@roamcode.ai/server 1.3.0 → 1.4.0

package/dist/start.js

@@ -4,10 +4,10 @@
 import { pathToFileURL, fileURLToPath as fileURLToPath3 } from "url";
 import { join as join19 } from "path";
 import { existsSync as existsSync7 } from "fs";
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 
 // src/transport.ts
-import { createHash as createHash7, randomBytes as randomBytes11, randomUUID as randomUUID7, timingSafeEqual as timingSafeEqual4 } from "crypto";
+import { createHash as createHash7, randomBytes as randomBytes11, randomUUID as randomUUID8, timingSafeEqual as timingSafeEqual4 } from "crypto";
 import { basename as pathBasename, join as join11, resolve as resolvePath } from "path";
 import { createReadStream } from "fs";
 import Fastify from "fastify";
@@ -4493,6 +4493,48 @@ function normalizeTrigger(value) {
   }
   return { type: "manual" };
 }
+function validTimeZone(value) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: value }).format(0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function normalizeConfiguredTriggers(value) {
+  if (!Array.isArray(value) || value.length > 16) throw new Error("invalid automation triggers");
+  const ids = /* @__PURE__ */ new Set();
+  return value.map((candidate) => {
+    if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
+      throw new Error("invalid automation trigger");
+    }
+    const raw = candidate;
+    const id = normalizeId(raw.id, "automation trigger id");
+    if (ids.has(id)) throw new Error("duplicate automation trigger id");
+    ids.add(id);
+    if (typeof raw.enabled !== "boolean") throw new Error("invalid automation trigger state");
+    if (raw.type === "schedule") {
+      if (typeof raw.cron !== "string" || raw.cron.trim().split(/\s+/).length !== 5 || raw.cron.length > 120 || typeof raw.timeZone !== "string" || raw.timeZone.length > 80 || !validTimeZone(raw.timeZone) || raw.missedRunPolicy !== "skip" || Object.keys(raw).some((key) => !["id", "type", "enabled", "cron", "timeZone", "missedRunPolicy"].includes(key))) {
+        throw new Error("invalid schedule trigger");
+      }
+      return {
+        id,
+        type: "schedule",
+        enabled: raw.enabled,
+        cron: raw.cron.trim().replace(/\s+/g, " "),
+        timeZone: raw.timeZone,
+        missedRunPolicy: "skip"
+      };
+    }
+    if (raw.type === "webhook") {
+      if (typeof raw.hookId !== "string" || !/^rcwh_[A-Za-z0-9_-]{24,80}$/.test(raw.hookId) || typeof raw.secretHash !== "string" || !/^[a-f0-9]{64}$/.test(raw.secretHash) || Object.keys(raw).some((key) => !["id", "type", "enabled", "hookId", "secretHash"].includes(key))) {
+        throw new Error("invalid webhook trigger");
+      }
+      return { id, type: "webhook", enabled: raw.enabled, hookId: raw.hookId, secretHash: raw.secretHash };
+    }
+    throw new Error("invalid automation trigger");
+  });
+}
 function normalizeRuntimeOptions(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid runtime options");
   let encoded;
@@ -4519,7 +4561,8 @@ function normalizeCreate(input) {
     cwd: normalizeCwd2(input.cwd),
     instruction: normalizeInstruction(input.instruction),
     runtimeOptions: normalizeRuntimeOptions(input.runtimeOptions ?? {}),
-    trigger: normalizeTrigger(input.trigger ?? { type: "manual" })
+    trigger: normalizeTrigger(input.trigger ?? { type: "manual" }),
+    triggers: normalizeConfiguredTriggers(input.triggers ?? [])
   };
 }
 function applyUpdate(current, input, now) {
@@ -4533,7 +4576,8 @@ function applyUpdate(current, input, now) {
     cwd: input.cwd ?? current.cwd,
     instruction: input.instruction ?? current.instruction,
     runtimeOptions: input.runtimeOptions ?? current.runtimeOptions,
-    trigger: input.trigger ?? current.trigger
+    trigger: input.trigger ?? current.trigger,
+    triggers: input.triggers ?? current.triggers
   };
   if (Object.values(input).some((value) => value === void 0) || typeof candidate.enabled !== "boolean") {
     throw new Error("invalid automation update");
@@ -4555,9 +4599,12 @@ function createMemoryStore3(opts) {
   const removedDefinitions = /* @__PURE__ */ new Set();
   const runs = /* @__PURE__ */ new Map();
   const runInputSnapshots = /* @__PURE__ */ new Map();
+  const activities = /* @__PURE__ */ new Map();
+  const triggerCursors = /* @__PURE__ */ new Map();
   const nodeOwners = /* @__PURE__ */ new Map();
   const generateAutomationId = opts.generateAutomationId ?? (() => randomId3("rca2"));
   const generateRunId = opts.generateRunId ?? (() => randomId3("rcar"));
+  const generateActivityId = opts.generateActivityId ?? (() => randomId3("rcae"));
   return {
     mode: "memory-fallback",
     getNodeOwner(nodeId) {
@@ -4643,8 +4690,8 @@ function createMemoryStore3(opts) {
       const snapshot = runInputSnapshots.get(id);
       return snapshot ? clone2(snapshot) : void 0;
     },
-    getRunByInvocationId(invocationId) {
-      const run = [...runs.values()].find((candidate) => candidate.invocationId === invocationId);
+    getRunByInvocationId(invocationId2) {
+      const run = [...runs.values()].find((candidate) => candidate.invocationId === invocationId2);
       return run ? clone2(run) : void 0;
     },
     getRunBySessionId(sessionId) {
@@ -4742,11 +4789,43 @@ function createMemoryStore3(opts) {
       const bounded = Math.max(1, Math.min(1e3, Math.trunc(limit)));
       return [...runs.values()].filter((run) => !automationId || run.automationId === automationId).sort((a, b) => b.createdAt - a.createdAt || b.id.localeCompare(a.id)).slice(0, bounded).map(clone2);
     },
+    getTriggerCursor(triggerId) {
+      return triggerCursors.get(normalizeId(triggerId, "automation trigger id"));
+    },
+    setTriggerCursor(triggerId, minute) {
+      if (!Number.isSafeInteger(minute) || minute < 0) throw new Error("invalid automation trigger cursor");
+      triggerCursors.set(normalizeId(triggerId, "automation trigger id"), minute);
+    },
+    createActivity(input, now = Date.now()) {
+      const id = normalizeId(generateActivityId(), "automation activity id");
+      if (activities.has(id)) throw new Error("automation activity id already exists");
+      const activity = { id, ...clone2(input), createdAt: now, updatedAt: now };
+      activities.set(id, activity);
+      return clone2(activity);
+    },
+    getActivityByInvocationId(invocationId2) {
+      const normalized = normalizeId(invocationId2, "invocation id");
+      const activity = [...activities.values()].find((candidate) => candidate.invocationId === normalized);
+      return activity ? clone2(activity) : void 0;
+    },
+    updateActivity(id, input, now = Date.now()) {
+      const current = activities.get(id);
+      if (!current) return void 0;
+      const next = { ...current, ...clone2(input), updatedAt: now };
+      activities.set(id, next);
+      return clone2(next);
+    },
+    listActivities(automationId, limit = 100) {
+      const bounded = Math.max(1, Math.min(1e3, Math.trunc(limit)));
+      return [...activities.values()].filter((activity) => !automationId || activity.automationId === automationId).sort((left, right) => right.createdAt - left.createdAt || right.id.localeCompare(left.id)).slice(0, bounded).map(clone2);
+    },
     close() {
       definitions.clear();
       removedDefinitions.clear();
       runs.clear();
       runInputSnapshots.clear();
+      activities.clear();
+      triggerCursors.clear();
       nodeOwners.clear();
     }
   };
@@ -4763,7 +4842,11 @@ function definitionFromRow(row) {
     cwd: row.cwd,
     instruction: row.instruction,
     runtimeOptions: JSON.parse(row.runtime_options_json),
-    trigger: normalizeTrigger(JSON.parse(row.trigger_json)),
+    trigger: { type: "manual" },
+    triggers: (() => {
+      const parsed = JSON.parse(row.trigger_json);
+      return Array.isArray(parsed) ? normalizeConfiguredTriggers(parsed) : [];
+    })(),
     revision: row.revision,
     createdAt: row.created_at,
     updatedAt: row.updated_at
@@ -4796,6 +4879,22 @@ function runInputSnapshotFromRow(row) {
     bootstrapState: row.bootstrap_state
   };
 }
+function activityFromRow(row) {
+  return {
+    id: row.id,
+    automationId: row.automation_id,
+    triggerId: row.trigger_id,
+    source: row.source,
+    status: row.status,
+    invocationId: row.invocation_id,
+    ...row.scheduled_for === null ? {} : { scheduledFor: row.scheduled_for },
+    ...row.missed_count === null ? {} : { missedCount: row.missed_count },
+    ...row.run_id === null ? {} : { runId: row.run_id },
+    ...row.failure_code === null ? {} : { failureCode: row.failure_code },
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
 function openSessionAutomationStore(opts) {
   let Database;
   try {
@@ -4859,6 +4958,27 @@ function openSessionAutomationStore(opts) {
       bootstrap_state TEXT NOT NULL DEFAULT 'pending'
         CHECK(bootstrap_state IN ('pending','submitting','submitted'))
     );
+    CREATE TABLE IF NOT EXISTS session_automation_trigger_cursors (
+      trigger_id TEXT PRIMARY KEY,
+      minute INTEGER NOT NULL CHECK(minute >= 0),
+      updated_at INTEGER NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS session_automation_activities (
+      id TEXT PRIMARY KEY,
+      automation_id TEXT NOT NULL REFERENCES session_automations(id) ON DELETE CASCADE,
+      trigger_id TEXT NOT NULL,
+      source TEXT NOT NULL CHECK(source IN ('schedule','webhook')),
+      status TEXT NOT NULL CHECK(status IN ('queued','started','failed','missed','expired')),
+      invocation_id TEXT NOT NULL UNIQUE,
+      scheduled_for INTEGER,
+      missed_count INTEGER CHECK(missed_count IS NULL OR missed_count > 0),
+      run_id TEXT REFERENCES session_automation_runs(id) ON DELETE SET NULL,
+      failure_code TEXT,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS session_automation_activities_definition_idx
+      ON session_automation_activities(automation_id, created_at DESC);
   `);
   const automationColumns = db.pragma("table_info(session_automations)");
   if (!automationColumns.some((column) => column.name === "deleted_at")) {
@@ -4872,6 +4992,7 @@ function openSessionAutomationStore(opts) {
   }
   const generateAutomationId = opts.generateAutomationId ?? (() => randomId3("rca2"));
   const generateRunId = opts.generateRunId ?? (() => randomId3("rcar"));
+  const generateActivityId = opts.generateActivityId ?? (() => randomId3("rcae"));
   const getDefinition = db.prepare("SELECT * FROM session_automations WHERE id = ? AND deleted_at IS NULL");
   const getDefinitionIncludingRemoved = db.prepare("SELECT * FROM session_automations WHERE id = ?");
   const listAll = db.prepare("SELECT * FROM session_automations WHERE deleted_at IS NULL ORDER BY updated_at DESC, id");
@@ -4898,6 +5019,30 @@ function openSessionAutomationStore(opts) {
   const listRunsForAutomation = db.prepare(
     "SELECT * FROM session_automation_runs WHERE automation_id = ? ORDER BY created_at DESC, id DESC LIMIT ?"
