@nanhara/hara 0.127.0 → 0.127.2

package/CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to `@nanhara/hara`.
 > Versioning (pre-1.0, SemVer-style): the **minor** (middle) number bumps for a **new feature**; the
 > **patch** (last) number bumps for **optimizations/fixes of existing features**.
 
+## 0.127.2 — 2026-07-20 — quiet scheduled monitoring
+
+- Cron delivery now supports `--deliver-mode always|on-output|on-error`. Existing jobs retain the
+  `always` heartbeat; high-frequency monitors can use `on-output` to stay silent unless redacted stdout
+  is non-empty, while `on-error` sends only failed outcomes.
+- Failure streak alarms remain independent of outcome filtering, so an `on-output` watchdog still sends
+  its configured `--alert-after N` alert even when routine runs and stderr-only diagnostics are quiet.
+- CLI, agent tool, and Desktop Serve automation APIs validate, persist, list, and display the same policy.
+- Upgrade with `npm i -g @nanhara/hara@0.127.2`.
+
+## 0.127.1 — 2026-07-20 — managed access lifecycle
+
+- Managed enrollment now persists the control plane's authoritative device-token expiry. Hara warns
+  during the final 24 hours, reports the boundary in `whoami`/`enroll --status`, and fails closed with
+  a focused re-enrollment command once access expires or lifecycle data is corrupt.
+- Serve provider settings expose only expiry metadata—not the token—so Hara Desktop can distinguish
+  an authenticated managed route from an expired one.
+- Upgrade with `npm i -g @nanhara/hara@0.127.1`.
+
 ## 0.127.0 — 2026-07-20 — structured context and typed task lifecycle
 
 - **Prompt assembly is now an explicit, ordered runtime layer.** Cache-stable policy, tool, project, and

package/README.md

@@ -274,7 +274,7 @@ new execution. The `hara resume` launcher preserves terminal input in both npm/N
 installs.
 **MCP**: add an `mcpServers` map to global config (a reviewed project config additionally needs `HARA_TRUST_PROJECT_CONFIG=1` at launch). Hara starts with every configured server stopped and exposes only `mcp_connect`; when the current task first needs one server, the agent requests permission to connect that server and its tools appear on the next round as `mcp__<server>__<tool>`. Unrelated servers remain stopped. Configured MCP servers, like `external_agent`, are trusted host extensions outside Hara's protected-file boundary. Every interactive external-tool call requires confirmation (even in `full-auto`), and non-interactive runs disable them by default; reviewed automation can explicitly opt in before launch with `HARA_ALLOW_TRUSTED_EXTENSIONS=1`. hara can also **be** an MCP server — `hara mcp` exposes its read/search tools (esp. **`codebase_search`**) over stdio so other clients (Claude Desktop, Cursor, another hara) can use them; read-only by default (`HARA_MCP_TOOLS` to override).
 **Vim mode**: `hara config set vimMode true` makes the prompt modal — Esc → normal, `i/a/A/I` insert, `h l 0 $ w b e` motions, `x D C dd cw p` edits. Off by default.
-**Scheduled tasks**: `hara cron add "0 9 * * 1-5" "<task>"` (or `"every 30m"`, `"in 2h"`) runs a task on a schedule — each run is a fresh hara session. `hara cron install` wires a per-minute tick into launchd/crontab (no daemon); `--org` routes through the role org. Manage with `hara cron list/run/enable/disable/remove/logs`. Every job has a 30-minute deadline and the whole sequential tick has a non-renewable 60-minute watchdog: a job timeout kills its process tree, records `timed out` + duration/error, then continues with the next due job; a tick timeout stops the remainder and releases the global lock. Add `--deliver feishu:<chatId>` (or Telegram/webhook) for outcomes and `--alert-after N` for the consecutive-failure 🚨 threshold (default 3). Delivery intent is durable before transport, uses a stable idempotency key, and retries with bounded backoff on later ticks until confirmed. A failed channel cannot grow `jobs.json` forever: each job keeps at most 64 pending effects, reserves outcome/alert room before launch, and disables itself with a visible backlog error when full; restore delivery, let the queue drain, then re-enable it. Tune milliseconds with `HARA_CRON_JOB_TIMEOUT_MS` (hard max 24h) and `HARA_CRON_TICK_TIMEOUT_MS` (hard max 5h); scheduled jobs are also capped by the tick. After upgrading from a version whose tick is already stuck, terminate that specific legacy `hara cron tick` process tree once (or reboot); the next scheduler minute marks over-age state interrupted/disabled and recovers the lock without replaying a possibly orphaned task.
+**Scheduled tasks**: `hara cron add "0 9 * * 1-5" "<task>"` (or `"every 30m"`, `"in 2h"`) runs a task on a schedule — each run is a fresh hara session. `hara cron install` wires a per-minute tick into launchd/crontab (no daemon); `--org` routes through the role org. Manage with `hara cron list/run/enable/disable/remove/logs`. Every job has a 30-minute deadline and the whole sequential tick has a non-renewable 60-minute watchdog: a job timeout kills its process tree, records `timed out` + duration/error, then continues with the next due job; a tick timeout stops the remainder and releases the global lock. Add `--deliver feishu:<chatId>` (or Telegram/WeChat/webhook) for outcomes. `--deliver-mode always` preserves the existing every-run heartbeat, `on-output` sends only when redacted stdout is non-empty, and `on-error` sends only failed runs; `--alert-after N` remains independent and still raises the consecutive-failure 🚨 threshold alarm (default 3). Delivery intent is durable before transport, uses a stable idempotency key, and retries with bounded backoff on later ticks until confirmed. A failed channel cannot grow `jobs.json` forever: each job keeps at most 64 pending effects, reserves outcome/alert room before launch, and disables itself with a visible backlog error when full; restore delivery, let the queue drain, then re-enable it. Tune milliseconds with `HARA_CRON_JOB_TIMEOUT_MS` (hard max 24h) and `HARA_CRON_TICK_TIMEOUT_MS` (hard max 5h); scheduled jobs are also capped by the tick. After upgrading from a version whose tick is already stuck, terminate that specific legacy `hara cron tick` process tree once (or reboot); the next scheduler minute marks over-age state interrupted/disabled and recovers the lock without replaying a possibly orphaned task.
 **Work coordination**: `todo_write` is the agent's short, session-scoped checklist; it persists with that
 session and is isolated between simultaneous sub-agents and serve sessions. `task` is the durable project pool
 for work that outlives a conversation: add/update/list/remove items with `pending|in_progress|done`, an optional

