@yemi33/minions 0.1.2424 → 0.1.2425

package/engine/runtimes/claude.js

@@ -14,7 +14,7 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { FAILURE_CLASS, safeWrite, ts, resolveEngineCacheDir } = require('../shared');
+const { FAILURE_CLASS, safeWrite, ts, resolveEngineCacheDir, staleResumeSessionCwdReason } = require('../shared');
 const { wrapUntrusted, buildSource } = require('../untrusted-fence');
 
 const ENGINE_DIR = __dirname.replace(/[\\/]runtimes$/, '');
@@ -317,6 +317,22 @@ function getResumeSessionId({ agentId, branchName, agentsDir, cwd = null, homeDi
       return null;
     }
 
+    // Stale-workdir invalidation (W-ms0vk9nv000z985b). The session is anchored
+    // to the directory it was created in; if the engine has since removed,
+    // recycled or quarantined that worktree, `--resume` dies before it writes
+    // any stdout. Checked BEFORE the jsonl probe below: it is the more
+    // specific diagnosis (and the jsonl probe would otherwise absorb the same
+    // case under a misleading "died before checkpoint" message, because the
+    // jsonl is keyed by the CURRENT cwd, not the session's).
+    const staleCwdReason = staleResumeSessionCwdReason(sessionFile.cwd, cwd);
+    if (staleCwdReason) {
+      if (logger && typeof logger.info === 'function') {
+        logger.info(`Skipping resume for ${agentId}: ${staleCwdReason} — clearing session.json`);
+      }
+      try { fs.unlinkSync(sessionPath); } catch {}
+      return null;
+    }
+
     // Stale-resume-target invalidation (W-mouugzow00068741). Claude only writes
     // the jsonl on stable checkpoint; a session ID stamped before checkpoint
     // dies with the agent. Probe for the jsonl and clear session.json when
@@ -348,7 +364,7 @@ function getResumeSessionId({ agentId, branchName, agentsDir, cwd = null, homeDi
   return null;
 }
 
-function saveSession({ agentId, dispatchId, branch, sessionId, agentsDir, now = ts, writeJson = safeWrite, logger = console } = {}) {
+function saveSession({ agentId, dispatchId, branch, sessionId, agentsDir, cwd = null, now = ts, writeJson = safeWrite, logger = console } = {}) {
   if (!sessionId || !agentId || agentId.startsWith('temp-') || !agentsDir) return false;
   try {
     writeJson(path.join(agentsDir, agentId, 'session.json'), {
@@ -356,6 +372,9 @@ function saveSession({ agentId, dispatchId, branch, sessionId, agentsDir, now =
       dispatchId,
       savedAt: typeof now === 'function' ? now() : new Date().toISOString(),
       branch: branch || null,
+      // Working directory the session was created in — read back by
+      // getResumeSessionId to refuse resuming into a dead/other worktree.
+      cwd: cwd || null,
       runtime: RUNTIME_NAME,
     });
     return true;
@@ -526,6 +545,42 @@ function parseStreamChunk(line) {
   try { return JSON.parse(trimmed); } catch { return null; }
 }
 
+// W-ms0vk9nv000z985b — did the process die between a tool start and its
+// result? See engine/runtimes/contract.js#hasUnfinishedToolCall.
+//
+// Claude's stream-json brackets a tool call as an assistant `tool_use` block
+// followed by a user `tool_result` block. A `result` event means the turn
+// terminated normally, so any outstanding block was reconciled by the CLI
+// itself and the turn was NOT truncated.
+function hasUnfinishedToolCall(raw) {
+  const safeRaw = raw == null ? '' : String(raw);
+  if (!safeRaw) return false;
+  let started = 0;
+  let completed = 0;
+  const visit = (obj) => {
+    if (!obj || typeof obj !== 'object') return false;
+    if (obj.type === 'result') return true;
+    const content = obj.message?.content;
+    if (Array.isArray(content)) {
+      for (const block of content) {
+        if (block?.type === 'tool_use') started++;
+        else if (block?.type === 'tool_result') completed++;
+      }
+    }
+    return false;
+  };
+  for (const rawLine of safeRaw.split('\n')) {
+    const line = rawLine.trim();
+    if (!line || (!line.startsWith('{') && !line.startsWith('['))) continue;
+    let parsed;
+    try { parsed = JSON.parse(line); } catch { continue; }
+    for (const obj of Array.isArray(parsed) ? parsed : [parsed]) {
+      if (visit(obj)) return false;
+    }
+  }
+  return started > completed;
+}
+
 // ── Error Normalization ──────────────────────────────────────────────────────
 
