@wonsukchoi/crondex 0.3.0 → 0.4.0

package/README.md

@@ -62,7 +62,8 @@ crondex/
 │   ├── content/
 │   ├── finance/
 │   ├── security/
-│   └── learning/
+│   ├── learning/
+│   └── team/
 └── scripts/
     ├── build-catalog.js   regenerates catalog.json from jobs/**/*.yaml
     └── validate-jobs.js   validates every job against the schema
@@ -70,7 +71,7 @@ crondex/
 
 ## Available jobs
 
-35 jobs across 7 categories. Full details (description, tags, variables)
+46 jobs across 8 categories. Full details (description, tags, variables)
 live in `catalog.json` and each job's YAML file — run `crondex list` or
 browse `jobs/<category>/` for the plain-language rundown of each.
 
@@ -92,6 +93,9 @@ browse `jobs/<category>/` for the plain-language rundown of each.
 | `db-backup-verify` | `0 5 * * *` | script |
 | `license-compliance-check` | `0 8 * * 1` | script |
 | `orphaned-branch-cleanup` | `0 9 * * 1` | script |
+| `dns-record-check` | `0 */6 * * *` | script |
+| `queue-depth-check` | `*/10 * * * *` | script |
+| `api-rate-limit-check` | `*/15 * * * *` | script |
 
 **productivity**
 
@@ -119,6 +123,8 @@ browse `jobs/<category>/` for the plain-language rundown of each.
 | `changelog-digest` | `0 10 * * 5` | script + agent-prompt |
 | `broken-link-check` | `0 7 * * 1` | script |
 | `social-mentions-watch` | `0 9 * * *` | agent-prompt only |
+| `seo-meta-check` | `0 7 * * 1` | script |
+| `rss-feed-validate` | `0 8 * * *` | script |
 
 **finance**
 
@@ -127,6 +133,8 @@ browse `jobs/<category>/` for the plain-language rundown of each.
 | `subscription-audit` | `0 9 1 * *` | script |
 | `net-worth-snapshot` | `0 9 1 * *` | script |
 | `saas-seat-audit` | `0 9 1 * *` | script |
+| `invoice-overdue-check` | `0 9 * * *` | script |
+| `tax-deadline-reminder` | `0 9 * * *` | script |
 
 **security**
 
@@ -135,6 +143,8 @@ browse `jobs/<category>/` for the plain-language rundown of each.
 | `secrets-scan` | `0 3 * * *` | script |
 | `open-port-check` | `0 */4 * * *` | script |
 | `failed-login-watch` | `*/15 * * * *` | script |
+| `sudo-usage-audit` | `0 * * * *` | script |
+| `firewall-rule-diff` | `0 6 * * *` | script |
 
 **learning**
 
@@ -144,6 +154,13 @@ browse `jobs/<category>/` for the plain-language rundown of each.
 | `reading-list-nudge` | `0 9 * * 6` | script |
 | `course-progress-checkin` | `0 9 * * 1` | script |
 
+**team**
+
+| id | schedule | modes |
+|---|---|---|
+| `1on1-prep-reminder` | `0 9 * * 3` | script |
+| `pto-balance-check` | `0 9 1 * *` | script |
+
 ## How a job works
 
 Every job is one YAML file with a `runner`:

