E2E === "1";
+async function resolveCrypto() {
+    if (!e2e)
+        return undefined;
+    const self = await loadOrCreateKeypair();
+    console.log(`[daemon] E2E on. Daemon public key (encode this into the pairing QR):\n  ${self.publicKey.toString("base64")}`);
+    // Devices pair themselves on connect (the `hello` handshake, gated by the
+    // Cloudflare Access token). Pre-existing pairings are just logged here.
+    const peers = await loadPeers();
+    console.log(`[daemon] ${peers.length} paired device(s); each socket seals to its own key on hello.`);
+    return { self };
+}
+const crypto = await resolveCrypto();
+const daemon = await startServer({ port, host, crypto });
+console.log(`[daemon] agent mode: ${agentMode}`);
+function shutdown(signal) {
+    console.log(`\n[daemon] ${signal} received, closing…`);
+    daemon.jobs.stop(); // cancel cron timers so nothing fires mid-teardown
+    void daemon.workspaces.shutdown().finally(() => {
+        daemon.wss.close();
+        daemon.http.close(() => process.exit(0));
+        setTimeout(() => process.exit(0), 2000).unref();
+    });
+}
+process.on("SIGINT", () => shutdown("SIGINT"));
+process.on("SIGTERM", () => shutdown("SIGTERM"));
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAgB,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,8EAA8E;AAC9E,eAAe,EAAE,CAAC;AAElB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;AACrD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC;AACpD,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;AACrE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC;AAEpC,KAAK,UAAU,aAAa;IAC1B,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,mBAAmB,EAAE,CAAC;IACzC,OAAO,CAAC,GAAG,CACT,4EAA4E,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAChH,CAAC;IACF,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,OAAO,CAAC,GAAG,CACT,YAAY,KAAK,CAAC,MAAM,+DAA+D,CACxF,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;AACrC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AAEzD,OAAO,CAAC,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;AAEjD,SAAS,QAAQ,CAAC,MAAc;IAC9B,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,qBAAqB,CAAC,CAAC;IACvD,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,mDAAmD;IACvE,KAAK,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;QAC7C,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC"}

package/dist/src/jobs/scheduler.d.ts

@@ -0,0 +1,94 @@
+/**
+ * JobScheduler — fires jobs on a schedule or reactively after a system event.
+ *
+ * Two trigger kinds (see protocol.ts):
+ *   - schedule: a croner Cron per job. If the daemon was down at fire time the
+ *     occurrence is simply missed (no catch-up).
+ *   - after:    subscribe once to the SystemEvents bus; when a matching event
+ *     lands, arm a one-shot timer for `delayMinutes`, then run.
+ *
+ * A job's action is a prompt handed to an agent, either in an existing workspace
+ * or in a throwaway ("ephemeral") one created for the run and torn down after —
+ * kept for review if the worktree ends dirty. Unattended runs are safe by
+ * construction: worktree-scoped tool calls auto-approve, anything escaping the
+ * worktree default-denies after ~2min (no phone is present to approve).
+ *
+ * Loop safety: a job never reacts to the completion of its own run (the run's
+ * jobId is suppressed for that specific agent.done), and a hard minimum interval
+ * per job backstops any pathological rapid re-trigger.