   );
+  const getTriggerCursorStatement = db.prepare(
+    "SELECT minute FROM session_automation_trigger_cursors WHERE trigger_id = ?"
+  );
+  const setTriggerCursorStatement = db.prepare(
+    `INSERT INTO session_automation_trigger_cursors(trigger_id,minute,updated_at) VALUES(?,?,?)
+     ON CONFLICT(trigger_id) DO UPDATE SET minute=excluded.minute,updated_at=excluded.updated_at`
+  );
+  const getActivity = db.prepare("SELECT * FROM session_automation_activities WHERE id = ?");
+  const getActivityByInvocationId = db.prepare("SELECT * FROM session_automation_activities WHERE invocation_id = ?");
+  const insertActivity = db.prepare(
+    `INSERT INTO session_automation_activities(
+       id,automation_id,trigger_id,source,status,invocation_id,scheduled_for,missed_count,run_id,failure_code,
+       created_at,updated_at
+     ) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)`
+  );
+  const updateActivityStatement = db.prepare(
+    `UPDATE session_automation_activities SET status=?,run_id=?,failure_code=?,updated_at=? WHERE id=?`
+  );
+  const listActivitiesAll = db.prepare(
+    "SELECT * FROM session_automation_activities ORDER BY created_at DESC, id DESC LIMIT ?"
+  );
+  const listActivitiesForAutomation = db.prepare(
+    "SELECT * FROM session_automation_activities WHERE automation_id = ? ORDER BY created_at DESC, id DESC LIMIT ?"
+  );
   return {
     mode: "sqlite",
     getNodeOwner(nodeId) {
@@ -4937,7 +5082,7 @@ function openSessionAutomationStore(opts) {
         definition.cwd,
         definition.instruction,
         JSON.stringify(definition.runtimeOptions),
-        JSON.stringify(definition.trigger),
+        JSON.stringify(definition.triggers),
         definition.revision,
         definition.createdAt,
         definition.updatedAt
@@ -4959,7 +5104,7 @@ function openSessionAutomationStore(opts) {
         next.cwd,
         next.instruction,
         JSON.stringify(next.runtimeOptions),
-        JSON.stringify(next.trigger),
+        JSON.stringify(next.triggers),
         next.revision,
         next.updatedAt,
         next.id,
@@ -5020,8 +5165,8 @@ function openSessionAutomationStore(opts) {
       const row = selectRunInputSnapshot.get(id);
       return row ? runInputSnapshotFromRow(row) : void 0;
     },
-    getRunByInvocationId(invocationId) {
-      const row = getRunByInvocationId.get(invocationId);
+    getRunByInvocationId(invocationId2) {
+      const row = getRunByInvocationId.get(invocationId2);
       return row ? runFromRow(row) : void 0;
     },
     getRunBySessionId(sessionId) {
@@ -5132,12 +5277,266 @@ function openSessionAutomationStore(opts) {
       const rows = automationId ? listRunsForAutomation.all(automationId, bounded) : listRunsAll.all(bounded);
       return rows.map(runFromRow);
     },
+    getTriggerCursor(triggerId) {
+      const row = getTriggerCursorStatement.get(normalizeId(triggerId, "automation trigger id"));
+      return row?.minute;
+    },
+    setTriggerCursor(triggerId, minute) {
+      if (!Number.isSafeInteger(minute) || minute < 0) throw new Error("invalid automation trigger cursor");
+      setTriggerCursorStatement.run(normalizeId(triggerId, "automation trigger id"), minute, Date.now());
+    },
+    createActivity(input, now = Date.now()) {
+      const activity = {
+        id: normalizeId(generateActivityId(), "automation activity id"),
+        ...input,
+        automationId: normalizeId(input.automationId, "automation id"),
+        triggerId: normalizeId(input.triggerId, "automation trigger id"),
+        invocationId: normalizeId(input.invocationId, "invocation id"),
+        createdAt: now,
+        updatedAt: now
+      };
+      insertActivity.run(
+        activity.id,
+        activity.automationId,
+        activity.triggerId,
+        activity.source,
+        activity.status,
+        activity.invocationId,
+        activity.scheduledFor ?? null,
+        activity.missedCount ?? null,
+        activity.runId ?? null,
+        activity.failureCode ?? null,
+        activity.createdAt,
+        activity.updatedAt
+      );
+      return activity;
+    },
+    getActivityByInvocationId(invocationId2) {
+      const row = getActivityByInvocationId.get(normalizeId(invocationId2, "invocation id"));
+      return row ? activityFromRow(row) : void 0;
+    },
+    updateActivity(id, input, now = Date.now()) {
+      const row = getActivity.get(id);
+      if (!row) return void 0;
+      const current = activityFromRow(row);
+      const next = { ...current, ...input, updatedAt: now };
+      const result = updateActivityStatement.run(
+        next.status,
+        next.runId ?? null,
+        next.failureCode ?? null,
+        next.updatedAt,
+        current.id
+      );
+      return result.changes === 1 ? next : void 0;
+    },
+    listActivities(automationId, limit = 100) {
+      const bounded = Math.max(1, Math.min(1e3, Math.trunc(limit)));
+      const rows = automationId ? listActivitiesForAutomation.all(automationId, bounded) : listActivitiesAll.all(bounded);
+      return rows.map(activityFromRow);
+    },
     close() {
       db.close();
     }
   };
 }
 
+// src/automation-trigger-engine.ts
+import { randomUUID as randomUUID3 } from "crypto";
+function parsePart(part, min, max, normalize) {
+  const [rangePart, stepPart] = part.split("/");
+  const step = stepPart === void 0 ? 1 : Number(stepPart);
+  if (!Number.isSafeInteger(step) || step < 1 || !rangePart) throw new Error("invalid cron field");
+  let start;
+  let end;
+  if (rangePart === "*") {
+    start = min;
+    end = max;
+  } else if (rangePart.includes("-")) {
+    const pair = rangePart.split("-");
+    if (pair.length !== 2) throw new Error("invalid cron field");
+    start = Number(pair[0]);
+    end = Number(pair[1]);
+  } else {
+    start = Number(rangePart);
+    end = start;
+  }
+  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < min || end > max || start > end) {
+    throw new Error("invalid cron field");
+  }
+  const values = [];
+  for (let value = start; value <= end; value += step) values.push(normalize ? normalize(value) : value);
+  return values;
+}
+function parseField(source, min, max, normalize) {
+  const values = /* @__PURE__ */ new Set();
+  for (const part of source.split(",")) {
+    for (const value of parsePart(part, min, max, normalize)) values.add(value);
+  }
+  return { any: source === "*", values };
+}
+function validateCronExpression(expression) {
+  const normalized = expression.trim().replace(/\s+/g, " ");
+  const fields = normalized.split(" ");
+  if (fields.length !== 5) throw new Error("cron must contain five fields");
+  parseField(fields[0], 0, 59);
+  parseField(fields[1], 0, 23);
+  parseField(fields[2], 1, 31);
+  parseField(fields[3], 1, 12);
+  parseField(fields[4], 0, 7, (value) => value === 7 ? 0 : value);
+  return normalized;
+}
+function zonedParts(time, timeZone) {
+  const parts = new Intl.DateTimeFormat("en-US", {
+    timeZone,
+    minute: "2-digit",
+    hour: "2-digit",
+    hourCycle: "h23",
+    day: "2-digit",
+    month: "2-digit",
+    weekday: "short"
+  }).formatToParts(time);
+  const byType = new Map(parts.map((part) => [part.type, part.value]));
+  const weekday = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"].indexOf(byType.get("weekday") ?? "");
+  return {
+    minute: Number(byType.get("minute")),
+    hour: Number(byType.get("hour")),
+    day: Number(byType.get("day")),
+    month: Number(byType.get("month")),
+    weekday
+  };
+}
+function cronMatches(expression, timeZone, time) {
+  const fields = validateCronExpression(expression).split(" ");
+  const minute = parseField(fields[0], 0, 59);
+  const hour = parseField(fields[1], 0, 23);
+  const day = parseField(fields[2], 1, 31);
+  const month = parseField(fields[3], 1, 12);
+  const weekday = parseField(fields[4], 0, 7, (value2) => value2 === 7 ? 0 : value2);
+  const value = zonedParts(time, timeZone);
+  const dayMatches = day.values.has(value.day);
+  const weekdayMatches = weekday.values.has(value.weekday);
+  const calendarMatches = day.any && weekday.any ? true : day.any ? weekdayMatches : weekday.any ? dayMatches : dayMatches || weekdayMatches;
+  return minute.values.has(value.minute) && hour.values.has(value.hour) && month.values.has(value.month) && calendarMatches;
+}
+function invocationId(source, automationId, triggerId, nonce) {
