@roamcode.ai/server 1.3.0 → 1.4.0

package/dist/index.js

@@ -9753,6 +9753,32 @@ var CloudHostHeartbeatV1Schema = z5.object({
     context.addIssue({ code: "custom", path: ["capabilities"], message: "capabilities must be unique" });
   }
 });
+var CloudAutomationWebhookRegistrationSchema = z5.object({
+  hookId: z5.string().regex(/^rcwh_[A-Za-z0-9_-]{24,80}$/),
+  automationId: SafeIdentifierSchema,
+  triggerId: SafeIdentifierSchema,
+  secretHash: z5.string().regex(/^[a-f0-9]{64}$/),
+  enabled: z5.boolean()
+}).strict();
+var CloudAutomationInvocationSchema = z5.object({
+  id: z5.uuid(),
+  automationId: SafeIdentifierSchema,
+  triggerId: SafeIdentifierSchema,
+  hookId: z5.string().regex(/^rcwh_[A-Za-z0-9_-]{24,80}$/),
+  createdAt: TimestampSchema
+}).strict();
+var CloudAutomationSyncRequestSchema = z5.object({
+  v: z5.literal(1),
+  organizationId: SafeIdentifierSchema,
+  hostId: SafeIdentifierSchema,
+  instanceId: SafeIdentifierSchema,
+  registrations: z5.array(CloudAutomationWebhookRegistrationSchema).max(128).refine(
+    (registrations) => new Set(registrations.map((registration) => registration.hookId)).size === registrations.length,
+    "webhook identities must be unique"
+  ),
+  acknowledgements: z5.array(z5.uuid()).max(200).refine((values) => new Set(values).size === values.length)
+}).strict();
+var CloudAutomationSyncResponseSchema = z5.object({ invocations: z5.array(CloudAutomationInvocationSchema).max(50) }).strict();
 var CloudAuthorizationScopeV1Schema = z5.discriminatedUnion("type", [
   z5.object({ type: z5.literal("organization") }).strict(),
   z5.object({ type: z5.literal("host"), id: SafeIdentifierSchema }).strict(),
@@ -10481,6 +10507,7 @@ function resolveCloudHostConfig(env, dataDir) {
 
 // src/cloud-host-runtime.ts
 var CLOUD_HOST_HEARTBEAT_PATH = "/api/v1/hosts/heartbeat";
+var CLOUD_HOST_AUTOMATION_SYNC_PATH = "/api/v1/hosts/automation-sync";
 var CLOUD_HOST_AUTHORIZATION_SNAPSHOT_PATH = "/api/v1/hosts/authorization-snapshot";
 var CLOUD_HOST_MAX_SIGNED_RESPONSE_BYTES = 16 * 1024 * 1024;
 var DEFAULT_REQUEST_TIMEOUT_MS3 = 15e3;
@@ -10567,6 +10594,7 @@ function createCloudHostRuntime(options) {
   let lastHeartbeatAt;
   let lastAuthorizationAt;
   let heartbeatFailures = 0;
+  let automationFailures = 0;
   let authorizationFailures = 0;
   let lastAuthorizationIssue;
   let running = false;
@@ -10576,6 +10604,8 @@ function createCloudHostRuntime(options) {
   let heartbeatInFlight;
   let authorizationInFlight;
   const capabilities2 = () => [...new Set(typeof options.capabilities === "function" ? options.capabilities() : options.capabilities)].sort();
+  const automationWebhooks = () => (typeof options.automationWebhooks === "function" ? options.automationWebhooks() : options.automationWebhooks ?? []).map((registration) => CloudAutomationWebhookRegistrationSchema.parse(registration)).sort((left, right) => left.hookId.localeCompare(right.hookId));
+  const automationAcknowledgements = /* @__PURE__ */ new Set();
   const request = async (path, init) => {
     try {
       return await fetchImpl(`${config.controlPlaneOrigin}${path}`, {
@@ -10695,6 +10725,51 @@ function createCloudHostRuntime(options) {
     }
     await response2.body?.cancel().catch(() => void 0);
     lastHeartbeatAt = currentNow;
+    if (state === "ready" && options.automationWebhooks && options.onAutomationInvocation) {
+      try {
+        let deliveryFailed = false;
+        for (let page = 0; page < 4; page += 1) {
+          const acknowledgements = [...automationAcknowledgements].slice(0, 200);
+          const payload = CloudAutomationSyncRequestSchema.parse({
+            v: 1,
+            organizationId: config.organizationId,
+            hostId: config.hostId,
+            instanceId: options.instanceId,
+            registrations: automationWebhooks(),
+            acknowledgements
+          });
+          const automationResponse = await request(CLOUD_HOST_AUTOMATION_SYNC_PATH, {
+            method: "POST",
+            headers: authenticatedHeaders({ "content-type": "application/json", accept: "application/json" }),
+            body: JSON.stringify(payload)
+          });
+          if (automationResponse.status === 404) {
+            await automationResponse.body?.cancel().catch(() => void 0);
+            break;
+          }
+          if (automationResponse.status !== 200) {
+            await boundedResponseText2(automationResponse).catch(() => "");
+            throw responseError(automationResponse);
+          }
+          const parsed = CloudAutomationSyncResponseSchema.parse(
+            JSON.parse(await boundedResponseText2(automationResponse))
+          );
+          for (const id of acknowledgements) automationAcknowledgements.delete(id);
+          for (const invocation of parsed.invocations) {
+            try {
+              await options.onAutomationInvocation(invocation);
+              automationAcknowledgements.add(invocation.id);
+            } catch {
+              deliveryFailed = true;
+            }
+          }
+          if (parsed.invocations.length === 0 && automationAcknowledgements.size === 0) break;
+        }
+        automationFailures = deliveryFailed ? automationFailures + 1 : 0;
+      } catch {
+        automationFailures += 1;
+      }
+    }
   };
   const jittered = (baseMs) => {
     const sample = random();
@@ -10759,6 +10834,7 @@ function createCloudHostRuntime(options) {
     status: () => ({
       running,
       heartbeatFailures,
+      automationFailures,
       authorizationFailures,
       ...lastAuthorizationIssue ? { authorizationIssue: lastAuthorizationIssue } : {},
       ...lastHeartbeatAt === void 0 ? {} : { lastHeartbeatAt },
@@ -14339,6 +14415,48 @@ function normalizeTrigger(value) {
   }
   return { type: "manual" };
 }
+function validTimeZone(value) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: value }).format(0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function normalizeConfiguredTriggers(value) {
+  if (!Array.isArray(value) || value.length > 16) throw new Error("invalid automation triggers");
+  const ids = /* @__PURE__ */ new Set();
+  return value.map((candidate) => {
+    if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
+      throw new Error("invalid automation trigger");
+    }
+    const raw = candidate;
+    const id = normalizeId(raw.id, "automation trigger id");
+    if (ids.has(id)) throw new Error("duplicate automation trigger id");
+    ids.add(id);
+    if (typeof raw.enabled !== "boolean") throw new Error("invalid automation trigger state");
+    if (raw.type === "schedule") {
+      if (typeof raw.cron !== "string" || raw.cron.trim().split(/\s+/).length !== 5 || raw.cron.length > 120 || typeof raw.timeZone !== "string" || raw.timeZone.length > 80 || !validTimeZone(raw.timeZone) || raw.missedRunPolicy !== "skip" || Object.keys(raw).some((key) => !["id", "type", "enabled", "cron", "timeZone", "missedRunPolicy"].includes(key))) {
+        throw new Error("invalid schedule trigger");
+      }
+      return {
+        id,
+        type: "schedule",
+        enabled: raw.enabled,
+        cron: raw.cron.trim().replace(/\s+/g, " "),
+        timeZone: raw.timeZone,
+        missedRunPolicy: "skip"
+      };
+    }
+    if (raw.type === "webhook") {
+      if (typeof raw.hookId !== "string" || !/^rcwh_[A-Za-z0-9_-]{24,80}$/.test(raw.hookId) || typeof raw.secretHash !== "string" || !/^[a-f0-9]{64}$/.test(raw.secretHash) || Object.keys(raw).some((key) => !["id", "type", "enabled", "hookId", "secretHash"].includes(key))) {
+        throw new Error("invalid webhook trigger");
+      }
+      return { id, type: "webhook", enabled: raw.enabled, hookId: raw.hookId, secretHash: raw.secretHash };
+    }
+    throw new Error("invalid automation trigger");
+  });
+}
 function normalizeRuntimeOptions(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid runtime options");
   let encoded;
@@ -14365,7 +14483,8 @@ function normalizeCreate2(input) {
     cwd: normalizeCwd2(input.cwd),
     instruction: normalizeInstruction(input.instruction),
     runtimeOptions: normalizeRuntimeOptions(input.runtimeOptions ?? {}),
-    trigger: normalizeTrigger(input.trigger ?? { type: "manual" })
+    trigger: normalizeTrigger(input.trigger ?? { type: "manual" }),
+    triggers: normalizeConfiguredTriggers(input.triggers ?? [])
   };
 }
 function applyUpdate(current, input, now) {
@@ -14379,7 +14498,8 @@ function applyUpdate(current, input, now) {
     cwd: input.cwd ?? current.cwd,
     instruction: input.instruction ?? current.instruction,
     runtimeOptions: input.runtimeOptions ?? current.runtimeOptions,
