cascade-ai 0.15.2 → 0.17.0

package/dist/desktop-core.cjs

@@ -222595,7 +222595,7 @@ Anthropic.Models = Models2;
 Anthropic.Beta = Beta;
 
 // src/constants.ts
-var CASCADE_VERSION = "0.15.2";
+var CASCADE_VERSION = "0.17.0";
 var CASCADE_CONFIG_DIR = ".cascade";
 var CASCADE_MD_FILE = "CASCADE.md";
 var CASCADE_IGNORE_FILE = ".cascadeignore";
@@ -253816,6 +253816,10 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
     const worker = new T3Worker(this.router, this.toolRegistry, this.id);
     if (this.store) worker.setStore(this.store, taskId);
     worker.setPeerBus(this.t3PeerBus);
+    if (this.permissionEscalator) worker.setPermissionEscalator(this.permissionEscalator);
+    if (this.toolCreator) worker.setToolCreator(this.toolCreator);
+    worker.on("log", (e3) => this.emit("log", e3));
+    worker.on("tier:status", (e3) => this.emit("tier:status", e3));
     worker.on("stream:token", (e3) => this.emit("stream:token", e3));
     worker.on("tool:approval-request", (e3) => this.emit("tool:approval-request", {
       ...e3,
@@ -254164,12 +254168,14 @@ Board guidance (must be followed in the plan): ${decision.note}`,
         status: "IN_PROGRESS"
       });
       const okBefore = okCount(allT2Results);
+      const completedSummary = this.summarizeCompletedSections(allT2Results);
+      const correctionContext = [systemContext, completedSummary].filter(Boolean).join("\n\n") || void 0;
       const correctionPlan = await this.decomposeTask(`The previous execution plan failed to fully satisfy the original goal or encountered errors.
 Review reason: ${reviewResult.reason}
 
 Original goal: ${enrichedPrompt}
 
-Create a CORRECTION PLAN that contains only the new sections needed to fix the issues. Do not repeat successful sections.`);
+Create a CORRECTION PLAN that contains only the new sections needed to fix the issues. Do not repeat successful sections.`, correctionContext);
       const correctionResults = await this.dispatchT2Managers(correctionPlan.sections);
       allT2Results = [...allT2Results, ...correctionResults];
       if (okCount(allT2Results) <= okBefore) {
@@ -254272,6 +254278,15 @@ In 3-5 terse bullets, flag the most important RISKS, GAPS, or over-/under-decomp
       return null;
     }
   }
+  /** Structured, grounded summary of what's already done — used to keep
+   * corrective replan passes from re-emitting completed sections. */
+  summarizeCompletedSections(results) {
+    const done = results.filter((r4) => r4.status === "COMPLETED" || r4.status === "PARTIAL");
+    if (done.length === 0) return "";
+    const lines = done.map((r4) => `- "${r4.sectionTitle}" [${r4.status}]: ${(r4.sectionSummary || "(no summary)").slice(0, 300)}`);
+    return `ALREADY COMPLETED SECTIONS (do not redo these \u2014 plan only what's still missing):
+${lines.join("\n")}`;
+  }
   async decomposeTask(prompt, systemContext) {
     const db = this.router.getWorldStateDB?.();
     let worldStateContext = "";
@@ -254539,7 +254554,7 @@ Leave dependsOn empty for sections that can run immediately in parallel.`;
         }
       }
       if (readyIds.length === 0) return;
-      await Promise.all(readyIds.map(async (id) => {
+      const runOne = async (id) => {
         resultMap.set(id, null);
         const index = sections.findIndex((s3) => s3.sectionId === id);
         const section = sections[index];
@@ -254579,7 +254594,14 @@ Leave dependsOn empty for sections that can run immediately in parallel.`;
         for (const dependentId of adj.get(id) ?? /* @__PURE__ */ new Set()) {
           inDegree.set(dependentId, Math.max(0, (inDegree.get(dependentId) ?? 1) - 1));
         }
-      }));
+      };
+      if (this.router.getT3ExecutionMode?.() === "sequential") {
+        for (const id of readyIds) {
+          await runOne(id);
+        }
+      } else {
+        await Promise.all(readyIds.map(runOne));
+      }
       if (Array.from(inDegree.values()).some((deg) => deg === 0) && resultMap.size < totalSections) {
         await executeWave();
       }
@@ -294549,6 +294571,13 @@ var PermissionEscalator = class extends EventEmitter__default.default {
    * All T3 workers under the same T2 share cached decisions for the same tool.