 // Pull a model id out of an Anthropic-style invalid-model error string. Claude
@@ -848,6 +903,8 @@ const capabilities = {
   // (proven empirically in spike P-3f8a1c92). Engine code gates on this flag,
   // never on runtime.name.
   imageInput: true,
+  // Claude natively discovers `.claude/skills/` directories without configuration
+  skillDiscovery: true,
 };
 
 // Install hint surfaced when `resolveBinary()` returns null. Consumed by
@@ -1042,6 +1099,7 @@ module.exports = {
   modelLooksFamiliar,
   parseOutput,
   parseStreamChunk,
+  hasUnfinishedToolCall,
   parseError,
   createStreamConsumer,
   permissionBypassFlags: PERMISSION_BYPASS_FLAGS,

package/engine/runtimes/codex.js

@@ -16,6 +16,7 @@ const {
   safeWrite,
   ts,
   resolveEngineCacheDir,
+  staleResumeSessionCwdReason,
   resolveCodexCcSandbox,
 } = require('../shared');
 
@@ -455,7 +456,7 @@ function getMcpConfigPaths({ homeDir = os.homedir(), project = null } = {}) {
   return [];
 }
 
-function getResumeSessionId({ agentId, branchName, agentsDir, maxAgeMs = 2 * 60 * 60 * 1000, logger = console } = {}) {
+function getResumeSessionId({ agentId, branchName, agentsDir, cwd = null, maxAgeMs = 2 * 60 * 60 * 1000, logger = console } = {}) {
   if (!agentId || agentId.startsWith('temp-') || !agentsDir) return null;
   const sessionPath = path.join(agentsDir, agentId, 'session.json');
   try {
@@ -468,6 +469,17 @@ function getResumeSessionId({ agentId, branchName, agentsDir, maxAgeMs = 2 * 60
       try { fs.unlinkSync(sessionPath); } catch {}
       return null;
     }
+    // Stale-workdir invalidation (W-ms0vk9nv000z985b) — see engine/shared.js
+    // staleResumeSessionCwdReason. A session anchored to a worktree the engine
+    // has since removed/recycled cannot be resumed.
+    const staleCwdReason = staleResumeSessionCwdReason(sessionFile.cwd, cwd);
+    if (staleCwdReason) {
+      if (logger && typeof logger.info === 'function') {
+        logger.info(`Skipping resume for ${agentId}: ${staleCwdReason} - clearing session.json`);
+      }
+      try { fs.unlinkSync(sessionPath); } catch {}
+      return null;
+    }
     const sessionAge = Date.now() - new Date(sessionFile.savedAt).getTime();
     const sameBranch = branchName && sessionFile.branch && sessionFile.branch === branchName;
     if (sessionAge < maxAgeMs && sameBranch) return sessionFile.sessionId;
@@ -477,7 +489,7 @@ function getResumeSessionId({ agentId, branchName, agentsDir, maxAgeMs = 2 * 60
   return null;
 }
 
-function saveSession({ agentId, dispatchId, branch, sessionId, agentsDir, now = ts, writeJson = safeWrite, logger = console } = {}) {
+function saveSession({ agentId, dispatchId, branch, sessionId, agentsDir, cwd = null, now = ts, writeJson = safeWrite, logger = console } = {}) {
   if (!sessionId || !agentId || agentId.startsWith('temp-') || !agentsDir) return false;
   try {
     writeJson(path.join(agentsDir, agentId, 'session.json'), {
@@ -485,6 +497,9 @@ function saveSession({ agentId, dispatchId, branch, sessionId, agentsDir, now =
       dispatchId,
       savedAt: typeof now === 'function' ? now() : new Date().toISOString(),
       branch: branch || null,
+      // Working directory the session was created in — read back by
+      // getResumeSessionId to refuse resuming into a dead/other worktree.
+      cwd: cwd || null,
       runtime: RUNTIME_NAME,
     });
     return true;
@@ -703,6 +718,45 @@ function parseStreamChunk(line) {
   try { return JSON.parse(trimmed); } catch { return null; }
 }
 
