amalgm 0.1.86 → 0.1.87

package/runtime/scripts/amalgm-mcp/automations/store.js

@@ -14,6 +14,9 @@ const { validateWorkflowToolActions } = require('./tool-actions');
 
 const LEGACY_MIGRATION_KEY = 'automations_legacy_migrated_v1';
 const DEFAULT_RUN_LIMIT = 100;
+const TERMINAL_RUN_STATUSES = new Set(['completed', 'failed', 'stopped', 'rejected', 'interrupted', 'unmatched']);
+const DEFAULT_STALE_RUN_MS = Math.max(60_000, Number(process.env.AMALGM_AUTOMATION_RUN_STALE_MS) || 10 * 60_000);
+const DEFAULT_RUN_RETENTION = Math.max(10, Number(process.env.AMALGM_AUTOMATION_RUN_RETENTION) || 500);
 
 let cronParser = null;
 
@@ -178,6 +181,104 @@ function rowToWorkflow(row) {
   });
 }
 
+/**
+ * Ordered automation→workflow links. automation_definitions.workflow_id stays
+ * the primary (first) workflow for backwards compatibility; the link table is
+ * the source of truth for the full ordered set.
+ */
+function replaceWorkflowLinks(db, automationId, workflowIds) {
+  db.prepare('DELETE FROM automation_workflow_links WHERE automation_id = ?').run(automationId);
+  const insert = db.prepare(`
+    INSERT INTO automation_workflow_links (automation_id, workflow_id, position)
+    VALUES (?, ?, ?)
+  `);
+  workflowIds.forEach((workflowId, position) => {
+    insert.run(automationId, workflowId, position);
+  });
+}
+
+function readWorkflowLinks(db) {
+  const links = new Map();
+  const rows = db.prepare(`
+    SELECT automation_id, workflow_id
+    FROM automation_workflow_links
+    ORDER BY automation_id, position ASC
+  `).all();
+  for (const row of rows) {
+    if (!links.has(row.automation_id)) links.set(row.automation_id, []);
+    links.get(row.automation_id).push(row.workflow_id);
+  }
+  return links;
+}
+
+/**
+ * Normalize the `workflows` input on create/update. Entries may be workflow
+ * objects or bare workflowText strings. Falls back to the legacy single
+ * workflow fields when no array is provided.
+ */
+function workflowInputsForAutomation(input = {}) {
+  if (Array.isArray(input.workflows) && input.workflows.length > 0) {
+    return input.workflows.map((entry) => (
+      typeof entry === 'string' ? { workflowText: entry } : (isObject(entry) ? entry : {})
+    ));
+  }
+  return null;
+}
+
+/**
+ * Match incoming workflow inputs against an automation's existing workflows so
+ * workflow identity (id, run history linkage) survives an array update.
+ * Matching order: explicit id, then the next unclaimed existing workflow —
+ * a mixed id/no-id array must not mis-bind and orphan-delete a survivor.
+ */
+function matchWorkflowsToExisting(workflowInputs, existingWorkflows) {
+  const unmatched = [...existingWorkflows];
+  return workflowInputs.map((input) => {
+    const inputId = cleanString(input?.id);
+    let matchIndex = inputId ? unmatched.findIndex((item) => item.id === inputId) : -1;
+    if (matchIndex < 0 && !inputId && unmatched.length > 0) matchIndex = 0;
+    const existing = matchIndex >= 0 ? unmatched.splice(matchIndex, 1)[0] : null;
+    return { input: input || {}, existing };
+  });
+}
+
+/**
+ * Guard a normalized workflows array before writing: ids must be unique, and
+ * an id the automation does not already own must not collide with a workflow
+ * row owned elsewhere — upsertWorkflowRow's ON CONFLICT would silently rewrite
+ * another automation's workflow (and its allowlist) in place.
+ */
+function assertWorkflowIdsWritable(db, workflows, ownedIds = new Set()) {
+  const seen = new Set();
+  for (const workflow of workflows) {
+    if (seen.has(workflow.id)) {
+      throw new Error(`Duplicate workflow id in workflows: ${workflow.id}`);
+    }
+    seen.add(workflow.id);
+    if (ownedIds.has(workflow.id)) continue;
+    const taken = db.prepare('SELECT 1 FROM automation_workflows WHERE id = ?').get(workflow.id);
+    if (taken) {
+      throw new Error(`Workflow id ${workflow.id} already belongs to another automation. Omit the id to create a new workflow.`);
+    }
+  }
+}
+
+function deleteOrphanedWorkflowRows(db, workflowIds) {
+  const remove = db.prepare(`
+    DELETE FROM automation_workflows
+    WHERE id = ?
+      AND NOT EXISTS (
+        SELECT 1 FROM automation_definitions WHERE workflow_id = automation_workflows.id
+      )
+      AND NOT EXISTS (
+        SELECT 1 FROM automation_workflow_links WHERE workflow_id = automation_workflows.id
+      )
+  `);
+  for (const workflowId of workflowIds) {
+    if (workflowId) remove.run(workflowId);
+  }
+}
+
 function upsertWorkflowRow(db, workflow) {
   const params = workflowRowParams(workflow);
   db.prepare(`
@@ -210,10 +311,21 @@ function normalizeSchedule(inputSchedule, existingSchedule = null) {
   const candidate = inputSchedule || existingSchedule;
   const result = normalizeTaskSchedule(candidate);
   if (result.error) throw new Error(result.error);
-  return result.schedule;
+  const schedule = result.schedule;
+  if (schedule?.kind === 'cron') {
+    // Reject unparseable cron expressions at save time. computeNextRunAt
+    // swallows parse errors and returns null, which leaves the trigger
+    // permanently dormant with status "active" — fail loudly here instead.
+    try {
+      cron().CronExpressionParser.parse(schedule.expr, { tz: schedule.tz || 'UTC' });
+    } catch (error) {
+      throw new Error(`Invalid cron schedule "${schedule.expr}" (tz ${schedule.tz || 'UTC'}): ${error?.message || error}`);
+    }
+  }
+  return schedule;
 }
 
