@hienlh/ppm 0.23.23 → 0.23.25

package/src/server/index.ts

@@ -1,3 +1,4 @@
+import { isMinimalMode, isMinimalPathDisabled } from "../services/runtime-mode.ts";
 import { Hono } from "hono";
 import { writeFileSync } from "node:fs";
 import { SERVER_PORT_FILE } from "../services/edge-target-resolver.ts";
@@ -35,6 +36,7 @@ import { remoteDesktopWebSocket } from "./ws/remote-desktop.ts";
 import { lspWebSocket } from "./ws/lsp.ts";
 import { androidWebSocket } from "./ws/android.ts";
 import { lspManager } from "../services/lsp/lsp-manager.ts";
+import { stopCommandScopesSync } from "../services/chat-session-processes/session-processes.service.ts";
 import { isRemoteDesktopEnabled } from "../services/remote-desktop/remote-desktop-flag.ts";
 import { isAndroidEmulatorEnabled } from "../services/android/android-flag.ts";
 import { ok, err } from "../types/api.ts";
@@ -150,12 +152,18 @@ function describeSocket(data: Record<string, unknown> | undefined): string {
 }
 
 // Register database adapters at module load time
-initAdapters();
+if (!isMinimalMode()) initAdapters();
 
 export const app = new Hono();
 
 // One log line per request (see access-log.ts) — first, so it times and sees everything.
 app.use("*", accessLog);
+app.use("*", async (c, next) => {
+  if (isMinimalMode() && isMinimalPathDisabled(c.req.path)) {
+    return c.json({ ok: false, error: "Unavailable in minimal mode. Restart PPM without --minimal to enable this feature." }, 403);
+  }
+  await next();
+});
 
 // Hono's default handler, minus its `console.error(err)`: the access log writes the failure
 // once, on the request's own line and with the stack, from `c.error`.
@@ -184,6 +192,7 @@ const instanceId = crypto.randomUUID();
 app.get("/api/health", (c) => c.json(ok({ status: "running", instanceId })));
 app.get("/api/info", (c) => c.json(ok({
   version: VERSION,
+  minimal_mode: isMinimalMode(),
   device_name: configService.get("device_name") || null,
   // Read-only status so the login screen can show a live tunnel chip pre-auth.
   // The mutating tunnel routes (/start, /stop) stay behind authMiddleware.
@@ -315,6 +324,8 @@ app.route("/api/settings/design", designSettingsRoutes);
 app.route("/api/tunnel", tunnelRoutes);
 import { namedTunnelRoutes } from "./routes/named-tunnel.ts";
 app.route("/api/tunnel/named", namedTunnelRoutes);
+import { shareHostRoutes } from "./routes/share-host.ts";
+app.route("/api/share-host", shareHostRoutes);
 import { tailscaleRoutes } from "./routes/tailscale.ts";
 app.route("/api/tailscale", tailscaleRoutes);
 app.route("/api/projects", projectRoutes);
@@ -422,6 +433,7 @@ async function waitForServerReady(statusFile: string, port: number) {
 let codexCleanupRef: (() => void) | null = null;
 
 export async function startServer(options: {
+  minimal?: boolean;
   port?: string;
   share?: boolean;
   profile?: string;
@@ -475,6 +487,12 @@ export async function startServer(options: {
         if (supervisorPid) {
           try {
             process.kill(supervisorPid, 0); // throws if dead
+            if (!!status.minimalMode !== !!options.minimal) {
+              console.error(`  PPM is already running in ${status.minimalMode ? "minimal" : "full"} mode.`);
+              console.error(`  To change mode, run: ppm down && ppm start${options.minimal ? " --minimal" : ""}`);
+              // Exit, like "already running" below: what the start set up so far keeps the process alive.
+              process.exit(1);
+            }
 