+// W-ms0vk9nv000z985b — did the process die between a tool start and its
+// completion? See engine/runtimes/contract.js#hasUnfinishedToolCall.
+//
+// Codex streams tool activity as per-item events (`item.started` /
+// `item.updated` / `item.completed`), so outstanding calls are tracked by item
+// id where one is supplied — that makes repeated `item.updated` events for the
+// same call idempotent. A turn-level terminal (`turn.completed`, `result`,
+// `task_complete`, …) means the turn ended normally and nothing was truncated.
+function hasUnfinishedToolCall(raw) {
+  const safeRaw = raw == null ? '' : String(raw);
+  if (!safeRaw) return false;
+  const pending = new Set();
+  let anonymousStarted = 0;
+  let anonymousCompleted = 0;
+  for (const rawLine of safeRaw.split('\n')) {
+    const line = rawLine.trim();
+    if (!line || !line.startsWith('{')) continue;
+    let obj;
+    try { obj = JSON.parse(line); } catch { continue; }
+    if (!obj || typeof obj !== 'object') continue;
+    const type = _eventType(obj);
+    if (_isTurnTerminalType(type)) return false;
+    const tool = _extractToolUse(obj);
+    if (!tool) continue;
+    const finished = tool.status === 'completed'
+      || tool.status === 'failed'
+      || /[._](?:completed|complete|end|ended|finished)$/i.test(type);
+    if (tool.id) {
+      if (finished) pending.delete(tool.id);
+      else pending.add(tool.id);
+    } else if (finished) {
+      anonymousCompleted++;
+    } else {
+      anonymousStarted++;
+    }
+  }
+  return pending.size > 0 || anonymousStarted > anonymousCompleted;
+}
+
 function _collectErrorSignal(rawOutput) {
   const text = rawOutput == null ? '' : String(rawOutput);
   if (!text) return '';
@@ -880,20 +934,6 @@ function getModelCacheKey({ env = process.env, timeoutMs = 10000 } = {}) {
   }
 }
 
-function getModelCacheKey({ env = process.env, timeoutMs = 10000 } = {}) {
-  const resolved = resolveBinary({ env });
-  if (!resolved) return null;
-  try {
-    return _execFileCapture(resolved.bin, [...(resolved.leadingArgs || []), '--version'], {
-      env,
-      timeoutMs,
-      native: resolved.native,
-    }).trim() || null;
-  } catch {
-    return null;
-  }
-}
-
 function createStreamConsumer(ctx) {
   let deltaText = '';
   let terminalText = '';
@@ -1003,6 +1043,7 @@ module.exports = {
   modelLooksFamiliar,
   parseOutput,
   parseStreamChunk,
+  hasUnfinishedToolCall,
   parseError,
   createStreamConsumer,
   permissionBypassFlags: PERMISSION_BYPASS_FLAGS,

package/engine/runtimes/contract.js

@@ -198,6 +198,26 @@ function shouldSuppressPostMutationError(runtime, context = {}) {
   }
 }
 
+/**
+ * Did this runtime's raw output end with a tool call that was started but never
+ * completed? (W-ms0vk9nv000z985b)
+ *
+ * Optional adapter hook. Only the adapter knows its own event vocabulary, so
+ * the detection lives there; orchestration asks this question without any
+ * knowledge of event names or runtime identity.
+ *
+ * Fails safe to `false`: an adapter that does not implement the hook (or one
+ * that throws) yields the pre-existing classification, never a new failure.
+ */
+function hasUnfinishedToolCall(runtime, raw) {
+  if (!runtime || typeof runtime.hasUnfinishedToolCall !== 'function') return false;
+  try {
+    return runtime.hasUnfinishedToolCall(raw) === true;
+  } catch {
+    return false;
+  }
+}
+
 function buildWorkerArgs(runtime, options = {}) {
   if (runtime?.capabilities?.acpWorkerPool !== true) {
     throw new Error(`Runtime "${runtime?.name || '<unknown>'}" does not support persistent ACP workers`);
@@ -234,6 +254,7 @@ module.exports = {
   prepareWorkspace,
   isSpawnStartupEvent,
   shouldSuppressPostMutationError,
+  hasUnfinishedToolCall,
   buildWorkerArgs,
   encodePooledOutput,
 };