+ */
+import type { JobInput, JobRecord, JobRun } from "../protocol.js";
+import { SystemEvents } from "../events.js";
+import { JobStore } from "./store.js";
+/** The slice of WorkspaceManager the scheduler needs (keeps it decoupled/testable). */
+export interface JobRunnerHost {
+    /** Send a prompt into a workspace's agent (spawns one if needed). */
+    prompt(ws: string, text: string): void;
+    /** Does a live workspace with this id exist? */
+    has(ws: string): boolean;
+    /** Create a workspace; returns at least its id + name. */
+    create(opts: {
+        repo?: string;
+        github?: {
+            fullName: string;
+            defaultBranch?: string;
+        };
+        name?: string;
+        branchBase?: string;
+        model?: string;
+    }): Promise<{
+        id: string;
+        name: string;
+    }>;
+    /** Remove a workspace's worktree (throws if the worktree is dirty). */
+    delete(ws: string): Promise<void>;
+    /** Ahead/behind/dirty summary, or null if the workspace is gone. */
+    gitStatus(ws: string): Promise<{
+        changed: string[];
+    } | null>;
+}
+/** Broadcast a job-run lifecycle frame to connected clients. */
+export type RunBroadcaster = (run: JobRun) => void;
+export declare class JobScheduler {
+    private store;
+    private host;
+    private events;
+    private broadcast;
+    private crons;
+    /** One-shot reactive timers, so disarming a job cancels its pending fires. */
+    private timers;
+    /** Runs dispatched to a workspace, awaiting that workspace's next agent.done. */
+    private pending;
+    private lastDispatchAt;
+    private started;
+    constructor(store: JobStore, host: JobRunnerHost, events: SystemEvents, broadcast: RunBroadcaster);
+    /** Arm every enabled job and begin listening for reactive triggers. */
+    start(): void;
+    list(): JobRecord[];
+    runsFor(jobId?: string, limit?: number): JobRun[];
+    create(input: JobInput): Promise<JobRecord>;
+    update(id: string, patch: Partial<JobInput>): Promise<JobRecord>;
+    delete(id: string): Promise<boolean>;
+    /** Fire a job immediately, ignoring its trigger (job.run / CLI). */
+    runNow(id: string): Promise<void>;
+    /** Cancel every timer/cron and let the process exit cleanly. */
+    stop(): void;
+    /** (Re)arm a single job: clears any prior wiring, then sets it up if enabled. */
+    private arm;
+    /**
+     * Disable a schedule job that has no further occurrence (a spent one-shot),
+     * so it stays in the list as a completed job (with its run history) instead of
+     * lingering "enabled" and re-arming as a no-op cron on every boot.
+     */
+    private retireSpentSchedule;
+    private disarm;
+    private trackTimer;
+    private onSystemEvent;
+    /** Pop the oldest run awaiting `ws`'s completion and finalize it. */
+    private finishOldestPending;
+    private finalizeRun;
+    private runJob;
+    private resolveTarget;
+    private emitRun;
+    private recordFinal;
+}

package/dist/src/jobs/scheduler.js

@@ -0,0 +1,373 @@
+/**
+ * JobScheduler — fires jobs on a schedule or reactively after a system event.
+ *
+ * Two trigger kinds (see protocol.ts):
+ *   - schedule: a croner Cron per job. If the daemon was down at fire time the
+ *     occurrence is simply missed (no catch-up).
+ *   - after:    subscribe once to the SystemEvents bus; when a matching event
+ *     lands, arm a one-shot timer for `delayMinutes`, then run.
+ *
+ * A job's action is a prompt handed to an agent, either in an existing workspace
+ * or in a throwaway ("ephemeral") one created for the run and torn down after —
+ * kept for review if the worktree ends dirty. Unattended runs are safe by
+ * construction: worktree-scoped tool calls auto-approve, anything escaping the
+ * worktree default-denies after ~2min (no phone is present to approve).
+ *
+ * Loop safety: a job never reacts to the completion of its own run (the run's
+ * jobId is suppressed for that specific agent.done), and a hard minimum interval
+ * per job backstops any pathological rapid re-trigger.
+ */
+import { randomUUID } from "node:crypto";
+import { Cron } from "croner";
+import { logger } from "../log.js";
+/** Hard floor between two runs of the same job — backstops re-trigger loops. */
+const MIN_RUN_INTERVAL_MS = 10_000;
+export class JobScheduler {
+    store;
+    host;
+    events;
+    broadcast;
+    crons = new Map();
+    /** One-shot reactive timers, so disarming a job cancels its pending fires. */
+    timers = new Map();
+    /** Runs dispatched to a workspace, awaiting that workspace's next agent.done. */
+    pending = new Map();
+    lastDispatchAt = new Map();
+    started = false;
+    constructor(store, host, events, broadcast) {
+        this.store = store;
+        this.host = host;
+        this.events = events;
+        this.broadcast = broadcast;
+    }
+    /** Arm every enabled job and begin listening for reactive triggers. */
+    start() {
+        if (this.started)
+            return;
+        this.started = true;
+        this.events.onSystem((e) => this.onSystemEvent(e));
+        for (const job of this.store.list())
+            this.arm(job);
+    }
+    list() {
+        // Surface a live nextRunAt for schedule jobs without persisting on every tick.