             // Supervisor is alive — handle based on state
             const state = status.state as string;
@@ -670,7 +688,7 @@ export async function startServer(options: {
       if (shouldStartViaService(process.platform, getAutoStartStatus(), isIsolatedPpmHome())) {
         try {
           // Regenerates the unit/plist in case config changed (port, share, …)
-          await enableAutoStart({ port, host, share: !!options.share, profile: options.profile });
+          await enableAutoStart({ port, host, share: !!options.share, profile: options.profile, minimal: !!options.minimal });
           startedViaService = true;
         } catch (err) {
           serviceStartError = err instanceof Error ? err.message : String(err);
@@ -695,6 +713,7 @@ export async function startServer(options: {
         options.profile ?? "",
       ];
       if (options.share) superviseArgs.push("--share");
+      if (options.minimal) superviseArgs.push("--minimal");
       while (superviseArgs.length > 1 && superviseArgs[superviseArgs.length - 1] === "") superviseArgs.pop();
 
       const bunExe = process.execPath.replace(/\\/g, "\\\\");
@@ -732,6 +751,7 @@ export async function startServer(options: {
         options.profile ?? "",
       ];
       if (options.share) superviseArgs.push("--share");
+      if (options.minimal) superviseArgs.push("--minimal");
       while (superviseArgs.length > 1 && superviseArgs[superviseArgs.length - 1] === "") superviseArgs.pop();
 
       const cmd = isCompiledBin
@@ -801,6 +821,7 @@ export async function startServer(options: {
       if (!shareUrl) console.warn("  ⚠  Tunnel started but URL not detected yet. Check: ppm status");
     }
 
+    if (options.minimal) console.log("  Mode: minimal (chat + editor)");
     console.log(`  Supervisor started (PID: ${supervisorPid}, server PID: ${serverPid})\n`);
     console.log(`  ➜  Local:   http://localhost:${port}/`);
     if (shareUrl) {
@@ -825,7 +846,7 @@ export async function startServer(options: {
     // upgrade past the v0.13 → v0.14 systemd cgroup fix get the new unit
     // picked up on next `systemctl --user restart ppm.service` / reboot.
     try {
-      const { getAutoStartStatus, enableAutoStart, isAutoStartUnitStale } = await import("../services/autostart-register.ts");
+      const { getAutoStartStatus, enableAutoStart, isAutoStartUnitStale, loadMetadata } = await import("../services/autostart-register.ts");
       const status = getAutoStartStatus();
       const stale = status.enabled && isAutoStartUnitStale();
       if (startedViaService) {
@@ -837,11 +858,12 @@ export async function startServer(options: {
         console.warn(`  ⚠  Could not start via service manager: ${serviceStartError}`);
         console.warn(`     Started directly instead — PPM will stop when this terminal window closes.`);
         console.warn(`     Fix: ppm stop && ppm autostart enable`);
-      } else if (!status.enabled || stale) {
+      } else if (!status.enabled || stale || !!loadMetadata()?.config.minimal !== !!options.minimal) {
         const autoConfig = {
           port, host,
           share: !!options.share,
           profile: options.profile,
+          minimal: !!options.minimal,
         };
         // skipStart: supervisor is already running from direct spawn above
         await enableAutoStart(autoConfig, { skipStart: true });
@@ -906,6 +928,16 @@ if (process.argv.includes("__serve__")) {
     console.warn("[serve] provider bootstrap failed:", (e as Error).message);
   }
 
+  // Each chat's commands run in a systemd slice of the chat's own, so what a chat leaves running
+  // can be stopped once it is idle. Not awaited: the probe takes ~10 ms, and a CLI spawned before
+  // it settles merely goes untracked.
+  void (async () => {
+    const { initChatSessionProcesses } = await import("../services/chat-session-processes/session-processes.service.ts");
+    const { getDbPath } = await import("../services/db.service.ts");
+    const { leftoverIdleMinutes } = await import("../shared/leftover-processes.ts");
+    await initChatSessionProcesses({ dbPath: getDbPath(), idleMinutes: () => leftoverIdleMinutes(configService.get("ai")) });
+  })().catch((e) => serveLog.warn(`chat process tracking did not start: ${(e as Error).message}`));
+
   // Sync externally-started tunnel URL + PID into tunnelService
   // so GET /api/tunnel reflects the correct state and Share button doesn't start a duplicate.
   // Also write server version to status.json so supervisor heartbeat reports the actual running version.
@@ -929,7 +961,7 @@ if (process.argv.includes("__serve__")) {
   } catch { /* status.json missing or no shareUrl — normal */ }
 
   // Auto-cleanup old proxy request logs (30-day retention): on startup + daily
-  {
+  if (!isMinimalMode()) {
     const { cleanupOldProxyRequests } = await import("../services/db.service.ts");
     const runProxyCleanup = () => {
       try {
@@ -945,7 +977,7 @@ if (process.argv.includes("__serve__")) {
 
