agentlas 1.0.64 → 1.0.66

package/engine/automation/launchd.cjs

@@ -23,6 +23,15 @@ const path = require("node:path");
 const { userDataDir } = require("../core/paths.cjs");
 
 const LABEL = "ai.agentlas.cli.automations";
+const DIRECTORY_MODE = 0o700;
+const FILE_MODE = 0o600;
+const MAX_PLIST_BYTES = 64 * 1024;
+const LAUNCHCTL_TIMEOUT_MS = 10_000;
+const LAUNCHCTL_MAX_BUFFER = 64 * 1024;
+const MIN_INTERVAL_SEC = 30;
+const MAX_INTERVAL_SEC = 24 * 60 * 60;
+const O_NOFOLLOW = fs.constants.O_NOFOLLOW || 0;
+const O_DIRECTORY = fs.constants.O_DIRECTORY || 0;
 
 function isSupported() { return process.platform === "darwin"; }
 function plistPath() { return path.join(os.homedir(), "Library", "LaunchAgents", `${LABEL}.plist`); }
@@ -31,18 +40,174 @@ function domainTarget() { return `gui/${os.userInfo().uid}`; }
 /** launchd 가 poke 할 CLI 진입점(절대경로). 전역 설치본이든 체크아웃이든 이 파일 기준으로 해석. */
 function cliEntry() { return path.resolve(__dirname, "..", "..", "bin", "agentlas.cjs"); }
 
