@hienlh/ppm 0.23.23 → 0.23.25

package/src/services/scheduler-core.ts

@@ -1,62 +1,94 @@
-/** Scheduler core: 60s tick, concurrency guard, run lifecycle.
+/** Scheduler core: a timer armed for the next due schedule, concurrency guard, run lifecycle.
  * Runner is constructor-injected so tests instantiate with mocks (no module mocking),
  * and importing this module never pulls the chat/provider/SDK chain. */
-import { Cron } from "croner";
 import {
   getSchedules,
   getSchedule,
   getDueSchedules,
+  getEarliestFireAt,
   updateSchedule,
   insertScheduleRun,
   updateScheduleRun,
   cleanupScheduleRuns,
 } from "./scheduler-db.service.ts";
-import type { Schedule, RunResult } from "../types/scheduler.ts";
+import type { AlwaysOnScripts, Schedule, SchedulerRunner } from "../types/scheduler.ts";
 import { createLogger } from "./logger.ts";
+import { executePromptRun } from "./scheduler-prompt-run.ts";
+import { MAX_SLEEP_MS, nextFireAt, wakeDelay } from "./scheduler-timing.ts";
 
-const log = createLogger("scheduler");
+export { nextFireAt, wakeDelay };
+export type { AlwaysOnScripts, SchedulerRunner };
 
-const TICK_MS = 60_000;
+const log = createLogger("scheduler");
 
-export interface SchedulerRunner {
-  ensureScheduleSession(schedule: Schedule): Promise<string>;
-  runScheduleOnce(schedule: Schedule, sessionId: string): Promise<RunResult>;
-}
-
-export function nextFireAt(cronExpr: string): string | null {
-  return new Cron(cronExpr).nextRun()?.toISOString() ?? null;
-}
+/** A script tick asked to run while its previous one still is: two at once never run. */
+export class ScheduleBusyError extends Error {}
 
 export class SchedulerService {
-  private tickTimer: ReturnType<typeof setInterval> | null = null;
+  private timer: ReturnType<typeof setTimeout> | null = null;
+  private started = false;
+  private ready: Promise<void> = Promise.resolve();
   // Refcount, not a Set: run-now can overlap a tick-run for the same id, and the
   // first finisher must not drop the guard while the second is still executing.
   private active = new Map<number, number>();
 
-  constructor(private runner: SchedulerRunner) {}
+  constructor(private runner: SchedulerRunner, private alwaysOn: AlwaysOnScripts) {}
 
   start(): void {
-    if (this.tickTimer) return;
+    if (this.started) return;
+    this.started = true;
     cleanupScheduleRuns();
     // Recompute next_fire_at from now — missed runs during downtime are not caught up
     for (const s of getSchedules(true)) {
+      if (s.mode !== "tick") continue;
       try {
         updateSchedule(s.id, { next_fire_at: nextFireAt(s.cron_expr) });
       } catch (e) {
         log.warn(`invalid cron for schedule ${s.id} (${s.name}): ${(e as Error).message}`);
       }
     }
-    this.tickTimer = setInterval(() => this.tick(), TICK_MS);
+    this.ready = this.alwaysOn.prepare()
+      .catch((e) => log.error("settling script processes left by the previous server failed:", e))
+      .then(() => this.alwaysOn.sync());
+    this.arm();
     log.info("started");
   }
 
   stop(): void {
-    if (this.tickTimer) { clearInterval(this.tickTimer); this.tickTimer = null; log.info("stopped"); }
-    // In-flight runs finish naturally
+    if (!this.started) return;
+    this.started = false;
+    if (this.timer) { clearTimeout(this.timer); this.timer = null; }
+    this.alwaysOn.stopAll("PPM stopped");
+    log.info("stopped");
+    // In-flight prompt runs finish naturally; script processes die with PPM's stdin.
+  }
+
+  /** Look again at the schedules as saved — after anything that may have changed them. */
+  rearm(): void {
+    if (!this.started) return;
+    this.arm();
+    void this.ready.then(() => this.alwaysOn.sync());
   }
 