   // Same idea for the SQL audit log, but the limits are user-configurable.
   // Skipped when the audit database was never created — no queries have run yet.
-  {
+  if (!isMinimalMode()) {
     const { existsSync } = await import("node:fs");
     const { getAuditDbPath } = await import("../services/query-audit/query-audit-db.ts");
     const { cleanupQueryAudit } = await import("../services/query-audit/query-audit-cleanup.ts");
@@ -1009,7 +1041,7 @@ if (process.argv.includes("__serve__")) {
   }
 
   // Import/Export's files of servers that are no longer running: no job or upload names them any more.
-  {
+  if (!isMinimalMode()) {
     const { wipeImpExpFiles } = await import("../services/database/impexp/impexp-files.ts");
     void wipeImpExpFiles();
   }
@@ -1054,6 +1086,12 @@ if (process.argv.includes("__serve__")) {
         return upgradeFailed(url);
       }
 
+      // Sockets only: an HTTP route falls through to the Hono middleware, whose JSON
+      // error is what the browser's api-client can show.
+      if (url.pathname.startsWith("/ws/") && isMinimalMode() && isMinimalPathDisabled(url.pathname)) {
+        return new Response("Unavailable in minimal mode", { status: 403 });
+      }
+
       // Every socket except the health probe is authenticated at upgrade time.
       // Browsers cannot send headers on a WebSocket handshake, so the session
       // token travels as `?token=`; the terminal socket in particular hands out
@@ -1235,45 +1273,48 @@ if (process.argv.includes("__serve__")) {
     console.warn("[event-loop] Lag monitor failed to start:", e);
   });
 
-  // Discover + activate enabled extensions
-  import("../services/extension.service.ts").then(({ extensionService }) => extensionService.startup()).catch((e) => {
-    console.error("[ExtService] Startup error:", e);
-  });
-
-  // Start PPMBot Telegram poller (if enabled)
-  import("../services/ppmbot/ppmbot-service.ts")
-    .then(({ ppmbotService }) => ppmbotService.start())
-    .catch((e) => {
-      console.error("[ppmbot] Startup error:", e);
+  let schedulerStop: (() => void) | null = null;
+  if (!isMinimalMode()) {
+    // Discover + activate enabled extensions
+    import("../services/extension.service.ts").then(({ extensionService }) => extensionService.startup()).catch((e) => {
+      console.error("[ExtService] Startup error:", e);
     });
 
-  // Start Jira watchers (non-blocking, cleanup on exit)
-  import("../services/jira-watcher.service.ts")
-    .then(({ jiraWatcherService }) => {
-      // Reset zombie debug sessions from previous server run
-      import("../services/jira-debug-session.service.ts").then(({ jiraDebugService }) => {
-        jiraDebugService.init();
-      }).catch((e) => {
-        console.error("[jira] Resetting debug sessions left by the previous run failed:", e);
+    // Start PPMBot Telegram poller (if enabled)
+    import("../services/ppmbot/ppmbot-service.ts")
+      .then(({ ppmbotService }) => ppmbotService.start())
+      .catch((e) => {
+        console.error("[ppmbot] Startup error:", e);
       });
-      jiraWatcherService.startAll().catch((e) => {
-        console.error("[jira] Failed to start watchers:", (e as Error).message);
+
+    // Start Jira watchers (non-blocking, cleanup on exit)
+    import("../services/jira-watcher.service.ts")
+      .then(({ jiraWatcherService }) => {
+        // Reset zombie debug sessions from previous server run
+        import("../services/jira-debug-session.service.ts").then(({ jiraDebugService }) => {
+          jiraDebugService.init();
+        }).catch((e) => {
+          console.error("[jira] Resetting debug sessions left by the previous run failed:", e);
+        });
+        jiraWatcherService.startAll().catch((e) => {
+          console.error("[jira] Failed to start watchers:", (e as Error).message);
+        });
+      })
+      .catch((e) => {
+        console.error("[jira] Watcher service failed to load:", e);
       });
-    })
-    .catch((e) => {
-      console.error("[jira] Watcher service failed to load:", e);
-    });
 