+function samePath(left, right) {
+  const a = path.normalize(String(left || ""));
+  const b = path.normalize(String(right || ""));
+  return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+}
+
+function sameDirectoryIdentity(left, right) {
+  return !!left && !!right
+    && left.isDirectory() && right.isDirectory()
+    && !left.isSymbolicLink() && !right.isSymbolicLink()
+    && left.dev === right.dev && left.ino === right.ino;
+}
+
+function sameFileIdentity(left, right) {
+  return !!left && !!right
+    && left.isFile() && right.isFile()
+    && !left.isSymbolicLink() && !right.isSymbolicLink()
+    && left.dev === right.dev && left.ino === right.ino;
+}
+
+function realPath(file) {
+  // Keep the normal Win32 spelling for plist paths; the non-native resolver is
+  // also available on older supported Node versions.
+  return fs.realpathSync(path.resolve(file));
+}
+
+function inspectDirectory(directory, label = "directory") {
+  const requestedPath = path.resolve(String(directory || ""));
+  const stat = fs.lstatSync(requestedPath);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error(`refusing unsafe ${label}`);
+  const realpath = realPath(requestedPath);
+  const verified = fs.lstatSync(requestedPath);
+  if (!sameDirectoryIdentity(stat, verified)) throw new Error(`${label} changed during inspection`);
+  return { requestedPath, stat: verified, realpath };
+}
+
+function assertDirectory(info, label = "directory") {
+  const current = inspectDirectory(info.requestedPath, label);
+  if (!sameDirectoryIdentity(info.stat, current.stat) || !samePath(info.realpath, current.realpath)) {
+    throw new Error(`${label} changed during operation`);
+  }
+  return current;
+}
+
+function ensureDirectory(directory, { create = false, mode = DIRECTORY_MODE, restrict = false, label = "directory" } = {}) {
+  const requestedPath = path.resolve(String(directory || ""));
+  const parentPath = path.dirname(requestedPath);
+  const parent = samePath(parentPath, requestedPath)
+    ? null
+    : inspectDirectory(parentPath, `${label} parent`);
+  if (create) {
+    let exists = true;
+    try { fs.lstatSync(requestedPath); }
+    catch (error) {
+      if (error && error.code === "ENOENT") exists = false;
+      else throw error;
+    }
+    // Callers provide an already-anchored parent, so one-level creation cannot
+    // silently follow a newly swapped parent symlink.
+    if (parent) assertDirectory(parent, `${label} parent`);
+    if (!exists) fs.mkdirSync(requestedPath, { mode });
+  }
+  if (parent) assertDirectory(parent, `${label} parent`);
+  const before = inspectDirectory(requestedPath, label);
+  if (restrict) {
+    if (process.platform === "win32") {
+      try { fs.chmodSync(requestedPath, mode); } catch { /* Windows/best-effort */ }
+    } else {
+      let fd = null;
+      try {
+        fd = fs.openSync(requestedPath, fs.constants.O_RDONLY | O_DIRECTORY | O_NOFOLLOW);
+        const opened = fs.fstatSync(fd);
+        if (!sameDirectoryIdentity(before.stat, opened)) throw new Error(`${label} changed before chmod`);
+        fs.fchmodSync(fd, mode);
+        const changed = fs.fstatSync(fd);
+        if (!sameDirectoryIdentity(before.stat, changed)) throw new Error(`${label} changed during chmod`);
+      } catch { /* best-effort; the lstat/realpath checks below still gate use */ }
+      finally { if (fd !== null) { try { fs.closeSync(fd); } catch { /* preserve boundary checks */ } } }
+    }
+  }
+  if (parent) assertDirectory(parent, `${label} parent`);
+  const after = inspectDirectory(requestedPath, label);
+  if (!sameDirectoryIdentity(before.stat, after.stat) || !samePath(before.realpath, after.realpath)) {
+    throw new Error(`${label} changed during setup`);
+  }
+  return after;
+}
+
+function isStrictChild(parent, child) {
+  const relative = path.relative(parent, child);
+  return !!relative && !path.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path.sep}`);
+}
+
+function launchAgentsDirectory({ create = false } = {}) {
+  const home = inspectDirectory(os.homedir(), "home directory");
+  const library = ensureDirectory(path.join(home.realpath, "Library"), {
+    create,
+    restrict: false,
+    label: "Library directory",
+  });
+  const launchAgents = ensureDirectory(path.join(library.realpath, "LaunchAgents"), {
+    create,
+    restrict: true,
+    label: "LaunchAgents directory",
+  });
+  if (!isStrictChild(home.realpath, library.realpath) || !isStrictChild(library.realpath, launchAgents.realpath)) {
+    throw new Error("LaunchAgents directory escaped the home boundary");
+  }
+  assertDirectory(home, "home directory");
+  assertDirectory(library, "Library directory");
+  assertDirectory(launchAgents, "LaunchAgents directory");
+  return { home, library, launchAgents };
+}
+
+function launchAgentsLocation(options = {}) {
+  const directories = launchAgentsDirectory(options);
+  const target = path.join(directories.launchAgents.realpath, `${LABEL}.plist`);
+  return { ...directories, target };
+}
+
+function inspectPlistTarget(target, { allowMissing = false, allowHardLinks = false } = {}) {
+  let stat;
+  try { stat = fs.lstatSync(target); }
+  catch (error) {
+    if (allowMissing && error && error.code === "ENOENT") return null;
+    throw error;
+  }
+  if (stat.isSymbolicLink()) throw new Error("refusing symlink LaunchAgent plist");
+  if (!stat.isFile()) throw new Error("refusing non-regular LaunchAgent plist");
+  if (!allowHardLinks && stat.nlink !== 1) throw new Error("refusing hard-linked LaunchAgent plist");
+  return stat;
+}
+
+function assertPlistTarget(target, expected) {
+  const current = inspectPlistTarget(target);
+  if (!sameFileIdentity(expected, current) || current.nlink !== 1) throw new Error("LaunchAgent plist changed during operation");
+  return current;
+}
+
 function logPath() {
-  const dir = path.join(userDataDir(), "logs");
-  try { fs.mkdirSync(dir, { recursive: true }); } catch { /* best-effort */ }
-  return path.join(dir, "launchd-automations.log");
+  const dataDir = path.resolve(String(userDataDir() || ""));
+  const data = ensureDirectory(dataDir, { create: true, restrict: true, label: "Agentlas data directory" });
+  const logs = ensureDirectory(path.join(data.realpath, "logs"), { create: true, restrict: true, label: "Agentlas log directory" });
+  assertDirectory(data, "Agentlas data directory");
+  assertDirectory(logs, "Agentlas log directory");
+  const file = path.join(logs.realpath, "launchd-automations.log");
+  inspectPlistTarget(file, { allowMissing: true });
+  return file;
+}
+
+function normalizeIntervalSec(value, fallback = 300) {
+  let number;
+  try { number = Number(value); } catch { number = NaN; }
+  if (!Number.isFinite(number)) return fallback;
+  return Math.max(MIN_INTERVAL_SEC, Math.min(MAX_INTERVAL_SEC, Math.trunc(number)));
 }
 