-function computeNextRunAt(trigger, afterDate = new Date()) {
+function computeNextRunAt(trigger, afterDate = new Date(), options = {}) {
   if (!trigger || trigger.enabled === false || trigger.kind !== 'scheduled') return null;
   const schedule = trigger.schedule;
   if (!schedule) return null;
@@ -223,13 +335,20 @@ function computeNextRunAt(trigger, afterDate = new Date()) {
     const at = validDate(schedule.at);
     if (!at) return null;
     if (trigger.lastFiredAt && validDate(trigger.lastFiredAt) >= at) return null;
-    return at > after ? at.toISOString() : at.toISOString();
+    // A past "at" stays claimable so a missed one-shot run catches up at boot.
+    return at.toISOString();
   }
 
   if (schedule.kind === 'interval') {
     const ms = Number(schedule.ms);
     if (!Number.isFinite(ms) || ms < 60_000) return null;
-    return new Date(after.getTime() + ms).toISOString();
+    // Anchor to the scheduled slot (not the claim time) when available so the
+    // cadence keeps its phase across poll latency, sleep, and restarts, and
+    // missed slots are skipped rather than replayed.
+    const anchor = validDate(options.anchor);
+    let next = (anchor || after).getTime() + ms;
+    while (next <= after.getTime()) next += ms;
+    return new Date(next).toISOString();
   }
 
   if (schedule.kind === 'cron') {
@@ -286,9 +405,22 @@ function normalizeTriggerRecord(input = {}, automation, existing = null) {
   if (kind === 'scheduled') {
     trigger.schedule = normalizeSchedule(input.schedule, existing?.schedule);
     trigger.scheduleLabel = scheduleLabel(trigger.schedule);
+    // When the schedule itself changes, the old next_run_at is stale — always
+    // recompute so the new cadence applies immediately instead of after one
+    // wrongly-timed fire. Callers often round-trip the full trigger record,
+    // so an input nextRunAt identical to the existing one is treated as
+    // round-tripped state, not an explicit override.
+    const scheduleChanged = !!existing
+      && JSON.stringify(trigger.schedule) !== JSON.stringify(existing.schedule || null);
+    const inputNextRunAt = isoOrNull(input.nextRunAt);
+    const roundTrippedNextRunAt = !!inputNextRunAt
+      && !!existing?.nextRunAt
+      && inputNextRunAt === isoOrNull(existing.nextRunAt);
     trigger.nextRunAt = input.nextRunAt === null
       ? null
-      : isoOrNull(input.nextRunAt) || existing?.nextRunAt || computeNextRunAt(trigger, trigger.createdAt);
+      : ((scheduleChanged && roundTrippedNextRunAt) ? null : inputNextRunAt)
+        || (!scheduleChanged && existing?.nextRunAt)
+        || computeNextRunAt(trigger, timestamp);
     trigger.source = null;
     trigger.event = null;
     trigger.sourceUrl = null;
@@ -311,6 +443,57 @@ function normalizeTriggerRecord(input = {}, automation, existing = null) {
   return trigger;
 }
 
