@tt-a1i/openpi 0.5.0 → 0.6.0

package/extensions/ai-providers/cursor/proxy.ts

@@ -0,0 +1,213 @@
+import * as http2 from "node:http2";
+import * as net from "node:net";
+import * as tls from "node:tls";
+
+export interface CursorHttp2ConnectOptions {
+  signal?: AbortSignal;
+  timeoutMs?: number;
+}
+
+function isLocalOrMetadataHost(hostname: string): boolean {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (
+    host === "localhost" ||
+    host.endsWith(".localhost") ||
+    host === "metadata.google.internal"
+  ) {
+    return true;
+  }
+  if (host === "::" || host === "::1" || /^f[cd]/.test(host)) return true;
+  const ipv4 = /^(\d{1,3})\.(\d{1,3})\./.exec(host);
+  if (!ipv4) return false;
+  const first = Number(ipv4[1]);
+  const second = Number(ipv4[2]);
+  return (
+    first === 0 ||
+    first === 10 ||
+    first === 127 ||
+    (first === 169 && second === 254) ||
+    (first === 172 && second >= 16 && second <= 31) ||
+    (first === 192 && second === 168)
+  );
+}
+
+function shouldBypassProxy(target: URL): boolean {
+  if (isLocalOrMetadataHost(target.hostname)) return true;
+  const noProxy = process.env.NO_PROXY || process.env.no_proxy;
+  if (!noProxy) return false;
+  const targetHost = target.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  const targetPort =
+    target.port || (target.protocol === "https:" ? "443" : "80");
+  for (const rawRule of noProxy.split(/[,\s]+/)) {
+    let rule = rawRule.trim().toLowerCase();
+    if (!rule) continue;
+    if (rule === "*") return true;
+    let rulePort: string | undefined;
+    const portMatch = /^(\[[^\]]+\]|[^:]+):(\d+)$/.exec(rule);
+    if (portMatch) {
+      rule = portMatch[1]!;
+      rulePort = portMatch[2];
+    }
+    if (rulePort && rulePort !== targetPort) continue;
+    rule = rule.replace(/^\[|\]$/g, "").replace(/^\./, "");
+    if (targetHost === rule || targetHost.endsWith(`.${rule}`)) return true;
+  }
+  return false;
+}
+
+/** Resolve Cursor's provider override first, then the standard proxy variables. */
+export function resolveCursorProxy(target: URL): string | undefined {
+  if (shouldBypassProxy(target)) return undefined;
+  const protocolProxy =
+    target.protocol === "https:"
+      ? process.env.HTTPS_PROXY || process.env.https_proxy
+      : process.env.HTTP_PROXY || process.env.http_proxy;
+  return [
+    process.env.PI_PROXY_CURSOR,
+    process.env.PI_PROXY,
+    protocolProxy,
+    process.env.ALL_PROXY || process.env.all_proxy,
+  ]
+    .map((value) => value?.trim())
+    .find((value): value is string => Boolean(value));
+}
+
+function connectProxyTunnel(
+  proxyUrl: URL,
+  targetUrl: URL,
+  options: CursorHttp2ConnectOptions,
+): Promise<net.Socket> {
+  if (!["http:", "https:"].includes(proxyUrl.protocol)) {
+    return Promise.reject(
+      new Error(`Unsupported Cursor proxy protocol: ${proxyUrl.protocol}`),
+    );
+  }
+  if (options.signal?.aborted) {
+    return Promise.reject(new Error("Cursor proxy tunnel aborted"));
+  }
+  const proxyTls = proxyUrl.protocol === "https:";
+  const proxyPort = Number(proxyUrl.port || (proxyTls ? 443 : 80));
+  const targetPort = Number(
+    targetUrl.port || (targetUrl.protocol === "https:" ? 443 : 80),
+  );
+  const targetAuthority = `${targetUrl.hostname}:${targetPort}`;
+  let proxyAuthorization: string | undefined;
+  if (proxyUrl.username || proxyUrl.password) {
+    try {
+      const credentials = `${decodeURIComponent(proxyUrl.username)}:${decodeURIComponent(proxyUrl.password)}`;
+      proxyAuthorization = Buffer.from(credentials).toString("base64");
+    } catch (cause) {
+      return Promise.reject(
+        new Error("Cursor proxy credentials contain invalid percent-encoding", {
+          cause,
+        }),
+      );