+  /** Sleep until the earliest due schedule, a minute at most, then tick and arm again. */
+  private arm(): void {
+    if (this.timer) clearTimeout(this.timer);
+    let delay = MAX_SLEEP_MS;
+    try {
+      delay = wakeDelay(getEarliestFireAt());
+    } catch (e) {
+      log.warn(`could not read when the next schedule is due: ${(e as Error).message}`);
+    }
+    this.timer = setTimeout(() => {
+      this.timer = null;
+      this.tick();
+      if (this.started) this.arm();
+    }, delay);
+  }
+
+  /** A tick run in progress, or an always-on process running. */
   isRunning(id: number): boolean {
-    return (this.active.get(id) ?? 0) > 0;
+    return (this.active.get(id) ?? 0) > 0 || this.alwaysOn.isRunning(id);
   }
 
   listActive(): number[] {
@@ -73,7 +105,11 @@ export class SchedulerService {
       return;
     }
     for (const schedule of due) {
+      this.advance(schedule);
+      if (schedule.mode !== "tick") continue;
       if (this.isRunning(schedule.id)) {
+        // A script ticking every few seconds would bury its history under these rows.
+        if (schedule.kind === "script") continue;
         log.info(`skipped ${schedule.id} (${schedule.name}) — previous run still active`);
         const runId = insertScheduleRun(schedule.id, schedule.session_id, "skipped");
         updateScheduleRun(runId, { ended_at: new Date().toISOString() });
@@ -83,69 +119,80 @@ export class SchedulerService {
     }
   }
 
-  /** Start one run. Creates the run row synchronously; execution is fire-and-forget. `trigger` is for the log line. */
-  fire(schedule: Schedule, trigger = "tick"): number {
+  /**
+   * Move a due schedule on to its next fire before it runs. Left in the past for as long as the
+   * run lasts, it would be "due" at every wake-up, and the timer would wake at once each time.
+   * A cron that no longer parses gets no next fire, so it stops being due rather than spinning.
+   */
+  private advance(schedule: Schedule): void {
+    let next: string | null = null;
+    try {
+      if (schedule.mode === "tick") next = nextFireAt(schedule.cron_expr);
+    } catch (e) {
+      log.warn(`invalid cron for schedule ${schedule.id} (${schedule.name}): ${(e as Error).message}`);
+    }
+    try {
+      updateSchedule(schedule.id, { next_fire_at: next });
+    } catch (e) {
+      log.warn(`failed to advance schedule ${schedule.id}: ${(e as Error).message}`);
+    }
+  }
+
+  /** Start one run, fire-and-forget. A prompt's run row is made here; a script tick makes its own at the end, if any. */
+  fire(schedule: Schedule, trigger = "tick"): number | null {
     this.active.set(schedule.id, (this.active.get(schedule.id) ?? 0) + 1);
+    if (schedule.kind === "script") {
+      log.debug(`Schedule ${schedule.id} (${schedule.name}) fired (${trigger})`);
+      void this.ready.then(() => this.runner.runScriptTick(schedule))
+        .catch((e) => log.error(`Schedule ${schedule.id} (${schedule.name}) tick crashed:`, e))
+        .finally(() => this.afterRun(schedule));
+      return null;
+    }
     const runId = insertScheduleRun(schedule.id, schedule.session_id, "running");
     log.info(`Schedule ${schedule.id} (${schedule.name}) fired: run ${runId} (${trigger})`);
-    void this.execute(schedule, runId).catch((e) => {
+    void executePromptRun(this.runner, schedule, runId)
       // The run's outcome could not be recorded, so its row may still say "running".
-      log.error(`run ${runId} crashed:`, e);
-    });
+      .catch((e) => log.error(`run ${runId} crashed:`, e))
+      .finally(() => this.afterRun(schedule));
     return runId;
   }
 