+function triggerMatchKind(trigger = {}) {
+  const rawKind = cleanString(trigger.kind || 'event').toLowerCase();
+  return rawKind === 'webhook' ? 'event' : rawKind;
+}
+
+function triggerFingerprint(trigger = {}) {
+  const kind = triggerMatchKind(trigger);
+  if (kind === 'scheduled') {
+    let schedule = trigger.schedule || null;
+    try {
+      schedule = normalizeTaskSchedule(trigger.schedule).schedule || schedule;
+    } catch {
+      // Fingerprint with the raw schedule if it does not normalize.
+    }
+    return `scheduled:${JSON.stringify(schedule)}`;
+  }
+  const source = cleanString(trigger.source) || '*';
+  const event = cleanString(trigger.event ?? trigger.eventName) || '*';
+  return `event:${source}.${event}`;
+}
+
+/**
+ * Match incoming trigger inputs against existing trigger records so trigger
+ * identity (id, webhook secret, schedule clock, fire history) survives a
+ * full-array update instead of being regenerated by delete-and-recreate.
+ * Matching order: explicit id, exact kind+selector/schedule fingerprint, then
+ * a single remaining trigger of the same kind (covers in-place edits).
+ */
+function matchTriggersToExisting(triggerInputs, existingTriggers) {
+  const unmatched = [...existingTriggers];
+  const inputs = Array.isArray(triggerInputs) ? triggerInputs : [];
+  return inputs.map((input) => {
+    const inputId = cleanString(input?.id);
+    let index = inputId ? unmatched.findIndex((item) => item.id === inputId) : -1;
+    if (index < 0 && !inputId) {
+      const fingerprint = triggerFingerprint(input || {});
+      index = unmatched.findIndex((item) => triggerFingerprint(item) === fingerprint);
+      if (index < 0) {
+        const kind = triggerMatchKind(input || {});
+        const sameKindExisting = unmatched.filter((item) => triggerMatchKind(item) === kind);
+        const sameKindIncoming = inputs.filter((item) => triggerMatchKind(item || {}) === kind);
+        if (sameKindExisting.length === 1 && sameKindIncoming.length === 1) {
+          index = unmatched.indexOf(sameKindExisting[0]);
+        }
+      }
+    }
+    const existing = index >= 0 ? unmatched.splice(index, 1)[0] : null;
+    return { input: input || {}, existing };
+  });
+}
+
 function triggerRowParams(trigger) {
   return {
     id: trigger.id,
@@ -470,41 +653,46 @@ function triggerStatus(trigger) {
   return 'active';
 }
 
-function automationStatus(automation, triggers, workflow) {
+function automationStatus(automation, triggers, workflows) {
+  const workflowList = (Array.isArray(workflows) ? workflows : [workflows]).filter(Boolean);
   if (automation.enabled === false) return 'paused';
-  if (workflowStatus(workflow) === 'error') return 'error';
+  if (workflowList.some((workflow) => workflowStatus(workflow) === 'error')) return 'error';
   if (triggers.some((trigger) => triggerStatus(trigger) === 'error')) return 'error';
   if (triggers.length > 0 && triggers.every((trigger) => trigger.enabled === false)) return 'paused';
   return 'active';
 }
 
-function composeAutomation(base, triggers, workflow) {
+function composeAutomation(base, triggers, workflowOrWorkflows) {
+  const workflowList = (Array.isArray(workflowOrWorkflows) ? workflowOrWorkflows : [workflowOrWorkflows])
+    .filter(Boolean);
+  const workflowIds = workflowList.map((workflow) => workflow.id);
   const normalizedTriggers = triggers.map((trigger) => ({
     ...trigger,
     workflowId: base.workflowId,
-    workflowIds: [base.workflowId],
+    workflowIds,
     status: triggerStatus(trigger),
     backing: {
       resource: 'triggers',
       id: trigger.id,
     },
   }));
-  const normalizedWorkflow = workflow ? {
+  const normalizedWorkflows = workflowList.map((workflow) => ({
     ...workflow,
     triggerIds: normalizedTriggers.map((trigger) => trigger.id),
     automationIds: [base.id],
     status: workflowStatus(workflow),
-  } : null;
+  }));
+  const primaryWorkflow = normalizedWorkflows[0] || null;
 
   return {
     ...base,
     kind: normalizedTriggers[0]?.kind || 'automation',
-    status: automationStatus(base, normalizedTriggers, normalizedWorkflow),
+    status: automationStatus(base, normalizedTriggers, normalizedWorkflows),
     triggerIds: normalizedTriggers.map((trigger) => trigger.id),
-    workflowIds: [base.workflowId],
+    workflowIds,
     triggers: normalizedTriggers,
-    workflow: normalizedWorkflow,
-    workflows: normalizedWorkflow ? [normalizedWorkflow] : [],
+    workflow: primaryWorkflow,
+    workflows: normalizedWorkflows,
   };
 }
 