 function plistXml(intervalSec = 300) {
   const node = process.execPath;
   const entry = cliEntry();
   const log = logPath();
-  const esc = (s) => String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-  return [
+  const esc = (s) => String(s)
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&apos;");
+  const xml = [
     '<?xml version="1.0" encoding="UTF-8"?>',
     '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
     '<plist version="1.0">',
@@ -57,7 +222,7 @@ function plistXml(intervalSec = 300) {
     "    <string>tick</string>",
     "  </array>",
     "  <key>StartInterval</key>",
-    `  <integer>${Math.max(30, Math.floor(intervalSec))}</integer>`,
+    `  <integer>${normalizeIntervalSec(intervalSec)}</integer>`,
     "  <key>RunAtLoad</key>",
     "  <true/>",
     "  <key>ProcessType</key>",
@@ -72,12 +237,23 @@ function plistXml(intervalSec = 300) {
     "</plist>",
     "",
   ].join("\n");
+  if (Buffer.byteLength(xml, "utf8") > MAX_PLIST_BYTES) throw new Error("LaunchAgent plist is too large");
+  return xml;
 }
 
 /** launchctl 실행 — throw 하지 않고 {code, stderr} 반환(상태 함수가 판정). */
 function launchctl(args) {
-  const res = spawnSync("launchctl", args, { encoding: "utf8" });
-  return { code: res.status ?? -1, stderr: (res.stderr || "").trim() };
+  try {
+    const res = spawnSync("launchctl", args, {
+      encoding: "utf8",
+      timeout: LAUNCHCTL_TIMEOUT_MS,
+      maxBuffer: LAUNCHCTL_MAX_BUFFER,
+    });
+    const stderr = String(res && (res.stderr || res.error?.message || "") || "").slice(0, LAUNCHCTL_MAX_BUFFER).trim();
+    return { code: res && Number.isInteger(res.status) ? res.status : -1, stderr };
+  } catch (error) {
+    return { code: -1, stderr: String((error && error.message) || error).slice(0, LAUNCHCTL_MAX_BUFFER).trim() };
+  }
 }
 
 function isLoaded() {
@@ -85,11 +261,209 @@ function isLoaded() {
   return launchctl(["print", `${domainTarget()}/${LABEL}`]).code === 0;
 }
 