+    }
+  }
+  const { promise, resolve, reject } = Promise.withResolvers<net.Socket>();
+  let rawSocket: net.Socket | undefined;
+  let targetSocket: net.Socket | undefined;
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let response = Buffer.alloc(0);
+  let settled = false;
+
+  const cleanup = () => {
+    if (timer) clearTimeout(timer);
+    options.signal?.removeEventListener("abort", onAbort);
+    rawSocket?.removeListener("error", onError);
+    rawSocket?.removeListener(proxyTls ? "secureConnect" : "connect", onReady);
+    rawSocket?.removeListener("data", onData);
+    targetSocket?.removeListener("error", onError);
+    targetSocket?.removeListener("secureConnect", onTargetReady);
+  };
+  const fail = (error: Error) => {
+    if (settled) return;
+    settled = true;
+    cleanup();
+    targetSocket?.destroy();
+    rawSocket?.destroy();
+    reject(error);
+  };
+  const succeed = (socket: net.Socket) => {
+    if (settled) return;
+    settled = true;
+    cleanup();
+    resolve(socket);
+  };
+  const onAbort = () => fail(new Error("Cursor proxy tunnel aborted"));
+  const onError = (error: Error) => fail(error);
+  const onTargetReady = () => {
+    if (targetSocket) succeed(targetSocket);
+  };
+  const onData = (chunk: Buffer) => {
+    if (!rawSocket) return;
+    response = Buffer.concat([response, chunk]);
+    if (response.length > 64 * 1024) {
+      fail(new Error("Cursor proxy response headers exceed 64 KiB"));
+      return;
+    }
+    const headerEnd = response.indexOf("\r\n\r\n");
+    if (headerEnd === -1) return;
+    const statusLine = response
+      .subarray(0, headerEnd)
+      .toString("latin1")
+      .split("\r\n")[0];
+    if (!/^HTTP\/1\.[01] 200\b/.test(statusLine ?? "")) {
+      fail(
+        new Error(
+          `Cursor proxy tunnel failed: ${statusLine || "invalid response"}`,
+        ),
+      );
+      return;
+    }
+    rawSocket.removeListener("data", onData);
+    if (targetUrl.protocol !== "https:") {
+      succeed(rawSocket);
+      return;
+    }
+    targetSocket = tls.connect({
+      socket: rawSocket,
+      servername: targetUrl.hostname,
+      ALPNProtocols: ["h2"],
+    });
+    targetSocket.once("error", onError);
+    targetSocket.once("secureConnect", onTargetReady);
+  };
+  const onReady = () => {
+    if (!rawSocket) return;
+    let request = `CONNECT ${targetAuthority} HTTP/1.1\r\nHost: ${targetAuthority}\r\n`;
+    if (proxyAuthorization) {
+      request += `Proxy-Authorization: Basic ${proxyAuthorization}\r\n`;
+    }
+    rawSocket.on("data", onData);
+    rawSocket.write(`${request}\r\n`);
+  };
+
+  options.signal?.addEventListener("abort", onAbort, { once: true });
+  if (options.timeoutMs !== undefined && options.timeoutMs > 0) {
+    const timeoutMs = Math.floor(options.timeoutMs);
+    timer = setTimeout(
+      () =>
+        fail(new Error(`Cursor proxy tunnel timed out after ${timeoutMs}ms`)),
+      timeoutMs,
+    );
+  }
+  rawSocket = proxyTls
+    ? tls.connect({ host: proxyUrl.hostname, port: proxyPort })
+    : net.connect({ host: proxyUrl.hostname, port: proxyPort });
+  rawSocket.once("error", onError);
+  rawSocket.once(proxyTls ? "secureConnect" : "connect", onReady);
+  return promise;
+}
+
+/** Open Cursor's HTTP/2 session directly or through an HTTP CONNECT proxy. */
+export async function connectCursorHttp2(
+  baseUrl: string,
+  options: CursorHttp2ConnectOptions = {},
+): Promise<http2.ClientHttp2Session> {
+  const target = new URL(baseUrl);
+  const proxy = resolveCursorProxy(target);
+  if (!proxy) return http2.connect(target);
+  const socket = await connectProxyTunnel(new URL(proxy), target, options);
+  return http2.connect(target, { createConnection: () => socket });
+}