-    trigger: input.trigger ?? current.trigger
+    trigger: input.trigger ?? current.trigger,
+    triggers: input.triggers ?? current.triggers
   };
   if (Object.values(input).some((value) => value === void 0) || typeof candidate.enabled !== "boolean") {
     throw new Error("invalid automation update");
@@ -14401,9 +14521,12 @@ function createMemoryStore8(opts) {
   const removedDefinitions = /* @__PURE__ */ new Set();
   const runs = /* @__PURE__ */ new Map();
   const runInputSnapshots = /* @__PURE__ */ new Map();
+  const activities = /* @__PURE__ */ new Map();
+  const triggerCursors = /* @__PURE__ */ new Map();
   const nodeOwners = /* @__PURE__ */ new Map();
   const generateAutomationId = opts.generateAutomationId ?? (() => randomId4("rca2"));
   const generateRunId = opts.generateRunId ?? (() => randomId4("rcar"));
+  const generateActivityId = opts.generateActivityId ?? (() => randomId4("rcae"));
   return {
     mode: "memory-fallback",
     getNodeOwner(nodeId) {
@@ -14489,8 +14612,8 @@ function createMemoryStore8(opts) {
       const snapshot = runInputSnapshots.get(id);
       return snapshot ? clone9(snapshot) : void 0;
     },
-    getRunByInvocationId(invocationId) {
-      const run = [...runs.values()].find((candidate) => candidate.invocationId === invocationId);
+    getRunByInvocationId(invocationId2) {
+      const run = [...runs.values()].find((candidate) => candidate.invocationId === invocationId2);
       return run ? clone9(run) : void 0;
     },
     getRunBySessionId(sessionId) {
@@ -14588,11 +14711,43 @@ function createMemoryStore8(opts) {
       const bounded = Math.max(1, Math.min(1e3, Math.trunc(limit)));
       return [...runs.values()].filter((run) => !automationId || run.automationId === automationId).sort((a, b) => b.createdAt - a.createdAt || b.id.localeCompare(a.id)).slice(0, bounded).map(clone9);
     },
+    getTriggerCursor(triggerId) {
+      return triggerCursors.get(normalizeId(triggerId, "automation trigger id"));
+    },
+    setTriggerCursor(triggerId, minute) {
+      if (!Number.isSafeInteger(minute) || minute < 0) throw new Error("invalid automation trigger cursor");
+      triggerCursors.set(normalizeId(triggerId, "automation trigger id"), minute);
+    },
+    createActivity(input, now = Date.now()) {
+      const id = normalizeId(generateActivityId(), "automation activity id");
+      if (activities.has(id)) throw new Error("automation activity id already exists");
+      const activity = { id, ...clone9(input), createdAt: now, updatedAt: now };
+      activities.set(id, activity);
+      return clone9(activity);
+    },
+    getActivityByInvocationId(invocationId2) {
+      const normalized = normalizeId(invocationId2, "invocation id");
+      const activity = [...activities.values()].find((candidate) => candidate.invocationId === normalized);
+      return activity ? clone9(activity) : void 0;
+    },
+    updateActivity(id, input, now = Date.now()) {
+      const current = activities.get(id);
+      if (!current) return void 0;
+      const next = { ...current, ...clone9(input), updatedAt: now };
+      activities.set(id, next);
+      return clone9(next);
+    },
+    listActivities(automationId, limit = 100) {
+      const bounded = Math.max(1, Math.min(1e3, Math.trunc(limit)));
+      return [...activities.values()].filter((activity) => !automationId || activity.automationId === automationId).sort((left, right) => right.createdAt - left.createdAt || right.id.localeCompare(left.id)).slice(0, bounded).map(clone9);
+    },
     close() {
       definitions.clear();
       removedDefinitions.clear();
       runs.clear();
       runInputSnapshots.clear();
+      activities.clear();
+      triggerCursors.clear();
       nodeOwners.clear();
     }
   };
@@ -14609,7 +14764,11 @@ function definitionFromRow(row) {
     cwd: row.cwd,
     instruction: row.instruction,
     runtimeOptions: JSON.parse(row.runtime_options_json),
-    trigger: normalizeTrigger(JSON.parse(row.trigger_json)),
+    trigger: { type: "manual" },
+    triggers: (() => {
+      const parsed = JSON.parse(row.trigger_json);
+      return Array.isArray(parsed) ? normalizeConfiguredTriggers(parsed) : [];
+    })(),
     revision: row.revision,
     createdAt: row.created_at,
     updatedAt: row.updated_at
@@ -14642,6 +14801,22 @@ function runInputSnapshotFromRow(row) {
     bootstrapState: row.bootstrap_state
   };
 }
+function activityFromRow(row) {
+  return {
+    id: row.id,
+    automationId: row.automation_id,
+    triggerId: row.trigger_id,
+    source: row.source,
+    status: row.status,
+    invocationId: row.invocation_id,
+    ...row.scheduled_for === null ? {} : { scheduledFor: row.scheduled_for },
+    ...row.missed_count === null ? {} : { missedCount: row.missed_count },
+    ...row.run_id === null ? {} : { runId: row.run_id },
+    ...row.failure_code === null ? {} : { failureCode: row.failure_code },
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
 function openSessionAutomationStore(opts) {
   let Database;
   try {
@@ -14705,6 +14880,27 @@ function openSessionAutomationStore(opts) {
       bootstrap_state TEXT NOT NULL DEFAULT 'pending'
         CHECK(bootstrap_state IN ('pending','submitting','submitted'))
     );
+    CREATE TABLE IF NOT EXISTS session_automation_trigger_cursors (
+      trigger_id TEXT PRIMARY KEY,
+      minute INTEGER NOT NULL CHECK(minute >= 0),
+      updated_at INTEGER NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS session_automation_activities (
+      id TEXT PRIMARY KEY,
+      automation_id TEXT NOT NULL REFERENCES session_automations(id) ON DELETE CASCADE,
+      trigger_id TEXT NOT NULL,
+      source TEXT NOT NULL CHECK(source IN ('schedule','webhook')),
+      status TEXT NOT NULL CHECK(status IN ('queued','started','failed','missed','expired')),
+      invocation_id TEXT NOT NULL UNIQUE,
+      scheduled_for INTEGER,
+      missed_count INTEGER CHECK(missed_count IS NULL OR missed_count > 0),
+      run_id TEXT REFERENCES session_automation_runs(id) ON DELETE SET NULL,
+      failure_code TEXT,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS session_automation_activities_definition_idx
+      ON session_automation_activities(automation_id, created_at DESC);
   `);
   const automationColumns = db.pragma("table_info(session_automations)");
   if (!automationColumns.some((column) => column.name === "deleted_at")) {
@@ -14718,6 +14914,7 @@ function openSessionAutomationStore(opts) {
   }
   const generateAutomationId = opts.generateAutomationId ?? (() => randomId4("rca2"));
   const generateRunId = opts.generateRunId ?? (() => randomId4("rcar"));
+  const generateActivityId = opts.generateActivityId ?? (() => randomId4("rcae"));
   const getDefinition = db.prepare("SELECT * FROM session_automations WHERE id = ? AND deleted_at IS NULL");
   const getDefinitionIncludingRemoved = db.prepare("SELECT * FROM session_automations WHERE id = ?");
   const listAll = db.prepare("SELECT * FROM session_automations WHERE deleted_at IS NULL ORDER BY updated_at DESC, id");
@@ -14744,6 +14941,30 @@ function openSessionAutomationStore(opts) {
   const listRunsForAutomation = db.prepare(
     "SELECT * FROM session_automation_runs WHERE automation_id = ? ORDER BY created_at DESC, id DESC LIMIT ?"
   );
+  const getTriggerCursorStatement = db.prepare(
+    "SELECT minute FROM session_automation_trigger_cursors WHERE trigger_id = ?"
+  );
+  const setTriggerCursorStatement = db.prepare(
+    `INSERT INTO session_automation_trigger_cursors(trigger_id,minute,updated_at) VALUES(?,?,?)
+     ON CONFLICT(trigger_id) DO UPDATE SET minute=excluded.minute,updated_at=excluded.updated_at`
+  );
+  const getActivity = db.prepare("SELECT * FROM session_automation_activities WHERE id = ?");
+  const getActivityByInvocationId = db.prepare("SELECT * FROM session_automation_activities WHERE invocation_id = ?");
+  const insertActivity = db.prepare(
+    `INSERT INTO session_automation_activities(
+       id,automation_id,trigger_id,source,status,invocation_id,scheduled_for,missed_count,run_id,failure_code,
+       created_at,updated_at
+     ) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)`
+  );
+  const updateActivityStatement = db.prepare(
+    `UPDATE session_automation_activities SET status=?,run_id=?,failure_code=?,updated_at=? WHERE id=?`
+  );
+  const listActivitiesAll = db.prepare(
+    "SELECT * FROM session_automation_activities ORDER BY created_at DESC, id DESC LIMIT ?"
+  );
+  const listActivitiesForAutomation = db.prepare(
+    "SELECT * FROM session_automation_activities WHERE automation_id = ? ORDER BY created_at DESC, id DESC LIMIT ?"
