@monotykamary/localterm-server 2.80.2 → 2.81.0

package/dist/index.js

@@ -1,4 +1,3 @@
-import { randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
@@ -9,6 +8,9 @@ import { bodyLimit } from "hono/body-limit";
 import open from "open";
 import { WebSocketServer } from "ws";
 import { AutomationRunTracker } from "./automation-run-tracker.js";
+import { AutomationDispatcher } from "./automation-dispatcher.js";
+import { isActiveAutomationRun } from "./utils/is-active-automation-run.js";
+import { isValidTimeZone } from "./utils/is-valid-time-zone.js";
 import { AutomationScheduler } from "./automation-scheduler.js";
 import { AutomationStore } from "./automation-store.js";
 import { runAgent, compactAgent, listAgentModels, readAgentSession } from "./agent-runner.js";
@@ -25,7 +27,7 @@ import { detectWithExplicitPort } from "./cdp/discover-explicit-endpoint.js";
 import { DaemonConfigStore } from "./daemon-config-store.js";
 import { formatCandidates, resolveCandidates, resolveCompletionContext, } from "./completion/index.js";
 import { z } from "zod";
-import { ACTIVITY_DIRNAME, ACTIVITY_REFRESH_DEBOUNCE_MS, ACTIVITY_WATCHED_PROGRAMS, AUTOMATION_EVENT_DEBOUNCE_MS, AUTOMATION_RECONCILE_MIN_DOWNTIME_MS, AUTOMATION_RUN_QUERY_PARAM, AUTOMATION_WATCH_DEBOUNCE_MS, AUTOMATION_WATCH_POST_RUN_GRACE_MS, AUTOMATION_WEBHOOK_DEBOUNCE_MS, CDP_EXTENSION_BROWSER_NAME, CDP_EXTENSION_PATH, DEFAULT_HOST, DEFAULT_PORT, FRIENDLY_HOSTNAME, GIT_DIRTY_THROTTLE_MS, GIT_MAX_REF_LENGTH, HERDR_THEME_SYNC_DEBOUNCE_MS, HIBERNATE_FILENAME, HTTP_STATUS_ACCEPTED, HTTP_STATUS_BAD_REQUEST, HTTP_STATUS_CONFLICT, HTTP_STATUS_SERVICE_UNAVAILABLE, HTTP_STATUS_CREATED, HTTP_STATUS_NOT_FOUND, HTTP_STATUS_PAYLOAD_TOO_LARGE, HTTP_STATUS_UNSUPPORTED_MEDIA_TYPE, MAX_AUTOMATIONS, MAX_IMAGE_UPLOAD_BYTES, MAX_IMAGE_UPLOAD_REQUEST_BYTES, MAX_PROCESSES, MAX_SECRETS, MS_PER_MINUTE, PROCESSES_FILENAME, SECRETS_FILENAME, THEMES_FILENAME, FONTS_FILENAME, SECRETS_SHIMS_DIRNAME, SECRET_EXPORT_SCRYPT_WORK_FACTOR, AUTOMATION_AGENT_SESSIONS_DIRNAME, SERVER_STOP_GRACE_MS, SESSION_ID_QUERY_PARAM, SESSION_ACTIVITY_WINDOW_MS, WINDOW_ID_QUERY_PARAM, WAIT_DEFAULT_TIMEOUT_MS, WS_BACKPRESSURE_THRESHOLD_BYTES, WS_CLOSE_BACKPRESSURE, WS_CLOSE_CAPACITY_REACHED, WS_CLOSE_SPAWN_FAILED, WS_CLOSE_POLICY_VIOLATION, WS_HEARTBEAT_GRACE_MS, WS_HEARTBEAT_INTERVAL_MS, WS_HEARTBEAT_TIMEOUT_MS, WS_MAX_INBOUND_PAYLOAD_BYTES, WS_READY_STATE_OPEN, AUTH_SECRET_FILENAME, AUTH_COOKIE_NAME, UPDATE_CHECK_FILENAME, } from "./constants.js";
+import { ACTIVITY_DIRNAME, ACTIVITY_REFRESH_DEBOUNCE_MS, ACTIVITY_WATCHED_PROGRAMS, AUTOMATION_EVENT_DEBOUNCE_MS, AUTOMATION_RUN_QUERY_PARAM, AUTOMATION_WATCH_DEBOUNCE_MS, AUTOMATION_WATCH_POST_RUN_GRACE_MS, AUTOMATION_WEBHOOK_DEBOUNCE_MS, CDP_EXTENSION_BROWSER_NAME, CDP_EXTENSION_PATH, DEFAULT_HOST, DEFAULT_PORT, FRIENDLY_HOSTNAME, GIT_DIRTY_THROTTLE_MS, GIT_MAX_REF_LENGTH, HERDR_THEME_SYNC_DEBOUNCE_MS, HIBERNATE_FILENAME, HTTP_STATUS_ACCEPTED, HTTP_STATUS_BAD_REQUEST, HTTP_STATUS_CONFLICT, HTTP_STATUS_SERVICE_UNAVAILABLE, HTTP_STATUS_CREATED, HTTP_STATUS_NOT_FOUND, HTTP_STATUS_PAYLOAD_TOO_LARGE, HTTP_STATUS_UNSUPPORTED_MEDIA_TYPE, MAX_AUTOMATIONS, MAX_IMAGE_UPLOAD_BYTES, MAX_IMAGE_UPLOAD_REQUEST_BYTES, MAX_PROCESSES, MAX_SECRETS, PROCESSES_FILENAME, SECRETS_FILENAME, THEMES_FILENAME, FONTS_FILENAME, SECRETS_SHIMS_DIRNAME, SECRET_EXPORT_SCRYPT_WORK_FACTOR, AUTOMATION_AGENT_SESSIONS_DIRNAME, SERVER_STOP_GRACE_MS, SESSION_ID_QUERY_PARAM, SESSION_ACTIVITY_WINDOW_MS, WINDOW_ID_QUERY_PARAM, WAIT_DEFAULT_TIMEOUT_MS, WS_BACKPRESSURE_THRESHOLD_BYTES, WS_CLOSE_BACKPRESSURE, WS_CLOSE_CAPACITY_REACHED, WS_CLOSE_SPAWN_FAILED, WS_CLOSE_POLICY_VIOLATION, WS_HEARTBEAT_GRACE_MS, WS_HEARTBEAT_INTERVAL_MS, WS_HEARTBEAT_TIMEOUT_MS, WS_MAX_INBOUND_PAYLOAD_BYTES, WS_READY_STATE_OPEN, AUTH_SECRET_FILENAME, AUTH_COOKIE_NAME, UPDATE_CHECK_FILENAME, } from "./constants.js";