+  const safeNonce = nonce.replace(/[^A-Za-z0-9._:-]/g, "_").slice(0, 96);
+  return `rci_${source}_${automationId}_${triggerId}_${safeNonce}`.slice(0, 256);
+}
+function createAutomationTriggerEngine(options) {
+  const now = options.now ?? Date.now;
+  const interval = options.setInterval ?? globalThis.setInterval;
+  const clearInterval2 = options.clearInterval ?? globalThis.clearInterval;
+  const concurrency = Number.isSafeInteger(options.concurrency) && (options.concurrency ?? 0) > 0 ? options.concurrency : 2;
+  const pending = [];
+  const pendingIds = /* @__PURE__ */ new Set();
+  const inFlightIds = /* @__PURE__ */ new Set();
+  let active = 0;
+  let ticking = false;
+  let timer;
+  const queue = (activity, deferDrain = false) => {
+    if (activity.status !== "queued" || pendingIds.has(activity.id) || inFlightIds.has(activity.id)) return;
+    pendingIds.add(activity.id);
+    pending.push(activity);
+    pending.sort((left, right) => left.createdAt - right.createdAt || left.id.localeCompare(right.id));
+    if (!deferDrain) drain();
+  };
+  const drain = () => {
+    while (active < concurrency && pending.length > 0) {
+      const activity = pending.shift();
+      pendingIds.delete(activity.id);
+      inFlightIds.add(activity.id);
+      active += 1;
+      void options.execute(activity).then(({ runId }) => options.store.updateActivity(activity.id, { status: "started", runId })).catch(
+        () => options.store.updateActivity(activity.id, { status: "failed", failureCode: "TRIGGER_EXECUTION_FAILED" })
+      ).finally(() => {
+        inFlightIds.delete(activity.id);
+        active -= 1;
+        drain();
+      });
+    }
+  };
+  const createQueued = (automation, trigger, source, nonce, scheduledFor) => {
+    const id = invocationId(source, automation.id, trigger.id, nonce);
+    const existing = options.store.getActivityByInvocationId(id);
+    if (existing) {
+      queue(existing);
+      return existing;
+    }
+    const activity = options.store.createActivity({
+      automationId: automation.id,
+      triggerId: trigger.id,
+      source,
+      status: "queued",
+      invocationId: id,
+      ...scheduledFor === void 0 ? {} : { scheduledFor }
+    });
+    queue(activity);
+    return activity;
+  };
+  const tick = async (at = now()) => {
+    if (ticking) return;
+    ticking = true;
+    try {
+      const currentMinute = Math.floor(at / 6e4);
+      for (const automation of options.store.list()) {
+        if (!automation.enabled) continue;
+        for (const trigger of automation.triggers) {
+          if (trigger.type !== "schedule" || !trigger.enabled) continue;
+          const previous = options.store.getTriggerCursor(trigger.id) ?? currentMinute - 1;
+          if (previous >= currentMinute) continue;
+          const firstMinute = Math.max(previous + 1, currentMinute - 43200);
+          const matches = [];
+          for (let minute = firstMinute; minute <= currentMinute; minute += 1) {
+            if (cronMatches(trigger.cron, trigger.timeZone, minute * 6e4)) matches.push(minute);
+          }
+          const missed = matches.filter((minute) => minute < currentMinute);
+          if (missed.length > 0) {
+            const missedInvocation = invocationId("schedule", automation.id, trigger.id, `missed-${currentMinute}`);
+            const exists = options.store.listActivities(automation.id, 1e3).some((activity) => activity.invocationId === missedInvocation);
+            if (!exists) {
+              options.store.createActivity({
+                automationId: automation.id,
+                triggerId: trigger.id,
+                source: "schedule",
+                status: "missed",
+                invocationId: missedInvocation,
+                scheduledFor: missed[missed.length - 1] * 6e4,
+                missedCount: missed.length,
+                failureCode: "NODE_OFFLINE_MISSED_SCHEDULE"
+              });
+            }
+          }
+          if (matches.includes(currentMinute)) {
+            createQueued(automation, trigger, "schedule", String(currentMinute), currentMinute * 6e4);
+          }
+          options.store.setTriggerCursor(trigger.id, currentMinute);
+        }
+      }
+    } finally {
+      ticking = false;
+    }
+  };
+  return {
+    start() {
+      if (timer) return;
+      for (const activity of options.store.listActivities(void 0, 1e3)) queue(activity, true);
+      drain();
+      void tick();
+      timer = interval(() => void tick(), 15e3);
+    },
+    stop() {
+      if (!timer) return;
+      clearInterval2(timer);
+      timer = void 0;
+    },
+    tick,
+    enqueueWebhook(automation, trigger, externalInvocationId) {
+      if (trigger.type !== "webhook") throw new Error("invalid webhook trigger");
+      return createQueued(automation, trigger, "webhook", externalInvocationId ?? randomUUID3());
+    }
+  };
+}
+
 // src/node-domain.ts
 import { createHash as createHash5 } from "crypto";
 function productContextFromOwner(owner, name) {
@@ -5211,7 +5610,7 @@ function projectAgentRuntimeRecords(input) {
 
 // src/updater.ts
 import { spawn as nodeSpawn } from "child_process";
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 import {
   chmodSync as nodeChmodSync,
   existsSync as nodeExistsSync,
@@ -5225,7 +5624,7 @@ import { fileURLToPath } from "url";
 
 // src/managed-runtime.ts
 import { spawn } from "child_process";
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 import {
   chmodSync as chmodSync2,
   existsSync as existsSync4,
@@ -5323,7 +5722,7 @@ function readPreviousVersion(root) {
 }
 
 // src/updater.ts
-var RUNNING_VERSION = "1.3.0" ? "1.3.0".replace(/^v/, "") : packageVersion();
+var RUNNING_VERSION = "1.4.0" ? "1.4.0".replace(/^v/, "") : packageVersion();
 var RELEASES_API = "https://api.github.com/repos/burakgon/roamcode/releases?per_page=100";
 var RELEASE_MANIFEST_ASSET = "roamcode-release.json";
 var CHECK_CACHE_MS = 15 * 6e4;
@@ -5622,7 +6021,7 @@ var Updater = class {
     const path = join6(this.dataDir, "update-status.json");
     const value = JSON.stringify(status, null, 2) + "\n";
     if (this.fs.renameSync) {
-      const temp = `${path}.${process.pid}.${randomUUID4()}.tmp`;
+      const temp = `${path}.${process.pid}.${randomUUID5()}.tmp`;
       this.fs.writeFileSync(temp, value, 384);
       this.fs.renameSync(temp, path);
     } else {
@@ -5685,7 +6084,7 @@ var Updater = class {
         return { started: false, reason: error instanceof Error ? error.message : String(error) };
       }
     }
-    const operationId = randomUUID4();
+    const operationId = randomUUID5();
     const status = {
       operationId,
       state: "starting",
@@ -10702,9 +11101,12 @@ function buildOpenApiDocument(options) {
           responses: {
             "201": response("Created session automation", {
               type: "object",
-              required: ["automation"],
+              required: ["automation", "webhookSecrets"],
               additionalProperties: false,
-              properties: { automation: ref("SessionAutomationDefinition") }
+              properties: {
+                automation: ref("SessionAutomationDefinition"),
+                webhookSecrets: { type: "array", items: ref("SessionAutomationWebhookSecret") }
+              }
             }),
             "404": response("Node or runtime not found", ref("Error")),
             ...errorResponses
@@ -10733,9 +11135,12 @@ function buildOpenApiDocument(options) {
           responses: {
             "200": response("Updated session automation", {
               type: "object",
-              required: ["automation"],
+              required: ["automation", "webhookSecrets"],
               additionalProperties: false,
-              properties: { automation: ref("SessionAutomationDefinition") }
+              properties: {
+                automation: ref("SessionAutomationDefinition"),
+                webhookSecrets: { type: "array", items: ref("SessionAutomationWebhookSecret") }
+              }
             }),
             "404": response("Automation, node, or runtime not found", ref("Error")),
             ...errorResponses
@@ -10751,6 +11156,76 @@ function buildOpenApiDocument(options) {
           }
         }
       },
+      "/api/v2/automations/{automationId}/activity": {
+        get: {
+          operationId: "listSessionAutomationActivityV2",
+          description: "Returns durable schedule and webhook delivery activity, including explicit missed schedules.",