+  );
   return {
     mode: "sqlite",
     getNodeOwner(nodeId) {
@@ -14783,7 +15004,7 @@ function openSessionAutomationStore(opts) {
         definition.cwd,
         definition.instruction,
         JSON.stringify(definition.runtimeOptions),
-        JSON.stringify(definition.trigger),
+        JSON.stringify(definition.triggers),
         definition.revision,
         definition.createdAt,
         definition.updatedAt
@@ -14805,7 +15026,7 @@ function openSessionAutomationStore(opts) {
         next.cwd,
         next.instruction,
         JSON.stringify(next.runtimeOptions),
-        JSON.stringify(next.trigger),
+        JSON.stringify(next.triggers),
         next.revision,
         next.updatedAt,
         next.id,
@@ -14866,8 +15087,8 @@ function openSessionAutomationStore(opts) {
       const row = selectRunInputSnapshot.get(id);
       return row ? runInputSnapshotFromRow(row) : void 0;
     },
-    getRunByInvocationId(invocationId) {
-      const row = getRunByInvocationId.get(invocationId);
+    getRunByInvocationId(invocationId2) {
+      const row = getRunByInvocationId.get(invocationId2);
       return row ? runFromRow(row) : void 0;
     },
     getRunBySessionId(sessionId) {
@@ -14978,6 +15199,63 @@ function openSessionAutomationStore(opts) {
       const rows = automationId ? listRunsForAutomation.all(automationId, bounded) : listRunsAll.all(bounded);
       return rows.map(runFromRow);
     },
+    getTriggerCursor(triggerId) {
+      const row = getTriggerCursorStatement.get(normalizeId(triggerId, "automation trigger id"));
+      return row?.minute;
+    },
+    setTriggerCursor(triggerId, minute) {
+      if (!Number.isSafeInteger(minute) || minute < 0) throw new Error("invalid automation trigger cursor");
+      setTriggerCursorStatement.run(normalizeId(triggerId, "automation trigger id"), minute, Date.now());
+    },
+    createActivity(input, now = Date.now()) {
+      const activity = {
+        id: normalizeId(generateActivityId(), "automation activity id"),
+        ...input,
+        automationId: normalizeId(input.automationId, "automation id"),
+        triggerId: normalizeId(input.triggerId, "automation trigger id"),
+        invocationId: normalizeId(input.invocationId, "invocation id"),
+        createdAt: now,
+        updatedAt: now
+      };
+      insertActivity.run(
+        activity.id,
+        activity.automationId,
+        activity.triggerId,
+        activity.source,
+        activity.status,
+        activity.invocationId,
+        activity.scheduledFor ?? null,
+        activity.missedCount ?? null,
+        activity.runId ?? null,
+        activity.failureCode ?? null,
+        activity.createdAt,
+        activity.updatedAt
+      );
+      return activity;
+    },
+    getActivityByInvocationId(invocationId2) {
+      const row = getActivityByInvocationId.get(normalizeId(invocationId2, "invocation id"));
+      return row ? activityFromRow(row) : void 0;
+    },
+    updateActivity(id, input, now = Date.now()) {
+      const row = getActivity.get(id);
+      if (!row) return void 0;
+      const current = activityFromRow(row);
+      const next = { ...current, ...input, updatedAt: now };
+      const result = updateActivityStatement.run(
+        next.status,
+        next.runId ?? null,
+        next.failureCode ?? null,
+        next.updatedAt,
+        current.id
+      );
+      return result.changes === 1 ? next : void 0;
+    },
+    listActivities(automationId, limit = 100) {
+      const bounded = Math.max(1, Math.min(1e3, Math.trunc(limit)));
+      const rows = automationId ? listActivitiesForAutomation.all(automationId, bounded) : listActivitiesAll.all(bounded);
+      return rows.map(activityFromRow);
+    },
     close() {
       db.close();
     }
@@ -15141,7 +15419,7 @@ function resolveVapidKeys(opts) {
 }
 
 // src/transport.ts
-import { createHash as createHash10, randomBytes as randomBytes17, randomUUID as randomUUID7, timingSafeEqual as timingSafeEqual6 } from "crypto";
+import { createHash as createHash10, randomBytes as randomBytes17, randomUUID as randomUUID8, timingSafeEqual as timingSafeEqual6 } from "crypto";
 import { basename as pathBasename, join as join17, resolve as resolvePath } from "path";
 import { createReadStream } from "fs";
 import Fastify2 from "fastify";
@@ -15322,9 +15600,206 @@ function terminalSharedDir(opts) {
   return join11(terminalSharedBase(opts), opts.sessionId);
 }
 
+// src/automation-trigger-engine.ts
+import { randomUUID as randomUUID5 } from "crypto";
+function parsePart(part, min, max, normalize) {
+  const [rangePart, stepPart] = part.split("/");
+  const step = stepPart === void 0 ? 1 : Number(stepPart);
+  if (!Number.isSafeInteger(step) || step < 1 || !rangePart) throw new Error("invalid cron field");
+  let start;
+  let end;
+  if (rangePart === "*") {
+    start = min;
+    end = max;
+  } else if (rangePart.includes("-")) {
+    const pair = rangePart.split("-");
+    if (pair.length !== 2) throw new Error("invalid cron field");
+    start = Number(pair[0]);
+    end = Number(pair[1]);
+  } else {
+    start = Number(rangePart);
+    end = start;
+  }
+  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < min || end > max || start > end) {
+    throw new Error("invalid cron field");
+  }
+  const values = [];
+  for (let value = start; value <= end; value += step) values.push(normalize ? normalize(value) : value);
+  return values;
+}
+function parseField(source, min, max, normalize) {
+  const values = /* @__PURE__ */ new Set();
+  for (const part of source.split(",")) {
+    for (const value of parsePart(part, min, max, normalize)) values.add(value);
+  }
+  return { any: source === "*", values };
+}
+function validateCronExpression(expression) {
+  const normalized = expression.trim().replace(/\s+/g, " ");
+  const fields = normalized.split(" ");
+  if (fields.length !== 5) throw new Error("cron must contain five fields");
+  parseField(fields[0], 0, 59);
+  parseField(fields[1], 0, 23);
+  parseField(fields[2], 1, 31);
+  parseField(fields[3], 1, 12);
+  parseField(fields[4], 0, 7, (value) => value === 7 ? 0 : value);
+  return normalized;
+}
+function zonedParts(time, timeZone) {
+  const parts = new Intl.DateTimeFormat("en-US", {
+    timeZone,
+    minute: "2-digit",
+    hour: "2-digit",
+    hourCycle: "h23",
+    day: "2-digit",
+    month: "2-digit",
+    weekday: "short"
+  }).formatToParts(time);
+  const byType = new Map(parts.map((part) => [part.type, part.value]));
+  const weekday = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"].indexOf(byType.get("weekday") ?? "");
+  return {
+    minute: Number(byType.get("minute")),
+    hour: Number(byType.get("hour")),
+    day: Number(byType.get("day")),
+    month: Number(byType.get("month")),
+    weekday
+  };
+}
+function cronMatches(expression, timeZone, time) {
+  const fields = validateCronExpression(expression).split(" ");
+  const minute = parseField(fields[0], 0, 59);
+  const hour = parseField(fields[1], 0, 23);
+  const day = parseField(fields[2], 1, 31);
+  const month = parseField(fields[3], 1, 12);
+  const weekday = parseField(fields[4], 0, 7, (value2) => value2 === 7 ? 0 : value2);
+  const value = zonedParts(time, timeZone);
+  const dayMatches = day.values.has(value.day);
+  const weekdayMatches = weekday.values.has(value.weekday);
+  const calendarMatches = day.any && weekday.any ? true : day.any ? weekdayMatches : weekday.any ? dayMatches : dayMatches || weekdayMatches;
+  return minute.values.has(value.minute) && hour.values.has(value.hour) && month.values.has(value.month) && calendarMatches;
+}
+function invocationId(source, automationId, triggerId, nonce) {
+  const safeNonce = nonce.replace(/[^A-Za-z0-9._:-]/g, "_").slice(0, 96);
+  return `rci_${source}_${automationId}_${triggerId}_${safeNonce}`.slice(0, 256);
+}
+function createAutomationTriggerEngine(options) {
+  const now = options.now ?? Date.now;
+  const interval = options.setInterval ?? globalThis.setInterval;
+  const clearInterval2 = options.clearInterval ?? globalThis.clearInterval;
+  const concurrency = Number.isSafeInteger(options.concurrency) && (options.concurrency ?? 0) > 0 ? options.concurrency : 2;
+  const pending = [];
+  const pendingIds = /* @__PURE__ */ new Set();
+  const inFlightIds = /* @__PURE__ */ new Set();
+  let active = 0;
+  let ticking = false;
+  let timer;
+  const queue = (activity, deferDrain = false) => {
+    if (activity.status !== "queued" || pendingIds.has(activity.id) || inFlightIds.has(activity.id)) return;
+    pendingIds.add(activity.id);
+    pending.push(activity);
+    pending.sort((left, right) => left.createdAt - right.createdAt || left.id.localeCompare(right.id));
+    if (!deferDrain) drain();
+  };
+  const drain = () => {
+    while (active < concurrency && pending.length > 0) {
+      const activity = pending.shift();
+      pendingIds.delete(activity.id);
+      inFlightIds.add(activity.id);
+      active += 1;
+      void options.execute(activity).then(({ runId }) => options.store.updateActivity(activity.id, { status: "started", runId })).catch(