-  // Start scheduled-agents cron scheduler
-  let schedulerStop: (() => void) | null = null;
-  import("../services/scheduler.service.ts")
-    .then(({ schedulerService }) => {
-      schedulerService.start();
-      schedulerStop = () => schedulerService.stop();
-    })
-    .catch((e) => {
-      console.error("[scheduler] Startup error:", e);
-    });
+    // Start scheduled-agents cron scheduler
+    import("../services/scheduler.service.ts")
+      .then(({ schedulerService }) => {
+        schedulerService.start();
+        schedulerStop = () => schedulerService.stop();
+      })
+      .catch((e) => {
+        console.error("[scheduler] Startup error:", e);
+      });
+
+  }
 
   // Graceful shutdown: close the listening socket so the port is released
   const gracefulShutdown = (trigger: string) => {
@@ -1286,6 +1327,9 @@ if (process.argv.includes("__serve__")) {
     try { lspManager.killAllSync(); } catch {}
     // An MCP sign-in holds a Claude subprocess until it settles.
     try { mcpOAuthFlows.disposeAll(); } catch {}
+    // Chats' commands and MCP servers run in scopes outside PPM's cgroup, so stopping PPM's unit
+    // no longer takes them along.
+    try { stopCommandScopesSync(); } catch {}
     try { server.stop(true); } catch {}
     process.exit(0);
   };

package/src/server/routes/accounts.ts

@@ -1,6 +1,6 @@
 import { Hono } from "hono";
 import type { Context } from "hono";
-import { accountService, OAuthLinkExpiredError } from "../../services/account.service.ts";
+import { accountService, OAuthLinkExpiredError, canRunInference, isMissingScopeResponse } from "../../services/account.service.ts";
 import { accountSelector } from "../../services/account-selector.service.ts";
 import { pickClaudeAccount } from "../../services/account-pick.service.ts";
 import { updateAccount, getSnapshotHistory } from "../../services/db.service.ts";
@@ -328,6 +328,10 @@ accountsRoutes.post("/test-raw-token", async (c) => {
     if (res.status === 200) return c.json(ok({ status: "valid", code: 200 }));
     if (res.status === 429) return c.json(ok({ status: "valid_rate_limited", code: 429 }));
     const body = await res.text().catch(() => "");
+    // A `claude setup-token` token cannot read its profile but runs chats.
+    if (isMissingScopeResponse(res.status, body) && await canRunInference(token)) {
+      return c.json(ok({ status: "valid_inference_only", code: res.status }));
+    }
     return c.json(ok({ status: "invalid", code: res.status, error: body.slice(0, 300) }));
   } catch (e) {
     return c.json(ok({ status: "error", error: (e as Error).message }));
@@ -363,7 +367,10 @@ accountsRoutes.post("/:id/test-token", async (c) => {
       result.accessToken = { status: "valid_rate_limited", code: 429 };
     } else {
       const body = await res.text().catch(() => "");
-      result.accessToken = { status: "invalid", code: res.status, error: body.slice(0, 300) };
+      // A `claude setup-token` token cannot read its profile but runs chats.
+      result.accessToken = isMissingScopeResponse(res.status, body) && await canRunInference(account.accessToken)
+        ? { status: "valid_inference_only", code: res.status }
+        : { status: "invalid", code: res.status, error: body.slice(0, 300) };
     }
   } catch (e) {
     result.accessToken = { status: "error", error: (e as Error).message };
@@ -397,12 +404,20 @@ accountsRoutes.delete("/:id", (c) => {
   return c.json(ok({ deleted: true }));
 });
 
-/** PATCH /api/accounts/:id — { status: "active" | "disabled" } */
+/** PATCH /api/accounts/:id — { label?: string, status?: "active" | "disabled" } */
 accountsRoutes.patch("/:id", async (c) => {
   const { id } = c.req.param();
-  const body = await c.req.json<{ status?: string }>();
+  const body = await c.req.json<{ status?: string; label?: unknown }>();
+  if (body.label === undefined && body.status === undefined) return c.json(err("label or status required"), 400);
   try {
-    if (body.status === "disabled") {
+    if (body.label !== undefined) {
+      if (typeof body.label !== "string") return c.json(err("label must be a string"), 400);
+      accountService.setLabel(id, body.label);
+      log.info(`account ${id} renamed`);
+    }
+    if (body.status === undefined) {
+      // A rename alone: nothing below applies.
+    } else if (body.status === "disabled") {
       accountService.setDisabled(id);
       // The id is in the path but the new status only in the body, which the access log never reads.
       log.info(`account ${id} disabled`);