package/catalog.json

@@ -1,8 +1,56 @@
 {
   "generated_by": "scripts/build-catalog.js",
   "schema": "schema/job.schema.json",
-  "count": 35,
+  "count": 46,
   "jobs": [
+    {
+      "id": "1on1-prep-reminder",
+      "version": 1,
+      "name": "1:1 Prep Reminder",
+      "description": "Nudges you to prep talking points before a recurring 1:1 and shows your last notes. Use this if you've ever walked into a 1:1 with nothing prepared and just winged it.",
+      "category": "team",
+      "tags": [
+        "1on1",
+        "meetings",
+        "team"
+      ],
+      "schedule": "0 9 * * 3",
+      "timezone": "America/Los_Angeles",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/team/1on1-prep-reminder.yaml"
+    },
+    {
+      "id": "api-rate-limit-check",
+      "version": 1,
+      "name": "API Rate Limit Check",
+      "description": "Checks how many API requests you have left before hitting a rate limit. Use this if you've ever gotten a 429 in production because nobody was watching the remaining quota.",
+      "category": "devops",
+      "tags": [
+        "api",
+        "rate-limit",
+        "monitoring"
+      ],
+      "schedule": "*/15 * * * *",
+      "timezone": "UTC",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/devops/api-rate-limit-check.yaml"
+    },
     {
       "id": "backup-reminder",
       "version": 1,
@@ -279,6 +327,30 @@
       ],
       "path": "jobs/devops/disk-space-check.yaml"
     },
+    {
+      "id": "dns-record-check",
+      "version": 1,
+      "name": "DNS Record Drift Check",
+      "description": "Checks that a DNS record still resolves to the value you expect, and flags drift. Use this if you've ever had DNS quietly change (an expired record, a misconfigured provider) and only found out when something broke.",
+      "category": "devops",
+      "tags": [
+        "dns",
+        "monitoring",
+        "drift"
+      ],
+      "schedule": "0 */6 * * *",
+      "timezone": "UTC",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/devops/dns-record-check.yaml"
+    },
     {
       "id": "docker-image-prune",
       "version": 1,
@@ -351,6 +423,30 @@
       ],
       "path": "jobs/security/failed-login-watch.yaml"
     },
+    {
+      "id": "firewall-rule-diff",
+      "version": 1,
+      "name": "Firewall Rule Diff",
+      "description": "Diffs your current firewall rules against a saved baseline and flags any drift. Use this if a firewall rule has ever changed without anyone remembering who did it or why.",
+      "category": "security",
+      "tags": [
+        "security",
+        "firewall",
+        "drift"
+      ],
+      "schedule": "0 6 * * *",
+      "timezone": "UTC",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/security/firewall-rule-diff.yaml"
+    },
     {
       "id": "focus-block-reminder",
       "version": 1,
@@ -425,6 +521,30 @@
       ],
       "path": "jobs/productivity/inbox-triage.yaml"
     },
+    {
+      "id": "invoice-overdue-check",
+      "version": 1,
+      "name": "Invoice Overdue Check",
+      "description": "Flags invoices that are past due and still unpaid. Use this if you freelance or run a small business and invoices have ever slipped through the cracks.",
+      "category": "finance",
+      "tags": [
+        "invoices",
+        "accounts-receivable",
+        "finance"
+      ],
+      "schedule": "0 9 * * *",
+      "timezone": "UTC",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/finance/invoice-overdue-check.yaml"
+    },
     {
       "id": "license-compliance-check",
       "version": 1,
@@ -571,6 +691,54 @@
       ],
       "path": "jobs/devops/orphaned-branch-cleanup.yaml"
     },
+    {
+      "id": "pto-balance-check",
+      "version": 1,
+      "name": "PTO Balance Check",
+      "description": "Warns you before unused PTO expires or resets. Use this if you've ever lost vacation days because you forgot they don't roll over.",
+      "category": "team",
+      "tags": [
+        "pto",
+        "vacation",
+        "team"
+      ],
+      "schedule": "0 9 1 * *",
+      "timezone": "America/Los_Angeles",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/team/pto-balance-check.yaml"
+    },
+    {
+      "id": "queue-depth-check",
+      "version": 1,
+      "name": "Queue Depth Check",
+      "description": "Checks how backed up a job queue is and warns if it crosses a threshold. Use this if a stuck worker has ever let a queue silently balloon until someone noticed customers weren't getting emails.",
+      "category": "devops",
+      "tags": [
+        "queue",
+        "redis",
+        "monitoring"
+      ],
+      "schedule": "*/10 * * * *",
+      "timezone": "UTC",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/devops/queue-depth-check.yaml"
+    },
     {
       "id": "reading-list-nudge",
       "version": 1,
@@ -622,6 +790,30 @@
       ],
       "path": "jobs/devops/repo-health-check.yaml"
     },
+    {
+      "id": "rss-feed-validate",
+      "version": 1,
+      "name": "RSS Feed Validation",
+      "description": "Checks your RSS/Atom feed is valid XML and shows the most recent item's publish date. Use this if you've ever shipped a broken feed and only found out when a reader's app stopped updating.",
+      "category": "content",
+      "tags": [
+        "rss",
+        "feed",
+        "content"
+      ],
+      "schedule": "0 8 * * *",
+      "timezone": "UTC",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/content/rss-feed-validate.yaml"
+    },
     {
       "id": "saas-seat-audit",
       "version": 1,
@@ -697,6 +889,30 @@
       ],
       "path": "jobs/security/secrets-scan.yaml"
     },
+    {
+      "id": "seo-meta-check",
+      "version": 1,
+      "name": "SEO Meta Tag Check",
+      "description": "Checks a list of pages for missing title, meta description, and Open Graph tags. Use this if pages have ever shipped without basic SEO/social-preview tags because nobody double-checked.",
+      "category": "content",
+      "tags": [
+        "seo",
+        "content",
+        "meta-tags"
+      ],
+      "schedule": "0 7 * * 1",
+      "timezone": "UTC",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/content/seo-meta-check.yaml"
+    },
     {
       "id": "social-mentions-watch",
       "version": 1,
@@ -796,6 +1012,54 @@
       ],
       "path": "jobs/finance/subscription-audit.yaml"
     },
+    {
+      "id": "sudo-usage-audit",
+      "version": 1,
+      "name": "Sudo Usage Audit",
+      "description": "Reports new sudo commands run since the last check. Use this if you want to notice unexpected privilege escalation on a shared or internet-facing server.",
+      "category": "security",
+      "tags": [
+        "security",
+        "sudo",
+        "audit"
+      ],
+      "schedule": "0 * * * *",
+      "timezone": "UTC",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/security/sudo-usage-audit.yaml"
+    },
+    {
+      "id": "tax-deadline-reminder",
+      "version": 1,
+      "name": "Tax Deadline Reminder",
+      "description": "Warns you ahead of upcoming tax deadlines you've listed. Use this if quarterly estimated payments or annual filing dates have ever snuck up on you.",
+      "category": "finance",
+      "tags": [
+        "tax",
+        "deadlines",
+        "finance"
+      ],
+      "schedule": "0 9 * * *",
+      "timezone": "UTC",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/finance/tax-deadline-reminder.yaml"
+    },
     {
       "id": "uptime-ping-check",
       "version": 1,