    */
   sessionCache = /* @__PURE__ */ new Map();
+  /**
+   * Task-wide cache keyed by `toolName` alone, for USER- and T1-level
+   * "always" decisions — these are meant to cover every sibling T2/T3 in the
+   * run, not just the one that happened to ask first (see PermissionDecision
+   * doc comment: "task-wide for T1").
+   */
+  taskWideCache = /* @__PURE__ */ new Map();
   t2Evaluator;
   t1Evaluator;
   /** Pending user-decision resolvers keyed by request ID */
@@ -294577,6 +294606,15 @@ var PermissionEscalator = class extends EventEmitter__default.default {
    * Returns a PermissionDecision from whichever tier was able to decide.
    */
   async requestPermission(req) {
+    if (!req.forceReprompt && this.taskWideCache.has(req.toolName)) {
+      return {
+        requestId: req.id,
+        approved: this.taskWideCache.get(req.toolName),
+        always: true,
+        decidedBy: "T1",
+        reasoning: "Cached from a previous task-wide decision in this session"
+      };
+    }
     const cacheKey = `${req.parentT2Id}:${req.toolName}`;
     if (!req.forceReprompt && this.sessionCache.has(cacheKey)) {
       return {
@@ -294621,7 +294659,7 @@ var PermissionEscalator = class extends EventEmitter__default.default {
       try {
         const t1Decision = await this.t1Evaluator(req);
         if (t1Decision !== null) {
-          if (t1Decision.always) this.sessionCache.set(cacheKey, t1Decision.approved);
+          if (t1Decision.always) this.taskWideCache.set(req.toolName, t1Decision.approved);
           return t1Decision;
         }
       } catch {
@@ -294651,7 +294689,7 @@ var PermissionEscalator = class extends EventEmitter__default.default {
       const wrappedResolver = (decision) => {
         if (timer) clearTimeout(timer);
         if (decision.always) {
-          this.sessionCache.set(`${req.parentT2Id}:${req.toolName}`, decision.approved);
+          this.taskWideCache.set(req.toolName, decision.approved);
         }
         resolve(decision);
       };
@@ -299132,6 +299170,25 @@ var DashboardSocket = class {
       });
     });
   }
+  /**
+   * Boardroom plan decisions from a connected client. The desktop shows a
+   * plan-review modal on `plan:approval-required` and answers here; the
+   * server routes the decision into the paused run via resolvePlanApproval.