-  /** Manual trigger (CLI/API). Bypasses the concurrency guard by explicit user action. */
-  runJobNow(id: number): { runId: number; wasRunning: boolean } {
+  /**
+   * Manual trigger (CLI/API). A prompt runs even over its previous run, by explicit user action;
+   * a script tick never does (ScheduleBusyError); an always-on script is restarted.
+   */
+  runJobNow(id: number): { runId: number | null; wasRunning: boolean } {
     const schedule = getSchedule(id);
     if (!schedule) throw new Error(`Schedule ${id} not found`);
     const wasRunning = this.isRunning(id);
-    const runId = this.fire(schedule, wasRunning ? "manual, previous run still active" : "manual");
-    return { runId, wasRunning };
+    if (schedule.kind === "script" && schedule.mode === "always-on") {
+      if (!schedule.enabled) throw new Error("Turn the schedule on to start it");
+      void this.ready.then(() => this.alwaysOn.restart(id))
+        .catch((e) => log.warn(`Schedule ${id} could not be restarted: ${(e as Error).message}`));
+      return { runId: null, wasRunning };
+    }
+    if (wasRunning && schedule.kind === "script") throw new ScheduleBusyError("This schedule is running now");
+    return { runId: this.fire(schedule, wasRunning ? "manual, previous run still active" : "manual"), wasRunning };
   }
 
-  private async execute(schedule: Schedule, runId: number): Promise<void> {
-    const startedAt = Date.now();
+  /** Every run, kept or not, moves last_run_at on and the next fire after it. */
+  private afterRun(schedule: Schedule): void {
+    const count = (this.active.get(schedule.id) ?? 1) - 1;
+    if (count <= 0) this.active.delete(schedule.id);
+    else this.active.set(schedule.id, count);
     try {
-      const sessionId = await this.runner.ensureScheduleSession(schedule);
-      if (sessionId !== schedule.session_id) {
-        updateScheduleRun(runId, { session_id: sessionId });
-        schedule = { ...schedule, session_id: sessionId };
+      // Read again: the cron may have been edited while this ran, or the schedule deleted.
+      const current = getSchedule(schedule.id);
+      if (current) {
+        let next: string | null | undefined;
+        if (current.mode === "tick" && current.enabled) {
+          try { next = nextFireAt(current.cron_expr); } catch { next = null; }
+        }
+        updateSchedule(schedule.id, { last_run_at: new Date().toISOString(), ...(next !== undefined && { next_fire_at: next }) });
       }
-      const result = await this.runner.runScheduleOnce(schedule, sessionId);
-      updateScheduleRun(runId, {
-        status: result.status,
-        output_truncated: result.output || null,
-        context_window_pct: result.contextWindowPct ?? null,
-        cost_usd: result.costUsd ?? null,
-        error: result.error ?? null,
-        rotated_to_session_id: result.rotatedToSessionId ?? null,
-        ended_at: new Date().toISOString(),
-      });
-      const summary = `Schedule ${schedule.id} run ${runId} ${result.status} in ${Date.now() - startedAt}ms`
-        + (result.costUsd != null ? ` cost=$${result.costUsd.toFixed(4)}` : "")
-        + (result.contextWindowPct != null ? ` ctx=${result.contextWindowPct}%` : "");
-      if (result.status === "error") log.error(`${summary}: ${(result.error ?? "unknown error").slice(0, 300)}`);
-      else log.info(summary);
+      this.rearm();
     } catch (e) {
-      log.error(`Schedule ${schedule.id} (${schedule.name}) run ${runId} failed after ${Date.now() - startedAt}ms:`, e);
-      updateScheduleRun(runId, {
-        status: "error",
-        error: (e as Error).message,
-        ended_at: new Date().toISOString(),
-      });
-    } finally {
-      const count = (this.active.get(schedule.id) ?? 1) - 1;
-      if (count <= 0) this.active.delete(schedule.id);
-      else this.active.set(schedule.id, count);
-      try {
-        updateSchedule(schedule.id, {
-          last_run_at: new Date().toISOString(),
-          next_fire_at: nextFireAt(schedule.cron_expr),
-        });
-      } catch (e) {
-        log.warn(`failed to advance schedule ${schedule.id}: ${(e as Error).message}`);
-      }
+      log.warn(`failed to advance schedule ${schedule.id}: ${(e as Error).message}`);
     }
   }
 }

package/src/services/scheduler-db.service.ts

@@ -20,10 +20,19 @@ export function getDueSchedules(nowIso: string): Schedule[] {
   ).all(nowIso) as Schedule[];
 }
 