package/extensions/ai-providers/cursor/with-resolvers.d.ts

@@ -0,0 +1,12 @@
+/** Node >=22 provides Promise.withResolvers; the repo's ES2022 lib needs a shim. */
+declare global {
+  interface PromiseConstructor {
+    withResolvers<T>(): {
+      promise: Promise<T>;
+      resolve: (value: T | PromiseLike<T>) => void;
+      reject: (reason?: unknown) => void;
+    };
+  }
+}
+
+export {};

package/extensions/ai-providers/index.ts

@@ -0,0 +1,86 @@
+/**
+ * ai-providers — OAuth-backed model providers for pi.
+ *
+ * Adds OAuth-backed Google Antigravity and Cursor model providers. Both are
+ * inert until the user logs in and selects one of their models. Cursor uses
+ * AgentService/Run in deliberately chat-only mode: Cursor-native coding tools
+ * are not exposed or executed by this extension.
+ *
+ * Wire protocol: Cloud Code Assist `v1internal:streamGenerateContent` over
+ * SSE (see antigravity/provider.ts). Reference implementation: oh-my-pi's
+ * google-gemini-cli provider (shared google-gemini-cli/google-antigravity).
+ */
+
+import { createProvider, type ProviderStreams } from "@earendil-works/pi-ai";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { createOAuthAuth } from "./oauth-adapter.ts";
+import { encodeApiKey } from "./antigravity/credentials.ts";
+import { fetchAntigravityModels } from "./antigravity/discovery.ts";
+import {
+  ANTIGRAVITY_API_URL,
+  ANTIGRAVITY_MODELS,
+} from "./antigravity/models.ts";
+import {
+  loginAntigravity,
+  refreshAntigravityToken,
+} from "./antigravity/oauth.ts";
+import { streamAntigravity } from "./antigravity/provider.ts";
+import { getCursorApiKey } from "./cursor/credentials.ts";
+import { fetchCursorModels } from "./cursor/discovery.ts";
+import { transformCursorImageInput } from "./cursor/input-images.ts";
+import { CURSOR_MODELS } from "./cursor/models.ts";
+import { loginCursor, refreshCursorToken } from "./cursor/oauth.ts";
+import { streamCursor } from "./cursor/provider.ts";
+
+function providerStreams(
+  streamSimple: ProviderStreams["streamSimple"],
+): ProviderStreams {
+  return {
+    stream: (model, context, options) => streamSimple(model, context, options),
+    streamSimple,
+  };
+}
+
+export default function authProviders(pi: ExtensionAPI) {
+  pi.on("input", transformCursorImageInput);
+
+  pi.registerProvider(
+    createProvider({
+      id: "google-antigravity",
+      name: "Google Antigravity",
+      baseUrl: ANTIGRAVITY_API_URL,
+      api: providerStreams(streamAntigravity),
+      auth: {
+        oauth: createOAuthAuth({
+          name: "Google (Antigravity)",
+          isSubscription: true,
+          login: loginAntigravity,
+          refreshToken: refreshAntigravityToken,
+          getApiKey: encodeApiKey,
+        }),
+      },
+      models: ANTIGRAVITY_MODELS,
+      fetchModels: fetchAntigravityModels,
+    }),
+  );
+
+  pi.registerProvider(
+    createProvider({
+      id: "cursor",
+      name: "Cursor",
+      baseUrl: "https://api2.cursor.sh",
+      api: providerStreams(streamCursor),
+      auth: {
+        oauth: createOAuthAuth({
+          name: "Cursor",
+          isSubscription: true,
+          login: loginCursor,
+          refreshToken: refreshCursorToken,
+          getApiKey: getCursorApiKey,
+        }),
+      },
+      models: CURSOR_MODELS,
+      fetchModels: fetchCursorModels,
+    }),
+  );
+}