package/jobs/content/rss-feed-validate.yaml

@@ -0,0 +1,32 @@
+id: rss-feed-validate
+version: 1
+name: RSS Feed Validation
+description: >
+  Checks your RSS/Atom feed is valid XML and shows the most recent
+  item's publish date. Use this if you've ever shipped a broken feed
+  and only found out when a reader's app stopped updating.
+category: content
+tags: [rss, feed, content]
+schedule: "0 8 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  url={{feed_url}};
+  xml=$(curl -sL --max-time 10 "$url");
+  [ -z "$xml" ] && { echo "ERROR: could not fetch $url"; exit 1; };
+  if command -v xmllint >/dev/null 2>&1; then
+    echo "$xml" | xmllint --noout - 2>&1 && echo "OK: valid XML" || { echo "INVALID XML"; exit 1; };
+  else
+    echo "xmllint not installed, skipping strict XML validation";
+  fi;
+  pubdate=$(echo "$xml" | grep -oE "<pubDate>[^<]+</pubDate>" | head -n1 | sed 's/<[^>]*>//g');
+  echo "Most recent item pubDate: ${pubdate:-unknown}"
+variables:
+  feed_url:
+    default: "https://example.com/feed.xml"
+    description: URL of the RSS/Atom feed to check.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Only reports the latest pubDate for you to eyeball —
+  doesn't flag "stale" automatically since feed cadences vary too much
+  for one threshold. Install `xmllint` (libxml2) for strict validation.

package/jobs/content/seo-meta-check.yaml

@@ -0,0 +1,32 @@
+id: seo-meta-check
+version: 1
+name: SEO Meta Tag Check
+description: >
+  Checks a list of pages for missing title, meta description, and
+  Open Graph tags. Use this if pages have ever shipped without basic
+  SEO/social-preview tags because nobody double-checked.
+category: content
+tags: [seo, content, meta-tags]
+schedule: "0 7 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  file={{urls_file}};
+  [ -f "$file" ] || { echo "ERROR: $file not found"; exit 1; };
+  while IFS= read -r url; do
+    [ -z "$url" ] && continue;
+    html=$(curl -sL --max-time 10 "$url");
+    missing="";
+    echo "$html" | grep -qi "<title>" || missing="$missing title";
+    echo "$html" | grep -qi 'name="description"' || missing="$missing meta-description";
+    echo "$html" | grep -qi 'property="og:title"' || missing="$missing og:title";
+    if [ -n "$missing" ]; then echo "MISSING on $url:$missing"; else echo "OK: $url"; fi
+  done < "$file"
+variables:
+  urls_file:
+    default: "./pages.txt"
+    description: Plain text file with one page URL per line to check.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Basic presence check only (does the tag exist), not content
+  quality — pair with a fuller SEO audit for anything deeper.