@@ -525,20 +713,32 @@ function readAutomationGraph(db = openLocalDb()) {
     triggersByAutomation.get(trigger.automationId).push(trigger);
   }
 
+  const links = readWorkflowLinks(db);
   const automations = automationRows
     .map(rowToAutomationBase)
     .filter(Boolean)
-    .map((automation) => composeAutomation(
-      automation,
-      triggersByAutomation.get(automation.id) || [],
-      workflowsById.get(automation.workflowId) || null,
-    ));
+    .map((automation) => {
+      const linkedIds = links.get(automation.id) || [];
+      const workflowIds = linkedIds.length > 0 ? linkedIds : [automation.workflowId];
+      const automationWorkflows = workflowIds
+        .map((workflowId) => workflowsById.get(workflowId) || null)
+        .filter(Boolean);
+      return composeAutomation(
+        automation,
+        triggersByAutomation.get(automation.id) || [],
+        automationWorkflows,
+      );
+    });
   const triggers = automations.flatMap((automation) => automation.triggers);
-  const usedWorkflowIds = new Set(automations.map((automation) => automation.workflowId));
+  const usedWorkflowIds = new Set(automations.flatMap((automation) => automation.workflowIds));
   const workflows = Array.from(workflowsById.values()).map((workflow) => ({
     ...workflow,
-    triggerIds: triggers.filter((trigger) => trigger.workflowId === workflow.id).map((trigger) => trigger.id),
-    automationIds: automations.filter((automation) => automation.workflowId === workflow.id).map((automation) => automation.id),
+    triggerIds: automations
+      .filter((automation) => automation.workflowIds.includes(workflow.id))
+      .flatMap((automation) => automation.triggerIds),
+    automationIds: automations
+      .filter((automation) => automation.workflowIds.includes(workflow.id))
+      .map((automation) => automation.id),
     status: workflowStatus(workflow),
     orphaned: !usedWorkflowIds.has(workflow.id),
   }));
@@ -579,7 +779,11 @@ function defaultTriggersForInput(input, automation) {
 }
 
 function insertAutomationBundle(db, input = {}) {
-  const workflowInput = {
+  const arrayInputs = workflowInputsForAutomation(input);
+  if (arrayInputs && (cleanString(input.workflowText) || typeof input.workflow === 'string')) {
+    throw new Error('Pass either workflowText/workflow or workflows, not both.');
+  }
+  const workflowInputs = arrayInputs || [{
     ...(isObject(input.workflow) ? input.workflow : {}),
     name: input.workflowName || input.name,
     description: input.workflowDescription ?? input.description,
@@ -588,20 +792,32 @@ function insertAutomationBundle(db, input = {}) {
     workflowText: input.workflowText || (typeof input.workflow === 'string' ? input.workflow : input.workflow?.workflowText),
     allowlist: input.allowlist || input.workflow?.allowlist,
     limits: input.limits || input.workflow?.limits,
-  };
-  const workflow = normalizeWorkflowRecord(workflowInput);
-  if (workflow.compilerErrors?.length) throw new Error(workflow.compilerErrors.join('\n'));
+  }];
+  const workflows = workflowInputs.map((workflowInput, index) => normalizeWorkflowRecord({
+    projectPath: input.projectPath,
+    // Top-level allowlist/limits apply to every workflow unless an entry
+    // carries its own (the spread below wins for per-entry values).
+    allowlist: input.allowlist,
+    limits: input.limits,
+    ...workflowInput,
+    name: workflowInput.name
+      || (index === 0 ? (input.workflowName || input.name) : `${input.name || 'Workflow'} ${index + 1}`),
+  }));
+  const compileErrors = workflows.flatMap((workflow) => workflow.compilerErrors || []);
+  if (compileErrors.length > 0) throw new Error(compileErrors.join('\n'));
+  assertWorkflowIdsWritable(db, workflows);
 
-  const automation = normalizeAutomationRecord(input, workflow);
-  automation.workflow = workflow;
+  const automation = normalizeAutomationRecord(input, workflows[0]);
+  automation.workflow = workflows[0];
   const triggerInputs = defaultTriggersForInput(input, automation);
   const triggers = triggerInputs.map((triggerInput) => normalizeTriggerRecord(triggerInput, automation));
   if (triggers.length === 0) throw new Error('Automation requires at least one trigger.');
 