+   */
+  onPlanDecision(callback) {
+    this.io.on("connection", (socket) => {
+      socket.on("plan:decision", (payload) => {
+        if (typeof payload?.sessionId === "string" && typeof payload?.approved === "boolean") {
+          callback({
+            sessionId: payload.sessionId,
+            approved: payload.approved,
+            note: typeof payload.note === "string" && payload.note.trim() ? payload.note.trim() : void 0,
+            editedPlan: payload.editedPlan
+          });
+        }
+      });
+    });
+  }
   onSessionSteer(callback) {
     this.io.on("connection", (socket) => {
       socket.on("session:steer", (payload) => {
@@ -299173,6 +299230,125 @@ var DashboardSocket = class {
     this.io.close();
   }
 };
+
+// src/scheduler/index.ts
+var import_node_cron = __toESM(require_node_cron(), 1);
+var TaskScheduler = class {
+  cronJobs = /* @__PURE__ */ new Map();
+  store;
+  runner;
+  constructor(store, runner) {
+    this.store = store;
+    this.runner = runner;
+  }
+  start() {
+    const tasks = this.store.listScheduledTasks();
+    for (const task of tasks) {
+      if (task.enabled) this.schedule(task);
+    }
+  }
+  stop() {
+    for (const job of this.cronJobs.values()) job.stop();
+    this.cronJobs.clear();
+  }
+  schedule(task) {
+    if (!import_node_cron.default.validate(task.cronExpression)) {
+      throw new Error(`Invalid cron expression: ${task.cronExpression}`);
+    }
+    const existing = this.cronJobs.get(task.id);
+    if (existing) {
+      try {
+        existing.stop();
+      } catch {
+      }
+    }
+    const job = import_node_cron.default.schedule(task.cronExpression, async () => {
+      try {
+        task.lastRun = (/* @__PURE__ */ new Date()).toISOString();
+        this.store.saveScheduledTask(task);
+        await this.runner(task);
+      } catch (err) {
+        console.error(`[scheduler] Task "${task.id}" (${task.cronExpression}) failed:`, err);
+      }
+    }, { timezone: "UTC" });
+    this.cronJobs.set(task.id, job);
+  }
+  unschedule(taskId) {
+    this.cronJobs.get(taskId)?.stop();
+    this.cronJobs.delete(taskId);
+  }
+  add(task) {
+    this.store.saveScheduledTask(task);
+    if (task.enabled) this.schedule(task);
+  }
+  remove(taskId) {
+    this.unschedule(taskId);
+    this.store.deleteScheduledTask(taskId);
+  }
+  list() {
+    return this.store.listScheduledTasks();
+  }
+  isRunning(taskId) {
+    return this.cronJobs.has(taskId);
+  }
+  static validateCron(expression) {
+    return import_node_cron.default.validate(expression);
+  }
+};
+
+// src/dashboard/cost-stats.ts
+var DAY_MS = 24 * 60 * 60 * 1e3;
+function utcDateKey(d2) {
+  return d2.toISOString().slice(0, 10);
+}
+function aggregateCostStats(sessions, opts = {}) {
+  const days = Math.max(1, opts.days ?? 30);
+  const topN = Math.max(1, opts.topN ?? 8);
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const buckets = /* @__PURE__ */ new Map();
+  for (let i4 = days - 1; i4 >= 0; i4--) {
+    const key = utcDateKey(new Date(now.getTime() - i4 * DAY_MS));
+    buckets.set(key, { date: key, costUsd: 0, tokens: 0, runs: 0 });
+  }
+  let totalCostUsd = 0;
+  let totalTokens = 0;
+  let totalRuns = 0;
+  for (const s3 of sessions) {
+    const cost = s3.metadata?.totalCostUsd ?? 0;
+    const tokens = s3.metadata?.totalTokens ?? 0;
+    const runs = s3.metadata?.taskCount ?? 0;
+    totalCostUsd += cost;
+    totalTokens += tokens;
+    totalRuns += runs;
+    const when = new Date(s3.updatedAt || s3.createdAt);
+    if (!Number.isNaN(when.getTime())) {
+      const bucket = buckets.get(utcDateKey(when));
+      if (bucket) {
+        bucket.costUsd += cost;
+        bucket.tokens += tokens;
+        bucket.runs += runs;
+      }
+    }
+  }
+  const topSessions = [...sessions].filter((s3) => (s3.metadata?.totalCostUsd ?? 0) > 0).sort((a2, b3) => (b3.metadata?.totalCostUsd ?? 0) - (a2.metadata?.totalCostUsd ?? 0)).slice(0, topN).map((s3) => ({
+    sessionId: s3.id,
+    title: s3.title,
+    costUsd: s3.metadata?.totalCostUsd ?? 0,
+    tokens: s3.metadata?.totalTokens ?? 0,
+    runs: s3.metadata?.taskCount ?? 0,
+    updatedAt: s3.updatedAt
+  }));
+  return {
+    totalCostUsd,
+    totalTokens,
+    totalSessions: sessions.length,
+    totalRuns,
+    perDay: [...buckets.values()],
+    topSessions
+  };
+}
+
+// src/dashboard/server.ts
 var __dirname2 = path22__namespace.default.dirname(Url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('desktop-core.cjs', document.baseURI).href))));
 var DashboardServer = class {
   app;
@@ -299198,6 +299374,14 @@ var DashboardServer = class {
    * map is how that answer reaches the run that's blocked on it.