package/engine/runtimes/copilot.js

@@ -32,7 +32,7 @@ const https = require('https');
 const os = require('os');
 const path = require('path');
 const { execSync } = require('child_process');
-const { ENGINE_DEFAULTS, FAILURE_CLASS, safeWrite, ts, resolveEngineCacheDir } = require('../shared');
+const { ENGINE_DEFAULTS, FAILURE_CLASS, safeWrite, ts, resolveEngineCacheDir, staleResumeSessionCwdReason } = require('../shared');
 
 const ENGINE_DIR = __dirname.replace(/[\\/]runtimes$/, '');
 const _CACHE_DIR = resolveEngineCacheDir(ENGINE_DIR);
@@ -639,7 +639,7 @@ function encodePooledOutput(event = {}) {
 // RUNTIME_NAME is stamped into every session.json so the pre-spawn resume path
 // can reject session IDs produced by another adapter before invoking the CLI.
 
-function getResumeSessionId({ agentId, branchName, agentsDir, maxAgeMs = 2 * 60 * 60 * 1000, logger = console } = {}) {
+function getResumeSessionId({ agentId, branchName, agentsDir, cwd = null, maxAgeMs = 2 * 60 * 60 * 1000, logger = console } = {}) {
   if (!agentId || agentId.startsWith('temp-') || !agentsDir) return null;
   const sessionPath = path.join(agentsDir, agentId, 'session.json');
   try {
@@ -659,6 +659,21 @@ function getResumeSessionId({ agentId, branchName, agentsDir, maxAgeMs = 2 * 60
       return null;
     }
 
+    // Stale-workdir invalidation (W-ms0vk9nv000z985b). Copilot auto-cds into
+    // the session's persisted cwd on resume; when the engine has removed or
+    // recycled that worktree the CLI logs `resume-auto-cd: ignoring persisted
+    // cwd ... missing or not a directory` and exits 1 with EMPTY stdout, which
+    // the engine could only classify as a meaningless `empty-output` failure.
+    // Refuse the resume up front and clear session.json so the retry is fresh.
+    const staleCwdReason = staleResumeSessionCwdReason(sessionFile.cwd, cwd);
+    if (staleCwdReason) {
+      if (logger && typeof logger.info === 'function') {
+        logger.info(`Skipping resume for ${agentId}: ${staleCwdReason} — clearing session.json`);
+      }
+      try { fs.unlinkSync(sessionPath); } catch {}
+      return null;
+    }
+
     const sessionAge = Date.now() - new Date(sessionFile.savedAt).getTime();
     const sameBranch = branchName && sessionFile.branch && sessionFile.branch === branchName;
     if (sessionAge < maxAgeMs && sameBranch) {
@@ -673,7 +688,7 @@ function getResumeSessionId({ agentId, branchName, agentsDir, maxAgeMs = 2 * 60
   return null;
 }
 
-function saveSession({ agentId, dispatchId, branch, sessionId, agentsDir, now = ts, writeJson = safeWrite, logger = console } = {}) {
+function saveSession({ agentId, dispatchId, branch, sessionId, agentsDir, cwd = null, now = ts, writeJson = safeWrite, logger = console } = {}) {
   if (!sessionId || !agentId || agentId.startsWith('temp-') || !agentsDir) return false;
   try {
     writeJson(path.join(agentsDir, agentId, 'session.json'), {
@@ -681,6 +696,9 @@ function saveSession({ agentId, dispatchId, branch, sessionId, agentsDir, now =
       dispatchId,
       savedAt: typeof now === 'function' ? now() : new Date().toISOString(),
       branch: branch || null,
+      // Working directory the session was created in — read back by
+      // getResumeSessionId to refuse resuming into a dead/other worktree.
+      cwd: cwd || null,
       runtime: RUNTIME_NAME,
     });
     return true;
@@ -921,6 +939,35 @@ function parseStreamChunk(line) {
   return obj;
 }
 