 import { getDefaultShell, listKnownShells, resolveShellOverride } from "./default-shell.js";
 import { resolveWindowId } from "./utils/resolve-window-id.js";
 import { resolveTermBackspaceSequence } from "./utils/resolve-term-backspace-sequence.js";
@@ -82,7 +84,6 @@ import { isLocaltermTabUrl } from "./utils/is-localterm-tab-url.js";
 import { normalizeTriggerInput } from "./utils/normalize-trigger.js";
 import { buildAutomationSecretEnv } from "./utils/build-automation-secret-env.js";
 import { migrateSecretsToProcesses } from "./utils/migrate-secrets-to-processes.js";
-import { enumerateMissedOccurrences } from "./utils/reconcile-downtime.js";
 const callRawMethod = (raw, method) => {
     if (!raw || typeof raw !== "object")
         return false;
@@ -197,7 +198,7 @@ const normalizeMouseAction = (input) => {
 };
 const buildApiRoutes = (ctx) => {
     const api = new Hono();
-    const { registry, ownerFor, cdpClient, secretBackend, secretExportScryptWorkFactor, secretStore, shimsDir, processStore, themeStore, fontStore, syncSecretShims, automationStore, broadcastAutomations, syncFolderWatchers, syncSessionEventListeners, webhookTriggerManager, worktreeConfigStore, portsSnapshotProcesses, portsSnapshotListeners, toAutomationWithNextRun, listAutomationsWithNextRun, tryLaunch, getCdpPort, applyCdpPort, getGraceSeconds, applyGraceSeconds, connectCdpNow, buildTabUrl, mintViewerCookie, stateDirectory, broadcastThemes, broadcastFonts, updateCheckStore, } = ctx;
+    const { registry, ownerFor, cdpClient, secretBackend, secretExportScryptWorkFactor, secretStore, shimsDir, processStore, themeStore, fontStore, syncSecretShims, automationStore, broadcastAutomations, syncFolderWatchers, syncSessionEventListeners, webhookTriggerManager, worktreeConfigStore, portsSnapshotProcesses, portsSnapshotListeners, toAutomationWithNextRun, listAutomationsWithNextRun, tryLaunch, automationDispatcher, refreshAutomationSchedule, getCdpPort, applyCdpPort, getGraceSeconds, applyGraceSeconds, connectCdpNow, buildTabUrl, mintViewerCookie, stateDirectory, broadcastThemes, broadcastFonts, updateCheckStore, } = ctx;
     // Headless SGR-1006 fallback for `mouse` when no CDP tab is reachable:
     // encode the gesture as SGR bytes and write them straight to the PTY. Closes
     // over `registry` so the automation layer stays CDP-agnostic. Coords arrive
@@ -1353,6 +1354,8 @@ const buildApiRoutes = (ctx) => {
         const normalized = normalizeTriggerInput(trigger);
         if (normalized.kind === "watch" || normalized.kind === "event" || normalized.kind === "webhook")
             return true;
+        if (normalized.schedule.kind === "interval")
+            return true;
         const crons = compileScheduleAll(normalized.schedule);
         return crons.length > 0 && crons.every((cron) => parseCronExpression(cron) !== null);
     };
@@ -1375,7 +1378,16 @@ const buildApiRoutes = (ctx) => {
             if (unknown.length > 0)
                 return context.json({ error: "invalid_secret" }, HTTP_STATUS_BAD_REQUEST);
         }
+        if (parsed.data.timezone !== undefined && !isValidTimeZone(parsed.data.timezone)) {
+            return context.json({ error: "invalid_timezone" }, HTTP_STATUS_BAD_REQUEST);
+        }
+        if (parsed.data.runner.kind === "agent" &&
+            parsed.data.runner.sessionMode === "thread" &&
+            parsed.data.concurrencyPolicy === "allow") {
+            return context.json({ error: "thread_requires_serial_execution" }, HTTP_STATUS_BAD_REQUEST);
+        }
         const automation = automationStore.create(parsed.data);
+        refreshAutomationSchedule();
         broadcastAutomations();
         syncFolderWatchers();
         syncSessionEventListeners();
@@ -1399,6 +1411,16 @@ const buildApiRoutes = (ctx) => {