+        () => options.store.updateActivity(activity.id, { status: "failed", failureCode: "TRIGGER_EXECUTION_FAILED" })
+      ).finally(() => {
+        inFlightIds.delete(activity.id);
+        active -= 1;
+        drain();
+      });
+    }
+  };
+  const createQueued = (automation, trigger, source, nonce, scheduledFor) => {
+    const id = invocationId(source, automation.id, trigger.id, nonce);
+    const existing = options.store.getActivityByInvocationId(id);
+    if (existing) {
+      queue(existing);
+      return existing;
+    }
+    const activity = options.store.createActivity({
+      automationId: automation.id,
+      triggerId: trigger.id,
+      source,
+      status: "queued",
+      invocationId: id,
+      ...scheduledFor === void 0 ? {} : { scheduledFor }
+    });
+    queue(activity);
+    return activity;
+  };
+  const tick = async (at = now()) => {
+    if (ticking) return;
+    ticking = true;
+    try {
+      const currentMinute = Math.floor(at / 6e4);
+      for (const automation of options.store.list()) {
+        if (!automation.enabled) continue;
+        for (const trigger of automation.triggers) {
+          if (trigger.type !== "schedule" || !trigger.enabled) continue;
+          const previous = options.store.getTriggerCursor(trigger.id) ?? currentMinute - 1;
+          if (previous >= currentMinute) continue;
+          const firstMinute = Math.max(previous + 1, currentMinute - 43200);
+          const matches = [];
+          for (let minute = firstMinute; minute <= currentMinute; minute += 1) {
+            if (cronMatches(trigger.cron, trigger.timeZone, minute * 6e4)) matches.push(minute);
+          }
+          const missed = matches.filter((minute) => minute < currentMinute);
+          if (missed.length > 0) {
+            const missedInvocation = invocationId("schedule", automation.id, trigger.id, `missed-${currentMinute}`);
+            const exists = options.store.listActivities(automation.id, 1e3).some((activity) => activity.invocationId === missedInvocation);
+            if (!exists) {
+              options.store.createActivity({
+                automationId: automation.id,
+                triggerId: trigger.id,
+                source: "schedule",
+                status: "missed",
+                invocationId: missedInvocation,
+                scheduledFor: missed[missed.length - 1] * 6e4,
+                missedCount: missed.length,
+                failureCode: "NODE_OFFLINE_MISSED_SCHEDULE"
+              });
+            }
+          }
+          if (matches.includes(currentMinute)) {
+            createQueued(automation, trigger, "schedule", String(currentMinute), currentMinute * 6e4);
+          }
+          options.store.setTriggerCursor(trigger.id, currentMinute);
+        }
+      }
+    } finally {
+      ticking = false;
+    }
+  };
+  return {
+    start() {
+      if (timer) return;
+      for (const activity of options.store.listActivities(void 0, 1e3)) queue(activity, true);
+      drain();
+      void tick();
+      timer = interval(() => void tick(), 15e3);
+    },
+    stop() {
+      if (!timer) return;
+      clearInterval2(timer);
+      timer = void 0;
+    },
+    tick,
+    enqueueWebhook(automation, trigger, externalInvocationId) {
+      if (trigger.type !== "webhook") throw new Error("invalid webhook trigger");
+      return createQueued(automation, trigger, "webhook", externalInvocationId ?? randomUUID5());
+    }
+  };
+}
+
 // src/updater.ts
 import { spawn as nodeSpawn } from "child_process";
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 import {
   chmodSync as nodeChmodSync,
   existsSync as nodeExistsSync,
@@ -15338,7 +15813,7 @@ import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/managed-runtime.ts
 import { spawn as spawn3 } from "child_process";
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 import {
   chmodSync as chmodSync4,
   existsSync as existsSync5,
@@ -15615,7 +16090,7 @@ function compareVersions(a, b) {
 }
 function atomicWrite(path, value, mode = 384) {
   mkdirSync3(dirname9(path), { recursive: true, mode: 448 });
-  const temp = `${path}.${process.pid}.${randomUUID5()}.tmp`;
+  const temp = `${path}.${process.pid}.${randomUUID6()}.tmp`;
   writeFileSync8(temp, value, { mode });
   chmodSync4(temp, mode);
   renameSync5(temp, path);
@@ -15759,7 +16234,7 @@ async function npmIntegrity(npmCommand, packageName, version, nodePath, log) {
   return parsed;
 }
 async function smokeServer(serverEntry, dataDir, nodePath, log) {
-  const smokeDir = join13(tmpdir(), `roamcode-smoke-${process.pid}-${randomUUID5()}`);
+  const smokeDir = join13(tmpdir(), `roamcode-smoke-${process.pid}-${randomUUID6()}`);
   mkdirSync3(smokeDir, { recursive: true, mode: 448 });
   let output = "";
   const child = spawn3(nodePath, [serverEntry], {
@@ -15767,7 +16242,7 @@ async function smokeServer(serverEntry, dataDir, nodePath, log) {
       ...process.env,
       PORT: "0",
       BIND_ADDRESS: "127.0.0.1",
-      ACCESS_TOKEN: `rc-smoke-${randomUUID5()}`,
+      ACCESS_TOKEN: `rc-smoke-${randomUUID6()}`,
       ROAMCODE_DATA_DIR: smokeDir,
       RC_TMUX_SOCKET: `rc-smoke-${process.pid}`,
       ROAMCODE_INSTALL_ROOT: "",
@@ -15810,7 +16285,7 @@ async function smokeServer(serverEntry, dataDir, nodePath, log) {
   }
 }
 function replaceSymlink(link2, target) {
-  const temp = `${link2}.${process.pid}.${randomUUID5()}.new`;
+  const temp = `${link2}.${process.pid}.${randomUUID6()}.new`;
   try {
     unlinkSync6(temp);
   } catch {
@@ -15826,7 +16301,7 @@ function trimLog(log) {
 async function installManagedRelease(opts) {
   if (!isStableVersion(opts.version)) throw new Error(`invalid release version: ${opts.version}`);
   const now = opts.now ?? Date.now;
-  const operationId = opts.operationId ?? randomUUID5();
+  const operationId = opts.operationId ?? randomUUID6();
   const nodePath = opts.nodePath ?? process.execPath;
   const npmCommand = opts.npmCommand ?? process.env.npm_execpath ?? "npm";
   const expectedIntegrities = opts.expectedIntegrities ?? (opts.expectedIntegrity ? { roamcode: opts.expectedIntegrity } : {});
@@ -15835,7 +16310,7 @@ async function installManagedRelease(opts) {
   mkdirSync3(paths.releases, { recursive: true, mode: 448 });
   mkdirSync3(paths.staging, { recursive: true, mode: 448 });
   const release = join13(paths.releases, opts.version);
-  const stage = join13(paths.staging, `${opts.version}-${process.pid}-${randomUUID5()}`);
+  const stage = join13(paths.staging, `${opts.version}-${process.pid}-${randomUUID6()}`);
   let logText = "";
   const log = (line) => {
     logText += line.endsWith("\n") ? line : `${line}
@@ -15970,7 +16445,7 @@ async function installManagedRelease(opts) {
 }
 
 // src/updater.ts
-var RUNNING_VERSION = "1.3.0" ? "1.3.0".replace(/^v/, "") : packageVersion();
+var RUNNING_VERSION = "1.4.0" ? "1.4.0".replace(/^v/, "") : packageVersion();
 var RUNNING_BUILD = RUNNING_VERSION;
 var RELEASES_API = "https://api.github.com/repos/burakgon/roamcode/releases?per_page=100";
 var RELEASE_MANIFEST_ASSET = "roamcode-release.json";
@@ -16271,7 +16746,7 @@ var Updater = class {
     const path = join14(this.dataDir, "update-status.json");
     const value = JSON.stringify(status, null, 2) + "\n";
     if (this.fs.renameSync) {
-      const temp = `${path}.${process.pid}.${randomUUID6()}.tmp`;
+      const temp = `${path}.${process.pid}.${randomUUID7()}.tmp`;
       this.fs.writeFileSync(temp, value, 384);
       this.fs.renameSync(temp, path);
     } else {
@@ -16334,7 +16809,7 @@ var Updater = class {
         return { started: false, reason: error instanceof Error ? error.message : String(error) };
       }
     }
-    const operationId = randomUUID6();
+    const operationId = randomUUID7();
     const status = {
       operationId,
       state: "starting",
@@ -19758,9 +20233,12 @@ function buildOpenApiDocument(options) {
           responses: {
             "201": response("Created session automation", {
               type: "object",
-              required: ["automation"],
+              required: ["automation", "webhookSecrets"],
               additionalProperties: false,
-              properties: { automation: ref("SessionAutomationDefinition") }
+              properties: {
+                automation: ref("SessionAutomationDefinition"),
+                webhookSecrets: { type: "array", items: ref("SessionAutomationWebhookSecret") }
+              }
             }),
             "404": response("Node or runtime not found", ref("Error")),
             ...errorResponses
@@ -19789,9 +20267,12 @@ function buildOpenApiDocument(options) {
           responses: {
             "200": response("Updated session automation", {
               type: "object",
-              required: ["automation"],
+              required: ["automation", "webhookSecrets"],
               additionalProperties: false,
-              properties: { automation: ref("SessionAutomationDefinition") }
+              properties: {
+                automation: ref("SessionAutomationDefinition"),