package/extensions/ai-providers/oauth-adapter.ts

@@ -0,0 +1,81 @@
+import type {
+  ModelAuth,
+  OAuthAuth,
+  OAuthCredential,
+  OAuthCredentials,
+  OAuthLoginCallbacks,
+  ProviderAuthInteraction,
+} from "@earendil-works/pi-ai";
+
+interface LegacyOAuthImplementation {
+  name: string;
+  isSubscription?: boolean;
+  login(callbacks: CancellableOAuthLoginCallbacks): Promise<OAuthCredentials>;
+  refreshToken(
+    credential: OAuthCredentials,
+    signal: AbortSignal,
+  ): Promise<OAuthCredentials>;
+  getApiKey(credential: OAuthCredentials): string | Promise<string>;
+}
+
+export type CancellableOAuthLoginCallbacks = Omit<
+  OAuthLoginCallbacks,
+  "onManualCodeInput"
+> & {
+  onManualCodeInput?(signal?: AbortSignal): Promise<string>;
+};
+
+function legacyCallbacks(
+  interaction: ProviderAuthInteraction,
+): CancellableOAuthLoginCallbacks {
+  return {
+    signal: interaction.signal,
+    onAuth: (info) => interaction.notify({ type: "auth_url", ...info }),
+    onDeviceCode: (info) =>
+      interaction.notify({ type: "device_code", ...info }),
+    onProgress: (message) => interaction.notify({ type: "progress", message }),
+    onPrompt: (prompt) =>
+      interaction.prompt({
+        type: "text",
+        message: prompt.message,
+        placeholder: prompt.placeholder,
+      }),
+    onManualCodeInput: (signal) =>
+      interaction.prompt({
+        type: "manual_code",
+        message: "Paste the authorization callback URL or code",
+        signal,
+      }),
+    onSelect: (prompt) =>
+      interaction.prompt({
+        type: "select",
+        message: prompt.message,
+        options: prompt.options,
+      }),
+  };
+}
+
+function canonicalCredential(credentials: OAuthCredentials): OAuthCredential {
+  return { ...credentials, type: "oauth" };
+}
+
+/** Adapt pi's retained extension OAuth callbacks to the native Provider API. */
+export function createOAuthAuth(
+  implementation: LegacyOAuthImplementation,
+): OAuthAuth {
+  return {
+    name: implementation.name,
+    isSubscription: implementation.isSubscription,
+    login: async (interaction) =>
+      canonicalCredential(
+        await implementation.login(legacyCallbacks(interaction)),
+      ),
+    refresh: async (credential, signal) =>
+      canonicalCredential(
+        await implementation.refreshToken(credential, signal),
+      ),
+    toAuth: async (credential): Promise<ModelAuth> => ({
+      apiKey: await implementation.getApiKey(credential),
+    }),
+  };
+}

package/extensions/ai-providers/usage.ts

@@ -0,0 +1,10 @@
+export function emptyUsage() {
+  return {
+    input: 0,
+    output: 0,
+    cacheRead: 0,
+    cacheWrite: 0,
+    totalTokens: 0,
+    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+  };
+}

package/extensions/background-terminals/index.ts

@@ -32,6 +32,7 @@ import {
   OPENPI_TOOL_SURFACE,
   patchOwnedTools,
 } from "../shared/tool-surface.ts";
+import { completionOwnerFor } from "../shared/completion-inbox.ts";
 import {
   projectBackgroundTerminalCapability,
   registerWebCapability,
@@ -105,7 +106,12 @@ export default function (pi: ExtensionAPI) {
   let ui: ExtensionUIContext | undefined;
   let unsubStatus: (() => void) | undefined;
   let startReservations = 0;
-  const resultDelivery = createDeferredResultDelivery<TerminalSnapshot>();
+  const resultDelivery = createDeferredResultDelivery<TerminalSnapshot>({
+    owner: () =>
+      sessionContext
+        ? completionOwnerFor(sessionContext.sessionManager)
+        : undefined,
+  });
   const hideLifecycleTools = () =>
     patchOwnedTools(pi, "background", {
       disable: OPENPI_TOOL_SURFACE.background.deferred,
@@ -245,6 +251,7 @@ export default function (pi: ExtensionAPI) {
   const flushResults = (wake: boolean) => {
     const snaps = resultDelivery.drain(MAX_RUNNING);
     if (!deliverResults(snaps, wake)) resultDelivery.restore(snaps);
+    else resultDelivery.acknowledge(snaps);
   };
 