    */
   pendingApprovals = /* @__PURE__ */ new Map();
+  /**
+   * The orchestration decision trail ("why") of each session's most recent
+   * run — captured when the run ends so the desktop's Why panel can show it
+   * after the fact. Bounded: oldest entry evicted past 50 sessions.
+   */
+  whyBySession = /* @__PURE__ */ new Map();
+  /** Cron scheduler for the Schedules UI — runs tasks while this server is up. */
+  scheduler;
   port;
   host;
   workspacePath;
@@ -299215,6 +299399,7 @@ var DashboardServer = class {
       secret: this.dashboardSecret,
       corsOrigin: config2.dashboard.auth ? [`http://localhost:${this.port}`, `http://127.0.0.1:${this.port}`] : "*"
     });
+    this.scheduler = new TaskScheduler(store, (task) => this.runScheduledTask(task));
     this.setupMiddleware();
     this.setupRoutes();
     this.socket.onSessionRate((sessionId, rating) => {
@@ -299278,6 +299463,9 @@ var DashboardServer = class {
       cascade.on("peer:message", (e3) => {
         this.socket.emitPeerMessage(e3);
       });
+      cascade.on("plan:approval-required", (e3) => {
+        this.socket.emitToSocket(socketId, "plan:approval-required", { sessionId, ...e3 });
+      });
       try {
         const result = await cascade.run({
           prompt: runPrompt,
@@ -299285,7 +299473,8 @@ var DashboardServer = class {
           approvalCallback: this.makeApprovalCallback(sessionId)
         });
         this.recordSessionTask(sessionId, result.taskId);
-        this.persistRunEnd(sessionId, title, prompt, result.output, "COMPLETED");
+        this.persistRunEnd(sessionId, title, prompt, result.output, "COMPLETED", result);
+        this.captureWhy(sessionId, cascade, result);
         this.socket.emitToSocket(socketId, "session:complete", { sessionId, result });
         this.socket.broadcast("cost:update", {
           sessionId,
@@ -299295,6 +299484,7 @@ var DashboardServer = class {
         this.throttledBroadcast("workspace");
       } catch (err) {
         this.persistRunEnd(sessionId, title, prompt, void 0, "FAILED");
+        this.captureWhy(sessionId, cascade);
         this.socket.emitToSocket(socketId, "session:error", {
           sessionId,
           error: err instanceof Error ? err.message : String(err)
@@ -299305,9 +299495,17 @@ var DashboardServer = class {
         this.denyPendingApprovals(sessionId);
       }
     });
+    this.socket.onPlanDecision(({ sessionId, approved, note, editedPlan }) => {
+      this.activeSessions.get(sessionId)?.resolvePlanApproval(
+        approved,
+        note,
+        editedPlan
+      );
+    });
     this.socket.onSessionHalt((sessionId) => {
       this.activeControllers.get(sessionId)?.abort();
       this.denyPendingApprovals(sessionId);
+      this.activeSessions.get(sessionId)?.resolvePlanApproval(false);
     });
     this.socket.onApprovalResponse(({ requestId, approved, always }) => {
       const pending = this.pendingApprovals.get(requestId);
@@ -299340,12 +299538,21 @@ var DashboardServer = class {
         resolve();
       });
     });
+    try {
+      this.scheduler.start();
+    } catch (err) {
+      console.warn("[dashboard] failed to start task scheduler:", err);
+    }
   }
   async stop() {
     if (this.broadcastTimer) {
       clearTimeout(this.broadcastTimer);
       this.broadcastTimer = null;
     }
+    try {
+      this.scheduler.stop();
+    } catch {
+    }
     this.socket.close();
     try {
       this.globalStore?.close();
@@ -299359,6 +299566,16 @@ var DashboardServer = class {
   getSocket() {
     return this.socket;
   }
+  /**
+   * Rebind the workspace tasks execute in — e.g. the desktop app's Code view
+   * opening a different project folder — without tearing down the socket
+   * server (which would drop the port/auth token/connection mid-session).
