agent-office 0.0.0 → 0.0.2

package/dist/server/routes.js

@@ -1,15 +1,42 @@
 import { Router } from "express";
-export function createRouter(sql, opencode) {
+import { Cron as CronerInstance } from "croner";
+const MAIL_INJECTION_BLURB = [
+    ``,
+    `---`,
+    `You have a new message. Please review the injected message above and respond accordingly.`,
+    `Respond using markdown. Your markdown front-matter can contain a property "choices" which`,
+    `is an array of choices for the message sender to choose from. These choices are optional`,
+    `and shouldn't alter your authentic personality in your responses.`,
+    `IMPORTANT: in order for the sender to see your response, you must send them a message back`,
+    `using the \`agent-office worker send-message\` tool. Also, don't go on for too long if things seem repetitive.`,
+].join("\n");
+export function createRouter(sql, opencode, serverUrl, scheduler) {
     const router = Router();
-    // GET /health
     router.get("/health", (_req, res) => {
         res.json({ ok: true });
     });
-    // GET /sessions
+    router.get("/modes", async (_req, res) => {
+        try {
+            const config = await opencode.config.get();
+            const agent = config.agent ?? {};
+            const modes = Object.entries(agent)
+                .filter(([, val]) => val != null)
+                .map(([name, val]) => ({
+                name,
+                description: val.description ?? "",
+                model: val.model ?? "",
+            }));
+            res.json(modes);
+        }
+        catch (err) {
+            console.error("GET /modes error:", err);
+            res.json([]);
+        }
+    });
     router.get("/sessions", async (_req, res) => {
         try {
             const rows = await sql `
-        SELECT id, name, session_id, agent_code, created_at
+        SELECT id, name, session_id, agent_code, mode, created_at
         FROM sessions
         ORDER BY created_at DESC
       `;
@@ -20,14 +47,14 @@ export function createRouter(sql, opencode) {
             res.status(500).json({ error: "Internal server error" });
         }
     });
-    // POST /sessions  { name }
     router.post("/sessions", async (req, res) => {
-        const { name } = req.body;
+        const { name, mode } = req.body;
         if (!name || typeof name !== "string" || !name.trim()) {
             res.status(400).json({ error: "name is required" });
             return;
         }
         const trimmedName = name.trim();
+        const trimmedMode = typeof mode === "string" && mode.trim() ? mode.trim() : null;
         const existing = await sql `
       SELECT id FROM sessions WHERE name = ${trimmedName}
     `;
@@ -35,7 +62,6 @@ export function createRouter(sql, opencode) {
             res.status(409).json({ error: `Session name "${trimmedName}" already exists` });
             return;
         }
-        // Create the OpenCode session
         let opencodeSessionId;
         try {
             const session = await opencode.session.create();
@@ -46,25 +72,44 @@ export function createRouter(sql, opencode) {
             res.status(502).json({ error: "Failed to create OpenCode session", detail: String(err) });
             return;
         }
-        // Persist — agent_code auto-generated by Postgres gen_random_uuid()
+        let row;
         try {
-            const [row] = await sql `
-        INSERT INTO sessions (name, session_id)
-        VALUES (${trimmedName}, ${opencodeSessionId})
-        RETURNING id, name, session_id, agent_code, created_at
+            const [inserted] = await sql `
+        INSERT INTO sessions (name, session_id, mode)
+        VALUES (${trimmedName}, ${opencodeSessionId}, ${trimmedMode})
+        RETURNING id, name, session_id, agent_code, mode, created_at
       `;
-            res.status(201).json(row);
+            row = inserted;
         }
         catch (err) {
             console.error("DB insert error:", err);
             try {
                 await opencode.session.delete(opencodeSessionId);
             }
-            catch { /* best-effort */ }
+            catch { }
             res.status(500).json({ error: "Internal server error" });
+            return;
+        }
+        try {
+            const providers = await opencode.app.providers();
+            const defaultEntry = Object.entries(providers.default)[0];
+            if (defaultEntry) {
+                const clockInToken = `${row.agent_code}@${serverUrl}`;
+                const modeNote = trimmedMode ? `\n  Mode:  ${trimmedMode}` : "";
+                const firstMessage = `You have been enrolled in the agent office.${modeNote}\n\nTo clock in and receive your full briefing, run:\n\n  agent-office worker clock-in ${clockInToken}`;
+                await opencode.session.chat(opencodeSessionId, {
+                    modelID: defaultEntry[0],
+                    providerID: defaultEntry[1],
+                    parts: [{ type: "text", text: firstMessage }],
+                    ...(trimmedMode ? { mode: trimmedMode } : {}),
+                });
+            }
+        }
+        catch (err) {
+            console.warn("Warning: could not send first message to session:", err);
         }
+        res.status(201).json(row);
     });
-    // POST /sessions/:name/regenerate-code
     router.post("/sessions/:name/regenerate-code", async (req, res) => {
         const { name } = req.params;
         const rows = await sql `
@@ -88,7 +133,6 @@ export function createRouter(sql, opencode) {
             res.status(500).json({ error: "Internal server error" });
         }
     });
-    // GET /sessions/:name/messages?limit=N
     router.get("/sessions/:name/messages", async (req, res) => {