package/jobs/devops/api-rate-limit-check.yaml

@@ -0,0 +1,31 @@
+id: api-rate-limit-check
+version: 1
+name: API Rate Limit Check
+description: >
+  Checks how many API requests you have left before hitting a rate
+  limit. Use this if you've ever gotten a 429 in production because
+  nobody was watching the remaining quota.
+category: devops
+tags: [api, rate-limit, monitoring]
+schedule: "*/15 * * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  url={{api_url}};
+  headers=$(curl -sI --max-time 10 "$url");
+  remaining=$(echo "$headers" | grep -i "^x-ratelimit-remaining:" | awk '{print $2}' | tr -d '\r');
+  if [ -z "$remaining" ]; then echo "no rate-limit headers found on $url (nothing to check, or a different header convention)"; exit 0;
+  elif [ "$remaining" -le {{warn_threshold}} ]; then echo "WARNING: $url has only $remaining requests remaining"; exit 1;
+  else echo "OK: $url has $remaining requests remaining"; fi
+variables:
+  api_url:
+    default: "https://api.example.com/status"
+    description: An endpoint on the API you want to watch — any request that returns rate-limit headers works.
+  warn_threshold:
+    default: 50
+    description: Warn if remaining requests drops to this or below.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Assumes the standard `X-RateLimit-Remaining` response header — adjust
+  the grep pattern if your API uses a different convention
+  (e.g. `RateLimit-Remaining`, a custom header).

package/jobs/devops/dns-record-check.yaml

@@ -0,0 +1,32 @@
+id: dns-record-check
+version: 1
+name: DNS Record Drift Check
+description: >
+  Checks that a DNS record still resolves to the value you expect, and
+  flags drift. Use this if you've ever had DNS quietly change (an
+  expired record, a misconfigured provider) and only found out when
+  something broke.
+category: devops
+tags: [dns, monitoring, drift]
+schedule: "0 */6 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  domain={{domain}}; type={{record_type}}; expected="{{expected_value}}";
+  command -v dig >/dev/null 2>&1 || { echo "ERROR: dig not installed"; exit 1; };
+  actual=$(dig +short "$domain" "$type" | tr '\n' ' ' | sed 's/ *$//');
+  if [ -z "$actual" ]; then echo "ERROR: no $type record found for $domain"; exit 1;
+  elif echo "$actual" | grep -qF "$expected"; then echo "OK: $domain $type matches expected ($actual)";
+  else echo "DRIFT: $domain $type is '$actual', expected to contain '$expected'"; exit 1; fi
+variables:
+  domain:
+    default: "example.com"
+    description: Domain to check.
+  record_type:
+    default: "A"
+    description: DNS record type (A, CNAME, TXT, MX, etc).
+  expected_value:
+    default: "93.184.216.34"
+    description: Value the record should contain — replace with your actual expected record.
+compatible_agents: [generic, claude, codex]
+notes: Zero-token, deterministic. Requires `dig` (part of dnsutils/bind-tools).

package/jobs/devops/queue-depth-check.yaml

@@ -0,0 +1,35 @@
+id: queue-depth-check
+version: 1
+name: Queue Depth Check
+description: >
+  Checks how backed up a job queue is and warns if it crosses a
+  threshold. Use this if a stuck worker has ever let a queue silently
+  balloon until someone noticed customers weren't getting emails.
+category: devops
+tags: [queue, redis, monitoring]
+schedule: "*/10 * * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v redis-cli >/dev/null 2>&1 || { echo "ERROR: redis-cli not installed"; exit 1; };
+  depth=$(redis-cli -h {{redis_host}} -p {{redis_port}} llen {{queue_key}} 2>/dev/null);
+  if [ -z "$depth" ]; then echo "ERROR: could not read queue depth for {{queue_key}}"; exit 1;
+  elif [ "$depth" -ge {{threshold}} ]; then echo "WARNING: queue {{queue_key}} depth is $depth (threshold {{threshold}})"; exit 1;
+  else echo "OK: queue {{queue_key}} depth is $depth"; fi
+variables:
+  redis_host:
+    default: "localhost"
+    description: Redis host.
+  redis_port:
+    default: 6379
+    description: Redis port.
+  queue_key:
+    default: "jobs:pending"
+    description: Redis list key backing the queue.
+  threshold:
+    default: 1000
+    description: Warn if the queue depth reaches this many items.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Redis list-backed queues only (uses LLEN). Adapt the depth-check
+  command for RabbitMQ, SQS, or other queue systems.