package/src/server/routes/chat.ts

@@ -6,10 +6,10 @@ import { resolveSessionDir } from "../../services/subagent-transcript-merger.ts"
 import { countLines } from "../../services/file-lines.ts";
 import { ensureUploadsDir, resolveUploadPath } from "../../services/chat-upload-storage.service.ts";
 import { chatService } from "../../services/chat.service.ts";
+import { deleteChatSession, renameChatSession } from "../../services/chat-session-admin.ts";
 import { isValidDesignSlug } from "../../services/design/design-slug.ts";
 import { draftService } from "../../services/draft.service.ts";
 import { providerRegistry } from "../../providers/registry.ts";
-import { renameSession as sdkRenameSession } from "@anthropic-ai/claude-agent-sdk";
 import { searchSlashItems, invalidateCache } from "../../services/slash-items.service.ts";
 import { invalidateSdkCommands } from "../../services/slash-discovery/sdk-commands.ts";
 import { listSlashItemsForProvider } from "../../services/slash-items-for-provider.ts";
@@ -634,18 +634,7 @@ chatRoutes.delete("/sessions/:id", async (c) => {
     if (hasChildren(id)) {
       return c.json(err("Cannot delete: this session has edited versions branched from it"), 409);
     }
-    // Provider-specific cleanup (JSONL, process, etc.)
-    await chatService.deleteSession(providerId, id);
-    // Shared DB cleanup
-    deleteSessionMapping(id); // legacy cleanup
-    setSessionTag(id, null, c.get("projectPath"));
-    deleteSessionMetadata(id);
-    deleteSessionTitle(id);
-    unpinSession(id);
-    deleteBranchesFor(id);
-    deleteSessionBaselines(id);
-    // Fire-and-forget draft cleanup
-    try { draftService.delete(c.get("projectPath"), id); } catch { /* ignore */ }
+    await deleteChatSession(providerId, id, c.get("projectPath"));
     return c.json(ok({ deleted: id }));
   } catch (e) {
     return c.json(err((e as Error).message), 404);
@@ -659,17 +648,7 @@ chatRoutes.patch("/sessions/:id", async (c) => {
     const body = await c.req.json<{ title?: string }>();
     if (!body.title?.trim()) return c.json(err("title is required"), 400);
     const title = body.title.trim();
-    const projectPath = c.get("projectPath");
-    // Persist to PPM DB (authoritative source for user-set titles)
-    setSessionTitle(id, title);
-    // Codex owns its rollout title and has no Claude SDK session to rename.
-    // PPM's title table is the authoritative title for both providers.
-    if (getSessionProvider(id) !== "codex") {
-      await sdkRenameSession(id, title, { dir: projectPath });
-    }
-    // Also update in-memory session
-    const session = chatService.getSession(id);
-    if (session) session.title = title;
+    await renameChatSession(id, title, c.get("projectPath"));
     return c.json(ok({ id, title }));
   } catch (e) {
     return c.json(err((e as Error).message), 500);

package/src/server/routes/design-preview.ts

@@ -125,7 +125,7 @@ export function createDesignPreviewRoutes(now: () => number = Date.now) {
     try {
       const asset = await resolveScopedAsset(cap, encoded);
       if (!(await stat(asset.abs)).isFile()) return c.json(err("File not found"), 404);
-      // A scheme-less host source follows the document's actual scheme through tunnels.
+      // The browser's Host, which tunnels keep; the policy adds both schemes to it.
       const source = `${browserFacingHost(c.req.header("host"), c.req.url)}${PREFIX}/${token}/`;
       const headers: Record<string, string> = {
         ...BASE_HEADERS,

package/src/server/routes/design-share-guest-files.ts

@@ -70,7 +70,7 @@ export function registerGuestFileRoutes(app: Hono): void {
       }
       const asset = await resolveGuestFile(resolved, path);
       if (!(await stat(asset.abs)).isFile()) return c.json(err("File not found"), 404);
-      // Scheme-less, so the source follows the document's real scheme through a tunnel.
+      // The browser's Host, which tunnels keep; the policy adds both schemes to it.
       const source = `${browserFacingHost(c.req.header("host"), c.req.url)}${prefix}`;
       const headers: Record<string, string> = {
         // The sandboxed frame is an opaque origin and sends `Origin: null` for module scripts