         const { name } = req.params;
         const limit = Math.min(parseInt(req.query.limit ?? "20", 10), 100);
@@ -118,7 +162,6 @@ export function createRouter(sql, opencode) {
             res.status(502).json({ error: "Failed to fetch messages from OpenCode", detail: String(err) });
         }
     });
-    // POST /sessions/:name/inject  { text, modelID?, providerID? }
     router.post("/sessions/:name/inject", async (req, res) => {
         const { name } = req.params;
         const { text, modelID, providerID } = req.body;
@@ -166,7 +209,6 @@ export function createRouter(sql, opencode) {
             res.status(502).json({ error: "Failed to inject message into OpenCode session", detail: String(err) });
         }
     });
-    // DELETE /sessions/:name
     router.delete("/sessions/:name", async (req, res) => {
         const { name } = req.params;
         const rows = await sql `
@@ -194,13 +236,416 @@ export function createRouter(sql, opencode) {
             res.status(500).json({ error: "Internal server error" });
         }
     });
+    router.get("/config", async (_req, res) => {
+        try {
+            const rows = await sql `SELECT key, value FROM config`;
+            const config = {};
+            for (const row of rows) {
+                config[row.key] = row.value;
+            }
+            res.json(config);
+        }
+        catch (err) {
+            console.error("GET /config error:", err);
+            res.status(500).json({ error: "Internal server error" });
+        }
+    });
+    router.put("/config", async (req, res) => {
+        const { key, value } = req.body;
+        if (!key || typeof key !== "string" || !key.trim()) {
+            res.status(400).json({ error: "key is required" });
+            return;
+        }
+        if (typeof value !== "string") {
+            res.status(400).json({ error: "value must be a string" });
+            return;
+        }
+        try {
+            await sql `
+        INSERT INTO config (key, value) VALUES (${key}, ${value})
+        ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value
+      `;
+            res.json({ ok: true, key, value });
+        }
+        catch (err) {
+            console.error("PUT /config error:", err);
+            res.status(500).json({ error: "Internal server error" });
+        }
+    });
+    router.get("/messages/:name", async (req, res) => {
+        const { name } = req.params;
+        const { sent, unread_only } = req.query;
+        try {
+            let rows;
+            if (sent === "true") {
+                rows = await sql `
+          SELECT id, from_name, to_name, body, read, injected, created_at
+          FROM messages
+          WHERE from_name = ${name}
+          ORDER BY created_at DESC
+        `;
+            }
+            else {
+                if (unread_only === "true") {
+                    rows = await sql `
+            SELECT id, from_name, to_name, body, read, injected, created_at
+            FROM messages
+            WHERE to_name = ${name} AND read = FALSE
+            ORDER BY created_at DESC
+          `;
+                }
+                else {
+                    rows = await sql `
+            SELECT id, from_name, to_name, body, read, injected, created_at
+            FROM messages
+            WHERE to_name = ${name}
+            ORDER BY created_at DESC
+          `;
+                }
+            }
+            res.json(rows);
+        }
+        catch (err) {
+            console.error("GET /messages/:name error:", err);
+            res.status(500).json({ error: "Internal server error" });
+        }
+    });
+    router.post("/messages", async (req, res) => {
+        const { from, to, body } = req.body;
+        if (!from || typeof from !== "string" || !from.trim()) {
+            res.status(400).json({ error: "from is required" });
+            return;
+        }
+        if (!to || !Array.isArray(to) || to.length === 0) {
+            res.status(400).json({ error: "to must be a non-empty array of recipient names" });
+            return;
+        }
+        if (!body || typeof body !== "string" || !body.trim()) {
+            res.status(400).json({ error: "body is required" });
+            return;
+        }
+        const trimmedFrom = from.trim();
+        const trimmedBody = body.trim();
+        const sessions = await sql `SELECT name, session_id FROM sessions`;
+        const sessionMap = new Map(sessions.map((s) => [s.name, s.session_id]));
+        const validRecipients = [];
+        for (const recipient of to) {
+            if (typeof recipient !== "string" || !recipient.trim())
+                continue;
+            const r = recipient.trim();
+            const config = await sql `SELECT value FROM config WHERE key = 'human_name'`;
+            const humanName = config[0]?.value ?? "Human";
+            if (sessionMap.has(r) || r === humanName) {
+                validRecipients.push(r);
+            }
+        }
+        if (validRecipients.length === 0) {
+            res.status(400).json({ error: "No valid recipients found" });
+            return;
+        }
+        const results = [];
+        for (const recipient of validRecipients) {
+            let injected = false;
+            const [msgRow] = await sql `
+        INSERT INTO messages (from_name, to_name, body)
+        VALUES (${trimmedFrom}, ${recipient}, ${trimmedBody})
+        RETURNING id, from_name, to_name, body, read, injected, created_at
+      `;
+            if (sessionMap.has(recipient)) {
+                const sessionId = sessionMap.get(recipient);
+                const msgId = msgRow.id;
+                injected = true;