+        return this.store.list().map((j) => {
+            const next = this.crons.get(j.id)?.nextRun();
+            return next ? { ...j, nextRunAt: next.getTime() } : j;
+        });
+    }
+    runsFor(jobId, limit) {
+        return this.store.runsFor(jobId, limit);
+    }
+    async create(input) {
+        validateInput(input);
+        const now = Date.now();
+        const job = {
+            id: randomUUID(),
+            name: input.name.trim() || "job",
+            prompt: input.prompt,
+            trigger: input.trigger,
+            target: input.target,
+            enabled: input.enabled ?? true,
+            createdAt: now,
+            updatedAt: now,
+        };
+        await this.store.upsert(job);
+        this.arm(job);
+        return job;
+    }
+    async update(id, patch) {
+        const existing = this.store.get(id);
+        if (!existing)
+            throw new Error(`no such job: ${id}`);
+        const next = {
+            ...existing,
+            ...("name" in patch && patch.name !== undefined ? { name: patch.name.trim() || "job" } : {}),
+            ...("prompt" in patch && patch.prompt !== undefined ? { prompt: patch.prompt } : {}),
+            ...("trigger" in patch && patch.trigger ? { trigger: patch.trigger } : {}),
+            ...("target" in patch && patch.target ? { target: patch.target } : {}),
+            ...("enabled" in patch && patch.enabled !== undefined ? { enabled: patch.enabled } : {}),
+            updatedAt: Date.now(),
+        };
+        validateInput(next);
+        await this.store.upsert(next);
+        this.arm(next); // re-arm from scratch (disarms first)
+        return next;
+    }
+    async delete(id) {
+        this.disarm(id);
+        return this.store.delete(id);
+    }
+    /** Fire a job immediately, ignoring its trigger (job.run / CLI). */
+    async runNow(id) {
+        const job = this.store.get(id);
+        if (!job)
+            throw new Error(`no such job: ${id}`);
+        await this.runJob(job, "manual");
+    }
+    /** Cancel every timer/cron and let the process exit cleanly. */
+    stop() {
+        for (const c of this.crons.values())
+            c.stop();
+        this.crons.clear();
+        for (const set of this.timers.values())
+            for (const t of set)
+                clearTimeout(t);
+        this.timers.clear();
+    }
+    // --- arming -------------------------------------------------------------
+    /** (Re)arm a single job: clears any prior wiring, then sets it up if enabled. */
+    arm(job) {
+        this.disarm(job.id);
+        if (!job.enabled)
+            return;
+        if (job.trigger.kind === "schedule") {
+            try {
+                const cron = new Cron(job.trigger.cron, { timezone: job.trigger.timezone, name: job.id }, () => {
+                    void this.runJob(job, "schedule");
+                    // A one-shot (absolute-time) schedule fires once, then has no next
+                    // occurrence — retire it so it doesn't linger "enabled" with a dead
+                    // cron and re-arm as a no-op on every daemon boot.
+                    if (this.crons.get(job.id)?.nextRun() == null) {
+                        void this.retireSpentSchedule(job.id);
+                    }
+                });
+                this.crons.set(job.id, cron);
+                // No upcoming occurrence means this schedule will never fire — a one-shot
+                // absolute time already in the past (a stale reset time, or the daemon
+                // was down at fire time). Surface it as a skipped run and retire it,
+                // rather than leaving a silent, permanently-"enabled" dead job.
+                if (cron.nextRun() == null) {
+                    this.emitRun(job, "schedule", "skipped", "scheduled time is already in the past", undefined);
+                    void this.retireSpentSchedule(job.id);
+                }
+            }
+            catch (err) {
+                logger.error("error", `failed to arm schedule for job`, {
+                    data: { job: job.name, message: err instanceof Error ? err.message : String(err) },
+                });
+            }
+        }
+        // "after" jobs need no arming here — onSystemEvent finds them by scanning
+        // the store when an event lands, so they stay correct across updates.
+    }
+    /**
+     * Disable a schedule job that has no further occurrence (a spent one-shot),
+     * so it stays in the list as a completed job (with its run history) instead of
+     * lingering "enabled" and re-arming as a no-op cron on every boot.