-  upsertWorkflowRow(db, workflow);
+  for (const workflow of workflows) upsertWorkflowRow(db, workflow);
   upsertAutomationRow(db, automation);
+  replaceWorkflowLinks(db, automation.id, workflows.map((workflow) => workflow.id));
   for (const trigger of triggers) upsertTriggerRow(db, trigger);
-  return composeAutomation(automation, triggers, workflow);
+  return composeAutomation(automation, triggers, workflows);
 }
 
 function createAutomation(input = {}, options = {}) {
@@ -637,30 +853,71 @@ function updateAutomation(automationId, updates = {}, options = {}) {
   const db = openLocalDb();
 
   db.transaction(() => {
-    const workflow = normalizeWorkflowRecord({
-      ...existing.workflow,
-      ...(isObject(updates.workflow) ? updates.workflow : {}),
-      ...(updates.workflowText !== undefined ? { workflowText: updates.workflowText } : {}),
-      ...(updates.workflow !== undefined && typeof updates.workflow === 'string' ? { workflowText: updates.workflow } : {}),
-      ...(updates.workflowName !== undefined ? { name: updates.workflowName } : {}),
-      ...(updates.allowlist !== undefined ? { allowlist: updates.allowlist } : {}),
-      ...(updates.limits !== undefined ? { limits: updates.limits } : {}),
-    }, existing.workflow);
-    if (workflow.compilerErrors?.length) throw new Error(workflow.compilerErrors.join('\n'));
+    const existingWorkflows = Array.isArray(existing.workflows) ? existing.workflows : [];
+    const workflowArrayInputs = workflowInputsForAutomation(updates);
+    let workflows;
+    let workflowsToUpsert;
+    if (workflowArrayInputs) {
+      if (cleanString(updates.workflowText) || typeof updates.workflow === 'string') {
+        throw new Error('Pass either workflowText/workflow or workflows, not both.');
+      }
+      // Full workflows-array update: match by id (then next unclaimed) so
+      // workflow identity and run-history linkage survive, like trigger
+      // updates.
+      const matched = matchWorkflowsToExisting(workflowArrayInputs, existingWorkflows);
+      workflows = matched.map(({ input, existing: prior }, index) => normalizeWorkflowRecord({
+        projectPath: existing.projectPath,
+        allowlist: updates.allowlist,
+        limits: updates.limits,
+        ...input,
+        name: cleanString(input.name) || prior?.name
+          || (index === 0 ? (updates.workflowName || existing.name) : `${existing.name || 'Workflow'} ${index + 1}`),
+      }, prior));
+      if (workflows.length === 0) throw new Error('Automation requires at least one workflow.');
+      assertWorkflowIdsWritable(db, workflows, new Set(existingWorkflows.map((workflow) => workflow.id)));
+      workflowsToUpsert = workflows;
+    } else {
+      // Legacy single-workflow updates apply to the primary workflow only.
+      const primary = normalizeWorkflowRecord({
+        ...existing.workflow,
+        ...(isObject(updates.workflow) ? updates.workflow : {}),
+        ...(updates.workflowText !== undefined ? { workflowText: updates.workflowText } : {}),
+        ...(updates.workflow !== undefined && typeof updates.workflow === 'string' ? { workflowText: updates.workflow } : {}),
+        ...(updates.workflowName !== undefined ? { name: updates.workflowName } : {}),
+        ...(updates.allowlist !== undefined ? { allowlist: updates.allowlist } : {}),
+        ...(updates.limits !== undefined ? { limits: updates.limits } : {}),
+      }, existing.workflow);
+      workflows = [primary, ...existingWorkflows.slice(1)];
+      workflowsToUpsert = [primary];
+    }
+    const compileErrors = workflows.flatMap((workflow) => workflow.compilerErrors || []);
+    if (compileErrors.length > 0) throw new Error(compileErrors.join('\n'));
 
     const base = normalizeAutomationRecord({
       ...existing,
       ...updates,
       id: existing.id,
-    }, workflow, existing);
-    base.workflow = workflow;
-    upsertWorkflowRow(db, workflow);
+    }, workflows[0], existing);
+    base.workflow = workflows[0];
+    for (const workflow of workflowsToUpsert) upsertWorkflowRow(db, workflow);
     upsertAutomationRow(db, base);
+    replaceWorkflowLinks(db, base.id, workflows.map((workflow) => workflow.id));
+    const keepWorkflowIds = new Set(workflows.map((workflow) => workflow.id));
+    deleteOrphanedWorkflowRows(
+      db,
+      existingWorkflows.map((workflow) => workflow.id).filter((id) => !keepWorkflowIds.has(id)),
+    );
 
     let triggers = existing.triggers;
     if (Array.isArray(updates.triggers)) {
-      db.prepare('DELETE FROM automation_triggers WHERE automation_id = ?').run(existing.id);
-      triggers = updates.triggers.map((triggerInput) => normalizeTriggerRecord(triggerInput, base));
+      const matched = matchTriggersToExisting(updates.triggers, existing.triggers);
+      triggers = matched.map(({ input, existing: prior }) => normalizeTriggerRecord(input, base, prior));
+      const keepIds = new Set(triggers.map((trigger) => trigger.id));
+      for (const prior of existing.triggers) {
+        if (!keepIds.has(prior.id)) {
+          db.prepare('DELETE FROM automation_triggers WHERE id = ?').run(prior.id);
+        }
+      }
       for (const trigger of triggers) upsertTriggerRow(db, trigger);
     } else if (isObject(updates.trigger) || updates.trigger_id || updates.triggerId) {
       const triggerId = updates.trigger_id || updates.triggerId || updates.trigger?.id;
@@ -676,7 +933,7 @@ function updateAutomation(automationId, updates = {}, options = {}) {
       });
     }
 