package/jobs/finance/invoice-overdue-check.yaml

@@ -0,0 +1,32 @@
+id: invoice-overdue-check
+version: 1
+name: Invoice Overdue Check
+description: >
+  Flags invoices that are past due and still unpaid. Use this if you
+  freelance or run a small business and invoices have ever slipped
+  through the cracks.
+category: finance
+tags: [invoices, accounts-receivable, finance]
+schedule: "0 9 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  file={{invoices_file}};
+  [ -f "$file" ] || { echo "ERROR: $file not found"; exit 1; };
+  today=$(date +%s);
+  tail -n +2 "$file" | while IFS=, read -r id client amount due paid; do
+    [ "$paid" = "yes" ] && continue;
+    due_epoch=$(date -j -f %Y-%m-%d "$due" +%s 2>/dev/null || date -d "$due" +%s);
+    days=$(( (today-due_epoch)/86400 ));
+    if [ "$days" -gt 0 ]; then echo "OVERDUE: invoice $id ($client, \$$amount) — $days day(s) past due ($due)"; fi
+  done
+variables:
+  invoices_file:
+    default: "./invoices.csv"
+    description: >
+      CSV with header "invoice_id,client,amount,due_date,paid"
+      (due_date is YYYY-MM-DD, paid is yes/no).
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. You maintain invoices.csv yourself (mark paid=yes once
+  settled) — this doesn't connect to any billing/accounting system.

package/jobs/finance/tax-deadline-reminder.yaml

@@ -0,0 +1,33 @@
+id: tax-deadline-reminder
+version: 1
+name: Tax Deadline Reminder
+description: >
+  Warns you ahead of upcoming tax deadlines you've listed. Use this if
+  quarterly estimated payments or annual filing dates have ever snuck
+  up on you.
+category: finance
+tags: [tax, deadlines, finance]
+schedule: "0 9 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  file={{deadlines_file}}; warn={{warn_days}};
+  [ -f "$file" ] || { echo "ERROR: $file not found"; exit 1; };
+  today=$(date +%s);
+  tail -n +2 "$file" | while IFS=, read -r label due; do
+    [ -z "$due" ] && continue;
+    due_epoch=$(date -j -f %Y-%m-%d "$due" +%s 2>/dev/null || date -d "$due" +%s);
+    days=$(( (due_epoch-today)/86400 ));
+    if [ "$days" -ge 0 ] && [ "$days" -le "$warn" ]; then echo "REMINDER: $label due in $days day(s) ($due)"; fi
+  done
+variables:
+  deadlines_file:
+    default: "./tax-deadlines.csv"
+    description: CSV with header "label,date" (date is YYYY-MM-DD), one deadline per row.
+  warn_days:
+    default: 14
+    description: Start warning this many days before a deadline.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. You maintain tax-deadlines.csv yourself with your actual
+  jurisdiction's dates — this job doesn't know tax law or deadlines on its own.

package/jobs/security/firewall-rule-diff.yaml

@@ -0,0 +1,30 @@
+id: firewall-rule-diff
+version: 1
+name: Firewall Rule Diff
+description: >
+  Diffs your current firewall rules against a saved baseline and flags
+  any drift. Use this if a firewall rule has ever changed without
+  anyone remembering who did it or why.
+category: security
+tags: [security, firewall, drift]
+schedule: "0 6 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  baseline={{baseline_path}};
+  if command -v ufw >/dev/null 2>&1; then current=$(sudo ufw status verbose 2>/dev/null);
+  elif command -v iptables >/dev/null 2>&1; then current=$(sudo iptables -S 2>/dev/null);
+  else echo "ERROR: no supported firewall tool found (ufw/iptables)"; exit 1; fi;
+  if [ ! -f "$baseline" ]; then echo "$current" > "$baseline"; echo "no baseline found — saved current rules as the new baseline"; exit 0; fi;
+  if diff -q <(echo "$current") "$baseline" >/dev/null 2>&1; then echo "OK: firewall rules match baseline";
+  else echo "DRIFT: firewall rules differ from baseline:"; diff <(echo "$current") "$baseline"; exit 1; fi
+variables:
+  baseline_path:
+    default: "./firewall-baseline.txt"
+    description: File storing the known-good firewall rule snapshot.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Requires sudo access to read ufw/iptables rules (configure passwordless
+  sudo for this specific read-only command if running unattended). First
+  run saves the baseline; later runs diff against it. Requires bash
+  (process substitution).