package/dist/cron/runner.js

@@ -367,7 +367,8 @@ export function runJobOnce(job, options = {}) {
             resolve({ ok: false, error: `failed to start: ${error instanceof Error ? error.message : String(error)}`, output: "" });
             return;
         }
-        let tail = ""; // last few KB, for chat delivery (the full stream goes to the log file)
+        let tail = ""; // combined stdout/stderr tail for diagnostics and ordinary delivery
+        let stdoutTail = ""; // separate so on-output never turns stderr noise into a notification
         let logBytes = (() => { try {
             return statSync(log).size;
         }
@@ -405,7 +406,10 @@ export function runJobOnce(job, options = {}) {
         };
         // stdout and stderr are separate byte streams; sharing a line buffer can splice unrelated chunks and
         // either corrupt output or create an unsafe synthetic token. Keep an independent redactor per stream.
-        const stdout = createToolOutputLineRedactor(appendSafe);
+        const stdout = createToolOutputLineRedactor((safe) => {
+            stdoutTail = (stdoutTail + safe).slice(-4_000);
+            appendSafe(safe);
+        });
         const stderr = createToolOutputLineRedactor(appendSafe);
         const flush = () => { stdout.flush(); stderr.flush(); };
         const settle = (result) => {
@@ -424,6 +428,7 @@ export function runJobOnce(job, options = {}) {
             resolve({
                 ...result,
                 error: result.error ? redactToolSubprocessOutput(result.error) : undefined,
+                stdout: stdoutTail,
                 output: tail,
             });
         };

