commandmate 0.3.1 → 0.3.3

package/.next/types/app/api/worktrees/[id]/schedules/route.ts

@@ -0,0 +1,343 @@
+// File: /home/runner/work/CommandMate/CommandMate/src/app/api/worktrees/[id]/schedules/route.ts
+import * as entry from '../../../../../../../src/app/api/worktrees/[id]/schedules/route.js'
+import type { NextRequest } from 'next/server.js'
+
+type TEntry = typeof import('../../../../../../../src/app/api/worktrees/[id]/schedules/route.js')
+
+// Check that the entry is a valid entry
+checkFields<Diff<{
+  GET?: Function
+  HEAD?: Function
+  OPTIONS?: Function
+  POST?: Function
+  PUT?: Function
+  DELETE?: Function
+  PATCH?: Function
+  config?: {}
+  generateStaticParams?: Function
+  revalidate?: RevalidateRange<TEntry> | false
+  dynamic?: 'auto' | 'force-dynamic' | 'error' | 'force-static'
+  dynamicParams?: boolean
+  fetchCache?: 'auto' | 'force-no-store' | 'only-no-store' | 'default-no-store' | 'default-cache' | 'only-cache' | 'force-cache'
+  preferredRegion?: 'auto' | 'global' | 'home' | string | string[]
+  runtime?: 'nodejs' | 'experimental-edge' | 'edge'
+  maxDuration?: number
+  
+}, TEntry, ''>>()
+
+// Check the prop type of the entry function
+if ('GET' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'GET'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'GET'>>
+      },
+      'GET'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<PageParams>,
+      {
+        __tag__: 'GET'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'GET'>>
+      },
+      'GET'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'GET',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'GET',
+        __return_type__: ReturnType<MaybeField<TEntry, 'GET'>>
+      },
+      'GET'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('HEAD' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'HEAD'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'HEAD'>>
+      },
+      'HEAD'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<PageParams>,
+      {
+        __tag__: 'HEAD'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'HEAD'>>
+      },
+      'HEAD'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'HEAD',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'HEAD',
+        __return_type__: ReturnType<MaybeField<TEntry, 'HEAD'>>
+      },
+      'HEAD'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('OPTIONS' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'OPTIONS'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'OPTIONS'>>
+      },
+      'OPTIONS'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<PageParams>,
+      {
+        __tag__: 'OPTIONS'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'OPTIONS'>>
+      },
+      'OPTIONS'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'OPTIONS',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'OPTIONS',
+        __return_type__: ReturnType<MaybeField<TEntry, 'OPTIONS'>>
+      },
+      'OPTIONS'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('POST' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'POST'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'POST'>>
+      },
+      'POST'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<PageParams>,
+      {
+        __tag__: 'POST'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'POST'>>
+      },
+      'POST'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'POST',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'POST',
+        __return_type__: ReturnType<MaybeField<TEntry, 'POST'>>
+      },
+      'POST'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('PUT' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'PUT'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'PUT'>>
+      },
+      'PUT'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<PageParams>,
+      {
+        __tag__: 'PUT'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'PUT'>>
+      },
+      'PUT'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'PUT',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'PUT',
+        __return_type__: ReturnType<MaybeField<TEntry, 'PUT'>>
+      },
+      'PUT'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('DELETE' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'DELETE'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'DELETE'>>
+      },
+      'DELETE'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<PageParams>,
+      {
+        __tag__: 'DELETE'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'DELETE'>>
+      },
+      'DELETE'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'DELETE',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'DELETE',
+        __return_type__: ReturnType<MaybeField<TEntry, 'DELETE'>>
+      },
+      'DELETE'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('PATCH' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'PATCH'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'PATCH'>>
+      },
+      'PATCH'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<PageParams>,
+      {
+        __tag__: 'PATCH'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'PATCH'>>
+      },
+      'PATCH'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'PATCH',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'PATCH',
+        __return_type__: ReturnType<MaybeField<TEntry, 'PATCH'>>
+      },
+      'PATCH'
+    >
+  >()
+}
+
+// Check the arguments and return type of the generateStaticParams function
+if ('generateStaticParams' in entry) {
+  checkFields<Diff<{ params: PageParams }, FirstArg<MaybeField<TEntry, 'generateStaticParams'>>, 'generateStaticParams'>>()
+  checkFields<Diff<{ __tag__: 'generateStaticParams', __return_type__: any[] | Promise<any[]> }, { __tag__: 'generateStaticParams', __return_type__: ReturnType<MaybeField<TEntry, 'generateStaticParams'>> }>>()
+}
+
+type PageParams = any
+export interface PageProps {
+  params?: any
+  searchParams?: any
+}
+export interface LayoutProps {
+  children?: React.ReactNode
+
+  params?: any
+}
+
+// =============
+// Utility types
+type RevalidateRange<T> = T extends { revalidate: any } ? NonNegative<T['revalidate']> : never
+
+// If T is unknown or any, it will be an empty {} type. Otherwise, it will be the same as Omit<T, keyof Base>.
+type OmitWithTag<T, K extends keyof any, _M> = Omit<T, K>
+type Diff<Base, T extends Base, Message extends string = ''> = 0 extends (1 & T) ? {} : OmitWithTag<T, keyof Base, Message>
+
+type FirstArg<T extends Function> = T extends (...args: [infer T, any]) => any ? unknown extends T ? any : T : never
+type SecondArg<T extends Function> = T extends (...args: [any, infer T]) => any ? unknown extends T ? any : T : never
+type MaybeField<T, K extends string> = T extends { [k in K]: infer G } ? G extends Function ? G : never : never
+
+type ParamCheck<T> = {
+  __tag__: string
+  __param_position__: string
+  __param_type__: T
+}
+
+function checkFields<_ extends { [k in keyof any]: never }>() {}
+
+// https://github.com/sindresorhus/type-fest
+type Numeric = number | bigint
+type Zero = 0 | 0n
+type Negative<T extends Numeric> = T extends Zero ? never : `${T}` extends `-${string}` ? T : never
+type NonNegative<T extends Numeric> = T extends Zero ? T : Negative<T> extends never ? T : '__invalid_negative_number__'