+                webhookSecrets: { type: "array", items: ref("SessionAutomationWebhookSecret") }
+              }
             }),
             "404": response("Automation, node, or runtime not found", ref("Error")),
             ...errorResponses
@@ -19807,6 +20288,76 @@ function buildOpenApiDocument(options) {
           }
         }
       },
+      "/api/v2/automations/{automationId}/activity": {
+        get: {
+          operationId: "listSessionAutomationActivityV2",
+          description: "Returns durable schedule and webhook delivery activity, including explicit missed schedules.",
+          parameters: [
+            idParameter("automationId"),
+            { name: "limit", in: "query", schema: { type: "integer", minimum: 1, maximum: 100, default: 25 } }
+          ],
+          responses: {
+            "200": response("Bounded automation trigger activity", {
+              type: "object",
+              required: ["activities"],
+              additionalProperties: false,
+              properties: { activities: { type: "array", items: ref("SessionAutomationActivity") } }
+            }),
+            "404": response("Automation not found", ref("Error")),
+            ...errorResponses
+          }
+        }
+      },
+      "/api/v2/automations/{automationId}/triggers/{triggerId}/secret": {
+        post: {
+          operationId: "rotateSessionAutomationWebhookSecretV2",
+          parameters: [idParameter("automationId"), idParameter("triggerId"), idempotency],
+          requestBody: {
+            required: true,
+            content: json({
+              type: "object",
+              required: ["expectedRevision"],
+              additionalProperties: false,
+              properties: { expectedRevision: { type: "integer", minimum: 1 } }
+            })
+          },
+          responses: {
+            "200": response("Rotated webhook secret shown exactly once", {
+              type: "object",
+              required: ["automation", "webhookSecret"],
+              additionalProperties: false,
+              properties: {
+                automation: ref("SessionAutomationDefinition"),
+                webhookSecret: ref("SessionAutomationWebhookSecret")
+              }
+            }),
+            "404": response("Automation or webhook trigger not found", ref("Error")),
+            ...errorResponses
+          }
+        }
+      },
+      "/api/v2/automation-hooks/{hookId}": {
+        post: {
+          operationId: "signalSessionAutomationWebhookV2",
+          description: "Queues a signal-only webhook. The request body is discarded and never becomes task instruction or stored prompt content.",
+          security: [{ webhookAuth: [] }],
+          parameters: [idParameter("hookId")],
+          requestBody: {
+            required: false,
+            content: json({ description: "Ignored signal payload", nullable: true })
+          },
+          responses: {
+            "202": response("Webhook signal accepted", {
+              type: "object",
+              required: ["accepted"],
+              additionalProperties: false,
+              properties: { accepted: { const: true } }
+            }),
+            "401": response("Unknown hook or invalid webhook secret", ref("Error")),
+            "429": response("Webhook rate limit reached", ref("Error"))
+          }
+        }
+      },
       "/api/v2/automations/{automationId}/runs": {
         get: {
           operationId: "listSessionAutomationRunsV2",
@@ -19864,7 +20415,8 @@ function buildOpenApiDocument(options) {
     },
     components: {
       securitySchemes: {
-        bearerAuth: { type: "http", scheme: "bearer", bearerFormat: "RoamCode device credential" }
+        bearerAuth: { type: "http", scheme: "bearer", bearerFormat: "RoamCode device credential" },
+        webhookAuth: { type: "http", scheme: "bearer", bearerFormat: "One-time-shown webhook secret" }
       },
       schemas: {
         Error: {
@@ -20838,6 +21390,62 @@ function buildOpenApiDocument(options) {
           additionalProperties: false,
           properties: { type: { const: "manual" } }
         },
+        SessionAutomationConfiguredTrigger: {
+          oneOf: [
+            {
+              type: "object",
+              required: ["id", "type", "enabled", "cron", "timeZone", "missedRunPolicy"],
+              additionalProperties: false,
+              properties: {
+                id: { type: "string", minLength: 1, maxLength: 256 },
+                type: { const: "schedule" },
+                enabled: { type: "boolean" },
+                cron: { type: "string", minLength: 9, maxLength: 120 },
+                timeZone: { type: "string", minLength: 1, maxLength: 80 },
+                missedRunPolicy: { const: "skip" }
+              }
+            },
+            {
+              type: "object",
+              required: ["id", "type", "enabled", "hookId"],
+              additionalProperties: false,
+              properties: {
+                id: { type: "string", minLength: 1, maxLength: 256 },
+                type: { const: "webhook" },
+                enabled: { type: "boolean" },
+                hookId: { type: "string", pattern: "^rcwh_[A-Za-z0-9_-]{24,80}$" }
+              }
+            }
+          ]
+        },
+        SessionAutomationTriggerInput: {
+          oneOf: [
+            {
+              type: "object",
+              required: ["type", "enabled", "cron", "timeZone", "missedRunPolicy"],
+              additionalProperties: false,
+              properties: {
+                id: { type: "string", minLength: 1, maxLength: 256 },
+                type: { const: "schedule" },
+                enabled: { type: "boolean" },
+                cron: { type: "string", minLength: 9, maxLength: 120 },
+                timeZone: { type: "string", minLength: 1, maxLength: 80 },
+                missedRunPolicy: { const: "skip" }
+              }
+            },
+            {
+              type: "object",
+              required: ["type", "enabled"],
+              additionalProperties: false,
+              properties: {
+                id: { type: "string", minLength: 1, maxLength: 256 },
+                type: { const: "webhook" },
+                enabled: { type: "boolean" },
+                hookId: { type: "string", pattern: "^rcwh_[A-Za-z0-9_-]{24,80}$" }
+              }
+            }
+          ]
+        },
         SessionAutomationDefinition: {
           type: "object",
           required: [
@@ -20850,6 +21458,7 @@ function buildOpenApiDocument(options) {
             "provider",
             "cwd",
             "trigger",
+            "triggers",
             "instruction",
             "runtimeOptions",
             "revision",
@@ -20867,6 +21476,7 @@ function buildOpenApiDocument(options) {
             provider: { type: "string", pattern: "^[a-z][a-z0-9-]{0,63}$" },
             cwd: { type: "string", minLength: 1 },
             trigger: ref("SessionAutomationTrigger"),
+            triggers: { type: "array", maxItems: 16, items: ref("SessionAutomationConfiguredTrigger") },
             instruction: {
               type: "string",
               minLength: 1,
@@ -20891,6 +21501,7 @@ function buildOpenApiDocument(options) {
             agentRuntimeId: { type: "string", pattern: "^runtime_[A-Za-z0-9_-]{24}$" },
             cwd: { type: "string", minLength: 1 },
             trigger: ref("SessionAutomationTrigger"),
+            triggers: { type: "array", maxItems: 16, items: ref("SessionAutomationTriggerInput") },
             instruction: {
               type: "string",
               minLength: 1,
@@ -20914,6 +21525,7 @@ function buildOpenApiDocument(options) {
             agentRuntimeId: { type: "string", pattern: "^runtime_[A-Za-z0-9_-]{24}$" },
             cwd: { type: "string", minLength: 1 },
             trigger: ref("SessionAutomationTrigger"),
+            triggers: { type: "array", maxItems: 16, items: ref("SessionAutomationTriggerInput") },
             instruction: {
               type: "string",
               minLength: 1,
@@ -20924,6 +21536,36 @@ function buildOpenApiDocument(options) {
             runtimeOptions: { type: "object", additionalProperties: true, "x-maxBytes": 65536 }
           }
         },
+        SessionAutomationWebhookSecret: {
+          type: "object",
+          required: ["triggerId", "hookId", "secret", "path"],
+          additionalProperties: false,
+          properties: {
+            triggerId: { type: "string", minLength: 1, maxLength: 256 },
+            hookId: { type: "string", pattern: "^rcwh_[A-Za-z0-9_-]{24,80}$" },
+            secret: { type: "string", pattern: "^rcws_[A-Za-z0-9_-]{43}$" },
+            path: { type: "string", pattern: "^/api/v2/automation-hooks/rcwh_[A-Za-z0-9_-]{24,80}$" }
+          }
+        },
+        SessionAutomationActivity: {
+          type: "object",
+          required: ["id", "automationId", "triggerId", "source", "status", "invocationId", "createdAt", "updatedAt"],
+          additionalProperties: false,
+          properties: {
+            id: { type: "string", minLength: 1, maxLength: 256 },