         const existing = automationStore.get(context.req.param("id"));
         if (!existing)
             return context.json({ error: "not_found" }, HTTP_STATUS_NOT_FOUND);
+        if (parsed.data.timezone !== undefined && !isValidTimeZone(parsed.data.timezone)) {
+            return context.json({ error: "invalid_timezone" }, HTTP_STATUS_BAD_REQUEST);
+        }
+        const runner = parsed.data.runner ?? existing.runner;
+        if ((parsed.data.runner !== undefined || parsed.data.concurrencyPolicy !== undefined) &&
+            runner.kind === "agent" &&
+            runner.sessionMode === "thread" &&
+            (parsed.data.concurrencyPolicy ?? existing.concurrencyPolicy) === "allow") {
+            return context.json({ error: "thread_requires_serial_execution" }, HTTP_STATUS_BAD_REQUEST);
+        }
         // A PATCH never un-finishes — re-enabling a finished automation must go
         // through reset so it can't accidentally fire past its limit.
         if (existing.lifecycle === "finished" && parsed.data.enabled === true) {
@@ -1407,14 +1429,24 @@ const buildApiRoutes = (ctx) => {
         const automation = automationStore.update(context.req.param("id"), parsed.data);
         if (!automation)
             return context.json({ error: "not_found" }, HTTP_STATUS_NOT_FOUND);
+        automationDispatcher.drain(automation.id);
+        refreshAutomationSchedule();
         broadcastAutomations();
         syncFolderWatchers();
         syncSessionEventListeners();
-        return context.json({ automation: toAutomationWithNextRun(automation, new Date()) });
+        return context.json({
+            automation: toAutomationWithNextRun(automationStore.get(automation.id) ?? automation, new Date()),
+        });
     });
     api.delete("/automations/:id", (context) => {
         const id = context.req.param("id");
         const automation = automationStore.get(id);
+        if (automation && automationDispatcher.isBusy(automation.id)) {
+            return context.json({
+                error: "automation_busy",
+                message: "Wait for active runs or cancel queued work before deleting.",
+            }, HTTP_STATUS_CONFLICT);
+        }
         if (!automation || !automationStore.remove(id)) {
             return context.json({ error: "not_found" }, HTTP_STATUS_NOT_FOUND);
         }
@@ -1442,7 +1474,17 @@ const buildApiRoutes = (ctx) => {
         const runId = tryLaunch(automation, "manual");
         if (!runId)
             return context.json({ error: "launch_failed" }, HTTP_STATUS_BAD_REQUEST);
-        return context.json({ runId });
+        const run = automationStore.get(automation.id)?.runs.find((entry) => entry.runId === runId);
+        return context.json({ runId, status: run?.status });
+    });
+    api.post("/automations/:id/runs/:runId/cancel", (context) => {
+        const id = context.req.param("id");
+        if (!automationStore.get(id))
+            return context.json({ error: "not_found" }, HTTP_STATUS_NOT_FOUND);
+        if (!automationDispatcher.cancel(id, context.req.param("runId"))) {
+            return context.json({ error: "run_not_queued" }, HTTP_STATUS_CONFLICT);
+        }
+        return context.json({ ok: true });
     });
     api.post("/automations/:id/reset", async (context) => {
         const parsed = resetAutomationInputSchema.safeParse((await readJsonBody(context)) ?? {});
@@ -1451,6 +1493,7 @@ const buildApiRoutes = (ctx) => {
         const automation = automationStore.reset(context.req.param("id"), parsed.data.clearHistory);
         if (!automation)
             return context.json({ error: "not_found" }, HTTP_STATUS_NOT_FOUND);
+        refreshAutomationSchedule();
         broadcastAutomations();
         // Reset re-enables + reactivates; a watch automation resumes watching.