package/dist/cron/store.js

@@ -364,6 +364,9 @@ function validCronJob(value) {
         && (job.pendingDueAt === undefined || (job.schedule.kind === "cron" && validFinite(job.pendingDueAt)))
         && (job.tz === undefined || (typeof job.tz === "string" && validTz(job.tz)))
         && (job.deliver === undefined || (typeof job.deliver === "string" && job.deliver.length > 0 && job.deliver.length <= 4_096))
+        && (job.deliverMode === undefined
+            || (job.deliver !== undefined
+                && (job.deliverMode === "always" || job.deliverMode === "on-output" || job.deliverMode === "on-error")))
         && (job.alertAfter === undefined || (Number.isInteger(job.alertAfter) && job.alertAfter >= 1 && job.alertAfter <= 1_000))
         && (job.lastRunAt === undefined || validFinite(job.lastRunAt))
         && (job.runningSince === undefined || validFinite(job.runningSince))
@@ -621,11 +624,18 @@ function enqueueOutcomeForJob(job, result, nowMs, attemptKey) {
         return [];
     const queued = [];
     const snippet = notificationText(result.output, 1_500).trim();
+    const stdout = notificationText(result.stdout, 1_500).trim();
     const safeError = notificationText(result.error || "failed", 1_000);
     const head = result.ok ? `⏰ ${job.name} ✓` : `⏰ ${job.name} ✗ ${safeError}`;
-    const outcomeId = enqueueNotification(job, "outcome", snippet ? `${head}\n${snippet}` : head, nowMs, attemptKey);
-    if (outcomeId)
-        queued.push(outcomeId);
+    const mode = job.deliverMode ?? "always";
+    const shouldDeliverOutcome = mode === "always"
+        || (mode === "on-output" && stdout.length > 0)
+        || (mode === "on-error" && !result.ok);
+    if (shouldDeliverOutcome) {
+        const outcomeId = enqueueNotification(job, "outcome", snippet ? `${head}\n${snippet}` : head, nowMs, attemptKey);
+        if (outcomeId)
+            queued.push(outcomeId);
+    }
     if (!result.ok) {
         const count = job.consecutiveErrors ?? 0;
         const threshold = job.alertAfter ?? 3;