+                opencode.app.providers().then((providers) => {
+                    const defaultEntry = Object.entries(providers.default)[0];
+                    if (!defaultEntry)
+                        return;
+                    const injectText = `[Message from "${trimmedFrom}"]: ${trimmedBody}${MAIL_INJECTION_BLURB}`;
+                    return opencode.session.chat(sessionId, {
+                        modelID: defaultEntry[0],
+                        providerID: defaultEntry[1],
+                        parts: [{ type: "text", text: injectText }],
+                    }).then(() => sql `UPDATE messages SET injected = TRUE WHERE id = ${msgId}`);
+                }).catch((err) => {
+                    console.warn(`Warning: could not inject message into session ${recipient}:`, err);
+                });
+            }
+            results.push({ to: recipient, messageId: msgRow.id, injected });
+        }
+        res.status(201).json({ ok: true, results });
+    });
+    router.post("/messages/:id/read", async (req, res) => {
+        const id = parseInt(req.params.id, 10);
+        if (isNaN(id)) {
+            res.status(400).json({ error: "Invalid message id" });
+            return;
+        }
+        try {
+            const [updated] = await sql `
+        UPDATE messages SET read = TRUE WHERE id = ${id}
+        RETURNING id, from_name, to_name, body, read, injected, created_at
+      `;
+            if (!updated) {
+                res.status(404).json({ error: "Message not found" });
+                return;
+            }
+            res.json(updated);
+        }
+        catch (err) {
+            console.error("POST /messages/:id/read error:", err);
+            res.status(500).json({ error: "Internal server error" });
+        }
+    });
+    // ── Cron Jobs Endpoints ────────────────────────────────────────────────────
+    router.get("/crons", async (req, res) => {
+        try {
+            const { session_name } = req.query;
+            let rows;
+            if (session_name) {
+                rows = await sql `
+          SELECT id, name, session_name, schedule, timezone, message, enabled, created_at, last_run
+          FROM cron_jobs
+          WHERE session_name = ${session_name}
+          ORDER BY name
+        `;
+            }
+            else {
+                rows = await sql `
+          SELECT id, name, session_name, schedule, timezone, message, enabled, created_at, last_run
+          FROM cron_jobs
+          ORDER BY name
+        `;
+            }
+            const jobs = rows.map((job) => {
+                let nextRun = null;
+                if (job.enabled) {
+                    try {
+                        const options = {};
+                        if (job.timezone)
+                            options.timezone = job.timezone;
+                        const cronJob = new CronerInstance(job.schedule, options);
+                        const next = cronJob.nextRun();
+                        nextRun = next ? next.toISOString() : null;
+                    }
+                    catch { }
+                }
+                return { ...job, next_run: nextRun, last_run: job.last_run ? job.last_run.toISOString() : null, created_at: job.created_at.toISOString() };
+            });
+            res.json(jobs);
+        }
+        catch (err) {
+            console.error("GET /crons error:", err);
+            res.status(500).json({ error: "Internal server error" });
+        }
+    });
+    router.post("/crons", async (req, res) => {
+        const { name, session_name, schedule, message, timezone } = req.body;
+        if (!name || typeof name !== "string" || !name.trim()) {
+            res.status(400).json({ error: "name is required" });
+            return;
+        }
+        if (!session_name || typeof session_name !== "string") {
+            res.status(400).json({ error: "session_name is required" });
+            return;
+        }
+        if (!schedule || typeof schedule !== "string" || !schedule.trim()) {
+            res.status(400).json({ error: "schedule is required" });
+            return;
+        }
+        if (!message || typeof message !== "string" || !message.trim()) {
+            res.status(400).json({ error: "message is required" });
+            return;
+        }
+        const trimmedName = name.trim();
+        const trimmedSchedule = schedule.trim();
+        const trimmedMessage = message.trim();
+        try {
+            new CronerInstance(trimmedSchedule);
+        }
+        catch {
+            res.status(400).json({ error: "Invalid cron schedule expression" });
+            return;
+        }
+        if (timezone) {
+            try {
+                new CronerInstance("0 0 * * *", { timezone });
+            }
+            catch {
+                res.status(400).json({ error: "Invalid timezone" });
+                return;
+            }
+        }
+        const [existing] = await sql `
+      SELECT id FROM cron_jobs WHERE name = ${trimmedName} AND session_name = ${session_name}
+    `;
+        if (existing) {
+            res.status(409).json({ error: `Cron job "${trimmedName}" already exists for this session` });
+            return;
+        }
+        try {
+            const [inserted] = await sql `
+        INSERT INTO cron_jobs (name, session_name, schedule, timezone, message)
+        VALUES (${trimmedName}, ${session_name}, ${trimmedSchedule}, ${timezone ?? null}, ${trimmedMessage})
+        RETURNING id, name, session_name, schedule, timezone, message, enabled, created_at, last_run
+      `;
+            const cronJobrow = inserted;
+            scheduler.addCronJob(cronJobrow);
+            const nextRun = cronJobrow.enabled ? (() => {