+          parameters: [
+            idParameter("automationId"),
+            { name: "limit", in: "query", schema: { type: "integer", minimum: 1, maximum: 100, default: 25 } }
+          ],
+          responses: {
+            "200": response("Bounded automation trigger activity", {
+              type: "object",
+              required: ["activities"],
+              additionalProperties: false,
+              properties: { activities: { type: "array", items: ref("SessionAutomationActivity") } }
+            }),
+            "404": response("Automation not found", ref("Error")),
+            ...errorResponses
+          }
+        }
+      },
+      "/api/v2/automations/{automationId}/triggers/{triggerId}/secret": {
+        post: {
+          operationId: "rotateSessionAutomationWebhookSecretV2",
+          parameters: [idParameter("automationId"), idParameter("triggerId"), idempotency],
+          requestBody: {
+            required: true,
+            content: json({
+              type: "object",
+              required: ["expectedRevision"],
+              additionalProperties: false,
+              properties: { expectedRevision: { type: "integer", minimum: 1 } }
+            })
+          },
+          responses: {
+            "200": response("Rotated webhook secret shown exactly once", {
+              type: "object",
+              required: ["automation", "webhookSecret"],
+              additionalProperties: false,
+              properties: {
+                automation: ref("SessionAutomationDefinition"),
+                webhookSecret: ref("SessionAutomationWebhookSecret")
+              }
+            }),
+            "404": response("Automation or webhook trigger not found", ref("Error")),
+            ...errorResponses
+          }
+        }
+      },
+      "/api/v2/automation-hooks/{hookId}": {
+        post: {
+          operationId: "signalSessionAutomationWebhookV2",
+          description: "Queues a signal-only webhook. The request body is discarded and never becomes task instruction or stored prompt content.",
+          security: [{ webhookAuth: [] }],
+          parameters: [idParameter("hookId")],
+          requestBody: {
+            required: false,
+            content: json({ description: "Ignored signal payload", nullable: true })
+          },
+          responses: {
+            "202": response("Webhook signal accepted", {
+              type: "object",
+              required: ["accepted"],
+              additionalProperties: false,
+              properties: { accepted: { const: true } }
+            }),
+            "401": response("Unknown hook or invalid webhook secret", ref("Error")),
+            "429": response("Webhook rate limit reached", ref("Error"))
+          }
+        }
+      },
       "/api/v2/automations/{automationId}/runs": {
         get: {
           operationId: "listSessionAutomationRunsV2",
@@ -10808,7 +11283,8 @@ function buildOpenApiDocument(options) {
     },
     components: {
       securitySchemes: {
-        bearerAuth: { type: "http", scheme: "bearer", bearerFormat: "RoamCode device credential" }
+        bearerAuth: { type: "http", scheme: "bearer", bearerFormat: "RoamCode device credential" },
+        webhookAuth: { type: "http", scheme: "bearer", bearerFormat: "One-time-shown webhook secret" }
       },
       schemas: {
         Error: {
@@ -11782,6 +12258,62 @@ function buildOpenApiDocument(options) {
           additionalProperties: false,
           properties: { type: { const: "manual" } }
         },
+        SessionAutomationConfiguredTrigger: {
+          oneOf: [
+            {
+              type: "object",
+              required: ["id", "type", "enabled", "cron", "timeZone", "missedRunPolicy"],
+              additionalProperties: false,
+              properties: {
+                id: { type: "string", minLength: 1, maxLength: 256 },
+                type: { const: "schedule" },
+                enabled: { type: "boolean" },
+                cron: { type: "string", minLength: 9, maxLength: 120 },
+                timeZone: { type: "string", minLength: 1, maxLength: 80 },
+                missedRunPolicy: { const: "skip" }
+              }
+            },
+            {
+              type: "object",
+              required: ["id", "type", "enabled", "hookId"],
+              additionalProperties: false,
+              properties: {
+                id: { type: "string", minLength: 1, maxLength: 256 },
+                type: { const: "webhook" },
+                enabled: { type: "boolean" },
+                hookId: { type: "string", pattern: "^rcwh_[A-Za-z0-9_-]{24,80}$" }
+              }
+            }
+          ]
+        },
+        SessionAutomationTriggerInput: {
+          oneOf: [
+            {
+              type: "object",
+              required: ["type", "enabled", "cron", "timeZone", "missedRunPolicy"],
+              additionalProperties: false,
+              properties: {
+                id: { type: "string", minLength: 1, maxLength: 256 },
+                type: { const: "schedule" },
+                enabled: { type: "boolean" },
+                cron: { type: "string", minLength: 9, maxLength: 120 },
+                timeZone: { type: "string", minLength: 1, maxLength: 80 },
+                missedRunPolicy: { const: "skip" }
+              }
+            },
+            {
+              type: "object",
+              required: ["type", "enabled"],
+              additionalProperties: false,
+              properties: {
+                id: { type: "string", minLength: 1, maxLength: 256 },
+                type: { const: "webhook" },
+                enabled: { type: "boolean" },
+                hookId: { type: "string", pattern: "^rcwh_[A-Za-z0-9_-]{24,80}$" }
+              }
+            }
+          ]
+        },
         SessionAutomationDefinition: {
           type: "object",
           required: [
@@ -11794,6 +12326,7 @@ function buildOpenApiDocument(options) {
             "provider",
             "cwd",
             "trigger",
+            "triggers",
             "instruction",
             "runtimeOptions",
             "revision",
@@ -11811,6 +12344,7 @@ function buildOpenApiDocument(options) {
             provider: { type: "string", pattern: "^[a-z][a-z0-9-]{0,63}$" },
             cwd: { type: "string", minLength: 1 },
             trigger: ref("SessionAutomationTrigger"),
+            triggers: { type: "array", maxItems: 16, items: ref("SessionAutomationConfiguredTrigger") },
             instruction: {
               type: "string",
               minLength: 1,
@@ -11835,6 +12369,7 @@ function buildOpenApiDocument(options) {
             agentRuntimeId: { type: "string", pattern: "^runtime_[A-Za-z0-9_-]{24}$" },
             cwd: { type: "string", minLength: 1 },
             trigger: ref("SessionAutomationTrigger"),
+            triggers: { type: "array", maxItems: 16, items: ref("SessionAutomationTriggerInput") },
             instruction: {
               type: "string",
               minLength: 1,
@@ -11858,6 +12393,7 @@ function buildOpenApiDocument(options) {
             agentRuntimeId: { type: "string", pattern: "^runtime_[A-Za-z0-9_-]{24}$" },
             cwd: { type: "string", minLength: 1 },
             trigger: ref("SessionAutomationTrigger"),
+            triggers: { type: "array", maxItems: 16, items: ref("SessionAutomationTriggerInput") },
             instruction: {
               type: "string",
               minLength: 1,
@@ -11868,6 +12404,36 @@ function buildOpenApiDocument(options) {
             runtimeOptions: { type: "object", additionalProperties: true, "x-maxBytes": 65536 }
           }
         },
+        SessionAutomationWebhookSecret: {
+          type: "object",
+          required: ["triggerId", "hookId", "secret", "path"],
+          additionalProperties: false,
+          properties: {
+            triggerId: { type: "string", minLength: 1, maxLength: 256 },
+            hookId: { type: "string", pattern: "^rcwh_[A-Za-z0-9_-]{24,80}$" },
+            secret: { type: "string", pattern: "^rcws_[A-Za-z0-9_-]{43}$" },
+            path: { type: "string", pattern: "^/api/v2/automation-hooks/rcwh_[A-Za-z0-9_-]{24,80}$" }
+          }
+        },
+        SessionAutomationActivity: {
+          type: "object",
+          required: ["id", "automationId", "triggerId", "source", "status", "invocationId", "createdAt", "updatedAt"],