-    saved = composeAutomation(base, triggers, workflow);
+    saved = composeAutomation(base, triggers, workflows);
   })();
 
   publishResources(options.source || 'automations:update');
@@ -734,14 +991,10 @@ function deleteAutomation(automationId, options = {}) {
   if (!existing) throw new Error(`Automation not found: ${automationId}`);
   const db = openLocalDb();
   db.transaction(() => {
+    // Deleting the definition cascades this automation's workflow links;
+    // workflow rows are then removed only if nothing else references them.
     db.prepare('DELETE FROM automation_definitions WHERE id = ?').run(existing.id);
-    db.prepare(`
-      DELETE FROM automation_workflows
-      WHERE id = ?
-        AND NOT EXISTS (
-          SELECT 1 FROM automation_definitions WHERE workflow_id = automation_workflows.id
-        )
-    `).run(existing.workflowId);
+    deleteOrphanedWorkflowRows(db, existing.workflowIds || [existing.workflowId]);
   })();
   publishResources(options.source || 'automations:delete');
   return existing;
@@ -802,12 +1055,20 @@ function claimDueScheduledTriggers(now = new Date(), options = {}) {
     FROM automation_triggers
     INNER JOIN automation_definitions
       ON automation_definitions.id = automation_triggers.automation_id
-    INNER JOIN automation_workflows
-      ON automation_workflows.id = automation_definitions.workflow_id
     WHERE automation_triggers.kind = 'scheduled'
       AND automation_triggers.enabled = 1
       AND automation_definitions.enabled = 1
-      AND automation_workflows.enabled = 1
+      AND EXISTS (
+        SELECT 1 FROM automation_workflows
+        WHERE automation_workflows.enabled = 1
+          AND (
+            automation_workflows.id = automation_definitions.workflow_id
+            OR automation_workflows.id IN (
+              SELECT workflow_id FROM automation_workflow_links
+              WHERE automation_workflow_links.automation_id = automation_definitions.id
+            )
+          )
+      )
       AND automation_triggers.next_run_at IS NOT NULL
       AND automation_triggers.next_run_at <= ?
     ORDER BY datetime(automation_triggers.next_run_at) ASC
@@ -826,13 +1087,15 @@ function claimDueScheduledTriggers(now = new Date(), options = {}) {
         updatedAt: timestamp,
       };
       if (fired.schedule?.kind === 'once') fired.enabled = false;
-      fired.nextRunAt = fired.enabled === false ? null : computeNextRunAt(fired, nowDate);
+      fired.nextRunAt = fired.enabled === false
+        ? null
+        : computeNextRunAt(fired, nowDate, { anchor: row.next_run_at });
       upsertTriggerRow(db, fired);
       claims.push({
         automation: composeAutomation(
           automation,
           automation.triggers.map((item) => (item.id === fired.id ? fired : item)),
-          automation.workflow,
+          automation.workflows,
         ),
         trigger: fired,
         scheduledFor: row.next_run_at,
@@ -844,6 +1107,60 @@ function claimDueScheduledTriggers(now = new Date(), options = {}) {
   return claims;
 }
 