+   * The next `cascade:run` picks this up immediately since `this.workspacePath`
+   * is read live per-run (see onCascadeRun below).
+   */
+  setWorkspacePath(workspacePath) {
+    this.workspacePath = workspacePath;
+  }
   /**
    * Write the in-memory config back to the workspace config file so mutations
    * made over the socket (Settings → Save) persist across restarts. Best-effort:
@@ -299456,16 +299673,60 @@ var DashboardServer = class {
     return title;
   }
   /** Record run end: the assistant reply (when there is one) and the runtime row's final status. */
-  persistRunEnd(sessionId, title, latestPrompt, reply, status) {
+  persistRunEnd(sessionId, title, latestPrompt, reply, status, result) {
     try {
       if (reply && reply.trim()) {
         this.store.addMessage({ id: crypto4.randomUUID(), sessionId, role: "assistant", content: reply, timestamp: (/* @__PURE__ */ new Date()).toISOString() });
       }
+      if (result) {
+        const session = this.store.getSession(sessionId);
+        if (session) {
+          this.store.updateSession(sessionId, {
+            updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            metadata: {
+              ...session.metadata,
+              totalTokens: session.metadata.totalTokens + result.usage.totalTokens,
+              totalCostUsd: session.metadata.totalCostUsd + result.usage.estimatedCostUsd,
+              taskCount: session.metadata.taskCount + 1
+            }
+          });
+        }
+      }
     } catch (err) {
       console.warn("[dashboard] failed to persist run end:", err);
     }
     this.persistRuntimeRow(sessionId, title, status, latestPrompt);
   }
+  /**
+   * Capture the run's decision trail + router economics ("why") and broadcast
+   * it so the desktop's Why panel updates live; kept per-session for the
+   * GET /api/sessions/:id/why fallback (panel opened after the run).
+   */
+  captureWhy(sessionId, cascade, result) {
+    try {
+      const stats = cascade.getRouter().getStats();
+      const savings = cascade.getRouter().getDelegationSavings();
+      const report = {
+        sessionId,
+        capturedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        decisions: cascade.getDecisionLog(),
+        savedUsd: savings.savedUsd,
+        savedPct: savings.savedPct,
+        totalCostUsd: stats.totalCostUsd,
+        totalTokens: stats.totalTokens,
+        costByTier: stats.costByTier,
+        durationMs: result?.durationMs
+      };
+      this.whyBySession.set(sessionId, report);
+      if (this.whyBySession.size > 50) {
+        const oldest = this.whyBySession.keys().next().value;
+        if (oldest) this.whyBySession.delete(oldest);
+      }
+      this.socket.broadcast("run:why", report);
+    } catch (err) {
+      console.warn("[dashboard] failed to capture decision trail:", err);
+    }
+  }
   /**
    * Route steering text into running Cascade instances. Targets the given
    * session, or every active session when none is specified (the desktop
@@ -299495,6 +299756,52 @@ var DashboardServer = class {
       this.pendingApprovals.set(request.id, { resolve, sessionId });
     });
   }
+  /**
+   * Execute one scheduled task firing. Runs headless (like `cascade run -p`):
+   * tool approvals are auto-granted since nobody may be watching when the cron
+   * fires — the Schedules UI states this. Events broadcast to every connected
+   * client so an open desktop sees the run appear live.