+/** When the earliest enabled schedule is due, or null when none is waiting on a cron. */
+export function getEarliestFireAt(): string | null {
+  const row = getDb().query(
+    "SELECT MIN(next_fire_at) AS at FROM schedules WHERE enabled = 1 AND next_fire_at IS NOT NULL",
+  ).get() as { at: string | null } | null;
+  return row?.at ?? null;
+}
+
 export function insertSchedule(s: NewSchedule): number {
   const res = getDb().query(
-    `INSERT INTO schedules (name, cron_expr, provider_id, project_path, prompt, permission_mode, max_turns, timeout_ms, enabled, next_fire_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    `INSERT INTO schedules (name, cron_expr, provider_id, project_path, prompt, permission_mode, max_turns, timeout_ms, enabled, next_fire_at,
+       kind, mode, description, script, inputs_json, input_values_json, secrets_enc)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
   ).run(
     s.name, s.cron_expr, s.provider_id, s.project_path, s.prompt,
     s.permission_mode ?? "bypassPermissions",
@@ -31,6 +40,13 @@ export function insertSchedule(s: NewSchedule): number {
     s.timeout_ms ?? 1_800_000,
     s.enabled === false ? 0 : 1,
     s.next_fire_at ?? null,
+    s.kind ?? "prompt",
+    s.mode ?? "tick",
+    s.description ?? "",
+    s.script ?? null,
+    s.inputs_json ?? "[]",
+    s.input_values_json ?? "{}",
+    s.secrets_enc ?? null,
   );
   return Number(res.lastInsertRowid);
 }
@@ -62,6 +78,23 @@ export function insertScheduleRun(scheduleId: number, sessionId: string | null,
   return Number(res.lastInsertRowid);
 }
 
+/**
+ * A run recorded once it is over — a script tick, which keeps a row only when it has something
+ * to show. `started_at` in SQLite's own format, as the column's default writes it.
+ */
+export function insertFinishedRun(scheduleId: number, run: {
+  status: Extract<RunStatus, "done" | "error">; startedAt: number; output: string; error: string | null; costUsd?: number;
+}): number {
+  const res = getDb().query(
+    `INSERT INTO schedule_runs (schedule_id, status, output_truncated, error, cost_usd, started_at, ended_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?)`,
+  ).run(
+    scheduleId, run.status, run.output || null, run.error, run.costUsd ?? null,
+    new Date(run.startedAt).toISOString().replace("T", " ").slice(0, 19), new Date().toISOString(),
+  );
+  return Number(res.lastInsertRowid);
+}
+
 export function updateScheduleRun(
   runId: number,
   fields: Partial<Pick<ScheduleRun, "status" | "session_id" | "output_truncated" | "context_window_pct" | "cost_usd" | "error" | "rotated_to_session_id" | "ended_at">>,
@@ -79,11 +112,16 @@ export function listScheduleRuns(scheduleId: number, limit = 20): ScheduleRun[]
   ).all(scheduleId, limit) as ScheduleRun[];
 }
 
-/** Boot hygiene: orphan stale running rows (>2h) and prune runs older than 30 days. */
+/**
+ * Boot hygiene: orphan stale running rows (>2h) and prune runs older than 30 days. A script's
+ * running row is the life of an always-on process, hours long by design: the always-on
+ * supervisor closes those itself.
+ */
 export function cleanupScheduleRuns(): void {
   getDb().exec(`
     UPDATE schedule_runs SET status = 'error', error = 'orphaned: server restart', ended_at = datetime('now')
-      WHERE status = 'running' AND started_at < datetime('now', '-2 hours');
+      WHERE status = 'running' AND started_at < datetime('now', '-2 hours')
+        AND schedule_id NOT IN (SELECT id FROM schedules WHERE kind = 'script');
     DELETE FROM schedule_runs WHERE started_at < datetime('now', '-30 days');
   `);
 }