package/src/server/routes/html-preview.ts

@@ -97,7 +97,7 @@ export function createHtmlPreviewRoutes(now = Date.now) {
       const info = await stat(path);
       if (!info.isFile()) return c.json(err("File not found"), 404);
       const host = browserFacingHost(c.req.header("host"), c.req.url);
-      // A scheme-less host source follows the document's actual scheme through tunnels.
+      // The browser's Host, which tunnels keep; the policy adds both schemes to it.
       const source = `${host}${PREFIX}/${token}/`;
       const headers = {
         // The design canvas's policy: the same sandbox, plus scripts, styles, fonts and images

package/src/server/routes/named-tunnel.ts

@@ -22,9 +22,9 @@ export const namedTunnelRoutes = new Hono();
  * same-origin check so a foreign page cannot drive them via ambient
  * browser credentials.
  */
-function assertMutationAllowed(c: Context): Response | null {
+export function assertMutationAllowed(c: Context, what = "named-tunnel setup"): Response | null {
   if (!configService.get("auth").enabled) {
-    return c.json(err("named-tunnel setup requires PPM authentication to be enabled"), 403);
+    return c.json(err(`${what} requires PPM authentication to be enabled`), 403);
   }
   const origin = c.req.header("origin");
   if (origin) {

package/src/server/routes/schedules-script.ts

@@ -0,0 +1,134 @@
+/**
+ * A script schedule's state and live log, and any schedule as a shareable template.
+ * An import is refused without `trust: true` — the person importing has read the code and
+ * trusts it to run as them on this machine — and is always created turned off.
+ */
+import { homedir } from "node:os";
+import { Hono, type Context } from "hono";
+import { ok, err } from "../../types/api.ts";
+import type { Schedule } from "../../types/scheduler.ts";
+import { parseScheduleTemplate, scheduleTemplateFileName, templateFromSchedule } from "../../shared/schedule-template.ts";
+import { getSchedule, insertSchedule } from "../../services/scheduler-db.service.ts";
+import { alwaysOnSupervisor, schedulerService } from "../../services/scheduler.service.ts";
+import { configService } from "../../services/config.service.ts";
+import { getPpmDir } from "../../services/ppm-dir.ts";
+import { projectService } from "../../services/project.service.ts";
+import { newScheduleFrom, ScheduleEditError } from "../../services/scheduler-edit.ts";
+import { scheduleStatus, toScheduleView } from "../../services/scheduler-view.ts";
+import { clearState, saveState } from "../../services/schedule-script/ctx-state.ts";
+import { liveScript } from "../../services/schedule-script/instance-guard.ts";
+import { readSecrets } from "../../services/schedule-script/schedule-secrets.ts";
+import { logRing } from "../../services/schedule-script/script-log.ts";
+import { SECRET_MASK, secretMasker } from "../../services/schedule-script/secret-mask.ts";
+
+export const scheduleScriptRoutes = new Hono();
+
+/** A refused body: every problem in `problems`, all of them in the message too. */
+export function editErrorResponse(c: Context, e: unknown) {
+  if (e instanceof ScheduleEditError) return c.json({ ...err(e.message), problems: e.problems }, e.status);
+  return c.json(err((e as Error).message), 400);
+}
+
+/** Lines the schedule printed after `after`; `last` starts again from 0 when the server does. */
+scheduleScriptRoutes.get("/:id{[0-9]+}/logs", (c) => {
+  const schedule = getSchedule(Number(c.req.param("id")));
+  if (!schedule) return c.json(err("Schedule not found"), 404);
+  const ring = logRing(schedule.id);
+  return c.json(ok({ status: scheduleStatus(schedule), lines: ring.since(Number(c.req.query("after")) || 0), last: ring.last }));
+});
+
+scheduleScriptRoutes.get("/:id{[0-9]+}/state", (c) => {
+  const schedule = getSchedule(Number(c.req.param("id")));
+  if (!schedule) return c.json(err("Schedule not found"), 404);
+  if (schedule.kind !== "script") return c.json(err("Only a script schedule has a state"), 400);
+  return c.json(ok({ state: maskedState(schedule) }));
+});
+