+          additionalProperties: false,
+          properties: {
+            id: { type: "string", minLength: 1, maxLength: 256 },
+            automationId: { type: "string", minLength: 1, maxLength: 256 },
+            triggerId: { type: "string", minLength: 1, maxLength: 256 },
+            source: { enum: ["schedule", "webhook"] },
+            status: { enum: ["queued", "started", "failed", "missed", "expired"] },
+            invocationId: { type: "string", minLength: 1, maxLength: 256 },
+            scheduledFor: { type: "integer", minimum: 0 },
+            missedCount: { type: "integer", minimum: 1 },
+            runId: { type: "string", minLength: 1, maxLength: 256 },
+            failureCode: { type: "string", pattern: "^[A-Z][A-Z0-9_]{0,79}$" },
+            createdAt: { type: "integer", minimum: 0 },
+            updatedAt: { type: "integer", minimum: 0 }
+          }
+        },
         SessionAutomationRun: {
           description: "Privacy-bounded run state with its exact execution binding; terminal transcript, instruction, and provider detail are omitted.",
           type: "object",
@@ -13091,7 +13657,7 @@ function createPluginRuntime(options) {
 }
 
 // src/input-lease.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 var INPUT_LEASE_TTL_MS = 3e4;
 function copy(lease) {
   return { ...lease };
@@ -13118,7 +13684,7 @@ var InputLeaseCoordinator = class {
       throw new Error("invalid input lease TTL");
     }
     this.now = options.now ?? Date.now;
-    this.generateId = options.generateId ?? randomUUID5;
+    this.generateId = options.generateId ?? randomUUID6;
     this.scheduleExpiry = options.scheduleExpiry ?? true;
     this.onEvent = options.onEvent;
   }
@@ -14789,7 +15355,7 @@ async function verifyPeerConnection(input) {
 }
 
 // src/presence.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 var PRESENCE_TTL_MS = 45e3;
 var PRESENCE_HEARTBEAT_MS = 15e3;
 function clone6(record) {
@@ -14833,7 +15399,7 @@ var PresenceCoordinator = class {
       throw new Error("invalid presence actor limit");
     }
     this.now = options.now ?? Date.now;
-    this.generateId = options.generateId ?? randomUUID6;
+    this.generateId = options.generateId ?? randomUUID7;
     if (options.scheduleExpiry ?? true) {
       this.timer = setInterval(() => this.sweep(), Math.min(15e3, Math.max(1e3, Math.floor(this.ttlMs / 2))));
       this.timer.unref?.();
@@ -15199,9 +15765,9 @@ function cloudStatusResponse(status) {
     };
   }
   const authorization = status.authorization;
-  const syncFailures = status.authorizationFailures > 0 || status.heartbeatFailures > 0;
+  const syncFailures = status.authorizationFailures > 0 || status.heartbeatFailures > 0 || status.automationFailures > 0;
   const syncState = authorization.status === "expired" ? "expired" : authorization.status === "pending" ? "pending" : authorization.status === "unavailable" ? syncFailures ? "degraded" : "syncing" : syncFailures ? "degraded" : "healthy";
-  const action = status.authorizationIssue === "credential-rejected" || status.authorizationIssue === "trust-expired" ? "reauthorize-host" : status.authorizationIssue === "invalid-control-plane-response" || status.authorizationIssue === "authorization-verification-failed" ? "contact-organization-admin" : status.authorizationIssue === "connectivity" ? "check-host-connectivity" : status.heartbeatFailures > 0 ? "check-host-connectivity" : authorization.status === "unavailable" ? "wait-for-cloud-sync" : authorization.status === "pending" ? "wait-for-authorization-activation" : authorization.status === "expired" ? "check-host-connectivity" : "none";
+  const action = status.authorizationIssue === "credential-rejected" || status.authorizationIssue === "trust-expired" ? "reauthorize-host" : status.authorizationIssue === "invalid-control-plane-response" || status.authorizationIssue === "authorization-verification-failed" ? "contact-organization-admin" : status.authorizationIssue === "connectivity" ? "check-host-connectivity" : status.heartbeatFailures > 0 || status.automationFailures > 0 ? "check-host-connectivity" : authorization.status === "unavailable" ? "wait-for-cloud-sync" : authorization.status === "pending" ? "wait-for-authorization-activation" : authorization.status === "expired" ? "check-host-connectivity" : "none";
   return {
     v: 1,
     mode: "managed",
@@ -15638,6 +16204,7 @@ function createServer(config, deps = {}) {
     enabled: config.rateLimitRpm > 0
   });
   const pairingRateLimiter = new RateLimiter({ capacity: 30, windowMs: 6e4, burst: 10 });
+  const automationWebhookRateLimiter = new RateLimiter({ capacity: 120, windowMs: 6e4, burst: 30 });
   const fsService = new FsService({ root: config.fsRoot });
   const terminalSharedRoot = terminalSharedBase({ dataDir, fsRoot: config.fsRoot });
   const backfilledFileSessions = /* @__PURE__ */ new Set();
@@ -15657,7 +16224,7 @@ function createServer(config, deps = {}) {
         const now = Date.now();
         const media = attachmentMedia(file.filename);
         store.putFile({
-          id: randomUUID7(),
+          id: randomUUID8(),
           sessionId,
           direction: "sent",
           storage: "managed",
@@ -15729,6 +16296,7 @@ function createServer(config, deps = {}) {
   }
   const relayInternalCapability = randomBytes11(32).toString("base64url");
   const authenticatedPrincipals = /* @__PURE__ */ new WeakMap();
+  const automationWebhookRequests = /* @__PURE__ */ new WeakMap();
   const hostPrincipal = () => ({
     actorType: config.accessToken ? "host" : "local",
     actorId: commandStore.getHost().id,
@@ -15875,6 +16443,28 @@ function createServer(config, deps = {}) {
       if (request.is404 && isPublicPath(path)) return;
     }
     if (path === "/health") return;
+    const automationHookMatch = /^\/api\/v2\/automation-hooks\/(rcwh_[A-Za-z0-9_-]{24,80})$/.exec(path);
+    if (request.method === "POST" && automationHookMatch && !hasEncodedSep(request.url)) {
+      const limit = automationWebhookRateLimiter.take(request.ip);
+      if (!limit.allowed) {
+        reply.header("retry-after", String(limit.retryAfterSeconds)).code(429).send({ error: "rate limited" });
+        return;
+      }
+      const hookId = automationHookMatch[1];
+      const match = sessionAutomationStore.list().flatMap((automation) => automation.triggers.map((trigger) => ({ automation, trigger }))).find(
+        (entry) => entry.automation.enabled && entry.trigger.type === "webhook" && entry.trigger.enabled && entry.trigger.hookId === hookId
+      );
+      const secret = extractBearerToken(request.headers.authorization);
+      const presented = secret ? createHash7("sha256").update(secret).digest() : Buffer.alloc(0);
+      const expected = match?.trigger.type === "webhook" ? Buffer.from(match.trigger.secretHash, "hex") : Buffer.alloc(32);
+      if (!match || presented.length !== expected.length || !timingSafeEqual4(presented, expected)) {
+        reply.code(401).send({ error: "unauthorized" });
+        return;
+      }
+      automationWebhookRequests.set(request, match);
+      authenticatedPrincipals.set(request, hostPrincipal());
+      return;
+    }
     if (request.method === "POST" && path === "/pairing/claim" && !hasEncodedSep(request.url)) {
       const originAllowed2 = isOriginAllowed(request.headers.origin, request.headers.host, {
         publicUrl: config.publicUrl,
@@ -16265,7 +16855,7 @@ function createServer(config, deps = {}) {
           return;
         }
         const principal = authenticatedPrincipals.get(request) ?? hostPrincipal();
-        const holderId = `ws:${randomUUID7()}`;
+        const holderId = `ws:${randomUUID8()}`;
         let leaseId;
         let lastLeaseRevision = 0;
         const sendLeaseState = (reason, revision) => {
@@ -16560,7 +17150,7 @@ function createServer(config, deps = {}) {
       reply.code(400).send({ code: "INVALID_PROVIDER", error: "Invalid provider" });
       return;
     }
-    const id = requestedSessionId ?? randomUUID7();
+    const id = requestedSessionId ?? randomUUID8();
     const existingMeta = requestedSessionId ? terminalManager.get(id) : void 0;
     if (!terminalAvailable) {
       reply.code(400).send({
@@ -17227,7 +17817,7 @@ function createServer(config, deps = {}) {
   const peerIdempotencyKey = (request, peerId) => {
     const actor = actorForRequest(request);