+function writeAll(fd, payload) {
+  let offset = 0;
+  while (offset < payload.length) {
+    const written = fs.writeSync(fd, payload, offset, payload.length - offset);
+    if (!written) throw new Error("failed to write LaunchAgent plist");
+    offset += written;
+  }
+}
+
+function tempPath(directory, suffix) {
+  return path.join(directory.realpath, `.${LABEL}.${process.pid}.${cryptoRandomId()}.${suffix}`);
+}
+
+function cryptoRandomId() {
+  // LaunchAgent paths are local-only, but a random name keeps recovery files
+  // from colliding with a user's own dotfiles or another CLI process.
+  return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+}
+
+function writePlistTemp(directory, xml) {
+  const payload = Buffer.from(xml, "utf8");
+  if (payload.length > MAX_PLIST_BYTES) throw new Error("LaunchAgent plist is too large");
+  const temporary = tempPath(directory, "tmp");
+  let fd = null;
+  let created = null;
+  try {
+    fd = fs.openSync(temporary, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | O_NOFOLLOW, FILE_MODE);
+    try { fs.fchmodSync(fd, FILE_MODE); } catch { /* Windows/best-effort */ }
+    created = fs.fstatSync(fd);
+    if (!created.isFile() || created.isSymbolicLink() || created.nlink !== 1) throw new Error("unsafe LaunchAgent plist temporary file");
+    writeAll(fd, payload);
+    fs.fsyncSync(fd);
+    const written = fs.fstatSync(fd);
+    if (!sameFileIdentity(created, written) || written.nlink !== 1 || written.size !== payload.length) {
+      throw new Error("LaunchAgent plist temporary file changed during write");
+    }
+    fs.closeSync(fd);
+    fd = null;
+    assertDirectory(directory, "LaunchAgents directory");
+    return { path: temporary, stat: written };
+  } catch (error) {
+    if (fd !== null) {
+      try { fs.closeSync(fd); } catch { /* preserve original */ }
+    }
+    // Never unlink a pathname which may have been replaced after our fd was
+    // opened.  An unknown temp successor is a recovery artifact, not ours.
+    if (created) {
+      try {
+        const current = inspectPlistTarget(temporary, { allowMissing: true });
+        if (current && sameFileIdentity(created, current) && current.nlink === 1) fs.unlinkSync(temporary);
+      } catch { /* best-effort; recovery path remains */ }
+    }
+    throw error;
+  }
+}
+
+function removeKnownFile(file, expected, directory) {
+  assertDirectory(directory, "LaunchAgents directory");
+  const current = assertPlistTarget(file, expected);
+  if (current.nlink !== 1) throw new Error("LaunchAgent plist became hard-linked");
+  fs.unlinkSync(file);
+  assertDirectory(directory, "LaunchAgents directory");
+}
+
+function restoreQuarantinedFile(location, quarantine) {
+  let quarantined;
+  try { quarantined = inspectPlistTarget(quarantine); } catch { return false; }
+  try {
+    // A directory swap can make the original boundary unverifiable, but the
+    // recovery path is still safe to use if the destination is absent: link(2)
+    // is no-replace, and the inode check below prevents restoring an unknown
+    // successor.  Do not require the unsafe directory assertion here or a
+    // victim moved by a race would be stranded under the quarantine name.
+    try { assertDirectory(location.launchAgents, "LaunchAgents directory"); } catch { /* recovery may cross a detected swap */ }
+    const target = inspectPlistTarget(location.target, { allowMissing: true });
+    if (target) return false;
+    fs.linkSync(quarantine, location.target);
+    const restored = fs.lstatSync(location.target);
+    if (!sameFileIdentity(quarantined, restored) || restored.nlink < 2) return false;
+    fs.unlinkSync(quarantine);
+    const final = inspectPlistTarget(location.target);
+    return sameFileIdentity(quarantined, final) && final.nlink === 1;
+  } catch {
+    return false;
+  }
+}
+