+                try {
+                    const options = {};
+                    if (cronJobrow.timezone)
+                        options.timezone = cronJobrow.timezone;
+                    const cronJob = new CronerInstance(cronJobrow.schedule, options);
+                    const next = cronJob.nextRun();
+                    return next ? next.toISOString() : null;
+                }
+                catch {
+                    return null;
+                }
+            })() : null;
+            res.status(201).json({
+                ...cronJobrow,
+                next_run: nextRun,
+                last_run: cronJobrow?.last_run?.toISOString() ?? null,
+                created_at: cronJobrow.created_at.toISOString(),
+            });
+        }
+        catch (err) {
+            console.error("POST /crons error:", err);
+            res.status(500).json({ error: "Internal server error" });
+        }
+    });
+    router.delete("/crons/:id", async (req, res) => {
+        const id = parseInt(req.params.id, 10);
+        if (isNaN(id)) {
+            res.status(400).json({ error: "Invalid cron job id" });
+            return;
+        }
+        try {
+            const [job] = await sql `SELECT id, name FROM cron_jobs WHERE id = ${id}`;
+            if (!job) {
+                res.status(404).json({ error: "Cron job not found" });
+                return;
+            }
+            scheduler.removeCronJob(id);
+            await sql `DELETE FROM cron_jobs WHERE id = ${id}`;
+            res.json({ deleted: true, id, name: job.name });
+        }
+        catch (err) {
+            console.error("DELETE /crons/:id error:", err);
+            res.status(500).json({ error: "Internal server error" });
+        }
+    });
+    router.post("/crons/:id/enable", async (req, res) => {
+        const id = parseInt(req.params.id, 10);
+        if (isNaN(id)) {
+            res.status(400).json({ error: "Invalid cron job id" });
+            return;
+        }
+        try {
+            const [existing] = await sql `
+        SELECT id, name FROM cron_jobs WHERE id = ${id}
+      `;
+            if (!existing) {
+                res.status(404).json({ error: "Cron job not found" });
+                return;
+            }
+            await sql `UPDATE cron_jobs SET enabled = TRUE WHERE id = ${id}`;
+            const [updated] = await sql `
+        SELECT id, name, session_name, schedule, timezone, message, enabled, created_at, last_run
+        FROM cron_jobs WHERE id = ${id}
+      `;
+            if (updated) {
+                scheduler.enableCronJob(updated);
+                const nextRun = (() => {
+                    try {
+                        const options = {};
+                        if (updated.timezone)
+                            options.timezone = updated.timezone;
+                        const cronJob = new CronerInstance(updated.schedule, options);
+                        const next = cronJob.nextRun();
+                        return next ? next.toISOString() : null;
+                    }
+                    catch {
+                        return null;
+                    }
+                })();
+                res.json({
+                    ...updated,
+                    next_run: nextRun,
+                    last_run: updated.last_run?.toISOString() ?? null,
+                    created_at: updated.created_at.toISOString(),
+                });
+            }
+            else {
+                res.status(404).json({ error: "Cron job not found" });
+            }
+        }
+        catch (err) {
+            console.error("POST /crons/:id/enable error:", err);
+            res.status(500).json({ error: "Internal server error" });
+        }
+    });
+    router.post("/crons/:id/disable", async (req, res) => {
+        const id = parseInt(req.params.id, 10);
+        if (isNaN(id)) {
+            res.status(400).json({ error: "Invalid cron job id" });
+            return;
+        }
+        try {
+            const [job] = await sql `
+        SELECT id, name FROM cron_jobs WHERE id = ${id}
+      `;
+            if (!job) {
+                res.status(404).json({ error: "Cron job not found" });
+                return;
+            }
+            await sql `UPDATE cron_jobs SET enabled = FALSE WHERE id = ${id}`;
+            scheduler.disableCronJob(id);
+            const [updated] = await sql `
+        SELECT id, name, session_name, schedule, timezone, message, enabled, created_at, last_run
+        FROM cron_jobs WHERE id = ${id}
+      `;
+            res.json({
+                ...updated,
+                next_run: null,
+                last_run: updated?.last_run?.toISOString() ?? null,
+                created_at: updated?.created_at.toISOString() ?? null,
+            });
+        }
+        catch (err) {
+            console.error("POST /crons/:id/disable error:", err);
+            res.status(500).json({ error: "Internal server error" });
+        }
+    });
+    router.get("/crons/:id/history", async (req, res) => {
+        const id = parseInt(req.params.id, 10);
+        const limit = Math.min(parseInt(req.query.limit ?? "10", 10), 100);
+        if (isNaN(id)) {
+            res.status(400).json({ error: "Invalid cron job id" });
+            return;
+        }
+        try {
+            const rows = await sql `
+        SELECT id, cron_job_id, executed_at, success, error_message
+        FROM cron_history
+        WHERE cron_job_id = ${id}
+        ORDER BY executed_at DESC
+        LIMIT ${limit}
+      `;
+            res.json(rows.map((r) => ({
+                ...r,
+                executed_at: r.executed_at.toISOString(),
+            })));