package/dist/index.js

@@ -22,7 +22,7 @@ import { notifyDone } from "./notify.js";
 import { startMcpServer, mcpServeToolNames } from "./mcp/server.js";
 import { completionScript } from "./completions.js";
 import { renderSessionMarkdown } from "./export.js";
-import { clearEnrollment, enrollDevice, heartbeat, syncOrgRoles } from "./org-fleet/enroll.js";
+import { clearEnrollment, enrollDevice, heartbeat, syncOrgRoles, deviceTokenExpired, deviceTokenExpiryWarning, } from "./org-fleet/enroll.js";
 import { loadActiveProfile, listProfiles, useProfile, addProfile, upsertProfile, removeProfile, setModel as setProfileModel, resetModel as resetProfileModel, getProfile, effectiveModel, routingLabel, routeHost, activeId, resolveActive, setFlagOverride, writePin, removePin, pinFilePath, DEFAULT_ORG_ID, PERSONAL_ID, } from "./profile/profile.js";
 import { loadPermissionRules, scaffoldPermissions, globalPermissionsPath, projectPermissionsPath } from "./security/permissions.js";
 import { routingProvider } from "./agent/route.js";
@@ -134,7 +134,7 @@ async function buildProvider(cfg, targetOverride) {
     // requests" — gateway (deviceToken at the gateway) vs BYOK (user's key direct to the provider).
     const { profile: ap } = profileForConfig(cfg);
     if (ap.kind === "gateway") {
-        if (!ap.gatewayUrl || !ap.deviceToken)
+        if (!ap.gatewayUrl || !ap.deviceToken || deviceTokenExpired(ap.tokenExpiresAt))
             return null;
         const baseURL = ap.baseURL || `${ap.gatewayUrl.replace(/\/$/, "")}/v1`;
         const model = resolveGatewayModel(cfg, ap, process.env, targetOverride?.model);
@@ -193,8 +193,12 @@ async function buildGuardian(cfg, primary) {
 }
 function authHint(cfg) {
     const { profile: ap } = profileForConfig(cfg);
-    if (ap.kind === "gateway")
+    if (ap.kind === "gateway") {
+        if (deviceTokenExpired(ap.tokenExpiresAt)) {
+            return `Active profile '${ap.id}' has expired organization access — re-enroll with \`hara profile add ${ap.id} --gateway ${ap.gatewayUrl || "<url>"} --code <code>\`.`;
+        }
         return `Active profile '${ap.id}' is a gateway profile but is missing deviceToken — re-enroll with \`hara profile add ${ap.id} --gateway <url> --code <code>\`.`;
+    }
     const target = resolveByokProviderTarget(cfg, ap, false);
     const provider = target.provider;
     if (provider === "qwen-oauth")
@@ -215,6 +219,7 @@ function providerSettingsSnapshot(targetCwd) {
     const catalog = providerCatalog();
     if (profile.kind === "gateway") {
         const entry = catalog.find((candidate) => candidate.id === "hara-gateway");
+        const tokenExpired = deviceTokenExpired(profile.tokenExpiresAt);
         return {
             current: {
                 provider: "hara-gateway",
@@ -223,11 +228,12 @@ function providerSettingsSnapshot(targetCwd) {
                 location: entry.location,
                 auth: entry.auth,
                 keyConfigured: !!profile.deviceToken,
-                authenticated: !!profile.gatewayUrl && !!profile.deviceToken,
+                authenticated: !!profile.gatewayUrl && !!profile.deviceToken && !tokenExpired,
                 profileId: profile.id,
                 profileKind: profile.kind,
                 profileSource: resolution.source,
                 editable: false,
+                ...(profile.tokenExpiresAt ? { tokenExpiresAt: profile.tokenExpiresAt, tokenExpired } : {}),
             },
             providers: catalog,
         };
@@ -1664,6 +1670,11 @@ function printWhoami() {
             out(c.dim(`  device:   ${p.deviceId.length > 8 ? "…" + p.deviceId.slice(-8) : p.deviceId}\n`));
         if (p.availableModels?.length)
             out(c.dim(`  available: ${p.availableModels.join(", ")}\n`));
+        if (p.tokenExpiresAt)
+            out(c.dim(`  expires:  ${p.tokenExpiresAt}\n`));
+        const warning = deviceTokenExpiryWarning(p.tokenExpiresAt);
+        if (warning)
+            out(c.yellow(`  ⚠ ${warning}\n`));
     }
     else {
         out(c.dim(`  provider: ${p.provider}\n`));
@@ -1795,6 +1806,7 @@ profileCmd
                 defaultModel: e.model || "",
                 availableModels: e.model ? [e.model] : [],
                 enrolledAt: e.enrolledAt,
+                tokenExpiresAt: e.expiresAt,
             };
             upsertProfile(p); // upsert: re-enrolling the same id rotates the token
             const r = useProfile(id);
@@ -1982,8 +1994,8 @@ program
     .option("--clear", "switch active profile back to personal (does NOT delete the gateway profile)")
     .action(async (gatewayUrl, opts) => {
     if (opts.status) {
-        const p = loadActiveProfile();