         syncFolderWatchers();
@@ -1569,26 +1612,34 @@ const buildApiRoutes = (ctx) => {
         if (automation.runner.kind !== "agent" || automation.runner.sessionMode !== "thread") {
             return context.json({ error: "not_compactable" }, HTTP_STATUS_CONFLICT);
         }
-        const sessionFile = path.join(stateDirectory, AUTOMATION_AGENT_SESSIONS_DIRNAME, `${automation.id}.jsonl`);
-        let secretEnv = {};
+        if (!automationDispatcher.acquireExclusive(automation.id)) {
+            return context.json({ error: "automation_busy" }, HTTP_STATUS_CONFLICT);
+        }
         try {
-            secretEnv = await buildAutomationSecretEnv(automation.requestedSecrets, secretStore, secretBackend);
+            const sessionFile = path.join(stateDirectory, AUTOMATION_AGENT_SESSIONS_DIRNAME, `${automation.id}.jsonl`);
+            let secretEnv = {};
+            try {
+                secretEnv = await buildAutomationSecretEnv(automation.requestedSecrets, secretStore, secretBackend);
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                console.warn(`failed to resolve secrets for compaction of "${automation.name}": ${message}`);
+            }
+            const result = await compactAgent({
+                harness: automation.runner.harness,
+                cwd: automation.cwd,
+                env: secretEnv,
+                sessionFile,
+                shimsDir,
+            });
+            if (!result.ok) {
+                return context.json({ error: "compact_failed", message: result.message }, HTTP_STATUS_BAD_REQUEST);
+            }
+            return context.json({ ok: true, message: result.message });
         }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            console.warn(`failed to resolve secrets for compaction of "${automation.name}": ${message}`);
-        }
-        const result = await compactAgent({
-            harness: automation.runner.harness,
-            cwd: automation.cwd,
-            env: secretEnv,
-            sessionFile,
-            shimsDir,
-        });
-        if (!result.ok) {
-            return context.json({ error: "compact_failed", message: result.message }, HTTP_STATUS_BAD_REQUEST);
+        finally {
+            automationDispatcher.releaseExclusive(automation.id);
         }
-        return context.json({ ok: true, message: result.message });
     });
     // Restart a thread-mode agent automation from a fresh session: delete the
     // persisted session file so the next fire starts a blank branch instead of
@@ -1601,15 +1652,23 @@ const buildApiRoutes = (ctx) => {
         if (automation.runner.kind !== "agent" || automation.runner.sessionMode !== "thread") {
             return context.json({ error: "not_thread" }, HTTP_STATUS_CONFLICT);
         }
-        const sessionFile = path.join(stateDirectory, AUTOMATION_AGENT_SESSIONS_DIRNAME, `${automation.id}.jsonl`);
+        if (!automationDispatcher.acquireExclusive(automation.id)) {
+            return context.json({ error: "automation_busy" }, HTTP_STATUS_CONFLICT);
+        }
         try {
-            await fs.promises.rm(sessionFile, { force: true });
+            const sessionFile = path.join(stateDirectory, AUTOMATION_AGENT_SESSIONS_DIRNAME, `${automation.id}.jsonl`);
+            try {
+                await fs.promises.rm(sessionFile, { force: true });
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                return context.json({ error: "clear_thread_failed", message }, HTTP_STATUS_BAD_REQUEST);
+            }
+            return context.json({ ok: true });
         }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            return context.json({ error: "clear_thread_failed", message }, HTTP_STATUS_BAD_REQUEST);
+        finally {
+            automationDispatcher.releaseExclusive(automation.id);
         }
-        return context.json({ ok: true });
     });
     // Daemon config (the editable CDP port). GET is a cheap read of the live
     // value; PUT persists it, drops the persistent CDP socket so the next
@@ -1714,6 +1773,8 @@ export const createServer = async (options = {}) => {
                 sessionEventManager.onSessionEvent(event, cwd);
             },
             onAutomationExit: (automationId, runId, exitCode, log) => {
+                if (automationExecutionStopped)
+                    return;
                 automationStore.updateRun(automationId, runId, {
                     status: exitCode === 0 ? "completed" : "failed",
                     exitCode,
@@ -1724,6 +1785,7 @@ export const createServer = async (options = {}) => {
                 closeRunTabIfRequested(automationId, runId);
                 folderWatchManager.notifyRunFinished(automationId);
                 sessionEventManager.notifyRunFinished(automationId);
+                automationDispatcher.drain(automationId);
             },
             onClientExit: (ws, exitCode) => {
                 const targetId = wsToTargetId.get(ws);
@@ -1744,6 +1806,7 @@ export const createServer = async (options = {}) => {
     // server-side offer goes unanswered and the connection stays uncompressed
     // (verified: a no-extension-header client negotiates ""). See
     // session-manager.ts broadcastBytes and the client's DecompressionStream path.