package/src/services/scheduler-edit.ts

@@ -0,0 +1,179 @@
+/**
+ * What POST and PATCH /api/schedules save, checked by the rules templates follow
+ * (`schedule-definition.ts`), so the routes and an import accept the same schedules.
+ * Input values and secrets are patches: a key sent sets its value, null clears it, a key not
+ * sent keeps what is saved. A value is only rewritten when it changes, because a new ciphertext
+ * or a reordered JSON restarts an always-on process that had nothing to restart for.
+ */
+import { DEFAULT_TIMEOUT_MS, definitionProblems, inputValueFits, isPlainObject, SCHEDULE_LIMITS } from "../shared/schedule-definition.ts";
+import { inputValueProblems, missingRequiredInputs, normalizeInputs, type InputValuePatch } from "../shared/schedule-inputs.ts";
+import type { NewSchedule, Schedule, ScheduleInputDecl, ScheduleInputValue, ScheduleKind, ScheduleMode } from "../types/scheduler.ts";
+import { encryptSecrets, readSecrets } from "./schedule-script/schedule-secrets.ts";
+import { nextFireAt } from "./scheduler-timing.ts";
+
+/** A body the route refuses: 400 when it is malformed, 409 when it would turn on a script that cannot run. */
+export class ScheduleEditError extends Error {
+  constructor(readonly problems: string[], readonly status: 400 | 409 = 400) {
+    super(problems.join("\n"));
+  }
+}
+
+type Body = Record<string, unknown>;
+type Values = Record<string, ScheduleInputValue>;
+
+/** Fields whose change is a change of what runs: only then is the whole definition checked again. */
+const DEFINITION_FIELDS = ["kind", "mode", "cron_expr", "prompt", "script", "inputs", "timeout_ms", "max_turns", "permission_mode"];
+
+export function newScheduleFrom(body: Body, providerId: string): NewSchedule {
+  const kind = (body.kind ?? "prompt") as ScheduleKind;
+  const mode = (body.mode ?? "tick") as ScheduleMode;
+  const problems = [...nameProblems(body, true)];
+  if (typeof body.project_path !== "string" || !body.project_path) problems.push("project_path is required");
+  const def = {
+    kind, mode,
+    cron_expr: (body.cron_expr ?? (mode === "always-on" ? "" : undefined)) as string,
+    prompt: (body.prompt ?? "") as string,
+    script: (body.script ?? null) as string | null,
+    inputs: body.inputs ?? [],
+    timeout_ms: body.timeout_ms,
+    max_turns: body.max_turns ?? undefined,
+    permission_mode: body.permission_mode,
+  };
+  problems.push(...definitionProblems(templateSpelling(def)));
+  if (problems.length) throw new ScheduleEditError(problems);
+
+  const decls = normalizeInputs(def.inputs as ScheduleInputDecl[]);
+  const values = inputs(decls, {}, {}, body);
+  const enabled = body.enabled !== false;
+  if (enabled && kind === "script") requireInputs(decls, values.values, values.secrets);
+  return {
+    name: (body.name as string).trim(),
+    description: (body.description as string | undefined) ?? "",
+    kind, mode,
+    cron_expr: def.cron_expr,
+    provider_id: providerId,
+    project_path: body.project_path as string,
+    prompt: kind === "prompt" ? def.prompt : "",
+    script: kind === "script" ? def.script : null,
+    permission_mode: def.permission_mode as string | undefined,
+    max_turns: (def.max_turns as number | undefined) ?? null,
+    timeout_ms: (def.timeout_ms as number | undefined) ?? DEFAULT_TIMEOUT_MS[kind],
+    enabled,
+    next_fire_at: mode === "tick" ? nextFireAt(def.cron_expr) : null,