-        return void out(p.kind === "gateway" ? c.green("enrolled") + c.dim(` · ${p.gatewayUrl} · device ${p.deviceId || "?"} · model ${effectiveModel(p) || "(gateway default)"} · since ${p.enrolledAt || "?"}\n`) : c.dim("Not enrolled — `hara enroll <gateway-url> --code <code>`.\n"));
+        printWhoami();
+        return;
     }
     if (opts.clear) {
         // Behavior change: don't *delete* the gateway profile (keeps the token around for re-use);
@@ -2010,6 +2022,7 @@ program
             defaultModel: e.model || "",
             availableModels: e.model ? [e.model] : [],
             enrolledAt: e.enrolledAt,
+            tokenExpiresAt: e.expiresAt,
         };
         upsertProfile(p);
         useProfile(DEFAULT_ORG_ID);
@@ -2441,7 +2454,8 @@ function renderCronJobs() {
                     : j.lastStatus === "error"
                         ? c.red(`err${elapsed}`)
                         : c.dim("—");
-        return `${c.bold(j.id)} ${describeSchedule(j.schedule)} ${c.dim(`· ${j.mode} · next ${nextLabel} · last ${status}`)}${j.enabled ? "" : c.dim(" [disabled]")}\n   ${c.dim(j.name)}`;
+        const delivery = j.deliver ? ` · deliver ${j.deliver} (${j.deliverMode ?? "always"})` : "";
+        return `${c.bold(j.id)} ${describeSchedule(j.schedule)} ${c.dim(`· ${j.mode}${delivery} · next ${nextLabel} · last ${status}`)}${j.enabled ? "" : c.dim(" [disabled]")}\n   ${c.dim(j.name)}`;
     });
     return head + "\n" + lines.join("\n") + "\n";
 }
@@ -2453,7 +2467,8 @@ cronCmd
     .option("--org", "run via `hara org` (role routing + review) instead of a plain `hara -p` prompt")
     .option("--command", "run the task as a plain SHELL COMMAND — deterministic, no agent, no tokens")
     .option("--tz <zone>", 'IANA timezone for cron exprs (e.g. "Asia/Shanghai"); default = local time')
-    .option("--deliver <spec>", "push each run's result: telegram:<chatId> | feishu:<chatId> | webhook:<url>")
+    .option("--deliver <spec>", "push selected results: telegram:<chatId> | feishu:<chatId> | weixin:<peerId> | webhook:<url>")
+    .option("--deliver-mode <mode>", "notification policy: always (default) | on-output | on-error")
     .option("--alert-after <n>", "send a 🚨 after N consecutive failures (1..1000; default 3)")
     .action((schedule, taskParts, opts) => {
     const task = taskParts.join(" ");
@@ -2471,6 +2486,11 @@ cronCmd
         if ("error" in d)
             return void out(c.red(d.error + "\n"));
     }
+    if (opts.deliverMode && !opts.deliver)
+        return void out(c.red("--deliver-mode requires --deliver\n"));
+    if (opts.deliverMode && !["always", "on-output", "on-error"].includes(opts.deliverMode)) {
+        return void out(c.red("--deliver-mode must be always, on-output, or on-error\n"));
+    }
     const alertAfter = opts.alertAfter === undefined ? undefined : Number(opts.alertAfter);
     if (alertAfter !== undefined && (!Number.isInteger(alertAfter) || alertAfter < 1 || alertAfter > 1_000)) {
         return void out(c.red("--alert-after must be an integer from 1 to 1000\n"));
@@ -2486,6 +2506,7 @@ cronCmd
             cwd: process.cwd(),
             ...(opts.tz ? { tz: opts.tz } : {}),
             ...(opts.deliver ? { deliver: opts.deliver } : {}),
+            ...(opts.deliverMode ? { deliverMode: opts.deliverMode } : {}),
             ...(alertAfter !== undefined ? { alertAfter } : {}),
             createdAt: Date.now(),
         });
@@ -2493,7 +2514,7 @@ cronCmd
     catch (error) {
         return void out(c.red(`${error instanceof Error ? error.message : String(error)}\n`));
     }
-    out(c.green(`✓ scheduled ${job.id}`) + c.dim(` · ${describeSchedule(sched)}${opts.tz ? ` @ ${opts.tz}` : ""} · ${job.mode}${opts.deliver ? ` · → ${opts.deliver}` : ""}${alertAfter !== undefined ? ` · alert ≥${alertAfter}` : ""} · cwd ${job.cwd}\n`));
+    out(c.green(`✓ scheduled ${job.id}`) + c.dim(` · ${describeSchedule(sched)}${opts.tz ? ` @ ${opts.tz}` : ""} · ${job.mode}${opts.deliver ? ` · → ${opts.deliver} (${opts.deliverMode ?? "always"})` : ""}${alertAfter !== undefined ? ` · alert ≥${alertAfter}` : ""} · cwd ${job.cwd}\n`));
     if (!isInstalled())
         out(c.yellow("⚠ scheduler not installed yet — run `hara cron install` so jobs actually fire.\n"));
 });
@@ -3093,6 +3114,11 @@ program.action(async (opts) => {
     // to suppress everywhere.
     if (!opts.print && process.env.HARA_QUIET !== "1") {
         out(c.dim(activeProfileLine(__activeP)) + "\n");
+        const expiryWarning = __activeP.kind === "gateway"
+            ? deviceTokenExpiryWarning(__activeP.tokenExpiresAt)
+            : null;
+        if (expiryWarning)
+            out(c.yellow(`⚠ ${expiryWarning}\n`));
     }
     if (__activeP.kind === "gateway" || cfg.provider === "hara-gateway") {
         void heartbeat(); // fleet visibility — fire-and-forget, never blocks startup