+    let automationExecutionStopped = false;
     const automationStore = new AutomationStore(path.join(stateDirectory, "automations.json"));
     const automationRunTracker = new AutomationRunTracker();
     const automationScheduler = new AutomationScheduler(automationStore);
@@ -1753,20 +1816,14 @@ export const createServer = async (options = {}) => {
     const folderWatchManager = new FolderWatchManager({
         debounceMs: AUTOMATION_WATCH_DEBOUNCE_MS,
         postRunGraceMs: AUTOMATION_WATCH_POST_RUN_GRACE_MS,
-        isRunInFlight: (automationId) => {
-            const status = automationStore.get(automationId)?.runs[0]?.status;
-            return status === "launched" || status === "running";
-        },
+        isRunInFlight: (automationId) => automationStore.get(automationId)?.runs.some(isActiveAutomationRun) ?? false,
         getAutomation: (automationId) => automationStore.get(automationId),
     });
     const syncFolderWatchers = () => folderWatchManager.sync(automationStore.list());
     const sessionEventManager = new SessionEventManager({
         debounceMs: AUTOMATION_EVENT_DEBOUNCE_MS,
         postRunGraceMs: AUTOMATION_WATCH_POST_RUN_GRACE_MS,
-        isRunInFlight: (automationId) => {
-            const status = automationStore.get(automationId)?.runs[0]?.status;
-            return status === "launched" || status === "running";
-        },
+        isRunInFlight: (automationId) => automationStore.get(automationId)?.runs.some(isActiveAutomationRun) ?? false,
         getAutomation: (automationId) => automationStore.get(automationId),
     });
     // Daemon-global git detection for event automations: arms a recursive
@@ -1786,10 +1843,7 @@ export const createServer = async (options = {}) => {
     // Stateless vs the watch/event managers — nothing to arm, so no sync().
     const webhookTriggerManager = new WebhookTriggerManager({
         debounceMs: AUTOMATION_WEBHOOK_DEBOUNCE_MS,
-        isRunInFlight: (automationId) => {
-            const status = automationStore.get(automationId)?.runs[0]?.status;
-            return status === "launched" || status === "running";
-        },
+        isRunInFlight: () => false,
         getAutomation: (automationId) => automationStore.get(automationId),
     });
     const heartbeatStore = new HeartbeatStore(path.join(stateDirectory, "daemon-heartbeat.json"));
@@ -2014,9 +2068,12 @@ export const createServer = async (options = {}) => {
         // log-stripped records (see automationRunWireSchema) so list/broadcast
         // payloads stay small.
         runs: automation.runs.map((run) => {
-            const { log, ...wire } = run;
+            const { log, execution: _execution, ...wire } = run;
             return { ...wire, hasLog: log !== null || wire.findings !== null };
         }),
+        timezone: automation.timezone ?? Intl.DateTimeFormat().resolvedOptions().timeZone,
+        concurrencyPolicy: automation.concurrencyPolicy ?? "skip",
+        missedRunPolicy: automation.missedRunPolicy ?? "skip",
         nextRunAt: computeNextAutomationRunAt(automation, from),
         cron: automation.trigger.kind === "schedule" ? compileSchedule(automation.trigger.schedule) : null,
         lastRun: deriveLastRun(automation),
@@ -2109,61 +2166,29 @@ export const createServer = async (options = {}) => {
         }
     };
     caffeinateManager.on("change", broadcastCaffeinate);
-    // Run an agent automation headlessly via `pi -p`. No tab, no PTY, no WS
-    // claim — the daemon spawns the subprocess, captures its stdout as the
-    // run's findings, diffs git status for changedFiles, and lands a completed/
-    // failed run with an unread Triage flag (when there are findings). The run
-    // goes straight to "running" (there is no "launched -> tab claim" step), so
-    // reconcileOnStartup's running->missed sweep covers a daemon restart mid-run.