+// W-ms0vk9nv000z985b — did the process die between a tool start and its
+// completion?
+//
+// Copilot brackets every tool invocation with `tool.execution_start` and
+// `tool.execution_complete`. When the CLI exits 0 in the middle of a long tool
+// call (the observed incident: exit right after starting `npm test`), the
+// start event has no matching completion. Counting is sufficient and
+// order-independent within a single sequential stream — no id correlation
+// needed, and a stream that never invoked a tool trivially reports false.
+//
+// `task_complete` is excluded: it is the terminal report tool, not workload.
+function hasUnfinishedToolCall(raw) {
+  const safeRaw = raw == null ? '' : String(raw);
+  if (!safeRaw) return false;
+  let started = 0;
+  let completed = 0;
+  for (const rawLine of safeRaw.split('\n')) {
+    const line = rawLine.trim();
+    if (!line || !line.startsWith('{')) continue;
+    let obj;
+    try { obj = JSON.parse(line); } catch { continue; }
+    if (!obj || typeof obj !== 'object') continue;
+    if (obj.data?.toolName === 'task_complete') continue;
+    if (obj.type === 'tool.execution_start') started++;
+    else if (obj.type === 'tool.execution_complete') completed++;
+  }
+  return started > completed;
+}
+
 // ── Error Normalization ─────────────────────────────────────────────────────
 
 // In-memory model-discovery cache used by parseError's invalid-model branch
@@ -1528,6 +1575,7 @@ module.exports = {
   modelLooksFamiliar,
   parseOutput,
   parseStreamChunk,
+  hasUnfinishedToolCall,
   parseError,
   createStreamConsumer,
   isSpawnStartupEvent,

package/engine/runtimes/index.js

@@ -82,6 +82,7 @@ module.exports = {
   prepareWorkspace: contract.prepareWorkspace,
   isSpawnStartupEvent: contract.isSpawnStartupEvent,
   shouldSuppressPostMutationError: contract.shouldSuppressPostMutationError,
+  hasUnfinishedToolCall: contract.hasUnfinishedToolCall,
   buildWorkerArgs: contract.buildWorkerArgs,
   encodePooledOutput: contract.encodePooledOutput,
   validateRuntimeAdapter: contract.normalizeRuntimeAdapter,