package/dist/org-fleet/enroll.js

@@ -5,7 +5,7 @@
 // plane fleet visibility. Token + endpoint live in ~/.hara/org.json (0600).
 //
 // Protocol (what `hara-control` implements on the other end):
-//   POST {gateway}/v1/enroll      {code, device:{name,os,hara_version}} -> {device_token, device_id, model, base_url?}
+//   POST {gateway}/v1/enroll      {code, device:{name,os,hara_version}} -> {device_token, device_id, model, base_url?, expires_at?}
 //   POST {gateway}/v1/heartbeat   Bearer <device_token> {device_id, name, os, hara_version} -> 200/204
 //   GET  {gateway}/v1/roles       Bearer <device_token> -> {version, org_policy, roles:[…]}  (B3 digital-employee push-down)
 //   POST {gateway}/v1/chat/completions  (OpenAI-compatible; the normal agent traffic, Bearer <device_token>)
@@ -45,6 +45,7 @@ export function loadEnrollment() {
                 model: ap.defaultModel || "",
                 baseURL: ap.baseURL,
                 enrolledAt: ap.enrolledAt || new Date().toISOString(),
+                expiresAt: ap.tokenExpiresAt,
             };
         }
     }
@@ -70,6 +71,14 @@ export function parseEnrollResponse(gatewayUrl, j, now) {
     const deviceToken = (j.device_token ?? j.deviceToken);
     if (!deviceToken)
         throw new Error("enroll response missing device_token");
+    const rawExpiresAt = j.expires_at ?? j.expiresAt;
+    let expiresAt;
+    if (rawExpiresAt !== undefined && rawExpiresAt !== null) {
+        if (typeof rawExpiresAt !== "string" || !Number.isFinite(Date.parse(rawExpiresAt))) {
+            throw new Error("enroll response contains an invalid expires_at");
+        }
+        expiresAt = new Date(rawExpiresAt).toISOString();
+    }
     return {
         gatewayUrl: gatewayUrl.replace(/\/$/, ""),
         deviceToken,
@@ -77,8 +86,36 @@ export function parseEnrollResponse(gatewayUrl, j, now) {
         model: String(j.model ?? ""),
         baseURL: (j.base_url ?? j.baseURL),
         enrolledAt: now,
+        expiresAt,
     };
 }
+/** Legacy control planes did not advertise token expiry, so absence remains compatible. New control
+ * planes provide it and the CLI can fail early with an actionable re-enrollment message. */
+export function deviceTokenExpired(expiresAt, now = new Date()) {
+    if (!expiresAt)
+        return false;
+    const expiryMs = Date.parse(expiresAt);
+    // A present-but-corrupt lifecycle boundary must not silently become a legacy non-expiring token.
+    return !Number.isFinite(expiryMs) || expiryMs <= now.getTime();
+}
+/** Only warn near the boundary; healthy week-long tokens should not add startup noise. */
+export function deviceTokenExpiryWarning(expiresAt, now = new Date()) {
+    if (!expiresAt)
+        return null;
+    const expiryMs = Date.parse(expiresAt);
+    if (!Number.isFinite(expiryMs))
+        return "organization access expiry is unreadable; re-enroll this profile";
+    const remainingMs = expiryMs - now.getTime();
+    if (remainingMs <= 0)
+        return "organization access expired; re-enroll this profile before running a task";
+    if (remainingMs > 24 * 60 * 60_000)
+        return null;
+    const remainingMinutes = Math.max(1, Math.ceil(remainingMs / 60_000));
+    const remaining = remainingMinutes < 60
+        ? `${remainingMinutes}m`
+        : `${Math.ceil(remainingMinutes / 60)}h`;
+    return `organization access expires in ${remaining}; ask your admin for a new enrollment code`;
+}
 /** Exchange a one-time code for a device token at the gateway, persist it, and return the Enrollment. */
 export async function enrollDevice(gatewayUrl, code, signal) {
     const base = gatewayUrl.replace(/\/$/, "");

package/dist/profile/profile.js

@@ -98,6 +98,7 @@ function readDefaultOrgFromOrgJson(e) {
         defaultModel,
         availableModels: defaultModel ? [defaultModel] : [],
         enrolledAt: e.enrolledAt || new Date().toISOString(),
+        tokenExpiresAt: typeof e.expiresAt === "string" ? e.expiresAt : undefined,
     };
 }
 /** First-time migration. Idempotent — running again is a no-op (profiles.json already present). */

package/dist/serve/protocol.js

@@ -24,7 +24,8 @@
 //   settings.providers.list {}                    → redacted provider catalog + current profile state
 //   settings.providers.test {provider,model,…}     → {ok,models,error?} (credential is ephemeral)
 //   settings.providers.save {provider,model,…}     → redacted state (credential is never returned)
-//   automation.add    {name,schedule,task,mode?,cwd?,tz?} → {id,name,schedule}
+//   automation.add    {name,schedule,task,mode?,cwd?,tz?,deliver?,deliverMode?,alertAfter?}
+//                                                               → {id,name,schedule}
 //   automation.toggle {id,enabled}                → {id,enabled}
 //   automation.delete {id}                        → {id,deleted}
 //   session.rename    {sessionId,title}           → {sessionId,title}