+     */
+    async retireSpentSchedule(jobId) {
+        const stored = this.store.get(jobId);
+        if (!stored || !stored.enabled)
+            return;
+        stored.enabled = false;
+        await this.store.upsert(stored);
+        this.disarm(jobId);
+    }
+    disarm(jobId) {
+        this.crons.get(jobId)?.stop();
+        this.crons.delete(jobId);
+        const set = this.timers.get(jobId);
+        if (set) {
+            for (const t of set)
+                clearTimeout(t);
+            this.timers.delete(jobId);
+        }
+    }
+    trackTimer(jobId, t) {
+        let set = this.timers.get(jobId);
+        if (!set)
+            this.timers.set(jobId, (set = new Set()));
+        set.add(t);
+    }
+    // --- reactive triggers & run completion ---------------------------------
+    onSystemEvent(e) {
+        // 1) A terminal agent event (done OR error) finalizes the oldest run awaiting
+        //    that workspace, and yields the jobId to suppress from re-arming on this
+        //    same event. Finalizing on error too is what stops a failed run — and its
+        //    ephemeral worktree — from dangling forever (an errored turn emits no
+        //    agent.done). agent.error is internal-only, so step 2 never matches it.
+        let finishedJobId;
+        if (e.kind === "agent.done" || e.kind === "agent.error") {
+            finishedJobId = this.finishOldestPending(e.ws, e.kind === "agent.done" ? "ok" : "error");
+        }
+        // 2) Arm any enabled "after" job whose event + workspace filter match, minus
+        //    the job that just finished here (never react to your own completion).
+        for (const job of this.store.list()) {
+            if (!job.enabled || job.trigger.kind !== "after")
+                continue;
+            if (job.trigger.event !== e.kind)
+                continue;
+            if (job.trigger.ws && job.trigger.ws !== e.ws)
+                continue;
+            if (job.id === finishedJobId)
+                continue;
+            const delayMs = Math.max(0, Math.floor(job.trigger.delayMinutes * 60_000));
+            const t = setTimeout(() => {
+                this.timers.get(job.id)?.delete(t);
+                void this.runJob(job, "after", { ...e.context, ws: e.ws });
+            }, delayMs);
+            this.trackTimer(job.id, t);
+        }
+    }
+    /** Pop the oldest run awaiting `ws`'s completion and finalize it. */
+    finishOldestPending(ws, outcome) {
+        const queue = this.pending.get(ws);
+        if (!queue || queue.length === 0)
+            return undefined;
+        const p = queue.shift();
+        if (queue.length === 0)
+            this.pending.delete(ws);
+        void this.finalizeRun(p, ws, outcome);
+        return p.jobId;
+    }
+    async finalizeRun(p, ws, outcome) {
+        const status = outcome === "error" ? "error" : "ok";
+        let message = outcome === "error" ? "agent reported an error" : "completed";
+        if (p.ephemeral) {
+            try {
+                const st = await this.host.gitStatus(ws);
+                if (st && st.changed.length > 0) {
+                    message += `; kept workspace for review (${st.changed.length} uncommitted change${st.changed.length === 1 ? "" : "s"})`;
+                }
+                else {
+                    await this.host.delete(ws);
+                    message += "; ephemeral workspace torn down";
+                }
+            }
+            catch (err) {
+                // Teardown is best-effort — keep the workspace rather than lose work.
+                message += `; teardown skipped (${errText(err)})`;
+            }
+        }
+        this.recordFinal(p.run, status, message);
+    }
+    // --- running ------------------------------------------------------------
+    async runJob(job, trigger, context) {
+        const now = Date.now();
+        const last = this.lastDispatchAt.get(job.id) ?? 0;
+        if (now - last < MIN_RUN_INTERVAL_MS) {
+            this.emitRun(job, trigger, "skipped", "throttled (min interval)", undefined);
+            return;
+        }
+        // Resolve where the run executes.