-    const launchAgentRun = (automation, trigger) => {
-        const now = Date.now();
-        const runId = randomUUID();
-        const counts = trigger !== "manual";
-        automationStore.appendRun(automation.id, {
-            runId,
-            scheduledFor: trigger === "schedule" ? Math.floor(now / MS_PER_MINUTE) * MS_PER_MINUTE : now,
-            startedAt: now,
-            finishedAt: null,
-            status: "running",
-            exitCode: null,
-            trigger,
-            countsTowardLimit: counts,
-            findings: null,
-            changedFiles: [],
-            unread: false,
-            log: null,
-        });
-        if (counts)
-            automationStore.incrementRunCount(automation.id);
-        broadcastAutomations();
-        syncFolderWatchers();
-        syncSessionEventListeners();
+    const agentRuns = new Map();
+    const launchAgentRun = (automation, run) => {
         if (automation.runner.kind !== "agent")
-            return runId;
+            return Promise.resolve();
         const runner = automation.runner;
-        const sessionFile = runner.sessionMode === "thread"
-            ? path.join(agentSessionsDir, `${automation.id}.jsonl`)
-            : null;
-        void (async () => {
-            let secretEnv = {};
-            try {
-                secretEnv = await buildAutomationSecretEnv(automation.requestedSecrets, secretStore, secretBackend);
-            }
-            catch (error) {
-                const message = error instanceof Error ? error.message : String(error);
-                console.warn(`failed to resolve secrets for automation "${automation.name}": ${message}`);
-            }
+        const controller = new AbortController();
+        const promise = (async () => {
+            const secretEnv = await buildAutomationSecretEnv(automation.requestedSecrets, secretStore, secretBackend);
+            if (automationExecutionStopped)
+                return;
             const result = await runAgent({
                 runner,
                 cwd: automation.cwd,
                 env: secretEnv,
-                sessionFile,
                 shimsDir,
+                signal: controller.signal,
+                sessionFile: runner.sessionMode === "thread"
+                    ? path.join(agentSessionsDir, `${automation.id}.jsonl`)
+                    : null,
             });
-            // The automation may have been deleted mid-run; drop the result.
-            if (!automationStore.get(automation.id))
+            if (automationExecutionStopped || !automationStore.get(automation.id))
                 return;
-            automationStore.updateRun(automation.id, runId, {
+            automationStore.updateRun(automation.id, run.runId, {
                 status: result.exitCode === 0 ? "completed" : "failed",
                 exitCode: result.exitCode,
                 finishedAt: Date.now(),
@@ -2175,91 +2200,49 @@ export const createServer = async (options = {}) => {
             broadcastAutomations();
             folderWatchManager.notifyRunFinished(automation.id);
             sessionEventManager.notifyRunFinished(automation.id);
-        })();
-        return runId;
+            automationDispatcher.drain(automation.id);
+        })().finally(() => agentRuns.delete(run.runId));
+        agentRuns.set(run.runId, { controller, promise });
+        return promise;
     };
-    // Open a browser tab for a run and record it in history. Scheduled and watch
-    // launches count toward the limit (and can finish the automation); manual
-    // launches never count and are allowed even on a finished/disabled automation.
-    // Agent runs bypass the tab/PTY path entirely (headless). Returns the runId
-    // (null only when a non-manual trigger hits the finished/disabled guard).
-    const tryLaunch = (automation, trigger) => {
-        if (trigger !== "manual") {
-            const current = automationStore.get(automation.id);
-            if (!current || !current.enabled || current.lifecycle === "finished")
-                return null;
-        }
-        if (automation.runner.kind === "agent")
-            return launchAgentRun(automation, trigger);
-        const run = automationRunTracker.create(automation);
-        const counts = trigger !== "manual";
-        automationStore.appendRun(automation.id, {
-            runId: run.runId,
-            scheduledFor: trigger === "schedule"
-                ? Math.floor(run.createdAt / MS_PER_MINUTE) * MS_PER_MINUTE
-                : run.createdAt,
-            startedAt: run.createdAt,
-            finishedAt: null,
-            status: "launched",
-            exitCode: null,
-            trigger,
-            countsTowardLimit: counts,
-            findings: null,
-            changedFiles: [],
-            unread: false,
-            log: null,
-        });
-        if (counts)
-            automationStore.incrementRunCount(automation.id);
-        broadcastAutomations();
-        // A watch automation that just reached its limit is now "finished"; stop
-        // watching its folder promptly instead of waiting for the next mutation.
-        syncFolderWatchers();
-        syncSessionEventListeners();
-        // Open the run tab at the announced LOCAL surface origin when the CLI
-        // resolved one (portless / loopback) — run tabs open in the daemon's own
-        // debugged browser, where a flapping `tailscale serve` (laptop wake, DERP
-        // relay, cert renewal) would fail the tab load and the automation, so they
-        // never ride the tailnet even when `publicOrigin` is the tailnet URL. Fall
-        // back to `publicOrigin` (then the loopback form) so a caller that only set
-        // `publicUrl` keeps the prior single-surface behavior. A bare origin (no
-        // path) is the contract, so the `new URL` base rewrites any stray path and
-        // searchParams encodes the id.