+   */
+  async runScheduledTask(task) {
+    const sessionId = crypto4.randomUUID();
+    const prompt = task.prompt;
+    const title = this.persistRunStart(sessionId, `[${task.name}] ${prompt}`);
+    const cascade = new Cascade(this.config, task.workspacePath ?? this.workspacePath, this.store);
+    this.activeSessions.set(sessionId, cascade);
+    cascade.on("tier:status", (e3) => {
+      this.socket.broadcast("tier:status", { sessionId, ...e3 });
+    });
+    cascade.on("peer:message", (e3) => {
+      this.socket.emitPeerMessage(e3);
+    });
+    try {
+      const result = await cascade.run({
+        prompt,
+        identityId: task.identityId,
+        approvalCallback: async () => ({ approved: true, always: false })
+      });
+      this.recordSessionTask(sessionId, result.taskId);
+      this.persistRunEnd(sessionId, title, prompt, result.output, "COMPLETED", result);
+      this.captureWhy(sessionId, cascade, result);
+      this.socket.broadcast("session:complete", { sessionId, result });
+      this.socket.broadcast("cost:update", {
+        sessionId,
+        totalTokens: result.usage.totalTokens,
+        totalCostUsd: result.usage.estimatedCostUsd
+      });
+      this.throttledBroadcast("workspace");
+    } catch (err) {
+      this.persistRunEnd(sessionId, title, prompt, void 0, "FAILED");
+      this.captureWhy(sessionId, cascade);
+      this.socket.broadcast("session:error", {
+        sessionId,
+        error: err instanceof Error ? err.message : String(err)
+      });
+      throw err;
+    } finally {
+      this.activeSessions.delete(sessionId);
+    }
+  }
   /** Deny + clear any approvals still pending for a session (run end / abort). */
   denyPendingApprovals(sessionId) {
     for (const [id, pending] of this.pendingApprovals) {
@@ -300007,6 +300314,9 @@ ${prompt}`;
         cascade.on("peer:message", (e3) => {
           this.socket.emitPeerMessage(e3);
         });
+        cascade.on("plan:approval-required", (e3) => {
+          this.socket.broadcastToRoom(`session:${sessionId}`, "plan:approval-required", { sessionId, ...e3 });
+        });
         try {
           const result = await cascade.run({
             prompt: runPrompt,
@@ -300014,7 +300324,8 @@ ${prompt}`;
             approvalCallback: this.makeApprovalCallback(sessionId)
           });
           this.recordSessionTask(sessionId, result.taskId);
-          this.persistRunEnd(sessionId, title, prompt, result.output, "COMPLETED");
+          this.persistRunEnd(sessionId, title, prompt, result.output, "COMPLETED", result);
+          this.captureWhy(sessionId, cascade, result);
           this.socket.broadcast("cost:update", {
             sessionId,
             totalTokens: result.usage.totalTokens,
@@ -300024,6 +300335,7 @@ ${prompt}`;
           this.throttledBroadcast("workspace");
         } catch (err) {
           this.persistRunEnd(sessionId, title, prompt, void 0, "FAILED");
+          this.captureWhy(sessionId, cascade);
           this.socket.broadcastToRoom(`session:${sessionId}`, "session:error", {
             sessionId,
             error: err instanceof Error ? err.message : String(err)
@@ -300045,6 +300357,168 @@ ${prompt}`;
         }))
       });
     });
+    this.app.get("/api/sessions/:id/why", auth, (req, res) => {
+      const report = this.whyBySession.get(req.params.id);
+      if (!report) {
+        res.status(404).json({ error: "No decision trail recorded for this session in the current app run." });
+        return;
+      }
+      res.json(report);
+    });
+    this.app.get("/api/sessions/:id/changes", auth, async (req, res) => {
+      const sessionId = req.params.id;
+      const taskIds = this.sessionTaskIds.get(sessionId) ?? [];
+      const before = /* @__PURE__ */ new Map();
+      for (const taskId of taskIds) {
+        for (const { filePath, content } of this.store.getLatestFileSnapshots(taskId)) {