package/dist/serve/server.js

@@ -25,6 +25,7 @@ import { listInstalled, enabledPlugins, setPluginEnabled, panelsForProject } fro
 import { loadSkillIndex, loadSkillBody } from "../skills/skills.js";
 import { loadJobs, addJob, removeJob, setEnabled } from "../cron/store.js";
 import { parseSchedule, describeSchedule } from "../cron/schedule.js";
+import { parseDeliver } from "../cron/deliver.js";
 import { loadTasks } from "../tools/task.js";
 import { listPending, resolvePending } from "../gateway/flows-pending.js";
 import { disposeTodoScope, onTodosChange, restoreTodos, serializeTodos } from "../tools/todo.js";
@@ -1034,7 +1035,20 @@ export async function startServe(opts, deps) {
                             // The automation timeline's data: cron jobs with their last outcome, plus this machine's
                             // automated sessions (source=cron/gateway) so the desktop can render results and "continue
                             // as conversation". Read-only.
-                            const jobs = loadJobs().map((j) => ({ id: j.id, name: j.name, mode: j.mode, cwd: j.cwd, enabled: j.enabled, deliver: j.deliver, lastRunAt: j.lastRunAt, lastStatus: j.lastStatus, lastError: j.lastError, schedule: describeSchedule(j.schedule) }));
+                            const jobs = loadJobs().map((j) => ({
+                                id: j.id,
+                                name: j.name,
+                                mode: j.mode,
+                                cwd: j.cwd,
+                                enabled: j.enabled,
+                                deliver: j.deliver,
+                                deliverMode: j.deliverMode ?? "always",
+                                alertAfter: j.alertAfter ?? 3,
+                                lastRunAt: j.lastRunAt,
+                                lastStatus: j.lastStatus,
+                                lastError: j.lastError,
+                                schedule: describeSchedule(j.schedule),
+                            }));
                             const automated = hub.list().filter((m) => m.source === "cron" || m.source === "gateway").map((m) => ({ id: m.id, title: m.title, cwd: m.cwd, source: m.source, sourceName: m.sourceName, updatedAt: m.updatedAt }));
                             return reply(rpcResult(id, { jobs, sessions: automated }));
                         }
@@ -1066,6 +1080,24 @@ export async function startServe(opts, deps) {
                             const sched = parseSchedule(p.schedule, Date.now());
                             if ("error" in sched)
                                 return reply(rpcError(id, ERR.PARAMS, `bad schedule: ${sched.error}`));
+                            const deliver = typeof p.deliver === "string" && p.deliver ? p.deliver : undefined;
+                            if (deliver) {
+                                const parsed = parseDeliver(deliver);
+                                if ("error" in parsed)
+                                    return reply(rpcError(id, ERR.PARAMS, parsed.error));
+                            }
+                            const deliverMode = typeof p.deliverMode === "string" && p.deliverMode
+                                ? p.deliverMode
+                                : undefined;
+                            if (deliverMode && !deliver)
+                                return reply(rpcError(id, ERR.PARAMS, "deliverMode requires deliver"));
+                            if (deliverMode && !["always", "on-output", "on-error"].includes(deliverMode)) {
+                                return reply(rpcError(id, ERR.PARAMS, "deliverMode must be always, on-output, or on-error"));
+                            }
+                            const alertAfter = p.alertAfter === undefined ? undefined : Number(p.alertAfter);
+                            if (alertAfter !== undefined && (!Number.isInteger(alertAfter) || alertAfter < 1 || alertAfter > 1_000)) {
+                                return reply(rpcError(id, ERR.PARAMS, "alertAfter must be an integer from 1 to 1000"));
+                            }
                             const job = addJob({
                                 name: p.name.slice(0, 60),
                                 schedule: sched,
@@ -1073,6 +1105,9 @@ export async function startServe(opts, deps) {
                                 mode: ["print", "org", "command"].includes(p.mode) ? p.mode : "print",
                                 cwd: typeof p.cwd === "string" && p.cwd ? p.cwd : opts.cwd,
                                 ...(typeof p.tz === "string" && p.tz ? { tz: p.tz } : {}),
+                                ...(deliver ? { deliver } : {}),
+                                ...(deliverMode ? { deliverMode: deliverMode } : {}),
+                                ...(alertAfter !== undefined ? { alertAfter } : {}),
                                 createdAt: Date.now(),
                             });
                             return reply(rpcResult(id, { id: job.id, name: job.name, schedule: describeSchedule(job.schedule) }));