+    inputs_json: JSON.stringify(decls),
+    input_values_json: JSON.stringify(values.values),
+    secrets_enc: encryptSecrets(values.secrets),
+  };
+}
+
+export function scheduleChangesFrom(current: Schedule, body: Body): Partial<Schedule> {
+  const problems = nameProblems(body, false);
+  if (body.kind !== undefined && body.kind !== current.kind) problems.push("A schedule's kind cannot change; create a new schedule instead");
+  if (body.project_path !== undefined && (typeof body.project_path !== "string" || !body.project_path)) problems.push("project_path is required");
+  const mode = (body.mode ?? current.mode) as ScheduleMode;
+  const def = {
+    kind: current.kind, mode,
+    cron_expr: (body.cron_expr !== undefined ? body.cron_expr : mode === "always-on" ? "" : current.cron_expr) as string,
+    prompt: (body.prompt ?? current.prompt) as string,
+    script: (body.script !== undefined ? body.script : current.script) as string | null,
+    inputs: body.inputs ?? JSON.parse(current.inputs_json),
+    // An always-on schedule keeps the stored value unused; one sent is refused by the rules.
+    timeout_ms: body.timeout_ms !== undefined ? body.timeout_ms : mode === "tick" ? current.timeout_ms : undefined,
+    max_turns: (body.max_turns !== undefined ? body.max_turns : current.max_turns) ?? undefined,
+    permission_mode: body.permission_mode ?? current.permission_mode,
+  };
+  if (DEFINITION_FIELDS.some((f) => body[f] !== undefined)) problems.push(...definitionProblems(templateSpelling(def)));
+  if (problems.length) throw new ScheduleEditError(problems);
+
+  const changes: Partial<Schedule> = {};
+  for (const key of ["name", "description", "project_path"] as const) {
+    if (body[key] !== undefined) changes[key] = key === "name" ? (body.name as string).trim() : (body[key] as string);
+  }
+  if (DEFINITION_FIELDS.some((f) => body[f] !== undefined)) {
+    Object.assign(changes, {
+      mode, cron_expr: def.cron_expr, prompt: current.kind === "prompt" ? def.prompt : "",
+      script: current.kind === "script" ? def.script : null, permission_mode: def.permission_mode as string,
+      max_turns: (def.max_turns as number | undefined) ?? null, timeout_ms: (def.timeout_ms as number | undefined) ?? current.timeout_ms,
+    });
+  }
+  const enabling = !!body.enabled && !current.enabled;
+  if (body.enabled !== undefined) changes.enabled = body.enabled ? 1 : 0;
+  if (mode === "always-on") changes.next_fire_at = null;
+  else if (body.cron_expr !== undefined || body.mode !== undefined || enabling) changes.next_fire_at = nextFireAt(def.cron_expr);
+
+  if (current.kind !== "script") return changes;
+  const decls = normalizeInputs(def.inputs as ScheduleInputDecl[]);
+  const savedValues = JSON.parse(current.input_values_json) as Values;
+  let savedSecrets: Record<string, string> | null;
+  try {
+    savedSecrets = readSecrets(current);
+  } catch {
+    // Unreadable with this PPM's key: whatever is sent replaces them; nothing sent keeps them as they are.
+    savedSecrets = null;
+  }
+  const merged = inputs(decls, savedValues, savedSecrets ?? {}, body);
+  const inputsJson = JSON.stringify(decls);
+  if (inputsJson !== current.inputs_json) changes.inputs_json = inputsJson;
+  if (!sameRecord(merged.values, savedValues)) changes.input_values_json = JSON.stringify(merged.values);
+  const secretsTouched = body.secrets !== undefined || body.inputs !== undefined;