+          if (!before.has(filePath)) before.set(filePath, content);
+        }
+      }
+      const { readFile } = await import('fs/promises');
+      const MAX_DIFF_BYTES = 2 * 1024 * 1024;
+      const changes = await Promise.all([...before.entries()].map(async ([filePath, beforeContent]) => {
+        let after = "";
+        let missing = false;
+        try {
+          const buf = await readFile(filePath);
+          after = buf.length > MAX_DIFF_BYTES ? `[file too large to diff \u2014 ${buf.length} bytes]` : buf.toString("utf-8");
+        } catch {
+          missing = true;
+        }
+        return { filePath, before: beforeContent, after, missing, changed: missing || after !== beforeContent };
+      }));
+      res.json({ sessionId, changes: changes.filter((c4) => c4.changed) });
+    });
+    this.app.post("/api/sessions/:id/revert-file", auth, mutationLimiter, async (req, res) => {
+      const sessionId = req.params.id;
+      const body = req.body;
+      if (!body.filePath || typeof body.filePath !== "string") {
+        res.status(400).json({ error: "filePath is required" });
+        return;
+      }
+      const taskIds = this.sessionTaskIds.get(sessionId) ?? [];
+      let content;
+      for (const taskId of taskIds) {
+        const snap = this.store.getLatestFileSnapshots(taskId).find((s3) => s3.filePath === body.filePath);
+        if (snap) {
+          content = snap.content;
+          break;
+        }
+      }
+      if (content === void 0) {
+        res.status(404).json({ error: "No snapshot recorded for that file in this session." });
+        return;
+      }
+      try {
+        const { writeFile: writeFile2 } = await import('fs/promises');
+        await writeFile2(body.filePath, content, "utf-8");
+        res.json({ ok: true, filePath: body.filePath });
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.get("/api/costs", auth, (_req, res) => {
+      try {
+        const sessions = this.store.listSessions(void 0, 1e3);
+        const budget = this.config.budget ?? { warnAtPct: 80 };
+        res.json({
+          ...aggregateCostStats(sessions, { days: 30, topN: 8 }),
+          budget: {
+            dailyBudgetUsd: budget.dailyBudgetUsd,
+            sessionBudgetUsd: budget.sessionBudgetUsd,
+            maxCostPerRunUsd: budget.maxCostPerRunUsd
+          }
+        });
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.get("/api/schedules", auth, (_req, res) => {
+      try {
+        res.json(this.scheduler.list().map((t4) => ({ ...t4, armed: this.scheduler.isRunning(t4.id) })));
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.post("/api/schedules", auth, mutationLimiter, (req, res) => {
+      const body = req.body;
+      if (!body.name?.trim() || !body.cronExpression?.trim() || !body.prompt?.trim()) {
+        res.status(400).json({ error: "name, cronExpression, and prompt are required" });
+        return;
+      }
+      if (!TaskScheduler.validateCron(body.cronExpression.trim())) {
+        res.status(400).json({ error: `Invalid cron expression: ${body.cronExpression}` });
+        return;
+      }
+      const task = {
+        id: crypto4.randomUUID(),
+        name: body.name.trim(),
+        cronExpression: body.cronExpression.trim(),
+        prompt: body.prompt.trim(),
+        workspacePath: this.workspacePath,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        enabled: body.enabled !== false
+      };
+      try {
+        this.scheduler.add(task);
+        res.json(task);
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.put("/api/schedules/:id", auth, mutationLimiter, (req, res) => {
+      const id = req.params.id;
+      const existing = this.scheduler.list().find((t4) => t4.id === id);
+      if (!existing) {
+        res.status(404).json({ error: "Not found" });
+        return;
+      }
+      const body = req.body;
+      if (body.cronExpression !== void 0 && !TaskScheduler.validateCron(body.cronExpression)) {