+function writePlistAtomic(location, xml) {
+  if (Buffer.byteLength(xml, "utf8") > MAX_PLIST_BYTES) throw new Error("LaunchAgent plist is too large");
+  assertDirectory(location.launchAgents, "LaunchAgents directory");
+  const expected = inspectPlistTarget(location.target, { allowMissing: true });
+  assertDirectory(location.launchAgents, "LaunchAgents directory");
+  const temporary = writePlistTemp(location.launchAgents, xml);
+  let published = false;
+  let quarantine = null;
+  try {
+    assertDirectory(location.launchAgents, "LaunchAgents directory");
+    const current = inspectPlistTarget(location.target, { allowMissing: true });
+    if (expected && (!current || !sameFileIdentity(expected, current) || current.nlink !== 1)) {
+      throw new Error("LaunchAgent plist changed before update");
+    }
+    if (!expected && current) throw new Error("LaunchAgent plist successor appeared during install");
+
+    if (expected) {
+      quarantine = tempPath(location.launchAgents, "previous");
+      // Move the known inode to a private recovery path. If a successor won
+      // the pathname race, the post-rename identity check restores it without
+      // overwriting the successor or losing the previous plist.
+      fs.renameSync(location.target, quarantine);
+      const moved = inspectPlistTarget(quarantine);
+      if (!sameFileIdentity(expected, moved) || moved.nlink !== 1) {
+        restoreQuarantinedFile(location, quarantine);
+        throw new Error("LaunchAgent plist successor replaced the expected file");
+      }
+      assertDirectory(location.launchAgents, "LaunchAgents directory");
+      if (inspectPlistTarget(location.target, { allowMissing: true })) {
+        throw new Error("LaunchAgent plist successor appeared during update");
+      }
+    }
+
+    // link(2) is atomic and no-replace. A successor that appears after the
+    // preflight therefore causes EEXIST instead of being silently clobbered.
+    fs.linkSync(temporary.path, location.target);
+    published = true;
+    assertDirectory(location.launchAgents, "LaunchAgents directory");
+    const linked = fs.lstatSync(location.target);
+    if (!sameFileIdentity(temporary.stat, linked) || linked.nlink < 2) throw new Error("LaunchAgent plist identity changed after publish");
+    const linkedTemporary = inspectPlistTarget(temporary.path, { allowHardLinks: true });
+    if (!sameFileIdentity(temporary.stat, linkedTemporary) || linkedTemporary.nlink < 2) {
+      throw new Error("LaunchAgent plist temporary file changed after publish");
+    }
+    assertDirectory(location.launchAgents, "LaunchAgents directory");
+    fs.unlinkSync(temporary.path);
+    published = false;
+    const installed = inspectPlistTarget(location.target);
+    if (!sameFileIdentity(temporary.stat, installed) || installed.nlink !== 1) throw new Error("LaunchAgent plist identity changed after publish");
+    if (quarantine) {
+      const previous = inspectPlistTarget(quarantine);
+      removeKnownFile(quarantine, previous, location.launchAgents);
+      quarantine = null;
+    }
+    assertDirectory(location.launchAgents, "LaunchAgents directory");
+  } catch (error) {
+    if (published) {
+      // If the directory was swapped after the no-replace link, the target
+      // pathname may now resolve through an unsafe successor directory.  Only
+      // unlink it when the inode is still exactly our temporary file; never
+      // remove a replacement merely because it occupies the same pathname.
+      try {
+        const current = inspectPlistTarget(location.target, { allowMissing: true });
+        if (current && sameFileIdentity(temporary.stat, current) && current.nlink >= 2) {
+          fs.unlinkSync(location.target);
+          published = false;
+        }
+      } catch { /* leave an unknown successor and recovery artifact intact */ }
+    }
+    if (!published) {