package/engine/scheduler.js

@@ -25,7 +25,141 @@ const fs = require('fs');
 const shared = require('./shared');
 const routing = require('./routing');
 const harness = require('./harness');
-const { safeJson, safeWrite, mutateJsonFileLocked, mutateScheduleRuns, ts, dateStamp, log, WI_STATUS, WORK_TYPE } = shared;
+const { safeJson, safeWrite, mutateJsonFileLocked, mutateScheduleRuns, ts, dateStamp, log, WI_STATUS, WORK_TYPE, WORK_ITEM_PRIORITY } = shared;
+const apiValidation = require('./api-validation');
+
+const SCHEDULE_LIMITS = Object.freeze({
+  id: 64,
+  cron: 64,
+  title: 300,
+  description: 20000,
+  naturalText: 2000,
+  participants: 50,
+});
+const SCHEDULE_WORK_TYPES = Object.freeze(Object.values(WORK_TYPE));
+const SCHEDULE_ID_PATTERN = /^[A-Za-z0-9_][A-Za-z0-9_-]*$/;
+
+function _scheduleInputError(message, options = {}) {
+  throw new apiValidation.ApiInputError(message, {
+    code: options.code || 'invalid-schedule',
+    path: options.path,
+    rejectedValue: options.rejectedValue,
+    allowedValues: options.allowedValues,
+    expected: options.expected,
+  });
+}
+
+function _validateConfiguredProject(project, config, pathName = 'project') {
+  if (project === undefined || project === null || project === '') return;
+  apiValidation.validateString(project, {
+    path: pathName,
+    allowEmpty: false,
+    maxLength: 128,
+  });
+  if (project.trim().toLowerCase() === 'central') return;
+  const result = shared.resolveConfiguredProject(project, config || {});
+  if (result.error) {
+    _scheduleInputError(result.error, {
+      code: 'invalid-project',
+      path: pathName,
+      rejectedValue: project,
+    });
+  }
+}
+
+function _validateConfiguredAgent(agent, config, pathName = 'agent', options = {}) {
+  if (agent === undefined || agent === null || agent === '') {
+    if (options.required === true) {
+      _scheduleInputError(`${pathName} must identify a configured agent`, {
+        code: 'invalid-agent',
+        path: pathName,
+        rejectedValue: agent,
+      });
+    }
+    return;
+  }
+  apiValidation.validateString(agent, {
+    path: pathName,
+    allowEmpty: false,
+    maxLength: 128,
+  });
+  const agents = Object.keys(config?.agents || {});
+  if (!agents.includes(agent)) {
+    _scheduleInputError(`Unknown agent "${agent}". Known agents: ${agents.join(', ') || '(none)'}`, {
+      code: 'invalid-agent',
+      path: pathName,
+      rejectedValue: agent,
+      allowedValues: agents,
+    });
+  }
+}
+
+function validateScheduleIdentifier(id, pathName = 'id') {
+  const validated = apiValidation.validateIdentifier(id, {
+    path: pathName,
+    maxLength: SCHEDULE_LIMITS.id,
+    pattern: SCHEDULE_ID_PATTERN,
+  });
+  if (validated === 'prototype'
+      || Object.prototype.hasOwnProperty.call(Object.prototype, validated)) {
+    _scheduleInputError(`${pathName} must not use a prototype-sensitive name`, {
+      code: 'invalid-identifier',
+      path: pathName,
+      rejectedValue: id,
+      expected: 'safe identifier',
+    });
+  }
+  return validated;
+}
+
+function _validateSchedulePriority(priority, pathName = 'priority') {
+  const error = shared.validateWorkItemPriority(priority);
+  if (!error) return;
+  _scheduleInputError(error.error, {
+    code: error.code,
+    path: pathName,
+    rejectedValue: error.rejectedValue,
+    allowedValues: error.allowedValues,
+  });
+}
+
+function validateScheduleDefinition(schedule, options = {}) {
+  apiValidation.validatePlainObject(schedule, { path: options.path || 'schedule' });
+  validateScheduleIdentifier(schedule.id);
+  validateCronExpression(schedule.cron, { path: 'cron' });
+  apiValidation.validateString(schedule.title, {
+    path: 'title',
+    allowEmpty: false,
+    maxLength: SCHEDULE_LIMITS.title,
+  });
+  apiValidation.validateString(schedule.description, {
+    path: 'description',
+    optional: true,
+    maxLength: SCHEDULE_LIMITS.description,
+  });
+  apiValidation.validateEnum(schedule.type, {
+    path: 'type',
+    optional: true,
+    values: SCHEDULE_WORK_TYPES,
+  });
+  _validateSchedulePriority(schedule.priority);
+  _validateConfiguredProject(schedule.project, options.config, 'project');
+  _validateConfiguredAgent(schedule.agent, options.config, 'agent');
+  for (const field of ['enabled', 'agentLock', 'hardAgent']) {
+    apiValidation.validateBoolean(schedule[field], { path: field, optional: true });
+  }
+  if (schedule.type === WORK_TYPE.MEETING || schedule.participants !== undefined) {
+    apiValidation.validateArray(schedule.participants, {
+      path: 'participants',
+      minLength: 1,
+      maxLength: SCHEDULE_LIMITS.participants,
+      itemValidator(participant, ctx) {
+        _validateConfiguredAgent(participant, options.config, ctx.path, { required: true });
+      },
+    });
+  }
+  return schedule;
+}
 
 /**
  * Compute the ISO 8601 week of the year for `date` as `YYYY-Www` (e.g.
@@ -218,44 +352,68 @@ function applyScheduleTemplateVarsRecursive(obj, extraVars) {
 // every Date when any field is out of range, so the schedule never fires.
 // This catches typos like minute=99, hour=24, dow=9 that today are accepted
 // as exact-value matchers and silently never trigger.
-function parseCronField(field, min, max) {
-  field = field.trim();
+function _strictCronFieldMatcher(field, min, max) {
+  if (typeof field !== 'string' || !field) return null;
   if (field === '*') return () => true;
 
-  const hasMin = typeof min === 'number';
-  const hasMax = typeof max === 'number';
-
-  // Step: */N — step must be > 0 AND not exceed the field's max.
-  // A step larger than max either matches only val=0 (e.g., */60 for minute)
-  // or nothing meaningful — treat as never-fires for predictability.
-  if (field.startsWith('*/')) {
-    const step = parseInt(field.slice(2), 10);
-    if (isNaN(step) || step <= 0) return () => false;
-    if (hasMax && step > max) return () => false;
+  const stepMatch = field.match(/^\*\/(\d+)$/);
+  if (stepMatch) {
+    const step = Number(stepMatch[1]);
+    if (!Number.isSafeInteger(step) || step <= 0 || step > max) return null;
     return (val) => val % step === 0;
   }
 