+            automationId: { type: "string", minLength: 1, maxLength: 256 },
+            triggerId: { type: "string", minLength: 1, maxLength: 256 },
+            source: { enum: ["schedule", "webhook"] },
+            status: { enum: ["queued", "started", "failed", "missed", "expired"] },
+            invocationId: { type: "string", minLength: 1, maxLength: 256 },
+            scheduledFor: { type: "integer", minimum: 0 },
+            missedCount: { type: "integer", minimum: 1 },
+            runId: { type: "string", minLength: 1, maxLength: 256 },
+            failureCode: { type: "string", pattern: "^[A-Z][A-Z0-9_]{0,79}$" },
+            createdAt: { type: "integer", minimum: 0 },
+            updatedAt: { type: "integer", minimum: 0 }
+          }
+        },
         SessionAutomationRun: {
           description: "Privacy-bounded run state with its exact execution binding; terminal transcript, instruction, and provider detail are omitted.",
           type: "object",
@@ -21358,9 +22000,9 @@ function cloudStatusResponse(status) {
     };
   }
   const authorization = status.authorization;
-  const syncFailures = status.authorizationFailures > 0 || status.heartbeatFailures > 0;
+  const syncFailures = status.authorizationFailures > 0 || status.heartbeatFailures > 0 || status.automationFailures > 0;
   const syncState = authorization.status === "expired" ? "expired" : authorization.status === "pending" ? "pending" : authorization.status === "unavailable" ? syncFailures ? "degraded" : "syncing" : syncFailures ? "degraded" : "healthy";
-  const action = status.authorizationIssue === "credential-rejected" || status.authorizationIssue === "trust-expired" ? "reauthorize-host" : status.authorizationIssue === "invalid-control-plane-response" || status.authorizationIssue === "authorization-verification-failed" ? "contact-organization-admin" : status.authorizationIssue === "connectivity" ? "check-host-connectivity" : status.heartbeatFailures > 0 ? "check-host-connectivity" : authorization.status === "unavailable" ? "wait-for-cloud-sync" : authorization.status === "pending" ? "wait-for-authorization-activation" : authorization.status === "expired" ? "check-host-connectivity" : "none";
+  const action = status.authorizationIssue === "credential-rejected" || status.authorizationIssue === "trust-expired" ? "reauthorize-host" : status.authorizationIssue === "invalid-control-plane-response" || status.authorizationIssue === "authorization-verification-failed" ? "contact-organization-admin" : status.authorizationIssue === "connectivity" ? "check-host-connectivity" : status.heartbeatFailures > 0 || status.automationFailures > 0 ? "check-host-connectivity" : authorization.status === "unavailable" ? "wait-for-cloud-sync" : authorization.status === "pending" ? "wait-for-authorization-activation" : authorization.status === "expired" ? "check-host-connectivity" : "none";
   return {
     v: 1,
     mode: "managed",
@@ -21797,6 +22439,7 @@ function createServer(config, deps = {}) {
     enabled: config.rateLimitRpm > 0
   });
   const pairingRateLimiter = new RateLimiter({ capacity: 30, windowMs: 6e4, burst: 10 });
+  const automationWebhookRateLimiter = new RateLimiter({ capacity: 120, windowMs: 6e4, burst: 30 });
   const fsService = new FsService({ root: config.fsRoot });
   const terminalSharedRoot = terminalSharedBase({ dataDir, fsRoot: config.fsRoot });
   const backfilledFileSessions = /* @__PURE__ */ new Set();
@@ -21816,7 +22459,7 @@ function createServer(config, deps = {}) {
         const now = Date.now();
         const media = attachmentMedia(file.filename);
         store.putFile({
-          id: randomUUID7(),
+          id: randomUUID8(),
           sessionId,
           direction: "sent",
           storage: "managed",
@@ -21888,6 +22531,7 @@ function createServer(config, deps = {}) {
   }
   const relayInternalCapability = randomBytes17(32).toString("base64url");
   const authenticatedPrincipals = /* @__PURE__ */ new WeakMap();
+  const automationWebhookRequests = /* @__PURE__ */ new WeakMap();
   const hostPrincipal = () => ({
     actorType: config.accessToken ? "host" : "local",
     actorId: commandStore.getHost().id,
@@ -22034,6 +22678,28 @@ function createServer(config, deps = {}) {
       if (request.is404 && isPublicPath(path)) return;
     }
     if (path === "/health") return;
+    const automationHookMatch = /^\/api\/v2\/automation-hooks\/(rcwh_[A-Za-z0-9_-]{24,80})$/.exec(path);
+    if (request.method === "POST" && automationHookMatch && !hasEncodedSep(request.url)) {
+      const limit = automationWebhookRateLimiter.take(request.ip);
+      if (!limit.allowed) {
+        reply.header("retry-after", String(limit.retryAfterSeconds)).code(429).send({ error: "rate limited" });
+        return;
+      }
+      const hookId = automationHookMatch[1];
+      const match = sessionAutomationStore.list().flatMap((automation) => automation.triggers.map((trigger) => ({ automation, trigger }))).find(
+        (entry) => entry.automation.enabled && entry.trigger.type === "webhook" && entry.trigger.enabled && entry.trigger.hookId === hookId
+      );
+      const secret = extractBearerToken(request.headers.authorization);
+      const presented = secret ? createHash10("sha256").update(secret).digest() : Buffer.alloc(0);
+      const expected = match?.trigger.type === "webhook" ? Buffer.from(match.trigger.secretHash, "hex") : Buffer.alloc(32);
+      if (!match || presented.length !== expected.length || !timingSafeEqual6(presented, expected)) {
+        reply.code(401).send({ error: "unauthorized" });
+        return;
+      }
+      automationWebhookRequests.set(request, match);
+      authenticatedPrincipals.set(request, hostPrincipal());
+      return;
+    }
     if (request.method === "POST" && path === "/pairing/claim" && !hasEncodedSep(request.url)) {
       const originAllowed2 = isOriginAllowed(request.headers.origin, request.headers.host, {
         publicUrl: config.publicUrl,
@@ -22424,7 +23090,7 @@ function createServer(config, deps = {}) {
           return;
         }
         const principal = authenticatedPrincipals.get(request) ?? hostPrincipal();
-        const holderId = `ws:${randomUUID7()}`;
+        const holderId = `ws:${randomUUID8()}`;
         let leaseId;
         let lastLeaseRevision = 0;
         const sendLeaseState = (reason, revision) => {
@@ -22719,7 +23385,7 @@ function createServer(config, deps = {}) {
       reply.code(400).send({ code: "INVALID_PROVIDER", error: "Invalid provider" });
       return;
     }
-    const id = requestedSessionId ?? randomUUID7();
+    const id = requestedSessionId ?? randomUUID8();
     const existingMeta = requestedSessionId ? terminalManager.get(id) : void 0;
     if (!terminalAvailable) {
       reply.code(400).send({
@@ -23386,7 +24052,7 @@ function createServer(config, deps = {}) {
   const peerIdempotencyKey = (request, peerId) => {
     const actor = actorForRequest(request);
     const provided = request.headers["idempotency-key"];
-    const key = typeof provided === "string" ? provided : randomUUID7();
+    const key = typeof provided === "string" ? provided : randomUUID8();
     return `peer-${createHash10("sha256").update(`${peerId}\0${actor.actorType}\0${actor.actorId}\0${key}`).digest("base64url")}`;
   };
   const workspaceAllowedByPeer = (peer, workspaceId) => typeof workspaceId === "string" && (peer.allowedWorkspaceIds === null || peer.allowedWorkspaceIds.includes(workspaceId));
@@ -25477,7 +26143,7 @@ data: ${JSON.stringify(data)}
         });
         return;
       }
-      holderId = `api-once:${randomUUID7()}`;
+      holderId = `api-once:${randomUUID8()}`;
       const acquired = inputLeases.acquire(request.params.id, holderId, principal);
       if (acquired.status === "denied") {
         reply.code(409).send({ code: "INPUT_LEASE_REQUIRED", error: "terminal input is already controlled" });
@@ -25631,7 +26297,7 @@ data: ${JSON.stringify(data)}
         return;
       }
       const isImage = body.kind === "image" ? true : body.kind === "file" ? false : described.isImage;
-      const id = randomUUID7();
+      const id = randomUUID8();
       const now = Date.now();
       const media = attachmentMedia(described.name);
       const stored2 = {
@@ -26085,9 +26751,78 @@ data: ${JSON.stringify(data)}
     const owner = currentNodeOwner();
     return automation && automation.owner.type === owner.type && automation.owner.id === owner.id ? automation : void 0;
   };
+  const projectAutomationDefinition = (automation) => ({
+    ...automation,
+    triggers: automation.triggers.map((trigger) => {
+      if (trigger.type !== "webhook") return trigger;
+      const { secretHash, ...publicTrigger } = trigger;
+      void secretHash;
+      return publicTrigger;
+    })
+  });
+  const newTriggerId = () => `rct_${randomBytes17(12).toString("base64url")}`;
+  const newWebhookHookId = () => `rcwh_${randomBytes17(24).toString("base64url")}`;
+  const newWebhookSecret = () => `rcws_${randomBytes17(32).toString("base64url")}`;
+  const prepareAutomationTriggers = (value, current) => {