+      try {
+        const current = inspectPlistTarget(temporary.path, { allowMissing: true });
+        if (current && sameFileIdentity(temporary.stat, current) && current.nlink === 1) {
+          fs.unlinkSync(temporary.path);
+        }
+      } catch { /* leave the temp as a recovery artifact if the boundary moved */ }
+    }
+    // A quarantine is deliberately retained when publication/update fails so
+    // an operator can restore the previous plist without guessing its bytes.
+    throw error;
+  }
+}
+
+function removePlistSafely(location) {
+  assertDirectory(location.launchAgents, "LaunchAgents directory");
+  const expected = inspectPlistTarget(location.target, { allowMissing: true });
+  if (!expected) return;
+  const quarantine = tempPath(location.launchAgents, "disabled");
+  assertDirectory(location.launchAgents, "LaunchAgents directory");
+  fs.renameSync(location.target, quarantine);
+  const moved = inspectPlistTarget(quarantine);
+  if (!sameFileIdentity(expected, moved) || moved.nlink !== 1) {
+    restoreQuarantinedFile(location, quarantine);
+    throw new Error("LaunchAgent plist successor replaced the expected file");
+  }
+  assertDirectory(location.launchAgents, "LaunchAgents directory");
+  if (inspectPlistTarget(location.target, { allowMissing: true })) {
+    throw new Error("LaunchAgent plist successor appeared during removal");
+  }
+  removeKnownFile(quarantine, moved, location.launchAgents);
+}
+
 function launchdStatus() {
   const supported = isSupported();
+  let installed = false;
+  if (supported) {
+    try {
+      const location = launchAgentsLocation({ create: false });
+      const target = inspectPlistTarget(location.target, { allowMissing: true });
+      assertDirectory(location.launchAgents, "LaunchAgents directory");
+      installed = !!target;
+    } catch { /* unsafe/missing path is not an installed LaunchAgent */ }
+  }
   return {
     supported,
-    installed: supported && fs.existsSync(plistPath()),
+    installed: supported && installed,
     loaded: supported && isLoaded(),
     plistPath: plistPath(),
     label: LABEL,
@@ -100,15 +474,15 @@ function launchdStatus() {
 /** plist 작성 + launchctl bootstrap 로드(멱등 — 이미 로드면 bootout 후 재로드). */
 function enableLaunchd({ intervalSec = 300 } = {}) {
   if (!isSupported()) return { ...launchdStatus(), error: "launchd persistence is macOS-only." };
-  const p = plistPath();
+  let location;
   try {
-    fs.mkdirSync(path.dirname(p), { recursive: true });
-    fs.writeFileSync(p, plistXml(intervalSec), "utf8");
+    location = launchAgentsLocation({ create: true });
+    writePlistAtomic(location, plistXml(intervalSec));
   } catch (err) {
     return { ...launchdStatus(), error: `failed to write plist: ${String(err)}` };
   }
   if (isLoaded()) launchctl(["bootout", `${domainTarget()}/${LABEL}`]);
-  const res = launchctl(["bootstrap", domainTarget(), p]);
+  const res = launchctl(["bootstrap", domainTarget(), location.target]);
   if (res.code !== 0 && !isLoaded()) {
     return { ...launchdStatus(), error: res.stderr || "launchctl bootstrap failed." };
   }
@@ -118,10 +492,15 @@ function enableLaunchd({ intervalSec = 300 } = {}) {
 /** launchctl bootout + plist 삭제. */
 function disableLaunchd() {
   if (!isSupported()) return launchdStatus();
+  let location;
+  try {
+    location = launchAgentsLocation({ create: false });
+    removePlistSafely(location);
+  } catch (err) {
+    if (err && err.code === "ENOENT") return launchdStatus();
+    return { ...launchdStatus(), error: `failed to remove plist: ${String(err)}` };
+  }
   if (isLoaded()) launchctl(["bootout", `${domainTarget()}/${LABEL}`]);
-  const p = plistPath();
-  try { if (fs.existsSync(p)) fs.rmSync(p); }
-  catch (err) { return { ...launchdStatus(), error: `failed to remove plist: ${String(err)}` }; }
   return launchdStatus();
 }
 