+        }
+        catch (err) {
+            console.error("GET /crons/:id/history error:", err);
+            res.status(500).json({ error: "Internal server error" });
+        }
+    });
     return router;
 }
-// Separate unauthenticated router for worker endpoints
-export function createWorkerRouter(sql) {
+export function createWorkerRouter(sql, opencode, serverUrl) {
     const router = Router();
-    // GET /worker/clock-in  — no Bearer auth, validated by agent_code
-    // Usage: agent-office worker clock-in <agent_code>@<url>
     router.get("/worker/clock-in", async (req, res) => {
         const { code } = req.query;
         if (!code || typeof code !== "string") {
@@ -217,12 +662,520 @@ export function createWorkerRouter(sql) {
             return;
         }
         const session = rows[0];
+        const token = `${session.agent_code}@<server-url>`;
+        const name = session.name;
+        const humanConfig = await sql `SELECT value FROM config WHERE key = 'human_name'`;
+        const humanName = humanConfig[0]?.value ?? "your human manager";
+        const humanDescConfig = await sql `SELECT value FROM config WHERE key = 'human_description'`;
+        const humanDescription = humanDescConfig[0]?.value ?? "";
+        const message = [
+            `╔══════════════════════════════════════════════════════╗`,
+            `║              WELCOME TO THE AGENT OFFICE             ║`,
+            `╚══════════════════════════════════════════════════════╝`,
+            ``,
+            `You are now clocked in.`,
+            `  Name:           ${name}`,
+            ...(session.mode ? [`  Mode:           ${session.mode}`] : []),
+            `  Human manager:  ${humanName} — the human who created your`,
+            `                  session, assigns your work, and is your`,
+            `                  primary point of contact for questions,`,
+            `                  updates, and decisions.`,
+            ...(humanDescription ? [
+                `                  "${humanDescription}"`,
+            ] : []),
+            ``,
+            `The agent-office CLI is your PRIMARY means of communicating`,
+            `with your human manager (${humanName}) and your coworkers.`,
+            `Use it to send and receive messages, and to discover who`,
+            `else is working.`,
+            ``,
+            `════════════════════════════════════════════════════════`,
+            ` AVAILABLE COMMANDS`,
+            `════════════════════════════════════════════════════════`,
+            ``,
+            ` List your coworkers`,
+            `   agent-office worker list-coworkers \\`,
+            `     ${token}`,
+            ``,
+            ` Send a message to your manager or a coworker`,
+            `   agent-office worker send-message \\`,
+            `     --name <recipient-name> \\`,
+            `     --body "Your message here" \\`,
+            `     ${token}`,
+            ``,
+            ` Send a message to multiple recipients at once`,
+            `   agent-office worker send-message \\`,
+            `     --name alice --name bob \\`,
+            `     --body "Your message here" \\`,
+            `     ${token}`,
+            ``,
+            ` Manage scheduled tasks (optional)`,
+            `   agent-office worker cron \\`,
+            `     ${token}`,
+            ``,
+            `════════════════════════════════════════════════════════`,
+            ` ⚠  IMPORTANT: YOUR SESSIONS ARE PRIVATE`,
+            `════════════════════════════════════════════════════════`,
+            ``,
+            ` Nobody — not ${humanName}, not your coworkers — can see`,
+            ` anything you think, reason, or write inside this session.`,
+            ` Your work is completely private until you explicitly send`,
+            ` a message using the send-message command.`,
+            ``,
+            ` This means:`,
+            `   • You must send a message to report progress or ask`,
+            `     for help. Silence looks like inaction.`,
+            `   • Finishing a task without messaging ${humanName}`,
+            `     means they will never know it is done.`,
+            `   • If you are blocked or uncertain, send a message —`,
+            `     nobody will know otherwise.`,
+            ``,
+            `════════════════════════════════════════════════════════`,
+            ` TIPS`,
+            `════════════════════════════════════════════════════════`,
+            ``,
+            ` - Run list-coworkers to discover who is available and`,
+            `   what their names are before sending messages.`,
+            ` - Messages you send are delivered directly into the`,
+            `   recipient's active session — they will see them`,
+            `   immediately.`,
+            ` - Your human manager is ${humanName}. They can send you`,
+            `   messages at any time and those will appear here in`,
+            `   your session just like this one. You can reach them`,
+            `   by sending a message to --name ${humanName}.`,
+            ` - Optional: Set up recurring scheduled tasks with cron`,
+            `   jobs. Run 'agent-office worker cron list ${token}' to`,
+            `   get started.`,
+            ``,
+        ].join("\n");
         res.json({
             ok: true,
             name: session.name,
             session_id: session.session_id,
-            message: `Welcome to the agent office, your name is ${session.name}. Your OpenCode session ID is ${session.session_id}. You are now clocked in and ready to work.`,
+            message,
         });
     });
+    router.get("/worker/list-coworkers", async (req, res) => {