package/dist/tools/cron.js

@@ -42,8 +42,9 @@ registerTool({
         "something on a time basis. action=add needs `schedule` (cron expr \"0 9 * * *\" · \"every 30m\" · \"in 2h\" · ISO time) " +
         "and `task`. Optional: `name`; `mode` — \"print\" (default: run task as a hara prompt), \"org\" (role-routed), or " +
         "\"command\" (run task as a plain SHELL COMMAND — deterministic, no agent, no tokens; prefer it for fixed scripts); " +
-        "`tz` (IANA, e.g. Asia/Shanghai, for cron exprs); `deliver` (push each run's result: telegram:<chatId> | " +
-        "feishu:<chatId> | webhook:<url>); `alertAfter` (1..1000 consecutive failures, default 3). Other actions: " +
+        "`tz` (IANA, e.g. Asia/Shanghai, for cron exprs); `deliver` (telegram:<chatId> | feishu:<chatId> | " +
+        "weixin:<peerId> | webhook:<url>); `deliverMode` — always (default), on-output (stdout non-empty), or " +
+        "on-error (failed runs only); `alertAfter` (1..1000 consecutive failures, default 3). Other actions: " +
         "list · remove · enable · disable · run (fire now), with `id`. " +
         "Jobs fire via the OS scheduler even when hara isn't running.",
     input_schema: {
@@ -55,7 +56,8 @@ registerTool({
             name: { type: "string" },
             mode: { type: "string", enum: ["print", "org", "command"] },
             tz: { type: "string", description: "IANA timezone for cron exprs" },
-            deliver: { type: "string", description: "telegram:<chatId> | feishu:<chatId> | webhook:<url>" },
+            deliver: { type: "string", description: "telegram:<chatId> | feishu:<chatId> | weixin:<peerId> | webhook:<url>" },
+            deliverMode: { type: "string", enum: ["always", "on-output", "on-error"] },
             alertAfter: { type: "integer", minimum: 1, maximum: 1000, description: "consecutive failures before 🚨 (default 3)" },
             id: { type: "string", description: "job id (or unique prefix) for remove/enable/disable/run" },
         },
@@ -90,7 +92,7 @@ registerTool({
                 .map((j) => {
                 const now = Date.now();
                 const next = nextRun(j, now);
-                return `${j.id} · ${j.enabled ? "on " : "OFF"} · ${j.name} · ${describeSchedule(j.schedule)}${j.tz ? ` @ ${j.tz}` : ""} · mode ${j.mode}${j.deliver ? ` · → ${j.deliver}` : ""} · next ${fmtNext(next, now)} · last ${status(j)}${j.consecutiveErrors ? ` (${j.consecutiveErrors}✗)` : ""}`;
+                return `${j.id} · ${j.enabled ? "on " : "OFF"} · ${j.name} · ${describeSchedule(j.schedule)}${j.tz ? ` @ ${j.tz}` : ""} · mode ${j.mode}${j.deliver ? ` · → ${j.deliver} (${j.deliverMode ?? "always"})` : ""} · next ${fmtNext(next, now)} · last ${status(j)}${j.consecutiveErrors ? ` (${j.consecutiveErrors}✗)` : ""}`;
             })
                 .join("\n");
         }
@@ -117,6 +119,12 @@ registerTool({
                 if ("error" in d)
                     return `Error: ${d.error}`;
             }
+            const deliverMode = input.deliverMode === undefined ? undefined : String(input.deliverMode);
+            if (deliverMode && !deliver)
+                return "Error: `deliverMode` requires `deliver`.";
+            if (deliverMode && !["always", "on-output", "on-error"].includes(deliverMode)) {
+                return "Error: `deliverMode` must be always, on-output, or on-error.";
+            }
             const alertAfter = input.alertAfter === undefined ? undefined : Number(input.alertAfter);
             if (alertAfter !== undefined && (!Number.isInteger(alertAfter) || alertAfter < 1 || alertAfter > 1_000)) {
                 return "Error: `alertAfter` must be an integer from 1 to 1000.";
@@ -137,6 +145,7 @@ registerTool({
                     cwd: ctx.cwd,
                     ...(tz ? { tz } : {}),
                     ...(deliver ? { deliver } : {}),
+                    ...(deliverMode ? { deliverMode: deliverMode } : {}),
                     ...(alertAfter !== undefined ? { alertAfter } : {}),
                     createdAt: Date.now(),
                 });
@@ -145,7 +154,7 @@ registerTool({
                 return `Error: ${error instanceof Error ? error.message : String(error)}`;
             }
             const warn = isInstalled() ? "" : "\n⚠ The OS scheduler isn't installed yet — tell the user to run `hara cron install` once, or jobs won't fire.";
-            return `✓ scheduled ${job.id} · ${describeSchedule(sched)}${tz ? ` @ ${tz}` : ""} · mode ${mode}${deliver ? ` · → ${deliver}` : ""}${alertAfter !== undefined ? ` · alert ≥${alertAfter}` : ""} · next ${fmt(nextRun(job, Date.now()))}${warn}`;
+            return `✓ scheduled ${job.id} · ${describeSchedule(sched)}${tz ? ` @ ${tz}` : ""} · mode ${mode}${deliver ? ` · → ${deliver} (${deliverMode ?? "always"})` : ""}${alertAfter !== undefined ? ` · alert ≥${alertAfter}` : ""} · next ${fmt(nextRun(job, Date.now()))}${warn}`;
         }
         // id-based actions
         const idArg = String(input.id ?? "").trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanhara/hara",
-  "version": "0.127.0",
+  "version": "0.127.2",
   "description": "hara — a coding agent CLI that runs like an engineering org.",
   "bin": {
     "hara": "runtime-bootstrap.cjs"