package/engine/automation/schedule.cjs

@@ -33,6 +33,7 @@ function cronField(expr, min, max) {
 
 const WEEKDAY_INDEX = { Sun: 0, Mon: 1, Tue: 2, Wed: 3, Thu: 4, Fri: 5, Sat: 6 };
 const zonedFormatterCache = new Map();
+const zonedCalendarFormatterCache = new Map();
 
 function zonedDateParts(date, timezone) {
   if (!timezone) {
@@ -69,6 +70,81 @@ function zonedDateParts(date, timezone) {
   };
 }
 
+function zonedCalendarParts(date, timezone) {
+  let formatter = zonedCalendarFormatterCache.get(timezone);
+  if (!formatter) {
+    formatter = new Intl.DateTimeFormat("en-US", {
+      timeZone: timezone,
+      hourCycle: "h23",
+      year: "numeric",
+      month: "2-digit",
+      day: "2-digit",
+      hour: "2-digit",
+      minute: "2-digit",
+    });
+    zonedCalendarFormatterCache.set(timezone, formatter);
+  }
+  const parts = Object.fromEntries(
+    formatter.formatToParts(date).filter((part) => part.type !== "literal").map((part) => [part.type, part.value]),
+  );
+  return {
+    year: Number(parts.year),
+    month: Number(parts.month),
+    day: Number(parts.day),
+    hour: Number(parts.hour),
+    minute: Number(parts.minute),
+  };
+}
+
+function calendarDayNumber(parts) {
+  return Date.UTC(parts.year, parts.month - 1, parts.day);
+}
+
+function zonedCalendarTime(parts, timezone) {
+  const desired = Date.UTC(parts.year, parts.month - 1, parts.day, parts.hour, parts.minute);
+  let candidate = new Date(desired);
+  for (let i = 0; i < 4; i++) {
+    const actual = zonedCalendarParts(candidate, timezone);
+    const actualAsUtc = Date.UTC(actual.year, actual.month - 1, actual.day, actual.hour, actual.minute);
+    const corrected = desired - (actualAsUtc - candidate.getTime());
+    if (corrected === candidate.getTime()) return candidate;
+    candidate = new Date(corrected);
+  }
+  return candidate;
+}
+
+function nextLocalDayStart(date, timezone) {
+  if (!timezone) {
+    const next = new Date(date.getTime());
+    next.setHours(0, 0, 0, 0);
+    next.setDate(next.getDate() + 1);
+    return next;
+  }
+
+  const current = zonedCalendarParts(date, timezone);
+  const nextDay = new Date(Date.UTC(current.year, current.month - 1, current.day + 1));
+  const target = {
+    year: nextDay.getUTCFullYear(),
+    month: nextDay.getUTCMonth() + 1,
+    day: nextDay.getUTCDate(),
+    hour: 0,
+    minute: 0,
+  };
+  const targetDay = calendarDayNumber(target);
+  let candidate = zonedCalendarTime(target, timezone);
+
+  // Midnight can be skipped by a timezone transition. Accept the first instant
+  // that has reached the next local calendar day (or a later, non-existent day).
+  for (let i = 0; i < 48; i++) {
+    if (candidate.getTime() > date.getTime()) {
+      const actual = zonedCalendarParts(candidate, timezone);
+      if (calendarDayNumber(actual) >= targetDay) return candidate;
+    }
+    candidate = new Date(candidate.getTime() + 60 * 60 * 1000);
+  }
+  return null;
+}
+
 function nextCronRun(cron, from = new Date(), timezone = null) {
   const parts = String(cron).trim().split(/\s+/);
   if (parts.length !== 5) return null;
@@ -85,10 +161,13 @@ function nextCronRun(cron, from = new Date(), timezone = null) {
   } catch {
     return null;
   }
-  const t = new Date(from.getTime());
+  const fromMs = from.getTime();
+  if (!Number.isFinite(fromMs)) return null;
+  const t = new Date(fromMs);
   t.setSeconds(0, 0);
   t.setMinutes(t.getMinutes() + 1);
-  for (let i = 0; i < 366 * 24 * 60; i++) {
+  const searchUntil = fromMs + 8 * 366 * 24 * 60 * 60 * 1000;
+  while (t.getTime() <= searchUntil) {
     const local = zonedDateParts(t, timezone);
     const domOk = doms.has(local.day);
     const dowOk = dows.has(local.weekday);
@@ -96,7 +175,15 @@ function nextCronRun(cron, from = new Date(), timezone = null) {
     const domRestricted = domS !== "*";
     const dowRestricted = dowS !== "*";
     const dayOk = domRestricted && dowRestricted ? domOk || dowOk : domOk && dowOk;
-    if (mons.has(local.month) && dayOk && hours.has(local.hour) && mins.has(local.minute)) return t;
+    const monthOk = mons.has(local.month);
+    if (monthOk && dayOk && hours.has(local.hour) && mins.has(local.minute)) return t;
+    if (!monthOk || !dayOk) {
+      const dayStart = nextLocalDayStart(t, timezone);
+      if (dayStart && dayStart.getTime() > t.getTime()) {
+        t.setTime(dayStart.getTime());
+        continue;
+      }
+    }
     t.setMinutes(t.getMinutes() + 1);
   }
   return null;