+  if (secretsTouched && (savedSecrets === null ? body.secrets !== undefined : !sameRecord(merged.secrets, savedSecrets))) {
+    changes.secrets_enc = encryptSecrets(merged.secrets);
+  }
+  const touchesInputs = body.inputs !== undefined || body.inputValues !== undefined || body.secrets !== undefined;
+  if ((changes.enabled ?? current.enabled) && (enabling || touchesInputs)) {
+    const secretsNow = savedSecrets === null && changes.secrets_enc === undefined ? {} : merged.secrets;
+    requireInputs(decls, merged.values, secretsNow);
+  }
+  return changes;
+}
+
+function nameProblems(body: Body, required: boolean): string[] {
+  const problems: string[] = [];
+  const { name, description } = body;
+  if ((required || name !== undefined) && (typeof name !== "string" || !name.trim() || name.length > SCHEDULE_LIMITS.name)) {
+    problems.push(`name must be 1-${SCHEDULE_LIMITS.name} characters`);
+  }
+  if (description !== undefined && (typeof description !== "string" || description.length > SCHEDULE_LIMITS.description)) {
+    problems.push(`description must be text of at most ${SCHEDULE_LIMITS.description} characters`);
+  }
+  return problems;
+}
+
+/** The routes' fields spelled as a template spells them, for `definitionProblems`. */
+function templateSpelling(d: { kind: string; mode: string; cron_expr: string; prompt: string; script: string | null; inputs: unknown; timeout_ms: unknown; max_turns: unknown; permission_mode: unknown }) {
+  return {
+    kind: d.kind, mode: d.mode,
+    cron: d.mode === "always-on" && d.cron_expr === "" ? undefined : d.cron_expr,
+    prompt: d.prompt, script: d.script ?? undefined, inputs: d.inputs,
+    timeoutMs: d.timeout_ms, maxTurns: d.max_turns, permissionMode: d.permission_mode,
+  };
+}
+
+/** Saved values with the body's patches applied, keeping only what the declarations still take. */
+function inputs(decls: ScheduleInputDecl[], values: Values, secrets: Record<string, string>, body: Body) {
+  const valuePatch = body.inputValues ?? {};
+  const secretPatch = body.secrets ?? {};
+  if (!isPlainObject(valuePatch)) throw new ScheduleEditError(["inputValues must be an object"]);
+  if (!isPlainObject(secretPatch)) throw new ScheduleEditError(["secrets must be an object"]);
+  const problems = inputValueProblems(decls, valuePatch as InputValuePatch, secretPatch as InputValuePatch);
+  if (problems.length) throw new ScheduleEditError(problems);
+  const out = { values: {} as Values, secrets: {} as Record<string, string> };
+  for (const d of decls) {
+    const patch = d.type === "secret" ? secretPatch : valuePatch;
+    const value = d.key in patch ? patch[d.key] : d.type === "secret" ? secrets[d.key] : values[d.key];
+    if (value === null || value === undefined || !inputValueFits(d, value)) continue;
+    if (d.type === "secret") out.secrets[d.key] = value as string;
+    else out.values[d.key] = value;
+  }
+  return out;
+}
+
+function requireInputs(decls: ScheduleInputDecl[], values: Values, secrets: Record<string, string>): void {
+  const missing = missingRequiredInputs(decls, values, Object.keys(secrets));
+  if (missing.length) throw new ScheduleEditError([`Fill in ${missing.join(", ")} before turning it on`], 409);
+}
+
+function sameRecord(a: Record<string, unknown>, b: Record<string, unknown>): boolean {
+  const keys = Object.keys(a);
+  return keys.length === Object.keys(b).length && keys.every((k) => k in b && a[k] === b[k]);
+}