-  // List: N,M,O — drop NaN entries AND entries outside [min, max] before
-  // building the Set. A list with no surviving entries falls through to the
-  // empty-Set matcher, which never matches anything.
-  if (field.includes(',')) {
-    const values = new Set(
-      field
-        .split(',')
-        .map(v => parseInt(v.trim(), 10))
-        .filter(v => !isNaN(v) && (!hasMin || v >= min) && (!hasMax || v <= max))
-    );
-    return (val) => values.has(val);
+  const values = new Set();
+  const tokens = field.split(',');
+  if (tokens.length === 0 || tokens.some(token => !token)) return null;
+  for (const token of tokens) {
+    const range = token.match(/^(\d+)-(\d+)$/);
+    if (range) {
+      const start = Number(range[1]);
+      const end = Number(range[2]);
+      if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end)
+          || start < min || end > max || start > end) return null;
+      for (let value = start; value <= end; value += 1) values.add(value);
+      continue;
+    }
+    if (!/^\d+$/.test(token)) return null;
+    const exact = Number(token);
+    if (!Number.isSafeInteger(exact) || exact < min || exact > max) return null;
+    values.add(exact);
   }
+  return (val) => values.has(val);
+}
 
-  // Single value: N — out-of-range exact values never fire.
-  const exact = parseInt(field, 10);
-  if (!isNaN(exact)) {
-    if ((hasMin && exact < min) || (hasMax && exact > max)) return () => false;
-    return (val) => val === exact;
-  }
+function parseCronField(field, min, max) {
+  return _strictCronFieldMatcher(typeof field === 'string' ? field.trim() : field, min, max)
+    || (() => false);
+}
 
-  return () => false;
+function validateCronExpression(expression, options = {}) {
+  const pathName = options.path || 'cron';
+  const normalized = apiValidation.validateString(expression, {
+    path: pathName,
+    trim: true,
+    allowEmpty: false,
+    maxLength: SCHEDULE_LIMITS.cron,
+  });
+  const parts = normalized.split(/\s+/);
+  const valid = parts.length === 3
+    && _strictCronFieldMatcher(parts[0], 0, 59)
+    && _strictCronFieldMatcher(parts[1], 0, 23)
+    && _strictCronFieldMatcher(parts[2], 0, 6);
+  if (!valid) {
+    _scheduleInputError(
+      `${pathName} must be a valid three-field cron expression (minute hour dayOfWeek)`,
+      {
+        code: 'invalid-cron',
+        path: pathName,
+        rejectedValue: expression,
+        expected: 'three-field cron',
+      },
+    );
+  }
+  return normalized;
 }
 
 // Parse a 3-field cron expression: "minute hour dayOfWeek"
@@ -332,7 +490,7 @@ function createScheduledWorkItem(sched, extraVars) {
     id: workItemId,
     title: sched.title,
     type: routing.normalizeWorkType(sched.type, WORK_TYPE.IMPLEMENT),
-    priority: sched.priority || 'medium',
+    priority: sched.priority || WORK_ITEM_PRIORITY.MEDIUM,
     description: sched.description || sched.title,
     status: WI_STATUS.PENDING,
     created: ts(),
@@ -398,6 +556,12 @@ function discoverScheduledWork(config) {
     for (const sched of schedules) {
       if (!sched.id || !sched.cron || !sched.title) continue;
       if (sched.enabled === false) continue; // strict false check — undefined/null default to enabled per schema
+      try {
+        validateScheduleDefinition(sched, { config });
+      } catch (error) {
+        log('warn', `Scheduler: invalid schedule ${sched.id || '(missing id)'} — skipping (${error.message})`);
+        continue;
+      }
 
       // Backward compat: runs[sched.id] can be a string (old format) or object (new format)
       const runEntry = runs[sched.id] || null;
@@ -474,6 +638,11 @@ function discoverScheduledWork(config) {
 }
 
 module.exports = {
+  SCHEDULE_LIMITS,
+  SCHEDULE_WORK_TYPES,
+  validateCronExpression,
+  validateScheduleIdentifier,
+  validateScheduleDefinition,
   parseCronExpr,
   parseCronField,
   shouldRunNow,