     const provided = request.headers["idempotency-key"];
-    const key = typeof provided === "string" ? provided : randomUUID7();
+    const key = typeof provided === "string" ? provided : randomUUID8();
     return `peer-${createHash7("sha256").update(`${peerId}\0${actor.actorType}\0${actor.actorId}\0${key}`).digest("base64url")}`;
   };
   const workspaceAllowedByPeer = (peer, workspaceId) => typeof workspaceId === "string" && (peer.allowedWorkspaceIds === null || peer.allowedWorkspaceIds.includes(workspaceId));
@@ -19318,7 +19908,7 @@ data: ${JSON.stringify(data)}
         });
         return;
       }
-      holderId = `api-once:${randomUUID7()}`;
+      holderId = `api-once:${randomUUID8()}`;
       const acquired = inputLeases.acquire(request.params.id, holderId, principal);
       if (acquired.status === "denied") {
         reply.code(409).send({ code: "INPUT_LEASE_REQUIRED", error: "terminal input is already controlled" });
@@ -19472,7 +20062,7 @@ data: ${JSON.stringify(data)}
         return;
       }
       const isImage = body.kind === "image" ? true : body.kind === "file" ? false : described.isImage;
-      const id = randomUUID7();
+      const id = randomUUID8();
       const now = Date.now();
       const media = attachmentMedia(described.name);
       const stored2 = {
@@ -19926,9 +20516,78 @@ data: ${JSON.stringify(data)}
     const owner = currentNodeOwner();
     return automation && automation.owner.type === owner.type && automation.owner.id === owner.id ? automation : void 0;
   };
+  const projectAutomationDefinition = (automation) => ({
+    ...automation,
+    triggers: automation.triggers.map((trigger) => {
+      if (trigger.type !== "webhook") return trigger;
+      const { secretHash, ...publicTrigger } = trigger;
+      void secretHash;
+      return publicTrigger;
+    })
+  });
+  const newTriggerId = () => `rct_${randomBytes11(12).toString("base64url")}`;
+  const newWebhookHookId = () => `rcwh_${randomBytes11(24).toString("base64url")}`;
+  const newWebhookSecret = () => `rcws_${randomBytes11(32).toString("base64url")}`;
+  const prepareAutomationTriggers = (value, current) => {
+    if (!Array.isArray(value) || value.length > 16) throw new Error("invalid automation triggers");
+    const existing = new Map(current?.triggers.map((trigger) => [trigger.id, trigger]) ?? []);
+    const ids = /* @__PURE__ */ new Set();
+    const webhookSecrets = [];
+    const triggers = value.map((candidate) => {
+      if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
+        throw new Error("invalid automation trigger");
+      }
+      const raw = candidate;
+      const requestedId = typeof raw.id === "string" && /^[A-Za-z0-9._:-]{1,256}$/.test(raw.id) ? raw.id : void 0;
+      const id = requestedId ?? newTriggerId();
+      if (ids.has(id)) throw new Error("duplicate automation trigger id");
+      ids.add(id);
+      if (typeof raw.enabled !== "boolean") throw new Error("invalid automation trigger state");
+      if (raw.type === "schedule") {
+        if (typeof raw.cron !== "string" || typeof raw.timeZone !== "string" || raw.timeZone.length > 80 || raw.missedRunPolicy !== "skip" || Object.keys(raw).some(
+          (key) => !["id", "type", "enabled", "cron", "timeZone", "missedRunPolicy"].includes(key)
+        )) {
+          throw new Error("invalid schedule trigger");
+        }
+        new Intl.DateTimeFormat("en-US", { timeZone: raw.timeZone }).format(0);
+        return {
+          id,
+          type: "schedule",
+          enabled: raw.enabled,
+          cron: validateCronExpression(raw.cron),
+          timeZone: raw.timeZone,
+          missedRunPolicy: "skip"
+        };
+      }
+      if (raw.type === "webhook") {
+        if (Object.keys(raw).some((key) => !["id", "type", "enabled", "hookId"].includes(key))) {
+          throw new Error("invalid webhook trigger");
+        }
+        const previous = existing.get(id);
+        if (previous?.type === "webhook") {
+          if (raw.hookId !== void 0 && raw.hookId !== previous.hookId) {
+            throw new Error("webhook identity cannot be replaced");
+          }
+          return { ...previous, enabled: raw.enabled };
+        }
+        const hookId = newWebhookHookId();
+        const secret = newWebhookSecret();
+        webhookSecrets.push({ triggerId: id, hookId, secret, path: `/api/v2/automation-hooks/${hookId}` });
+        return {
+          id,
+          type: "webhook",
+          enabled: raw.enabled,
+          hookId,
+          secretHash: createHash7("sha256").update(secret).digest("hex")
+        };
+      }
+      throw new Error("invalid automation trigger");
+    });
+    return { triggers, webhookSecrets };
+  };
   const automationInvocationIdentity = (request, automationId) => {
     const idempotency2 = mutationContexts.get(request)?.idempotency;
-    if (!idempotency2) return { invocationId: randomUUID7(), sessionId: randomUUID7() };
+    if (!idempotency2) return { invocationId: randomUUID8(), sessionId: randomUUID8() };
     const actor = actorForRequest(request);
     const digest2 = createHash7("sha256").update("roamcode-automation-invocation-v1\0").update(JSON.stringify([actor.actorType, actor.actorId, idempotency2.key, idempotency2.fingerprint, automationId])).digest("hex");
     const uuidHex = digest2.slice(0, 32).split("");
@@ -20197,10 +20856,13 @@ data: ${JSON.stringify(data)}
     "cwd",
     "instruction",
     "runtimeOptions",
-    "trigger"
+    "trigger",
+    "triggers"
   ]);
   const automationUpdateKeys = /* @__PURE__ */ new Set([...automationCreateKeys, "expectedRevision"]);
-  app.get("/api/v2/automations", async () => ({ automations: sessionAutomationStore.list(currentNodeOwner()) }));
+  app.get("/api/v2/automations", async () => ({
+    automations: sessionAutomationStore.list(currentNodeOwner()).map(projectAutomationDefinition)
+  }));
   app.post("/api/v2/automations", { bodyLimit: 128 * 1024 }, async (request, reply) => {
     if (!validObjectBody(request.body)) return sendInvalidAutomation(reply);
     if ("owner" in request.body || "provider" in request.body) {
@@ -20220,15 +20882,17 @@ data: ${JSON.stringify(data)}
     );
     if (!target) return;
     try {
+      const prepared = prepareAutomationTriggers(request.body.triggers ?? [], void 0);
       const automation = sessionAutomationStore.create({
         owner: currentNodeOwner(),
         name: request.body.name,
         ...request.body.enabled === void 0 ? {} : { enabled: request.body.enabled },
         ...target,
         instruction: request.body.instruction,
-        ...request.body.trigger === void 0 ? { trigger: { type: "manual" } } : { trigger: request.body.trigger }
+        ...request.body.trigger === void 0 ? { trigger: { type: "manual" } } : { trigger: request.body.trigger },
+        triggers: prepared.triggers
       });
-      reply.code(201).send({ automation });
+      reply.code(201).send({ automation: projectAutomationDefinition(automation), webhookSecrets: prepared.webhookSecrets });
     } catch {
       sendInvalidAutomation(reply);
     }
@@ -20239,7 +20903,7 @@ data: ${JSON.stringify(data)}
       reply.code(404).send({ code: "SESSION_AUTOMATION_NOT_FOUND", error: "automation not found" });
       return;
     }
-    return { automation };
+    return { automation: projectAutomationDefinition(automation) };
   });
   app.patch(
     "/api/v2/automations/:automationId",
@@ -20277,18 +20941,20 @@ data: ${JSON.stringify(data)}
         ...target
       };
       try {
+        const prepared = prepareAutomationTriggers(request.body.triggers ?? current.triggers, current);
+        input.triggers = prepared.triggers;
         const automation = sessionAutomationStore.update(current.id, input, request.body.expectedRevision);
         if (!automation) {
           reply.code(404).send({ code: "SESSION_AUTOMATION_NOT_FOUND", error: "automation not found" });
           return;
         }
-        return { automation };
+        return { automation: projectAutomationDefinition(automation), webhookSecrets: prepared.webhookSecrets };
       } catch (error) {
         if (error instanceof SessionAutomationRevisionConflictError) {
           reply.code(409).send({
             code: "SESSION_AUTOMATION_REVISION_CONFLICT",
             error: "automation state changed",
-            current: error.current
+            current: projectAutomationDefinition(error.current)
           });