package/README.md

@@ -1,5 +1,6 @@
 # CommandMate
 
+[![GitHub Stars](https://img.shields.io/github/stars/Kewton/CommandMate?style=social)](https://github.com/Kewton/CommandMate)
 ![npm version](https://img.shields.io/npm/v/commandmate)
 ![npm downloads](https://img.shields.io/npm/dm/commandmate)
 ![license](https://img.shields.io/github/license/Kewton/CommandMate)
@@ -16,12 +17,17 @@
 
 Not a "remote control" — a **mobile dev cockpit**.
 
-AI writes code for you. That was supposed to mean freedom.
-Instead, you're watching a terminal, afraid to walk away.
-Your friends are at dinner. Your kid needs a bath. You just want ten minutes on the couch.
-But close the lid and every session dies. So you sit there — babysitting the machine that was supposed to babysit your code.
+```bash
+npx commandmate
+```
+
+**From install to mobile monitoring in 60 seconds.** macOS / Linux · Node.js v20+ · npm · git · tmux · openssl
 
-CommandMate changes that. Auto Yes keeps the agent moving. Sessions survive in the background. And a Web UI on your phone means you can check in, review diffs, edit instructions, and send screenshots — from anywhere.
+---
+
+AI writes code for you — but you're stuck watching a terminal, afraid to walk away.
+Close the lid and every session dies.
+**CommandMate keeps it alive, and puts the controls on your phone.**
 
 Of course, it works great on desktop too — the two-column layout gives you a full overview of all sessions and worktrees at a glance.
 