package/src/services/scheduler-prompt-run.ts

@@ -0,0 +1,39 @@
+/** One run of a prompt schedule: its session, its turn, and the row that records them. */
+import type { Schedule, SchedulerRunner } from "../types/scheduler.ts";
+import { createLogger } from "./logger.ts";
+import { updateScheduleRun } from "./scheduler-db.service.ts";
+
+const log = createLogger("scheduler");
+
+export async function executePromptRun(runner: Pick<SchedulerRunner, "ensureScheduleSession" | "runScheduleOnce">, schedule: Schedule, runId: number): Promise<void> {
+  const startedAt = Date.now();
+  try {
+    const sessionId = await runner.ensureScheduleSession(schedule);
+    if (sessionId !== schedule.session_id) {
+      updateScheduleRun(runId, { session_id: sessionId });
+      schedule = { ...schedule, session_id: sessionId };
+    }
+    const result = await runner.runScheduleOnce(schedule, sessionId);
+    updateScheduleRun(runId, {
+      status: result.status,
+      output_truncated: result.output || null,
+      context_window_pct: result.contextWindowPct ?? null,
+      cost_usd: result.costUsd ?? null,
+      error: result.error ?? null,
+      rotated_to_session_id: result.rotatedToSessionId ?? null,
+      ended_at: new Date().toISOString(),
+    });
+    const summary = `Schedule ${schedule.id} run ${runId} ${result.status} in ${Date.now() - startedAt}ms`
+      + (result.costUsd != null ? ` cost=$${result.costUsd.toFixed(4)}` : "")
+      + (result.contextWindowPct != null ? ` ctx=${result.contextWindowPct}%` : "");
+    if (result.status === "error") log.error(`${summary}: ${(result.error ?? "unknown error").slice(0, 300)}`);
+    else log.info(summary);
+  } catch (e) {
+    log.error(`Schedule ${schedule.id} (${schedule.name}) run ${runId} failed after ${Date.now() - startedAt}ms:`, e);
+    updateScheduleRun(runId, {
+      status: "error",
+      error: (e as Error).message,
+      ended_at: new Date().toISOString(),
+    });
+  }
+}

package/src/services/scheduler-runner.ts

@@ -3,40 +3,12 @@ import { chatService } from "./chat.service.ts";
 import { setScheduleSessionId } from "./scheduler-db.service.ts";
 import type { Schedule, RunResult } from "../types/scheduler.ts";
 import { createLogger } from "./logger.ts";
+import { BoundedBuffer } from "./bounded-buffer.ts";
 
 const log = createLogger("scheduler");
 
-const HEAD_CAP = 16 * 1024;
-const TAIL_CAP = 16 * 1024;
 const CONTEXT_ROTATION_THRESHOLD = 80; // % — same as ppmbot coordinator rotation
 
-/** Head+tail bounded buffer — keeps first/last 16KB, drops the middle. */
-class BoundedBuffer {
-  private head = "";
-  private tail = "";
-  private droppedBytes = 0;
-
-  append(chunk: string): void {
-    if (this.head.length < HEAD_CAP) {
-      const room = HEAD_CAP - this.head.length;
-      this.head += chunk.slice(0, room);
-      chunk = chunk.slice(room);
-    }
-    if (!chunk) return;
-    this.tail += chunk;
-    if (this.tail.length > TAIL_CAP) {
-      this.droppedBytes += this.tail.length - TAIL_CAP;
-      this.tail = this.tail.slice(-TAIL_CAP);
-    }
-  }
-
-  toString(): string {
-    if (!this.tail) return this.head;
-    const marker = this.droppedBytes > 0 ? `\n... [truncated ${this.droppedBytes} bytes] ...\n` : "";
-    return this.head + marker + this.tail;
-  }
-}
-
 /** Resume the schedule's persistent session, or create one and persist its id. */
 export async function ensureScheduleSession(schedule: Schedule): Promise<string> {
   let resumeError: string | null = null;

package/src/services/scheduler-timing.ts

@@ -0,0 +1,17 @@
+/** When schedules fire, and how long the scheduler's timer may sleep before looking again. */
+import { Cron } from "croner";
+
+/** Longest the timer sleeps, so a clock jump or a machine waking from sleep is caught within a minute. */
+export const MAX_SLEEP_MS = 60_000;
+/** A timer that fires a hair early finds nothing due and re-arms after this, never in a tight loop. */
+const MIN_SLEEP_MS = 20;
+
+export function nextFireAt(cronExpr: string): string | null {
+  return new Cron(cronExpr).nextRun()?.toISOString() ?? null;
+}
+
+/** How long to sleep before the earliest due schedule `at` (ISO), within the bounds above. */
+export function wakeDelay(at: string | null, now = Date.now()): number {
+  if (!at) return MAX_SLEEP_MS;
+  return Math.min(MAX_SLEEP_MS, Math.max(MIN_SLEEP_MS, Date.parse(at) - now));
+}