           return;
         }
@@ -20303,6 +20969,70 @@ data: ${JSON.stringify(data)}
     }
     reply.code(204).send();
   });
+  app.get(
+    "/api/v2/automations/:automationId/activity",
+    async (request, reply) => {
+      const automation = ownedAutomationIncludingRemoved(request.params.automationId);
+      if (!automation) {
+        reply.code(404).send({ code: "SESSION_AUTOMATION_NOT_FOUND", error: "automation not found" });
+        return;
+      }
+      const limit = request.query.limit === void 0 ? 25 : Number(request.query.limit);
+      if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100) {
+        reply.code(400).send({ code: "INVALID_AUTOMATION_ACTIVITY_LIMIT", error: "limit must be between 1 and 100" });
+        return;
+      }
+      return { activities: sessionAutomationStore.listActivities(automation.id, limit) };
+    }
+  );
+  app.post(
+    "/api/v2/automations/:automationId/triggers/:triggerId/secret",
+    { bodyLimit: 1024 },
+    async (request, reply) => {
+      const current = ownedAutomation(request.params.automationId);
+      if (!current) {
+        reply.code(404).send({ code: "SESSION_AUTOMATION_NOT_FOUND", error: "automation not found" });
+        return;
+      }
+      if (!validObjectBody(request.body) || !hasOnlyKeys(request.body, /* @__PURE__ */ new Set(["expectedRevision"])) || !Number.isSafeInteger(request.body.expectedRevision) || request.body.expectedRevision !== current.revision) {
+        return sendInvalidAutomation(reply, "a current expectedRevision is required");
+      }
+      const selected = current.triggers.find(
+        (trigger) => trigger.id === request.params.triggerId && trigger.type === "webhook"
+      );
+      if (!selected || selected.type !== "webhook") {
+        reply.code(404).send({ code: "AUTOMATION_TRIGGER_NOT_FOUND", error: "webhook trigger not found" });
+        return;
+      }
+      const secret = newWebhookSecret();
+      const triggers = current.triggers.map(
+        (trigger) => trigger.id === selected.id ? { ...selected, secretHash: createHash7("sha256").update(secret).digest("hex") } : trigger
+      );
+      try {
+        const automation = sessionAutomationStore.update(current.id, { triggers }, current.revision);
+        if (!automation) throw new Error("automation disappeared");
+        return {
+          automation: projectAutomationDefinition(automation),
+          webhookSecret: {
+            triggerId: selected.id,
+            hookId: selected.hookId,
+            secret,
+            path: `/api/v2/automation-hooks/${selected.hookId}`
+          }
+        };
+      } catch (error) {
+        if (error instanceof SessionAutomationRevisionConflictError) {
+          reply.code(409).send({
+            code: "SESSION_AUTOMATION_REVISION_CONFLICT",
+            error: "automation state changed",
+            current: projectAutomationDefinition(error.current)
+          });
+          return;
+        }
+        sendInvalidAutomation(reply);
+      }
+    }
+  );
   app.get(
     "/api/v2/automations/:automationId/runs",
     async (request, reply) => {
@@ -20531,6 +21261,46 @@ data: ${JSON.stringify(data)}
       );
     }
   );
+  const parsedAutomationConcurrency = Number.parseInt(process.env.ROAMCODE_AUTOMATION_CONCURRENCY ?? "2", 10);
+  const automationTriggerEngine = createAutomationTriggerEngine({
+    store: sessionAutomationStore,
+    concurrency: Number.isSafeInteger(parsedAutomationConcurrency) && parsedAutomationConcurrency > 0 ? parsedAutomationConcurrency : 2,
+    execute: async (activity) => {
+      const response2 = await app.inject({
+        method: "POST",
+        url: `/api/v2/automations/${encodeURIComponent(activity.automationId)}/runs`,
+        headers: {
+          "idempotency-key": activity.id,
+          ...config.accessToken ? { authorization: `Bearer ${config.accessToken}` } : {}
+        }
+      });
+      const body = (() => {
+        try {
+          return response2.json();
+        } catch {
+          return {};
+        }
+      })();
+      if (response2.statusCode !== 201 || typeof body.run?.id !== "string") {
+        throw new Error("automation trigger execution failed");
+      }
+      return { runId: body.run.id };
+    }
+  });
+  app.post(
+    "/api/v2/automation-hooks/:hookId",
+    { bodyLimit: 64 * 1024 },
+    async (request, reply) => {
+      const authorized = automationWebhookRequests.get(request);
+      if (!authorized || authorized.trigger.type !== "webhook" || authorized.trigger.hookId !== request.params.hookId) {
+        reply.code(401).send({ error: "unauthorized" });
+        return;
+      }
+      automationTriggerEngine.enqueueWebhook(authorized.automation, authorized.trigger);
+      reply.code(202).send({ accepted: true });
+    }
+  );
+  app.addHook("onReady", async () => automationTriggerEngine.start());
   app.get("/providers", async () => {
     return { providers: await readProviderAvailability() };
   });
@@ -20889,7 +21659,7 @@ data: ${JSON.stringify(data)}
       reply.code(400).send({ error: "no file field in the upload" });
       return;
     }
-    const id = randomUUID7();
+    const id = randomUUID8();
     try {
       const dir = await fsService.ensureDirWithinRoot(
         `${terminalSharedDir({ dataDir, fsRoot: config.fsRoot, sessionId })}/${id}`
@@ -20941,7 +21711,7 @@ data: ${JSON.stringify(data)}
       reply.code(400).send({ error: "an edited image is required" });
       return;
     }
-    const id = randomUUID7();
+    const id = randomUUID8();
     try {
       const dir = await fsService.ensureDirWithinRoot(
         `${terminalSharedDir({ dataDir, fsRoot: config.fsRoot, sessionId: source.sessionId })}/${id}`
@@ -21067,6 +21837,7 @@ data: ${JSON.stringify(data)}
   );
   if (deps.webDir) registerStatic(app, { webDir: deps.webDir });
   app.addHook("onClose", async () => {
+    automationTriggerEngine.stop();
     clearInterval(sharedSweepTimer);
     inputLeases.close();
     unsubscribeAutomations();
@@ -21162,6 +21933,25 @@ data: ${JSON.stringify(data)}
     authGate,
     terminalManager,
     terminalAvailable,
+    automationWebhookRegistrations: () => sessionAutomationStore.list().flatMap(
+      (automation) => automation.triggers.filter((trigger) => trigger.type === "webhook").map((trigger) => ({
+        hookId: trigger.hookId,
+        automationId: automation.id,
+        triggerId: trigger.id,
+        secretHash: trigger.secretHash,
+        enabled: automation.enabled && trigger.enabled
+      }))
+    ),
+    acceptCloudAutomationInvocation: async (invocation) => {
+      const automation = sessionAutomationStore.get(invocation.automationId);
+      const trigger = automation?.triggers.find(
+        (candidate) => candidate.type === "webhook" && candidate.id === invocation.triggerId && candidate.hookId === invocation.hookId
+      );
+      if (!automation?.enabled || !trigger?.enabled || trigger.type !== "webhook") {
+        throw new Error("managed automation webhook is no longer active");
+      }
+      automationTriggerEngine.enqueueWebhook(automation, trigger, invocation.id);
+    },
     inputLeases,
     teamStore,
     policyStore,
@@ -21581,7 +22371,7 @@ function createUsageService(opts) {
 
 // src/claude-auth-service.ts
 import { spawn as nodeSpawn2 } from "child_process";
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 function parseAuthStatus(stdout) {
   try {
     const o = JSON.parse(stdout);
@@ -21658,7 +22448,7 @@ var ClaudeAuthService = class {
         reject(err instanceof Error ? err : new Error("failed to spawn claude"));
         return;
       }
-      const id = randomUUID8();
+      const id = randomUUID9();
       let settled = false;
       let buf = "";
       const onData = (d) => {
@@ -23020,7 +23810,7 @@ var CodexMetadataService = class {
 
 // src/providers/claude-metadata-service.ts
 import { execFile as nodeExecFile2, spawn as nodeSpawn3 } from "child_process";
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 import { StringDecoder } from "string_decoder";
 var SAFE_VALUE = /^[A-Za-z0-9][A-Za-z0-9._:/\u005b\u005d-]*$/;
 var MAX_MODELS = 64;
@@ -23228,7 +24018,7 @@ function createClaudeMetadataRunner(options) {
           reject(metadataUnavailable2());
           return;
         }
-        const requestId = `roamcode-models-${randomUUID9()}`;
+        const requestId = `roamcode-models-${randomUUID10()}`;