+/**
+ * Re-arm enabled scheduled triggers whose next_run_at is NULL. Re-arming
+ * normally only happens as a side effect of a successful claim, so any path
+ * that nulls next_run_at (historical cron parse failure, explicit
+ * nextRunAt:null, partial writes) leaves the trigger permanently dormant —
+ * the claim query filters `next_run_at IS NOT NULL`. Run this on scheduler
+ * boot so dormant triggers come back without a manual enable-toggle.
+ */
+function repairScheduledTriggers(options = {}) {
+  ensureAutomationsStore();
+  const db = openLocalDb();
+  const rows = db.prepare(`
+    SELECT automation_triggers.*
+    FROM automation_triggers
+    INNER JOIN automation_definitions
+      ON automation_definitions.id = automation_triggers.automation_id
+    WHERE automation_triggers.kind = 'scheduled'
+      AND automation_triggers.enabled = 1
+      AND automation_definitions.enabled = 1
+      AND automation_triggers.next_run_at IS NULL
+  `).all();
+
+  const repaired = [];
+  for (const row of rows) {
+    const trigger = rowToTrigger(row);
+    const nextRunAt = computeNextRunAt(trigger, new Date());
+    if (!nextRunAt) continue; // e.g. once-schedules that already fired
+    repaired.push({ ...trigger, nextRunAt, updatedAt: nowIso() });
+  }
+  if (repaired.length > 0) {
+    db.transaction(() => {
+      for (const trigger of repaired) upsertTriggerRow(db, trigger);
+    })();
+    publishResources(options.source || 'automations:repair');
+  }
+  return repaired;
+}
+
+function recordSchedulerHeartbeat(timestamp = nowIso()) {
+  try {
+    setMetaValue(openLocalDb(), 'automation_scheduler_heartbeat', timestamp);
+  } catch {
+    // Heartbeat is diagnostics only; never let it break the poll.
+  }
+}
+
+function getSchedulerHeartbeat() {
+  try {
+    return metaValue(openLocalDb(), 'automation_scheduler_heartbeat');
+  } catch {
+    return null;
+  }
+}
+
 function rowToAutomationRun(row) {
   if (!row) return null;
   const parsed = parseJson(row.run_json, {});
@@ -936,6 +1253,17 @@ function recordAutomationRun(automationId, entry, options = {}) {
     const timestamp = nowIso();
     const events = Array.isArray(existing?.events) ? existing.events.slice(-99) : [];
     events.push({ ...entry, recordedAt: timestamp });
+    // Terminal statuses are final: a late or out-of-order cell event must not
+    // resurrect a finished/interrupted run back to "running". One exception:
+    // 'interrupted' is reaper-written and can race a legitimately long run in
+    // flight — a real in-process terminal outcome wins over it.
+    const existingTerminal = !!existing
+      && (existing.finishedAt || TERMINAL_RUN_STATUSES.has(existing.status));
+    const overridesInterrupted = !!existing
+      && existing.status === 'interrupted'
+      && TERMINAL_RUN_STATUSES.has(entry.status)
+      && entry.status !== 'interrupted';
+    const frozen = existingTerminal && !overridesInterrupted;
     run = {
       ...(existing || {}),
       id: runId,
@@ -945,11 +1273,14 @@ function recordAutomationRun(automationId, entry, options = {}) {
       automationName: entry.automationName ?? existing?.automationName ?? null,
       triggerName: entry.triggerName ?? existing?.triggerName ?? null,
       workflowName: entry.workflowName ?? existing?.workflowName ?? null,
-      status: entry.status || existing?.status || 'running',
+      status: frozen ? existing.status : (entry.status || existing?.status || 'running'),
       startedAt: entry.startedAt || existing?.startedAt || timestamp,
-      finishedAt: entry.finishedAt || existing?.finishedAt || null,
+      finishedAt: frozen
+        ? existing.finishedAt
+        : (entry.finishedAt || (overridesInterrupted ? null : existing?.finishedAt) || null),
       projectPath: entry.projectPath ?? existing?.projectPath ?? null,
-      error: entry.error || existing?.error || null,
+      // Overriding a reaper-written 'interrupted' must also clear its error.
+      error: entry.error || (overridesInterrupted ? null : existing?.error) || null,
       output: entry.output !== undefined ? entry.output : existing?.output,
       events,
       createdAt: existing?.createdAt || timestamp,
@@ -971,22 +1302,126 @@ function recordAutomationRun(automationId, entry, options = {}) {
 function listAutomationRuns(options = {}) {
   ensureAutomationsStore();
   const limit = Math.max(1, Math.min(Number(options.limit) || DEFAULT_RUN_LIMIT, 1000));
+  const offset = Math.max(0, Number(options.offset) || 0);
   const db = openLocalDb();
   const rows = options.automationId
     ? db.prepare(`
         SELECT * FROM automation_runs
         WHERE automation_id = ?
         ORDER BY datetime(updated_at) DESC
-        LIMIT ?
-      `).all(options.automationId, limit)
+        LIMIT ? OFFSET ?
+      `).all(options.automationId, limit, offset)
     : db.prepare(`
         SELECT * FROM automation_runs
         ORDER BY datetime(updated_at) DESC
-        LIMIT ?
-      `).all(limit);
+        LIMIT ? OFFSET ?
+      `).all(limit, offset);
   return rows.map(rowToAutomationRun).filter(Boolean);
 }
 