@@ -29,83 +35,69 @@ Of course, it works great on desktop too — the two-column layout gives you a f
   <img src="./docs/images/demo-desktop.gif" alt="CommandMate desktop demo" width="600">
 </p>
 
-```bash
-npx commandmate
-```
-
 ---
 
-## The 6 Pillars
+## Key Features
 
-| Pillar | What it does | Why it matters |
-|--------|-------------|----------------|
+| Feature | What it does | Why it matters |
+|---------|-------------|----------------|
 | **Auto Yes Mode** | Agent runs without stopping for confirmations | No babysitting — Claude Code keeps working while you're away |
 | **Git Worktree Sessions** | One session per worktree, parallel execution | Multiple tasks progress simultaneously |
 | **Mobile Web UI** | Full session control from any browser | Monitor and steer from your phone |
 | **File Viewer** | Browse worktree files from the browser | Review code changes without touching your PC |
 | **Markdown Editor** | Edit Markdown files in the browser | Update AI instructions on the go |
 | **Screenshot Instructions** | Attach images to your prompts | Snap a bug → "Fix this" — the agent sees the screenshot |
+| **Token Authentication** | SHA-256 hashed token + HTTPS + rate limiting | Secure remote access — no credentials leaked, brute-force protected |
+| **Scheduled Execution** | Cron-based auto-run via CMATE.md | Daily reviews, nightly tests — Claude Code works on a schedule |
 
 ---
 
-## Quick Start
+## Use Cases
 
-**Prerequisites:** macOS / Linux, Node.js v20+, npm, git, tmux, openssl
-
-```bash
-# Install & start in one command
-npx commandmate
-
-# Or install globally
-npm install -g commandmate
-commandmate init
-commandmate start --daemon
-```
-
-Open http://localhost:3000 in your browser.
-
-See the [CLI Setup Guide](./docs/en/user-guide/cli-setup-guide.md) for details.
+| Scenario | How CommandMate helps |
+|----------|----------------------|
+| **Couch coding** | Start a task on your PC, then monitor and steer from the sofa |
+| **Commute review** | Review AI-generated code changes on the train |
+| **Overnight runs** | Let Claude Code work all night — check progress from bed |
+| **Visual bug fix** | Snap a UI bug on your phone, send it with "Fix this" |
+| **Parallel tasks** | Run multiple worktree sessions, manage them all from one dashboard |
 
 ---
 
 ## Comparison
 
-| Feature | CommandMate | Happy Coder | claude-squad | Omnara |
-|---------|:-----------:|:-----------:|:------------:|:------:|
-| Auto Yes Mode | Yes | No | Yes (TUI only) | No |
-| Git Worktree Management | Yes | No | Yes (TUI only) | No |
-| Mobile Web UI | Yes | Yes | **No** | Yes |
-| File Viewer | Yes | No | No | No |
-| Markdown Editor | Yes | No | No | No |
-| Screenshot Instructions | Yes | No | Not possible | No |
-| Free / OSS | Yes | Free + Paid | Yes | $20/mo |
-| Runs 100% Locally | Yes | Server-routed | Yes | Cloud fallback |
+| Feature | CommandMate | Remote Control (Official) | Happy Coder | claude-squad | Omnara |
+|---------|:-----------:|:------------------------:|:-----------:|:------------:|:------:|
+| Auto Yes Mode | Yes | No | No | Yes (TUI only) | No |
+| Git Worktree Management | Yes | No | No | Yes (TUI only) | No |
+| Parallel Sessions | Yes | **No (1 only)** | Yes | Yes | No |
+| Mobile Web UI | Yes | Yes (claude.ai) | Yes | **No** | Yes |
+| File Viewer | Yes | No | No | No | No |
+| Markdown Editor | Yes | No | No | No | No |
+| Screenshot Instructions | Yes | No | No | Not possible | No |
+| Scheduled Execution | Yes | No | No | No | No |
+| Survives Laptop Close | Yes (daemon) | **No (terminal must stay open)** | Yes | Yes | Yes |
+| Token Authentication | Yes | N/A (Anthropic account) | N/A (app) | No | N/A (cloud) |
+| Free / OSS | Yes | Requires Pro/Max | Free + Paid | Yes | $20/mo |
+| Runs 100% Locally | Yes | Via Anthropic API | Server-routed | Yes | Cloud fallback |
 