+        res.status(400).json({ error: `Invalid cron expression: ${body.cronExpression}` });
+        return;
+      }
+      const updated = {
+        ...existing,
+        name: body.name?.trim() || existing.name,
+        cronExpression: body.cronExpression?.trim() || existing.cronExpression,
+        prompt: body.prompt?.trim() || existing.prompt,
+        enabled: body.enabled ?? existing.enabled
+      };
+      try {
+        this.scheduler.add(updated);
+        if (!updated.enabled) this.scheduler.unschedule(id);
+        res.json(updated);
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.delete("/api/schedules/:id", auth, mutationLimiter, (req, res) => {
+      try {
+        this.scheduler.remove(req.params.id);
+        res.json({ ok: true });
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.get("/api/audit-chain", auth, async (req, res) => {
+      try {
+        const limit2 = Math.min(500, Math.max(1, parseInt(req.query["limit"] || "200", 10) || 200));
+        const offset = Math.max(0, parseInt(req.query["offset"] || "0", 10) || 0);
+        const { AuditLogger: AuditLogger3 } = await Promise.resolve().then(() => (init_audit_logger(), audit_logger_exports));
+        const logger = new AuditLogger3(this.workspacePath);
+        try {
+          const all = logger.getAllLogs();
+          const total = all.length;
+          const entries = all.reverse().slice(offset, offset + limit2);
+          res.json({ total, offset, entries });
+        } finally {
+          logger.close();
+        }
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
     const prodPath = path22__namespace.default.resolve(__dirname2, "../web/dist");
     const devPath = path22__namespace.default.resolve(__dirname2, "../../web/dist");
     const webDistPath = fs11__namespace.default.existsSync(prodPath) ? prodPath : devPath;
@@ -300066,71 +300540,6 @@ ${prompt}`;
     }
   }
 };
-
-// src/scheduler/index.ts
-var import_node_cron = __toESM(require_node_cron(), 1);
-var TaskScheduler = class {
-  cronJobs = /* @__PURE__ */ new Map();
-  store;
-  runner;
-  constructor(store, runner) {
-    this.store = store;
-    this.runner = runner;
-  }
-  start() {
-    const tasks = this.store.listScheduledTasks();
-    for (const task of tasks) {
-      if (task.enabled) this.schedule(task);
-    }
-  }
-  stop() {
-    for (const job of this.cronJobs.values()) job.stop();
-    this.cronJobs.clear();
-  }
-  schedule(task) {
-    if (!import_node_cron.default.validate(task.cronExpression)) {
-      throw new Error(`Invalid cron expression: ${task.cronExpression}`);
-    }
-    const existing = this.cronJobs.get(task.id);
-    if (existing) {
-      try {
-        existing.stop();
-      } catch {
-      }
-    }
-    const job = import_node_cron.default.schedule(task.cronExpression, async () => {
-      try {
-        task.lastRun = (/* @__PURE__ */ new Date()).toISOString();
-        this.store.saveScheduledTask(task);
-        await this.runner(task);
-      } catch (err) {
-        console.error(`[scheduler] Task "${task.id}" (${task.cronExpression}) failed:`, err);
-      }
-    }, { timezone: "UTC" });
-    this.cronJobs.set(task.id, job);
-  }
-  unschedule(taskId) {
-    this.cronJobs.get(taskId)?.stop();
-    this.cronJobs.delete(taskId);
-  }
-  add(task) {
-    this.store.saveScheduledTask(task);
-    if (task.enabled) this.schedule(task);
-  }
-  remove(taskId) {
-    this.unschedule(taskId);
-    this.store.deleteScheduledTask(taskId);
-  }
-  list() {
-    return this.store.listScheduledTasks();
-  }
-  isRunning(taskId) {
-    return this.cronJobs.has(taskId);
-  }
-  static validateCron(expression) {
-    return import_node_cron.default.validate(expression);
-  }
-};
 var execFileAsync2 = util$1.promisify(child_process.execFile);
 var SAFE_ENV_NAME = /^[A-Z][A-Z0-9_]*$/;
 function sanitizeEnvValue(v6) {