         const decoder = new StringDecoder("utf8");
         let stdoutBuffer = "";
         let outputBytes = 0;
@@ -23480,7 +24270,7 @@ var CodexLatestService = class {
 import { execFile } from "child_process";
 import { constants as constants5 } from "fs";
 import { access as access2, chmod, copyFile, link, realpath as realpath7, rename as rename3, rm as rm2, rmdir as rmdir2, stat as stat7 } from "fs/promises";
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 import { basename as basename5, delimiter, dirname as dirname8, isAbsolute as isAbsolute9, join as join14, sep as sep5 } from "path";
 var CODEX_EXECUTABLE_PROBE_TIMEOUT_MS = 5e3;
 var OPENAI_CODE_SIGNING_TEAM_ID = "2DC432GLL2";
@@ -23590,7 +24380,7 @@ async function removeLegacyManagedCopy(dataDir) {
 }
 async function repairHomebrewExecutable(source, sourceStat, env, deps) {
   if (!await deps.verifyOfficialSignature(source)) return false;
-  const nonce = randomUUID10();
+  const nonce = randomUUID11();
   const directory = dirname8(source);
   const name = basename5(source);
   const temporary = join14(directory, `.${name}.roamcode-repair-${nonce}`);
@@ -24821,6 +25611,32 @@ var CloudHostHeartbeatV1Schema = z9.object({
     context.addIssue({ code: "custom", path: ["capabilities"], message: "capabilities must be unique" });
   }
 });
+var CloudAutomationWebhookRegistrationSchema = z9.object({
+  hookId: z9.string().regex(/^rcwh_[A-Za-z0-9_-]{24,80}$/),
+  automationId: SafeIdentifierSchema,
+  triggerId: SafeIdentifierSchema,
+  secretHash: z9.string().regex(/^[a-f0-9]{64}$/),
+  enabled: z9.boolean()
+}).strict();
+var CloudAutomationInvocationSchema = z9.object({
+  id: z9.uuid(),
+  automationId: SafeIdentifierSchema,
+  triggerId: SafeIdentifierSchema,
+  hookId: z9.string().regex(/^rcwh_[A-Za-z0-9_-]{24,80}$/),
+  createdAt: TimestampSchema
+}).strict();
+var CloudAutomationSyncRequestSchema = z9.object({
+  v: z9.literal(1),
+  organizationId: SafeIdentifierSchema,
+  hostId: SafeIdentifierSchema,
+  instanceId: SafeIdentifierSchema,
+  registrations: z9.array(CloudAutomationWebhookRegistrationSchema).max(128).refine(
+    (registrations) => new Set(registrations.map((registration) => registration.hookId)).size === registrations.length,
+    "webhook identities must be unique"
+  ),
+  acknowledgements: z9.array(z9.uuid()).max(200).refine((values) => new Set(values).size === values.length)
+}).strict();
+var CloudAutomationSyncResponseSchema = z9.object({ invocations: z9.array(CloudAutomationInvocationSchema).max(50) }).strict();
 var CloudAuthorizationScopeV1Schema = z9.discriminatedUnion("type", [
   z9.object({ type: z9.literal("organization") }).strict(),
   z9.object({ type: z9.literal("host"), id: SafeIdentifierSchema }).strict(),
@@ -25859,6 +26675,7 @@ function openCloudAuthorizationStore(options) {
 
 // src/cloud-host-runtime.ts
 var CLOUD_HOST_HEARTBEAT_PATH = "/api/v1/hosts/heartbeat";
+var CLOUD_HOST_AUTOMATION_SYNC_PATH = "/api/v1/hosts/automation-sync";
 var CLOUD_HOST_AUTHORIZATION_SNAPSHOT_PATH = "/api/v1/hosts/authorization-snapshot";
 var CLOUD_HOST_MAX_SIGNED_RESPONSE_BYTES = 16 * 1024 * 1024;
 var DEFAULT_REQUEST_TIMEOUT_MS3 = 15e3;
@@ -25945,6 +26762,7 @@ function createCloudHostRuntime(options) {
   let lastHeartbeatAt;
   let lastAuthorizationAt;
   let heartbeatFailures = 0;
+  let automationFailures = 0;
   let authorizationFailures = 0;
   let lastAuthorizationIssue;
   let running = false;
@@ -25954,6 +26772,8 @@ function createCloudHostRuntime(options) {
   let heartbeatInFlight;
   let authorizationInFlight;
   const capabilities2 = () => [...new Set(typeof options.capabilities === "function" ? options.capabilities() : options.capabilities)].sort();
+  const automationWebhooks = () => (typeof options.automationWebhooks === "function" ? options.automationWebhooks() : options.automationWebhooks ?? []).map((registration) => CloudAutomationWebhookRegistrationSchema.parse(registration)).sort((left, right) => left.hookId.localeCompare(right.hookId));
+  const automationAcknowledgements = /* @__PURE__ */ new Set();
   const request = async (path, init) => {
     try {
       return await fetchImpl(`${config.controlPlaneOrigin}${path}`, {
@@ -26073,6 +26893,51 @@ function createCloudHostRuntime(options) {
     }
     await response2.body?.cancel().catch(() => void 0);
     lastHeartbeatAt = currentNow;
+    if (state === "ready" && options.automationWebhooks && options.onAutomationInvocation) {
+      try {
+        let deliveryFailed = false;
+        for (let page = 0; page < 4; page += 1) {
+          const acknowledgements = [...automationAcknowledgements].slice(0, 200);
+          const payload = CloudAutomationSyncRequestSchema.parse({
+            v: 1,
+            organizationId: config.organizationId,
+            hostId: config.hostId,
+            instanceId: options.instanceId,
+            registrations: automationWebhooks(),
+            acknowledgements
+          });
+          const automationResponse = await request(CLOUD_HOST_AUTOMATION_SYNC_PATH, {
+            method: "POST",
+            headers: authenticatedHeaders({ "content-type": "application/json", accept: "application/json" }),
+            body: JSON.stringify(payload)
+          });
+          if (automationResponse.status === 404) {
+            await automationResponse.body?.cancel().catch(() => void 0);
+            break;
+          }
+          if (automationResponse.status !== 200) {
+            await boundedResponseText2(automationResponse).catch(() => "");
+            throw responseError(automationResponse);
+          }
+          const parsed = CloudAutomationSyncResponseSchema.parse(
+            JSON.parse(await boundedResponseText2(automationResponse))
+          );
+          for (const id of acknowledgements) automationAcknowledgements.delete(id);
+          for (const invocation of parsed.invocations) {
+            try {
+              await options.onAutomationInvocation(invocation);
+              automationAcknowledgements.add(invocation.id);
+            } catch {
+              deliveryFailed = true;
+            }
+          }
+          if (parsed.invocations.length === 0 && automationAcknowledgements.size === 0) break;
+        }
+        automationFailures = deliveryFailed ? automationFailures + 1 : 0;
+      } catch {
+        automationFailures += 1;
+      }
+    }
   };
   const jittered = (baseMs) => {
     const sample = random();
@@ -26137,6 +27002,7 @@ function createCloudHostRuntime(options) {
     status: () => ({
       running,
       heartbeatFailures,
+      automationFailures,
       authorizationFailures,
       ...lastAuthorizationIssue ? { authorizationIssue: lastAuthorizationIssue } : {},
       ...lastHeartbeatAt === void 0 ? {} : { lastHeartbeatAt },
@@ -26594,13 +27460,14 @@ function cloudHostCapabilities(input) {
   return [
     `authorization.v${input.authorizationVersion}`,
     ...input.terminalAvailable ? ["terminal.v1"] : [],
+    ...input.terminalAvailable ? ["automation-schedule.v1", "automation-webhook.v1"] : [],
     ...input.relayEnabled ? ["relay.v1"] : [],
     ...input.managedDeviceEnrollmentEnabled && input.relayEnabled && input.terminalAvailable ? ["managed-device-enrollment.v1"] : []
   ];
 }
 async function startServer(env = process.env, options = {}) {
   const config = loadServerConfig(env);
-  const healthInstanceId = randomUUID11();
+  const healthInstanceId = randomUUID12();
   ensureDataDir(config.dataDir);
   const loopback = isLoopbackAddress(config.bindAddress);
   let token;
@@ -26873,6 +27740,7 @@ async function startServer(env = process.env, options = {}) {
       cloudStatus: () => cloudHostRuntime?.status() ?? {
         running: false,
         heartbeatFailures: 0,
+        automationFailures: 0,
         authorizationFailures: 0,
         authorization: cloudAuthorizationStore.getState()
       }
@@ -26905,6 +27773,8 @@ async function startServer(env = process.env, options = {}) {
         relayEnabled: relayConfig !== void 0,
         managedDeviceEnrollmentEnabled: cloudDeviceEnrollmentConfirmer !== void 0 && relayProvisioner !== void 0
       }),
+      automationWebhooks: () => result.automationWebhookRegistrations(),
+      onAutomationInvocation: (invocation) => result.acceptCloudAutomationInvocation(invocation),
       ...relayConfig ? {
         relayHostIdentity: {
           publicKey: relayConfig.hostIdentity.publicKey,