+    if (!Array.isArray(value) || value.length > 16) throw new Error("invalid automation triggers");
+    const existing = new Map(current?.triggers.map((trigger) => [trigger.id, trigger]) ?? []);
+    const ids = /* @__PURE__ */ new Set();
+    const webhookSecrets = [];
+    const triggers = value.map((candidate) => {
+      if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
+        throw new Error("invalid automation trigger");
+      }
+      const raw = candidate;
+      const requestedId = typeof raw.id === "string" && /^[A-Za-z0-9._:-]{1,256}$/.test(raw.id) ? raw.id : void 0;
+      const id = requestedId ?? newTriggerId();
+      if (ids.has(id)) throw new Error("duplicate automation trigger id");
+      ids.add(id);
+      if (typeof raw.enabled !== "boolean") throw new Error("invalid automation trigger state");
+      if (raw.type === "schedule") {
+        if (typeof raw.cron !== "string" || typeof raw.timeZone !== "string" || raw.timeZone.length > 80 || raw.missedRunPolicy !== "skip" || Object.keys(raw).some(
+          (key) => !["id", "type", "enabled", "cron", "timeZone", "missedRunPolicy"].includes(key)
+        )) {
+          throw new Error("invalid schedule trigger");
+        }
+        new Intl.DateTimeFormat("en-US", { timeZone: raw.timeZone }).format(0);
+        return {
+          id,
+          type: "schedule",
+          enabled: raw.enabled,
+          cron: validateCronExpression(raw.cron),
+          timeZone: raw.timeZone,
+          missedRunPolicy: "skip"
+        };
+      }
+      if (raw.type === "webhook") {
+        if (Object.keys(raw).some((key) => !["id", "type", "enabled", "hookId"].includes(key))) {
+          throw new Error("invalid webhook trigger");
+        }
+        const previous = existing.get(id);
+        if (previous?.type === "webhook") {
+          if (raw.hookId !== void 0 && raw.hookId !== previous.hookId) {
+            throw new Error("webhook identity cannot be replaced");
+          }
+          return { ...previous, enabled: raw.enabled };
+        }
+        const hookId = newWebhookHookId();
+        const secret = newWebhookSecret();
+        webhookSecrets.push({ triggerId: id, hookId, secret, path: `/api/v2/automation-hooks/${hookId}` });
+        return {
+          id,
+          type: "webhook",
+          enabled: raw.enabled,
+          hookId,
+          secretHash: createHash10("sha256").update(secret).digest("hex")
+        };
+      }
+      throw new Error("invalid automation trigger");
+    });
+    return { triggers, webhookSecrets };
+  };
   const automationInvocationIdentity = (request, automationId) => {
     const idempotency2 = mutationContexts.get(request)?.idempotency;
-    if (!idempotency2) return { invocationId: randomUUID7(), sessionId: randomUUID7() };
+    if (!idempotency2) return { invocationId: randomUUID8(), sessionId: randomUUID8() };
     const actor = actorForRequest(request);
     const digest3 = createHash10("sha256").update("roamcode-automation-invocation-v1\0").update(JSON.stringify([actor.actorType, actor.actorId, idempotency2.key, idempotency2.fingerprint, automationId])).digest("hex");
     const uuidHex = digest3.slice(0, 32).split("");
@@ -26356,10 +27091,13 @@ data: ${JSON.stringify(data)}
     "cwd",
     "instruction",
     "runtimeOptions",
-    "trigger"
+    "trigger",
+    "triggers"
   ]);
   const automationUpdateKeys = /* @__PURE__ */ new Set([...automationCreateKeys, "expectedRevision"]);
-  app.get("/api/v2/automations", async () => ({ automations: sessionAutomationStore.list(currentNodeOwner()) }));
+  app.get("/api/v2/automations", async () => ({
+    automations: sessionAutomationStore.list(currentNodeOwner()).map(projectAutomationDefinition)
+  }));
   app.post("/api/v2/automations", { bodyLimit: 128 * 1024 }, async (request, reply) => {
     if (!validObjectBody(request.body)) return sendInvalidAutomation(reply);
     if ("owner" in request.body || "provider" in request.body) {
@@ -26379,15 +27117,17 @@ data: ${JSON.stringify(data)}
     );
     if (!target) return;
     try {
+      const prepared = prepareAutomationTriggers(request.body.triggers ?? [], void 0);
       const automation = sessionAutomationStore.create({
         owner: currentNodeOwner(),
         name: request.body.name,
         ...request.body.enabled === void 0 ? {} : { enabled: request.body.enabled },
         ...target,
         instruction: request.body.instruction,
-        ...request.body.trigger === void 0 ? { trigger: { type: "manual" } } : { trigger: request.body.trigger }
+        ...request.body.trigger === void 0 ? { trigger: { type: "manual" } } : { trigger: request.body.trigger },
+        triggers: prepared.triggers
       });
-      reply.code(201).send({ automation });
+      reply.code(201).send({ automation: projectAutomationDefinition(automation), webhookSecrets: prepared.webhookSecrets });
     } catch {
       sendInvalidAutomation(reply);
     }
@@ -26398,7 +27138,7 @@ data: ${JSON.stringify(data)}
       reply.code(404).send({ code: "SESSION_AUTOMATION_NOT_FOUND", error: "automation not found" });
       return;
     }
-    return { automation };
+    return { automation: projectAutomationDefinition(automation) };
   });
   app.patch(
     "/api/v2/automations/:automationId",
@@ -26436,18 +27176,20 @@ data: ${JSON.stringify(data)}
         ...target
       };
       try {
+        const prepared = prepareAutomationTriggers(request.body.triggers ?? current.triggers, current);
+        input.triggers = prepared.triggers;
         const automation = sessionAutomationStore.update(current.id, input, request.body.expectedRevision);
         if (!automation) {
           reply.code(404).send({ code: "SESSION_AUTOMATION_NOT_FOUND", error: "automation not found" });
           return;
         }
-        return { automation };
+        return { automation: projectAutomationDefinition(automation), webhookSecrets: prepared.webhookSecrets };
       } catch (error) {
         if (error instanceof SessionAutomationRevisionConflictError) {
           reply.code(409).send({
             code: "SESSION_AUTOMATION_REVISION_CONFLICT",
             error: "automation state changed",
-            current: error.current
+            current: projectAutomationDefinition(error.current)
           });
           return;
         }
@@ -26462,6 +27204,70 @@ data: ${JSON.stringify(data)}
     }
     reply.code(204).send();
   });
+  app.get(
+    "/api/v2/automations/:automationId/activity",
+    async (request, reply) => {
+      const automation = ownedAutomationIncludingRemoved(request.params.automationId);
+      if (!automation) {
+        reply.code(404).send({ code: "SESSION_AUTOMATION_NOT_FOUND", error: "automation not found" });
+        return;
+      }
+      const limit = request.query.limit === void 0 ? 25 : Number(request.query.limit);
+      if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100) {
+        reply.code(400).send({ code: "INVALID_AUTOMATION_ACTIVITY_LIMIT", error: "limit must be between 1 and 100" });
+        return;
+      }
+      return { activities: sessionAutomationStore.listActivities(automation.id, limit) };
+    }
+  );
+  app.post(
+    "/api/v2/automations/:automationId/triggers/:triggerId/secret",
+    { bodyLimit: 1024 },
+    async (request, reply) => {
+      const current = ownedAutomation(request.params.automationId);
+      if (!current) {
+        reply.code(404).send({ code: "SESSION_AUTOMATION_NOT_FOUND", error: "automation not found" });
+        return;
+      }
+      if (!validObjectBody(request.body) || !hasOnlyKeys(request.body, /* @__PURE__ */ new Set(["expectedRevision"])) || !Number.isSafeInteger(request.body.expectedRevision) || request.body.expectedRevision !== current.revision) {
+        return sendInvalidAutomation(reply, "a current expectedRevision is required");
+      }
+      const selected = current.triggers.find(
+        (trigger) => trigger.id === request.params.triggerId && trigger.type === "webhook"
+      );
+      if (!selected || selected.type !== "webhook") {
+        reply.code(404).send({ code: "AUTOMATION_TRIGGER_NOT_FOUND", error: "webhook trigger not found" });
+        return;
+      }
+      const secret = newWebhookSecret();
+      const triggers = current.triggers.map(
+        (trigger) => trigger.id === selected.id ? { ...selected, secretHash: createHash10("sha256").update(secret).digest("hex") } : trigger
+      );
+      try {
+        const automation = sessionAutomationStore.update(current.id, { triggers }, current.revision);
+        if (!automation) throw new Error("automation disappeared");
+        return {
+          automation: projectAutomationDefinition(automation),
+          webhookSecret: {
+            triggerId: selected.id,
+            hookId: selected.hookId,
+            secret,
+            path: `/api/v2/automation-hooks/${selected.hookId}`
+          }
+        };
+      } catch (error) {
+        if (error instanceof SessionAutomationRevisionConflictError) {
+          reply.code(409).send({