package/jobs/security/sudo-usage-audit.yaml

@@ -0,0 +1,35 @@
+id: sudo-usage-audit
+version: 1
+name: Sudo Usage Audit
+description: >
+  Reports new sudo commands run since the last check. Use this if you
+  want to notice unexpected privilege escalation on a shared or
+  internet-facing server.
+category: security
+tags: [security, sudo, audit]
+schedule: "0 * * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  log={{auth_log_path}}; state={{state_file}};
+  [ -f "$log" ] || { echo "ERROR: $log not found"; exit 1; };
+  total=$(grep -c "sudo:.*COMMAND=" "$log");
+  last=$(cat "$state" 2>/dev/null || echo 0);
+  new=$(( total - last ));
+  [ "$new" -lt 0 ] && new=0;
+  echo "$total" > "$state";
+  if [ "$new" -gt 0 ]; then
+    echo "New sudo commands since last check ($new):";
+    grep "sudo:.*COMMAND=" "$log" | tail -n "$new";
+  else echo "OK: no new sudo usage since last check"; fi
+variables:
+  auth_log_path:
+    default: "/var/log/auth.log"
+    description: Path to the auth log (Linux-style).
+  state_file:
+    default: "./.sudo-audit-state"
+    description: File this job uses to remember the last count seen, so it only reports new entries.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Linux-oriented (/var/log/auth.log with sudo entries). On macOS use
+  `log show --predicate 'process == "sudo"'` instead and adapt the command.

package/jobs/team/1on1-prep-reminder.yaml

@@ -0,0 +1,26 @@
+id: 1on1-prep-reminder
+version: 1
+name: 1:1 Prep Reminder
+description: >
+  Nudges you to prep talking points before a recurring 1:1 and shows
+  your last notes. Use this if you've ever walked into a 1:1 with
+  nothing prepared and just winged it.
+category: team
+tags: [1on1, meetings, team]
+schedule: "0 9 * * 3"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  echo "1:1 with {{person_name}} coming up. Jot down talking points.";
+  if [ -f "{{notes_file}}" ]; then echo "--- last notes ---"; tail -n 10 "{{notes_file}}"; fi
+variables:
+  person_name:
+    default: "your manager"
+    description: Who the 1:1 is with.
+  notes_file:
+    default: "./1on1-notes.txt"
+    description: Plain text file you append notes/action items to after each 1:1.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Adjust the schedule to match your actual 1:1 day/time —
+  the default (Wednesday morning) is just a placeholder.

package/jobs/team/pto-balance-check.yaml

@@ -0,0 +1,33 @@
+id: pto-balance-check
+version: 1
+name: PTO Balance Check
+description: >
+  Warns you before unused PTO expires or resets. Use this if you've
+  ever lost vacation days because you forgot they don't roll over.
+category: team
+tags: [pto, vacation, team]
+schedule: "0 9 1 * *"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  today_epoch=$(date +%s);
+  expiry_epoch=$(date -j -f %Y-%m-%d "{{expiry_date}}" +%s 2>/dev/null || date -d "{{expiry_date}}" +%s);
+  days_left=$(( (expiry_epoch-today_epoch)/86400 ));
+  if [ "$days_left" -lt 0 ]; then echo "note: expiry date has passed — update expiry_date for the next period.";
+  elif [ "$days_left" -le {{warn_days_before_expiry}} ] && [ {{pto_balance_hours}} -gt 0 ]; then
+    echo "REMINDER: {{pto_balance_hours}}h PTO expires in $days_left day(s) (on {{expiry_date}}) — use it or lose it.";
+  else echo "OK: {{pto_balance_hours}}h PTO, $days_left day(s) until expiry."; fi
+variables:
+  pto_balance_hours:
+    default: 40
+    description: Your current unused PTO balance, in hours — update this yourself as it changes.
+  expiry_date:
+    default: "2026-12-31"
+    description: Date (YYYY-MM-DD) this PTO expires or resets.
+  warn_days_before_expiry:
+    default: 30
+    description: Start warning this many days before expiry.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. You maintain pto_balance_hours and expiry_date yourself —
+  this doesn't pull from any HR system.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wonsukchoi/crondex",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "A public directory of pre-made, agent-editable cron jobs.",
   "type": "module",
   "license": "MIT",