+        const { code } = req.query;
+        if (!code || typeof code !== "string") {
+            res.status(400).json({ error: "code query parameter is required" });
+            return;
+        }
+        const rows = await sql `
+      SELECT id, name, session_id, agent_code, created_at
+      FROM sessions
+      WHERE agent_code = ${code}
+    `;
+        if (rows.length === 0) {
+            res.status(401).json({ error: "Invalid agent code" });
+            return;
+        }
+        const session = rows[0];
+        try {
+            const sessions = await sql `SELECT name FROM sessions WHERE name != ${session.name}`;
+            const config = await sql `SELECT value FROM config WHERE key = 'human_name'`;
+            const humanName = config[0]?.value ?? "Human";
+            const workers = sessions.map((s) => s.name);
+            workers.push(humanName);
+            res.json(workers);
+        }
+        catch (err) {
+            console.error("GET /worker/list-coworkers error:", err);
+            res.status(500).json({ error: "Internal server error" });
+        }
+    });
+    router.post("/worker/send-message", async (req, res) => {
+        const { code } = req.query;
+        const { to, body } = req.body;
+        if (!code || typeof code !== "string") {
+            res.status(400).json({ error: "code query parameter is required" });
+            return;
+        }
+        const rows = await sql `
+      SELECT id, name, session_id, agent_code, created_at
+      FROM sessions
+      WHERE agent_code = ${code}
+    `;
+        if (rows.length === 0) {
+            res.status(401).json({ error: "Invalid agent code" });
+            return;
+        }
+        const session = rows[0];
+        if (!to || !Array.isArray(to) || to.length === 0) {
+            res.status(400).json({ error: "to must be a non-empty array of recipient names" });
+            return;
+        }
+        if (!body || typeof body !== "string" || !body.trim()) {
+            res.status(400).json({ error: "body is required" });
+            return;
+        }
+        const trimmedBody = body.trim();
+        const sessions = await sql `SELECT name, session_id FROM sessions`;
+        const sessionMap = new Map(sessions.map((s) => [s.name, s.session_id]));
+        const config = await sql `SELECT value FROM config WHERE key = 'human_name'`;
+        const humanName = config[0]?.value ?? "Human";
+        const validRecipients = [];
+        for (const recipient of to) {
+            if (typeof recipient !== "string" || !recipient.trim())
+                continue;
+            const r = recipient.trim();
+            if (sessionMap.has(r) || r === humanName) {
+                validRecipients.push(r);
+            }
+        }
+        if (validRecipients.length === 0) {
+            res.status(400).json({ error: "No valid recipients found" });
+            return;
+        }
+        const results = [];
+        for (const recipient of validRecipients) {
+            let injected = false;
+            const [msgRow] = await sql `
+        INSERT INTO messages (from_name, to_name, body)
+        VALUES (${session.name}, ${recipient}, ${trimmedBody})
+        RETURNING id, from_name, to_name, body, read, injected, created_at
+      `;
+            if (sessionMap.has(recipient)) {
+                const recipientSessionId = sessionMap.get(recipient);
+                const msgId = msgRow.id;
+                injected = true;
+                opencode.app.providers().then((providers) => {
+                    const defaultEntry = Object.entries(providers.default)[0];
+                    if (!defaultEntry)
+                        return;
+                    const injectText = `[Message from "${session.name}"]: ${trimmedBody}${MAIL_INJECTION_BLURB}`;
+                    return opencode.session.chat(recipientSessionId, {
+                        modelID: defaultEntry[0],
+                        providerID: defaultEntry[1],
+                        parts: [{ type: "text", text: injectText }],
+                    }).then(() => sql `UPDATE messages SET injected = TRUE WHERE id = ${msgId}`);
+                }).catch((err) => {
+                    console.warn(`Warning: could not inject message into session ${recipient}:`, err);
+                });
+            }
+            results.push({ to: recipient, messageId: msgRow.id, injected });
+        }
+        res.status(201).json({ ok: true, results });
+    });
+    // ── Worker Cron Endpoints (authenticated via agent_code in query) ───────────
+    router.get("/worker/crons", async (req, res) => {
+        const { code } = req.query;
+        if (!code || typeof code !== "string") {
+            res.status(400).json({ error: "code query parameter is required" });
+            return;
+        }
+        const session = await sql `
+      SELECT name FROM sessions WHERE agent_code = ${code}
+    `;
+        if (session.length === 0) {
+            res.status(401).json({ error: "Invalid agent code" });
+            return;
+        }
+        const sessionName = session[0].name;
+        try {
+            const rows = await sql `
+        SELECT id, name, session_name, schedule, timezone, message, enabled, created_at, last_run
+        FROM cron_jobs
+        WHERE session_name = ${sessionName}
+        ORDER BY name
+      `;
+            const jobs = rows.map((job) => {
+                let nextRun = null;
+                if (job.enabled) {
+                    try {
+                        const options = {};
+                        if (job.timezone)
+                            options.timezone = job.timezone;
+                        const cronJob = new CronerInstance(job.schedule, options);