+    const launchShellRun = async (automation, record) => {
+        const run = automationRunTracker.create(automation, record.startedAt ?? Date.now(), record.runId);
+        // Use the local surface: a waking laptop's tailnet may not be available yet.
         const runUrl = new URL(localOrigin ?? publicOrigin ?? `http://${FRIENDLY_HOSTNAME}:${actualPort}`);
         runUrl.searchParams.set(AUTOMATION_RUN_QUERY_PARAM, run.runId);
-        // Resolve requested secrets before opening the run tab so the env is set on
-        // the pending run by the time the WS claims it. The claim happens only after
-        // the browser loads this tab, which is gated on the resolution below, so
-        // `onOpen` always sees the resolved env. The launch stays synchronous up to
-        // here — the pending run + "launched" history are already recorded, so the
-        // `isRunInFlight` overlap guard holds across the await. A secret-resolution
-        // error is logged but does not block the tab (the run still starts, just
-        // without the failed secret).
-        void (async () => {
-            try {
-                const secretEnv = await buildAutomationSecretEnv(automation.requestedSecrets, secretStore, secretBackend);
-                automationRunTracker.setEnv(run.runId, secretEnv);
-                if (automation.redactOutput) {
-                    automationRunTracker.setRedactionValues(run.runId, Object.values(secretEnv));
-                }
-            }
-            catch (error) {
-                const message = error instanceof Error ? error.message : String(error);
-                console.warn(`failed to resolve secrets for automation "${automation.name}": ${message}`);
-            }
-            try {
-                const handle = await tabController.open(runUrl.href);
-                // Remember the tab so `automation-exit` can close it if closeOnFinish.
-                if (handle)
+        try {
+            const secretEnv = await buildAutomationSecretEnv(automation.requestedSecrets, secretStore, secretBackend);
+            automationRunTracker.setEnv(run.runId, secretEnv);
+            if (automation.redactOutput)
+                automationRunTracker.setRedactionValues(run.runId, Object.values(secretEnv));
+            if (automationExecutionStopped)
+                return;
+            const handle = await tabController.open(runUrl.href);
+            if (handle) {
+                if (automationExecutionStopped)
+                    await tabController.close(handle);
+                else
                     runTabHandles.set(run.runId, handle);
             }
-            catch (error) {
-                const message = error instanceof Error ? error.message : String(error);
-                console.warn(`failed to open a browser tab for automation "${automation.name}": ${message}`);
-            }
-        })();
-        return run.runId;
+        }
+        catch (error) {
+            automationRunTracker.claim(run.runId);
+            throw error;
+        }
     };
+    const automationDispatcher = new AutomationDispatcher({
+        store: automationStore,
+        launch: (automation, run) => automation.runner.kind === "agent"
+            ? launchAgentRun(automation, run)
+            : launchShellRun(automation, run),
+        changed: () => {
+            broadcastAutomations();
+            syncFolderWatchers();
+            syncSessionEventListeners();
+        },
+    });
+    const refreshAutomationSchedule = () => automationScheduler.refresh();
+    const tryLaunch = (automation, trigger) => automationDispatcher.request(automation.id, trigger);
     // Close a finished run's tab when the automation opted into closeOnFinish.
     const closeRunTabIfRequested = (automationId, runId) => {
         const handle = runTabHandles.get(runId);
@@ -2267,51 +2250,14 @@ export const createServer = async (options = {}) => {
         if (!handle)
             return;
         const automation = automationStore.get(automationId);
-        if (!automation?.closeOnFinish)
+        const run = automation?.runs.find((entry) => entry.runId === runId);
+        if (!(run?.execution?.closeOnFinish ?? automation?.closeOnFinish))
             return;
         void tabController.close(handle).catch((error) => {
             const message = error instanceof Error ? error.message : String(error);
             console.warn(`failed to close automation tab (run ${runId}): ${message}`);
         });
     };
-    // On boot, settle the state the dead process left behind: any run still
-    // "launched"/"running" can never resume (the run tracker is in-memory), so it
-    // becomes "missed"; and if the daemon was down across scheduled times, record
-    // those as "skipped" so the user can see what didn't run while the machine was
-    // off. Skipped runs never launch and never count toward a limit. No clients
-    // exist yet, so nothing is broadcast.
-    const reconcileOnStartup = (now) => {
-        const lastAliveAt = heartbeatStore.read();
-        const hadOutage = lastAliveAt !== null && now - lastAliveAt >= AUTOMATION_RECONCILE_MIN_DOWNTIME_MS;
-        for (const automation of automationStore.list()) {
-            for (const run of automation.runs) {
-                if (run.status === "launched" || run.status === "running") {
-                    automationStore.updateRun(automation.id, run.runId, {
-                        status: "missed",
-                        finishedAt: now,
-                    });
-                }
-            }
-            if (!hadOutage || !automation.enabled || automation.lifecycle === "finished")
-                continue;
-            for (const occurrence of enumerateMissedOccurrences(automation, lastAliveAt, now)) {
-                automationStore.appendRun(automation.id, {
-                    runId: randomUUID(),
-                    scheduledFor: occurrence,
-                    startedAt: null,
-                    finishedAt: occurrence,
-                    status: "skipped",
-                    exitCode: null,
-                    trigger: "schedule",
-                    countsTowardLimit: false,
-                    findings: null,
-                    changedFiles: [],
-                    unread: false,
-                    log: null,
-                });
-            }
-        }
-    };
     const getCdpPort = () => cdpPort;
     // Live read of the persisted no-clients grace window (seconds; `null` = never
     // reap). The SessionManager's getGraceMs closure converts to ms at arm time.