+function getAutomationRun(runId) {
+  const id = cleanString(runId);
+  if (!id) return null;
+  ensureAutomationsStore();
+  const row = openLocalDb().prepare('SELECT * FROM automation_runs WHERE id = ?').get(id);
+  return rowToAutomationRun(row);
+}
+
+/**
+ * Liveness heartbeat for an in-flight run. The runner only writes at cell
+ * boundaries, so a single cell longer than the stale threshold would look
+ * orphaned to the reaper — touching updated_at while a cell executes keeps
+ * legitimate long runs out of the reaper's reach. No event is published;
+ * this is reaper bookkeeping, not UI state.
+ */
+function touchAutomationRun(runId) {
+  const id = cleanString(runId);
+  if (!id) return;
+  try {
+    openLocalDb().prepare(`
+      UPDATE automation_runs SET updated_at = ? WHERE id = ? AND status = 'running'
+    `).run(nowIso(), id);
+  } catch {
+    // Never let a heartbeat break a run.
+  }
+}
+
+/**
+ * Mark "running" runs that have made no progress for staleAfterMs as
+ * interrupted. Runs execute in-process and every cell boundary touches
+ * updated_at, so a stale running row means the runtime died mid-run or a
+ * cell hung past its timeout. Without this, run history shows phantom
+ * in-progress runs forever.
+ */
+function expireStaleAutomationRuns(options = {}) {
+  ensureAutomationsStore();
+  const staleAfterMs = Math.max(60_000, Number(options.staleAfterMs) || DEFAULT_STALE_RUN_MS);
+  const db = openLocalDb();
+  const cutoff = new Date(Date.now() - staleAfterMs).toISOString();
+  const rows = db.prepare(`
+    SELECT * FROM automation_runs
+    WHERE status = 'running' AND updated_at <= ?
+  `).all(cutoff);
+
+  const expired = [];
+  for (const row of rows) {
+    const run = rowToAutomationRun(row);
+    if (!run) continue;
+    const timestamp = nowIso();
+    const error = `Run interrupted: no progress since ${row.updated_at} (runtime restart or hung cell).`;
+    const cellRows = db.prepare(`
+      SELECT * FROM workflow_cell_runs WHERE run_id = ? AND status = 'running'
+    `).all(run.id);
+    for (const cellRow of cellRows) {
+      recordWorkflowCellRun(run, {
+        name: cellRow.cell_name,
+        kind: cellRow.cell_kind,
+        status: 'interrupted',
+        startedAt: cellRow.started_at,
+        finishedAt: timestamp,
+        error,
+      }, { source: 'workflow_cell_runs:interrupted' });
+    }
+    const updated = recordAutomationRun(run.automationId, {
+      runId: run.id,
+      status: 'interrupted',
+      finishedAt: timestamp,
+      error,
+    }, { source: 'automation_runs:interrupted' });
+    if (updated) expired.push(updated);
+  }
+  return expired;
+}
+
+/**
+ * Keep run history bounded: retain the most recent N runs per automation
+ * (never deleting in-flight runs). workflow_cell_runs rows follow via the
+ * run_id ON DELETE CASCADE foreign key.
+ */
+function pruneAutomationRuns(options = {}) {
+  ensureAutomationsStore();
+  const keep = Math.max(1, Number(options.keepPerAutomation) || DEFAULT_RUN_RETENTION);
+  const db = openLocalDb();
+  const automationIds = db.prepare('SELECT DISTINCT automation_id FROM automation_runs').all()
+    .map((row) => row.automation_id);
+  let pruned = 0;
+  for (const automationId of automationIds) {
+    const result = db.prepare(`
+      DELETE FROM automation_runs
+      WHERE automation_id = ?
+        AND status != 'running'
+        AND id IN (
+          SELECT id FROM automation_runs
+          WHERE automation_id = ?
+          ORDER BY datetime(updated_at) DESC
+          LIMIT -1 OFFSET ?
+        )
+    `).run(automationId, automationId, keep);
+    pruned += result.changes;
+  }
+  return pruned;
+}
+
 function recordWorkflowCellRun(run, cell, options = {}) {
   if (!run?.id || !cell?.name) return null;
   ensureAutomationsStore();
@@ -1108,8 +1543,11 @@ module.exports = {
   deleteAutomationByTriggerId,
   ensureAutomationsStore,
   eventRefForTrigger,
+  expireStaleAutomationRuns,
   getAutomation,
   getAutomationByTriggerId,
+  getAutomationRun,
+  getSchedulerHeartbeat,
   listAutomationRuns,
   listAutomations,
   listEventTriggersForIngress,
@@ -1118,9 +1556,13 @@ module.exports = {
   listWorkflows,
   markTriggerFired,
   normalizeWorkflowRecord,
+  pruneAutomationRuns,
   publishResources,
   recordAutomationRun,
+  recordSchedulerHeartbeat,
   recordWorkflowCellRun,
+  repairScheduledTriggers,
+  touchAutomationRun,
   updateAutomation,
   updateAutomationByTriggerId,
 };