+                        const next = cronJob.nextRun();
+                        nextRun = next ? next.toISOString() : null;
+                    }
+                    catch { }
+                }
+                return {
+                    ...job,
+                    next_run: nextRun,
+                    last_run: job.last_run ? job.last_run.toISOString() : null,
+                    created_at: job.created_at.toISOString(),
+                };
+            });
+            res.json(jobs);
+        }
+        catch (err) {
+            console.error("GET /worker/crons error:", err);
+            res.status(500).json({ error: "Internal server error" });
+        }
+    });
+    router.post("/worker/crons", async (req, res) => {
+        const { code } = req.query;
+        const { name, schedule, message, timezone } = req.body;
+        if (!code || typeof code !== "string") {
+            res.status(400).json({ error: "code query parameter is required" });
+            return;
+        }
+        const session = await sql `
+      SELECT name FROM sessions WHERE agent_code = ${code}
+    `;
+        if (session.length === 0) {
+            res.status(401).json({ error: "Invalid agent code" });
+            return;
+        }
+        if (!name || typeof name !== "string" || !name.trim()) {
+            res.status(400).json({ error: "name is required" });
+            return;
+        }
+        if (!schedule || typeof schedule !== "string" || !schedule.trim()) {
+            res.status(400).json({ error: "schedule is required" });
+            return;
+        }
+        if (!message || typeof message !== "string" || !message.trim()) {
+            res.status(400).json({ error: "message is required" });
+            return;
+        }
+        const trimmedName = name.trim();
+        const trimmedSchedule = schedule.trim();
+        const trimmedMessage = message.trim();
+        const sessionName = session[0].name;
+        try {
+            new CronerInstance(trimmedSchedule);
+        }
+        catch {
+            res.status(400).json({ error: "Invalid cron schedule expression" });
+            return;
+        }
+        if (timezone) {
+            try {
+                new CronerInstance("0 0 * * *", { timezone });
+            }
+            catch {
+                res.status(400).json({ error: "Invalid timezone" });
+                return;
+            }
+        }
+        const [existing] = await sql `
+      SELECT id FROM cron_jobs WHERE name = ${trimmedName} AND session_name = ${sessionName}
+    `;
+        if (existing) {
+            res.status(409).json({ error: `Cron job "${trimmedName}" already exists` });
+            return;
+        }
+        try {
+            const [inserted] = await sql `
+        INSERT INTO cron_jobs (name, session_name, schedule, timezone, message)
+        VALUES (${trimmedName}, ${sessionName}, ${trimmedSchedule}, ${timezone ?? null}, ${trimmedMessage})
+        RETURNING id, name, session_name, schedule, timezone, message, enabled, created_at, last_run
+      `;
+            const cronJobrow = inserted;
+            const nextRun = cronJobrow.enabled ? (() => {
+                try {
+                    const options = {};
+                    if (cronJobrow.timezone)
+                        options.timezone = cronJobrow.timezone;
+                    const cronJob = new CronerInstance(cronJobrow.schedule, options);
+                    const next = cronJob.nextRun();
+                    return next ? next.toISOString() : null;
+                }
+                catch {
+                    return null;
+                }
+            })() : null;
+            res.status(201).json({
+                ...cronJobrow,
+                next_run: nextRun,
+                last_run: cronJobrow?.last_run?.toISOString() ?? null,
+                created_at: cronJobrow.created_at.toISOString(),
+            });
+        }
+        catch (err) {
+            console.error("POST /worker/crons error:", err);
+            res.status(500).json({ error: "Internal server error" });
+        }
+    });
+    router.delete("/worker/crons/:id", async (req, res) => {
+        const { code } = req.query;
+        const id = parseInt(req.params.id, 10);
+        if (!code || typeof code !== "string") {
+            res.status(400).json({ error: "code query parameter is required" });
+            return;
+        }
+        if (isNaN(id)) {
+            res.status(400).json({ error: "Invalid cron job id" });
+            return;
+        }
+        const session = await sql `
+      SELECT name FROM sessions WHERE agent_code = ${code}
+    `;
+        if (session.length === 0) {
+            res.status(401).json({ error: "Invalid agent code" });
+            return;
+        }
+        const sessionName = session[0].name;
+        try {
+            const [job] = await sql `
+        SELECT id, name FROM cron_jobs WHERE id = ${id} AND session_name = ${sessionName}
+      `;
+            if (!job) {
+                res.status(404).json({ error: "Cron job not found or not owned by you" });
+                return;
+            }
+            await sql `DELETE FROM cron_jobs WHERE id = ${id}`;
+            res.json({ deleted: true, id, name: job.name });
+        }
+        catch (err) {
+            console.error("DELETE /worker/crons/:id error:", err);
+            res.status(500).json({ error: "Internal server error" });
+        }
+    });
+    router.post("/worker/crons/:id/enable", async (req, res) => {
+        const { code } = req.query;
+        const id = parseInt(req.params.id, 10);
+        if (!code || typeof code !== "string") {