+            code: "SESSION_AUTOMATION_REVISION_CONFLICT",
+            error: "automation state changed",
+            current: projectAutomationDefinition(error.current)
+          });
+          return;
+        }
+        sendInvalidAutomation(reply);
+      }
+    }
+  );
   app.get(
     "/api/v2/automations/:automationId/runs",
     async (request, reply) => {
@@ -26690,6 +27496,46 @@ data: ${JSON.stringify(data)}
       );
     }
   );
+  const parsedAutomationConcurrency = Number.parseInt(process.env.ROAMCODE_AUTOMATION_CONCURRENCY ?? "2", 10);
+  const automationTriggerEngine = createAutomationTriggerEngine({
+    store: sessionAutomationStore,
+    concurrency: Number.isSafeInteger(parsedAutomationConcurrency) && parsedAutomationConcurrency > 0 ? parsedAutomationConcurrency : 2,
+    execute: async (activity) => {
+      const response2 = await app.inject({
+        method: "POST",
+        url: `/api/v2/automations/${encodeURIComponent(activity.automationId)}/runs`,
+        headers: {
+          "idempotency-key": activity.id,
+          ...config.accessToken ? { authorization: `Bearer ${config.accessToken}` } : {}
+        }
+      });
+      const body = (() => {
+        try {
+          return response2.json();
+        } catch {
+          return {};
+        }
+      })();
+      if (response2.statusCode !== 201 || typeof body.run?.id !== "string") {
+        throw new Error("automation trigger execution failed");
+      }
+      return { runId: body.run.id };
+    }
+  });
+  app.post(
+    "/api/v2/automation-hooks/:hookId",
+    { bodyLimit: 64 * 1024 },
+    async (request, reply) => {
+      const authorized = automationWebhookRequests.get(request);
+      if (!authorized || authorized.trigger.type !== "webhook" || authorized.trigger.hookId !== request.params.hookId) {
+        reply.code(401).send({ error: "unauthorized" });
+        return;
+      }
+      automationTriggerEngine.enqueueWebhook(authorized.automation, authorized.trigger);
+      reply.code(202).send({ accepted: true });
+    }
+  );
+  app.addHook("onReady", async () => automationTriggerEngine.start());
   app.get("/providers", async () => {
     return { providers: await readProviderAvailability() };
   });
@@ -27048,7 +27894,7 @@ data: ${JSON.stringify(data)}
       reply.code(400).send({ error: "no file field in the upload" });
       return;
     }
-    const id = randomUUID7();
+    const id = randomUUID8();
     try {
       const dir = await fsService.ensureDirWithinRoot(
         `${terminalSharedDir({ dataDir, fsRoot: config.fsRoot, sessionId })}/${id}`
@@ -27100,7 +27946,7 @@ data: ${JSON.stringify(data)}
       reply.code(400).send({ error: "an edited image is required" });
       return;
     }
-    const id = randomUUID7();
+    const id = randomUUID8();
     try {
       const dir = await fsService.ensureDirWithinRoot(
         `${terminalSharedDir({ dataDir, fsRoot: config.fsRoot, sessionId: source.sessionId })}/${id}`
@@ -27226,6 +28072,7 @@ data: ${JSON.stringify(data)}
   );
   if (deps.webDir) registerStatic(app, { webDir: deps.webDir });
   app.addHook("onClose", async () => {
+    automationTriggerEngine.stop();
     clearInterval(sharedSweepTimer);
     inputLeases.close();
     unsubscribeAutomations();
@@ -27321,6 +28168,25 @@ data: ${JSON.stringify(data)}
     authGate,
     terminalManager,
     terminalAvailable,
+    automationWebhookRegistrations: () => sessionAutomationStore.list().flatMap(
+      (automation) => automation.triggers.filter((trigger) => trigger.type === "webhook").map((trigger) => ({
+        hookId: trigger.hookId,
+        automationId: automation.id,
+        triggerId: trigger.id,
+        secretHash: trigger.secretHash,
+        enabled: automation.enabled && trigger.enabled
+      }))
+    ),
+    acceptCloudAutomationInvocation: async (invocation) => {
+      const automation = sessionAutomationStore.get(invocation.automationId);
+      const trigger = automation?.triggers.find(
+        (candidate) => candidate.type === "webhook" && candidate.id === invocation.triggerId && candidate.hookId === invocation.hookId
+      );
+      if (!automation?.enabled || !trigger?.enabled || trigger.type !== "webhook") {
+        throw new Error("managed automation webhook is no longer active");
+      }
+      automationTriggerEngine.enqueueWebhook(automation, trigger, invocation.id);
+    },
     inputLeases,
     teamStore,
     policyStore,
@@ -27345,7 +28211,7 @@ function fileEntityTag(size, mtimeMs) {
 import { pathToFileURL as pathToFileURL2, fileURLToPath as fileURLToPath4 } from "url";
 import { join as join20 } from "path";
 import { existsSync as existsSync7 } from "fs";
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 
 // src/push-store.ts
 import { createRequire as createRequire15 } from "module";
@@ -27667,7 +28533,7 @@ function createUsageService(opts) {
 
 // src/claude-auth-service.ts
 import { spawn as nodeSpawn2 } from "child_process";
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 function parseAuthStatus(stdout) {
   try {
     const o = JSON.parse(stdout);
@@ -27744,7 +28610,7 @@ var ClaudeAuthService = class {
         reject(err instanceof Error ? err : new Error("failed to spawn claude"));
         return;
       }
-      const id = randomUUID8();
+      const id = randomUUID9();
       let settled = false;
       let buf = "";
       const onData = (d) => {
@@ -29106,7 +29972,7 @@ var CodexMetadataService = class {
 
 // src/providers/claude-metadata-service.ts
 import { execFile as nodeExecFile2, spawn as nodeSpawn3 } from "child_process";
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 import { StringDecoder } from "string_decoder";
 var SAFE_VALUE = /^[A-Za-z0-9][A-Za-z0-9._:/\u005b\u005d-]*$/;
 var MAX_MODELS = 64;
@@ -29314,7 +30180,7 @@ function createClaudeMetadataRunner(options) {
           reject(metadataUnavailable2());
           return;
         }
-        const requestId = `roamcode-models-${randomUUID9()}`;
+        const requestId = `roamcode-models-${randomUUID10()}`;
         const decoder = new StringDecoder("utf8");
         let stdoutBuffer = "";
         let outputBytes = 0;
@@ -29566,7 +30432,7 @@ var CodexLatestService = class {
 import { execFile } from "child_process";
 import { constants as constants10 } from "fs";
 import { access as access2, chmod, copyFile, link, realpath as realpath7, rename as rename3, rm as rm2, rmdir as rmdir2, stat as stat7 } from "fs/promises";
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 import { basename as basename5, delimiter, dirname as dirname12, isAbsolute as isAbsolute9, join as join19, sep as sep5 } from "path";
 var CODEX_EXECUTABLE_PROBE_TIMEOUT_MS = 5e3;
 var OPENAI_CODE_SIGNING_TEAM_ID = "2DC432GLL2";
@@ -29676,7 +30542,7 @@ async function removeLegacyManagedCopy(dataDir) {
 }
 async function repairHomebrewExecutable(source, sourceStat, env, deps) {
   if (!await deps.verifyOfficialSignature(source)) return false;
-  const nonce = randomUUID10();
+  const nonce = randomUUID11();
   const directory = dirname12(source);
   const name = basename5(source);
   const temporary = join19(directory, `.${name}.roamcode-repair-${nonce}`);
@@ -29906,13 +30772,14 @@ function cloudHostCapabilities(input) {
   return [
     `authorization.v${input.authorizationVersion}`,
     ...input.terminalAvailable ? ["terminal.v1"] : [],
+    ...input.terminalAvailable ? ["automation-schedule.v1", "automation-webhook.v1"] : [],
     ...input.relayEnabled ? ["relay.v1"] : [],
     ...input.managedDeviceEnrollmentEnabled && input.relayEnabled && input.terminalAvailable ? ["managed-device-enrollment.v1"] : []
   ];
 }
 async function startServer(env = process.env, options = {}) {
   const config = loadServerConfig(env);
-  const healthInstanceId = randomUUID11();
+  const healthInstanceId = randomUUID12();
   ensureDataDir(config.dataDir);
   const loopback = isLoopbackAddress(config.bindAddress);
   let token;
@@ -30185,6 +31052,7 @@ async function startServer(env = process.env, options = {}) {
       cloudStatus: () => cloudHostRuntime?.status() ?? {
         running: false,
         heartbeatFailures: 0,
+        automationFailures: 0,
         authorizationFailures: 0,
         authorization: cloudAuthorizationStore.getState()
       }
@@ -30217,6 +31085,8 @@ async function startServer(env = process.env, options = {}) {
         relayEnabled: relayConfig !== void 0,
         managedDeviceEnrollmentEnabled: cloudDeviceEnrollmentConfirmer !== void 0 && relayProvisioner !== void 0
       }),
+      automationWebhooks: () => result.automationWebhookRegistrations(),
+      onAutomationInvocation: (invocation) => result.acceptCloudAutomationInvocation(invocation),
       ...relayConfig ? {
         relayHostIdentity: {
           publicKey: relayConfig.hostIdentity.publicKey,
@@ -30372,6 +31242,7 @@ export {
   CLOUD_DEVICE_ENROLLMENT_CONFIRM_PATH,
   CLOUD_DEVICE_ENROLLMENT_HOST_ROUTE,
   CLOUD_HOST_AUTHORIZATION_SNAPSHOT_PATH,
+  CLOUD_HOST_AUTOMATION_SYNC_PATH,
   CLOUD_HOST_CONFIG_FILE,
   CLOUD_HOST_HEARTBEAT_PATH,
   CLOUD_HOST_MAX_SIGNED_RESPONSE_BYTES,