+        let ws;
+        let ephemeral = false;
+        try {
+            const resolved = await this.resolveTarget(job, context);
+            ws = resolved.ws;
+            ephemeral = resolved.ephemeral;
+        }
+        catch (err) {
+            this.emitRun(job, trigger, "skipped", errText(err), undefined);
+            return;
+        }
+        this.lastDispatchAt.set(job.id, now);
+        const run = this.emitRun(job, trigger, "started", "dispatched", ws);
+        // Queue for completion tracking, then dispatch the prompt.
+        const queue = this.pending.get(ws) ?? [];
+        queue.push({ jobId: job.id, run, ephemeral });
+        this.pending.set(ws, queue);
+        const prompt = renderPrompt(job.prompt, { ...context, ws });
+        this.host.prompt(ws, prompt);
+        // Update bookkeeping on the stored record.
+        const stored = this.store.get(job.id);
+        if (stored) {
+            stored.lastRunAt = now;
+            stored.lastStatus = "started";
+            await this.store.upsert(stored);
+        }
+    }
+    async resolveTarget(job, context) {
+        const target = job.target;
+        if (target.kind === "workspace") {
+            // For an "after" trigger, an omitted ws means "where the event fired".
+            const ws = target.ws ?? context?.ws;
+            if (!ws)
+                throw new Error("workspace target has no workspace id");
+            if (!this.host.has(ws))
+                throw new Error(`workspace ${ws} no longer exists`);
+            return { ws, ephemeral: false };
+        }
+        if (!target.repo && !target.github?.fullName) {
+            throw new Error("ephemeral target needs a repo path or a github source");
+        }
+        const rec = await this.host.create({
+            repo: target.repo,
+            github: target.github,
+            name: target.name ?? `job-${job.name}`,
+            branchBase: target.branchBase,
+            model: target.model,
+        });
+        return { ws: rec.id, ephemeral: true };
+    }
+    // --- run records --------------------------------------------------------
+    emitRun(job, trigger, status, message, ws) {
+        const run = {
+            id: randomUUID(),
+            jobId: job.id,
+            jobName: job.name,
+            ts: Date.now(),
+            status,
+            ws,
+            trigger,
+            message,
+        };
+        void this.store.appendRun(run);
+        this.broadcast(run);
+        return run;
+    }
+    recordFinal(started, status, message) {
+        const run = { ...started, id: randomUUID(), ts: Date.now(), status, message };
+        void this.store.appendRun(run);
+        this.broadcast(run);
+        const stored = this.store.get(started.jobId);
+        if (stored) {
+            stored.lastStatus = status;
+            void this.store.upsert(stored);
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+/** Substitute `{{key}}` placeholders in a prompt from the event context. */
+function renderPrompt(template, ctx) {
+    return template.replace(/\{\{\s*([\w.]+)\s*\}\}/g, (_m, key) => key in ctx ? ctx[key] : `{{${key}}}`);
+}
+/** Throw on a malformed job so create/update reject before persisting. */
+function validateInput(input) {
+    if (!input.prompt || !input.prompt.trim())
+        throw new Error("job prompt is empty");
+    const t = input.trigger;
+    if (t.kind === "schedule") {
+        validateCron(t);
+    }
+    else if (t.kind === "after") {
+        if (!Number.isFinite(t.delayMinutes) || t.delayMinutes < 0) {
+            throw new Error("delayMinutes must be a non-negative number");
+        }
+    }
+    else {
+        throw new Error("trigger.kind must be 'schedule' or 'after'");
+    }
+    const target = input.target;
+    if (target.kind === "ephemeral" && !target.repo && !target.github?.fullName) {
+        throw new Error("ephemeral target needs a repo path or a github source");
+    }
+    if (target.kind !== "workspace" && target.kind !== "ephemeral") {
+        throw new Error("target.kind must be 'workspace' or 'ephemeral'");
+    }
+}
+/** croner throws on a bad pattern; construct-and-stop to validate cheaply. */
+function validateCron(t) {
+    try {
+        const c = new Cron(t.cron, { timezone: t.timezone, paused: true });
+        c.stop();
+    }
+    catch (err) {
+        throw new Error(`invalid cron expression: ${errText(err)}`);
+    }
+}
+function errText(err) {
+    return (err instanceof Error ? err.message : String(err)).slice(0, 300);
+}
+//# sourceMappingURL=scheduler.js.map