   const idleResultBatcher = createIdleResultBatcher({

package/extensions/background-terminals/src/manager.ts

@@ -395,11 +395,9 @@ export async function signalWindowsProcessTree(
       : attempt.outcome === "timed_out"
         ? `taskkill timed out after ${attempt.timeoutMs}ms; helper ${attempt.helperClosed ? "closed after SIGKILL" : `did not close within an additional ${attempt.helperCloseTimeoutMs}ms`}`
         : `taskkill exited ${attempt.exitCode ?? "without a code"}${attempt.signal ? ` (${attempt.signal})` : ""}`;
-  if (
-    attempt.outcome === "timed_out" &&
-    !attempt.helperClosed &&
-    !targetExited()
-  ) {
+  // Closing the helper or observing the shell exit does not prove that all
+  // descendants exited. Preserve uncertainty instead of killing only the shell.
+  if (attempt.outcome === "timed_out") {
     return { outcome: "unresolved", detail };
   }
   // A failed graceful taskkill must leave the shell PID alive for the

package/extensions/background-terminals/src/result-delivery.ts

@@ -1,44 +1,64 @@
 import type { ConsumableResultDeliveryQueue } from "../../shared/result-delivery.ts";
+import {
+  type CompletionOwner,
+  createCompletionInbox,
+} from "../../shared/completion-inbox.ts";
 
 /**
- * Deferred one-shot delivery map (same semantics as subagents'): a settled
- * terminal's result is held here until it is either drained into a follow-up
- * message or consumed by a tool call (bg_kill / bg_status) that already
- * returned the settlement itself. Keyed by id, so double delivery is
- * structurally impossible — whoever drains first wins.
+ * Deferred one-shot delivery adapter (same semantics as subagents'): a
+ * settled terminal's result is held in the shared inbox until it is either
+ * drained into a follow-up message or consumed by a tool call (bg_kill /
+ * bg_status) that already returned the settlement itself. Stable ids make
+ * double delivery structurally impossible — whoever claims first wins.
  */
-export function createDeferredResultDelivery<T extends { id: string }>() {
-  const pending = new Map<string, T>();
+export function createDeferredResultDelivery<T extends { id: string }>(
+  options: { readonly owner?: () => CompletionOwner | undefined } = {},
+) {
+  const inbox = createCompletionInbox<T>();
+  const owner = options.owner ?? (() => ({ sessionId: "test", epoch: 0 }));
 
   const queue = {
     defer(result: T) {
-      pending.set(result.id, result);
-      return pending.size;
+      const currentOwner = owner();
+      inbox.defer(
+        {
+          deliveryId: `background:${result.id}`,
+          owner: currentOwner ?? { sessionId: "unowned", epoch: 0 },
+          producer: "background",
+          producerId: result.id,
+          terminalRef: { kind: "terminal-snapshot", id: result.id },
+          wake: "producer-policy",
+          payload: result,
+        },
+        currentOwner,
+      );
+      return inbox.size();
     },
     consume(ids: Iterable<string>) {
-      for (const id of ids) pending.delete(id);
+      inbox.consume("background", ids);
     },
     drain(maxResults = Number.POSITIVE_INFINITY) {
-      const results: T[] = [];
-      for (const [id, result] of pending) {
-        if (results.length >= maxResults) break;
-        results.push(result);
-        pending.delete(id);
-      }
-      return results;
+      return inbox
+        .claim(owner(), maxResults)
+        .map((envelope) => envelope.payload);
     },
     restore(results: readonly T[]) {
-      const current = [...pending.values()];
-      pending.clear();
-      for (const result of results) pending.set(result.id, result);
-      for (const result of current) pending.set(result.id, result);
+      inbox.retryClaimed(
+        "background",
+        results.map((result) => result.id),
+        owner(),
+      );
+    },
+    acknowledge(results: readonly T[]) {
+      inbox.acknowledge(results.map((result) => `background:${result.id}`));
     },
     size() {
-      return pending.size;
+      return inbox.size();
     },
     clear() {
-      pending.clear();
+      inbox.clear();
     },
+    inspectDeadLetters: inbox.inspectDeadLetters,
   };
   return queue satisfies ConsumableResultDeliveryQueue<T>;
 }

package/extensions/cron/index.ts

@@ -17,6 +17,9 @@ import type {
 } from "@earendil-works/pi-coding-agent";
 import {
   advanceDeliveredJobs,
+  CRON_DELIVERY_MAX_BYTES,
+  CRON_DELIVERY_MAX_JOBS,
+  CRON_MAX_JOBS,
   type CronJob,
   dueJobs,
   formatInterval,
@@ -41,6 +44,48 @@ const SYSTEM_RUNTIME: CronRuntime = {
   },
 };
 