+            res.status(400).json({ error: "code query parameter is required" });
+            return;
+        }
+        if (isNaN(id)) {
+            res.status(400).json({ error: "Invalid cron job id" });
+            return;
+        }
+        const session = await sql `
+      SELECT name FROM sessions WHERE agent_code = ${code}
+    `;
+        if (session.length === 0) {
+            res.status(401).json({ error: "Invalid agent code" });
+            return;
+        }
+        const sessionName = session[0].name;
+        try {
+            const [existing] = await sql `
+        SELECT id FROM cron_jobs WHERE id = ${id} AND session_name = ${sessionName}
+      `;
+            if (!existing) {
+                res.status(404).json({ error: "Cron job not found or not owned by you" });
+                return;
+            }
+            await sql `UPDATE cron_jobs SET enabled = TRUE WHERE id = ${id}`;
+            const [updated] = await sql `
+        SELECT id, name, session_name, schedule, timezone, message, enabled, created_at, last_run
+        FROM cron_jobs WHERE id = ${id}
+      `;
+            if (updated) {
+                const nextRun = (() => {
+                    try {
+                        const options = {};
+                        if (updated.timezone)
+                            options.timezone = updated.timezone;
+                        const cronJob = new CronerInstance(updated.schedule, options);
+                        const next = cronJob.nextRun();
+                        return next ? next.toISOString() : null;
+                    }
+                    catch {
+                        return null;
+                    }
+                })();
+                res.json({
+                    ...updated,
+                    next_run: nextRun,
+                    last_run: updated.last_run?.toISOString() ?? null,
+                    created_at: updated.created_at.toISOString(),
+                });
+            }
+            else {
+                res.status(404).json({ error: "Cron job not found" });
+            }
+        }
+        catch (err) {
+            console.error("POST /worker/crons/:id/enable error:", err);
+            res.status(500).json({ error: "Internal server error" });
+        }
+    });
+    router.post("/worker/crons/:id/disable", async (req, res) => {
+        const { code } = req.query;
+        const id = parseInt(req.params.id, 10);
+        if (!code || typeof code !== "string") {
+            res.status(400).json({ error: "code query parameter is required" });
+            return;
+        }
+        if (isNaN(id)) {
+            res.status(400).json({ error: "Invalid cron job id" });
+            return;
+        }
+        const session = await sql `
+      SELECT name FROM sessions WHERE agent_code = ${code}
+    `;
+        if (session.length === 0) {
+            res.status(401).json({ error: "Invalid agent code" });
+            return;
+        }
+        const sessionName = session[0].name;
+        try {
+            const [job] = await sql `
+        SELECT id FROM cron_jobs WHERE id = ${id} AND session_name = ${sessionName}
+      `;
+            if (!job) {
+                res.status(404).json({ error: "Cron job not found or not owned by you" });
+                return;
+            }
+            await sql `UPDATE cron_jobs SET enabled = FALSE WHERE id = ${id}`;
+            const [updated] = await sql `
+        SELECT id, name, session_name, schedule, timezone, message, enabled, created_at, last_run
+        FROM cron_jobs WHERE id = ${id}
+      `;
+            res.json({
+                ...updated,
+                next_run: null,
+                last_run: updated?.last_run?.toISOString() ?? null,
+                created_at: updated?.created_at.toISOString() ?? null,
+            });
+        }
+        catch (err) {
+            console.error("POST /worker/crons/:id/disable error:", err);
+            res.status(500).json({ error: "Internal server error" });
+        }
+    });
+    router.get("/worker/crons/:id/history", async (req, res) => {
+        const { code } = req.query;
+        const id = parseInt(req.params.id, 10);
+        const limit = Math.min(parseInt(req.query.limit ?? "10", 10), 100);
+        if (!code || typeof code !== "string") {
+            res.status(400).json({ error: "code query parameter is required" });
+            return;
+        }
+        if (isNaN(id)) {
+            res.status(400).json({ error: "Invalid cron job id" });
+            return;
+        }
+        const session = await sql `
+      SELECT name FROM sessions WHERE agent_code = ${code}
+    `;
+        if (session.length === 0) {
+            res.status(401).json({ error: "Invalid agent code" });
+            return;
+        }
+        const sessionName = session[0].name;
+        try {
+            const [job] = await sql `
+        SELECT id FROM cron_jobs WHERE id = ${id} AND session_name = ${sessionName}
+      `;
+            if (!job) {
+                res.status(404).json({ error: "Cron job not found or not owned by you" });
+                return;
+            }
+            const rows = await sql `
+        SELECT id, cron_job_id, executed_at, success, error_message
+        FROM cron_history
+        WHERE cron_job_id = ${id}
+        ORDER BY executed_at DESC
+        LIMIT ${limit}
+      `;
+            res.json(rows.map((r) => ({
+                ...r,
+                executed_at: r.executed_at.toISOString(),
+            })));
+        }
+        catch (err) {
+            console.error("GET /worker/crons/:id/history error:", err);
+            res.status(500).json({ error: "Internal server error" });
+        }
+    });
     return router;
 }