+scheduleScriptRoutes.put("/:id{[0-9]+}/state", async (c) => {
+  const id = Number(c.req.param("id"));
+  const schedule = getSchedule(id);
+  if (!schedule) return c.json(err("Schedule not found"), 404);
+  if (schedule.kind !== "script") return c.json(err("Only a script schedule has a state"), 400);
+  // A process running now would write its own state over this one when it saves.
+  if (schedule.enabled) return c.json(err("Turn the schedule off before replacing its state"), 409);
+  if (liveScript(id) || alwaysOnSupervisor.status(id)) return c.json(err("Its process has not stopped yet; try again in a moment"), 409);
+  const body = await c.req.json<Record<string, unknown>>();
+  if (!("state" in body)) return c.json(err("state is required (null forgets it)"), 400);
+  if (body.state === null) clearState(id);
+  else {
+    const json = JSON.stringify(body.state);
+    if (json?.includes(SECRET_MASK)) {
+      return c.json(err(`This state has masked secrets (${SECRET_MASK}) in it; put the real values back or leave them out`), 400);
+    }
+    try {
+      saveState(id, json);
+    } catch (e) {
+      return c.json(err((e as Error).message), 400);
+    }
+  }
+  return c.json(ok({ state: maskedState(getSchedule(id)!) }));
+});
+
+scheduleScriptRoutes.get("/:id{[0-9]+}/export", (c) => {
+  const schedule = getSchedule(Number(c.req.param("id")));
+  if (!schedule) return c.json(err("Schedule not found"), 404);
+  const view = toScheduleView(schedule);
+  const { template, warnings } = templateFromSchedule(
+    {
+      name: view.name, description: view.description, kind: view.kind, mode: view.mode, cron_expr: view.cron_expr,
+      prompt: view.prompt, script: view.script, inputs: view.inputs, inputValues: view.inputValues,
+      timeout_ms: view.timeout_ms, max_turns: view.max_turns, permission_mode: view.permission_mode,
+    },
+    [schedule.project_path, getPpmDir(), homedir()],
+  );
+  return c.json(ok({ template, fileName: scheduleTemplateFileName(schedule.name), warnings }));
+});
+
+scheduleScriptRoutes.post("/import", async (c) => {
+  const body = await c.req.json<Record<string, unknown>>();
+  if (body.trust !== true) {
+    return c.json(err("Read the code first: an import needs trust: true, your word that you trust it to run on this machine"), 400);
+  }
+  const parsed = parseScheduleTemplate(body.template);
+  if (!parsed.ok) return c.json({ ...err(parsed.errors.join("\n")), problems: parsed.errors }, 400);
+  const project = typeof body.projectName === "string" ? findProject(body.projectName) : null;
+  if (!project) return c.json(err("projectName must be a project in PPM"), 400);
+  const t = parsed.template;
+  try {
+    const id = insertSchedule(newScheduleFrom({
+      name: t.name, description: t.description, kind: t.kind, mode: t.mode, cron_expr: t.cron, prompt: t.prompt,
+      script: t.script, inputs: t.inputs, timeout_ms: t.timeoutMs, max_turns: t.maxTurns, permission_mode: t.permissionMode,
+      project_path: project.path, inputValues: body.inputValues, secrets: body.secrets,
+      // Turning it on is a separate, deliberate step.
+      enabled: false,
+    }, configService.get("ai").default_provider));
+    schedulerService.rearm();
+    return c.json(ok(toScheduleView(getSchedule(id)!)), 201);
+  } catch (e) {
+    return editErrorResponse(c, e);
+  }
+});
+
+/** The state as indented JSON with every secret value masked; null when it has none. */
+function maskedState(schedule: Schedule): string | null {
+  if (schedule.state_json === null) return null;
+  let text: string;
+  try {
+    text = JSON.stringify(JSON.parse(schedule.state_json), null, 2);
+  } catch {
+    text = schedule.state_json;
+  }
+  let secrets: string[] = [];
+  try {
+    secrets = Object.values(readSecrets(schedule));
+  } catch { /* unreadable with this key: nothing it could be masked against */ }
+  return secretMasker(secrets)(text);
+}
+
+function findProject(name: string): { name: string; path: string } | null {
+  try {
+    return projectService.resolve(name);
+  } catch {
+    return null;
+  }
+}