@@ -2401,6 +2347,8 @@ export const createServer = async (options = {}) => {
         toAutomationWithNextRun,
         listAutomationsWithNextRun,
         tryLaunch,
+        automationDispatcher,
+        refreshAutomationSchedule,
         getCdpPort,
         applyCdpPort,
         getGraceSeconds,
@@ -2615,11 +2563,21 @@ export const createServer = async (options = {}) => {
                             });
                             runTabHandles.delete(claimedRun.runId);
                             broadcastAutomations();
+                            automationDispatcher.drain(claimedRun.automationId);
                         }
                         ws.close(WS_CLOSE_SPAWN_FAILED, error.message);
                         return;
                     }
                     if (!spawned) {
+                        if (claimedRun) {
+                            automationStore.updateRun(claimedRun.automationId, claimedRun.runId, {
+                                status: "failed",
+                                reason: "capacity",
+                                finishedAt: Date.now(),
+                            });
+                            broadcastAutomations();
+                            automationDispatcher.drain(claimedRun.automationId);
+                        }
                         ws.close(WS_CLOSE_CAPACITY_REACHED, "session capacity reached");
                         return;
                     }
@@ -2846,9 +2804,13 @@ export const createServer = async (options = {}) => {
     if (!httpServer) {
         throw new ServerErrorException(serverError.listenFailed(host, port, new Error("hono serve() resolved without binding an http server")));
     }
-    automationScheduler.on("due", (automation) => {
-        tryLaunch(automation, "schedule");
+    automationScheduler.on("due", (automation, scheduledFor) => {
+        automationDispatcher.request(automation.id, "schedule", scheduledFor);
     });
+    automationScheduler.on("skipped", (automation, scheduledFor) => {
+        automationDispatcher.request(automation.id, "schedule", scheduledFor, "downtime");
+    });
+    automationScheduler.on("fault", (error) => console.error("automation scheduling failed", error));
     folderWatchManager.on("due", (automation) => {
         tryLaunch(automation, "watch");
     });
@@ -2858,9 +2820,21 @@ export const createServer = async (options = {}) => {
     webhookTriggerManager.on("due", (automation) => {
         tryLaunch(automation, "webhook");
     });
-    automationScheduler.on("tick", (now) => {
-        // Liveness heartbeat for downtime detection on the next boot.
-        heartbeatStore.write(now.getTime());
+    automationScheduler.on("tick", (now, healthy) => {
+        let dispatchHealthy = healthy;
+        // A queue commit can succeed while the subsequent launch commit fails.
+        // Retry accepted work even when its occurrence watermark already advanced.
+        for (const automation of automationStore.list()) {
+            try {
+                automationDispatcher.drain(automation.id);
+            }
+            catch (error) {
+                dispatchHealthy = false;
+                console.error("automation queue dispatch failed", error);
+            }
+        }
+        if (dispatchHealthy)
+            heartbeatStore.write(now.getTime());
         let didExpireAny = false;
         for (const expiredRun of automationRunTracker.sweepExpired(now.getTime())) {
             const automation = automationStore.get(expiredRun.automationId);
@@ -2871,13 +2845,14 @@ export const createServer = async (options = {}) => {
                 status: "missed",
                 finishedAt: now.getTime(),
             });
+            automationDispatcher.drain(automation.id);
             didExpireAny = true;
         }
         if (didExpireAny)
             broadcastAutomations();
     });
-    reconcileOnStartup(Date.now());
-    automationScheduler.start();
+    automationDispatcher.recover();
+    automationScheduler.start(heartbeatStore.read());
     // Arm folder-watch triggers for the automations loaded at boot.
     syncFolderWatchers();
     syncSessionEventListeners();
@@ -2909,10 +2884,17 @@ export const createServer = async (options = {}) => {
     const stop = () => {
         if (stopPromise)
             return stopPromise;
+        automationExecutionStopped = true;
+        automationDispatcher.dispose();
+        automationScheduler.dispose();
+        for (const run of agentRuns.values())
+            run.controller.abort();
         stopPromise = (async () => {
+            await Promise.allSettled([...agentRuns.values()].map((run) => run.promise));
             hibernateStore.write(await registry.hibernateEntries());
             automationScheduler.dispose();
             folderWatchManager.dispose();
+            sessionEventManager.dispose();
             automationGitWatcher.dispose();
             updateCheckStore.dispose();
             webhookTriggerManager.dispose();