+function deliveryMessage(due: readonly CronJob[]) {
+  const jobs = due.map((job) => ({
+    id: job.id,
+    prompt: job.prompt,
+    recurring: job.intervalMs !== undefined,
+  }));
+  return due.length === 1
+    ? {
+        customType: "cron-fire",
+        content: `[cron ${jobs[0]!.id} · ${jobs[0]!.recurring ? "recurring" : "once"}]\n${jobs[0]!.prompt}`,
+        display: true,
+        details: jobs[0]!,
+      }
+    : {
+        customType: "cron-fire",
+        content: `${due.length} scheduled prompts are due:\n\n${jobs
+          .map(
+            (job) =>
+              `[cron ${job.id} · ${job.recurring ? "recurring" : "once"}]\n${job.prompt}`,
+          )
+          .join("\n\n")}`,
+        display: true,
+        details: { count: jobs.length, jobs },
+      };
+}
+
+function dueDeliveryBatch(due: readonly CronJob[]) {
+  const selected: CronJob[] = [];
+  for (const job of due.slice(0, CRON_DELIVERY_MAX_JOBS)) {
+    const candidate = [...selected, job];
+    const message = deliveryMessage(candidate);
+    if (
+      new TextEncoder().encode(message.content).byteLength >
+      CRON_DELIVERY_MAX_BYTES
+    ) {
+      break;
+    }
+    selected.push(job);
+  }
+  return selected;
+}
+
 export default function cron(
   pi: ExtensionAPI,
   runtime: CronRuntime = SYSTEM_RUNTIME,
@@ -58,30 +103,7 @@ export default function cron(
   const fire = (due: readonly CronJob[]) => {
     if (due.length === 0) return true;
     try {
-      const jobs = due.map((job) => ({
-        id: job.id,
-        prompt: job.prompt,
-        recurring: job.intervalMs !== undefined,
-      }));
-      const message =
-        due.length === 1
-          ? {
-              customType: "cron-fire",
-              content: `[cron ${jobs[0]!.id} · ${jobs[0]!.recurring ? "recurring" : "once"}]\n${jobs[0]!.prompt}`,
-              display: true,
-              details: jobs[0],
-            }
-          : {
-              customType: "cron-fire",
-              content: `${due.length} scheduled prompts are due:\n\n${jobs
-                .map(
-                  (job) =>
-                    `[cron ${job.id} · ${job.recurring ? "recurring" : "once"}]\n${job.prompt}`,
-                )
-                .join("\n\n")}`,
-              display: true,
-              details: { count: jobs.length, jobs },
-            };
+      const message = deliveryMessage(due);
       pi.sendMessage<
         | { id: number; prompt: string; recurring: boolean }
         | {
@@ -109,9 +131,11 @@ export default function cron(
     const now = runtime.now();
     const due = dueJobs(jobs, now);
     if (due.length === 0) return;
+    const batch = dueDeliveryBatch(due);
+    if (batch.length === 0) return;
     const deliveredIds = new Set<number>();
-    if (fire(due)) {
-      for (const job of due) deliveredIds.add(job.id);
+    if (fire(batch)) {
+      for (const job of batch) deliveredIds.add(job.id);
     }
     jobs = advanceDeliveredJobs(jobs, deliveredIds, runtime.now());
     if (jobs.length === 0) stopTicker();
@@ -170,12 +194,29 @@ export default function cron(
         return;
       }
 
+      if (jobs.length >= CRON_MAX_JOBS) {
+        ctx.ui.notify(
+          `A session can have at most ${CRON_MAX_JOBS} scheduled prompts. Remove one before adding another.`,
+          "warning",
+        );
+        return;
+      }
+
       const intervalMs = parsed.intervalMs!;
+      const now = runtime.now();
+      const nextRunAt = now + intervalMs;
+      if (!Number.isSafeInteger(now) || !Number.isSafeInteger(nextRunAt)) {
+        ctx.ui.notify(
+          "Scheduled time is too far in the future. Use a shorter duration.",
+          "warning",
+        );
+        return;
+      }
       const job: CronJob = {
         id: nextId++,
         prompt: parsed.prompt!,
         ...(parsed.oneShot ? {} : { intervalMs }),
-        nextRunAt: runtime.now() + intervalMs,
+        nextRunAt,
       };
       jobs.push(job);
       startTicker();