 ---
 
-## Workflow
+## Screenshots
 
-```
-1. Start tasks on your PC
-   $ commandmate start --daemon
-   → Claude Code begins working with Auto Yes
+### Desktop
 
-2. Close your laptop and go
+![Desktop view](./docs/images/screenshot-desktop.png)
 
-3. Check in from your phone
-   → Web UI shows all sessions at a glance
+### Mobile
 
-4. Review code changes
-   → File Viewer lets you read diffs on mobile
+| Top Page | Worktree (History) | Worktree (Terminal) |
+|----------|-------------------|-------------------|
+| ![Mobile view](./docs/images/screenshot-mobile.png) | ![Mobile - History](./docs/images/screenshot-worktree-mobile.png) | ![Mobile - Terminal](./docs/images/screenshot-worktree-mobile-terminal.png) |
 
-5. Adjust direction
-   → Edit a Markdown instruction file, or type a new prompt
+### Worktree Detail (Desktop)
 
-6. Snap a bug
-   → Screenshot Instructions: attach a photo and say "Fix this"
-
-7. Claude Code sees the image and starts fixing
-```
+![Desktop - Worktree detail](./docs/images/screenshot-worktree-desktop.png)
 
 ---
 
@@ -115,7 +107,7 @@ Runs **100% locally**. No external server, no cloud relay, no account required.
 
 - Fully open-source ([MIT License](./LICENSE))
 - Local database, local sessions
-- For remote access, use a VPN or authenticated reverse proxy
+- For remote access, use a tunneling service ([Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/), [ngrok](https://ngrok.com/), [Pinggy](https://pinggy.io/)), a VPN, or an authenticated reverse proxy
 
 See the [Security Guide](./docs/security-guide.md) and [Trust & Safety](./docs/en/TRUST_AND_SAFETY.md) for details.
 
@@ -136,6 +128,25 @@ Each Git worktree gets its own tmux session, so multiple tasks run in parallel w
 
 ---
 
+<details>
+<summary><strong>Quick Start (detailed)</strong></summary>
+
+```bash
+# Install & start in one command
+npx commandmate
+
+# Or install globally
+npm install -g commandmate
+commandmate init
+commandmate start --daemon
+```
+
+Open http://localhost:3000 in your browser.
+
+See the [CLI Setup Guide](./docs/en/user-guide/cli-setup-guide.md) for details.
+
+</details>
+
 <details>
 <summary><strong>CLI Commands</strong></summary>
 
@@ -196,25 +207,6 @@ See `commandmate --help` for all options.
 
 </details>
 
-<details>
-<summary><strong>Screenshots</strong></summary>
-
-### Desktop
-
-![Desktop view](./docs/images/screenshot-desktop.png)
-
-### Worktree Detail View (Message / Console / History)
-
-| Desktop | Mobile (History) | Mobile (Terminal) |
-|---------|-----------------|-------------------|
-| ![Desktop - Worktree detail](./docs/images/screenshot-worktree-desktop.png) | ![Mobile - History](./docs/images/screenshot-worktree-mobile.png) | ![Mobile - Terminal](./docs/images/screenshot-worktree-mobile-terminal.png) |
-
-### Top Page (Mobile)
-
-![Mobile view](./docs/images/screenshot-mobile.png)
-
-</details>
-
 <details>
 <summary><strong>Troubleshooting & FAQ</strong></summary>
 
@@ -258,7 +250,13 @@ Claude Code sets `CLAUDECODE=1` to prevent nesting. CommandMate removes this aut
 A: CommandMate runs a web server on your PC. To access it from your phone, your phone and PC must be on the same network (Wi-Fi). Run `commandmate init` and enable external access — this sets `CM_BIND=0.0.0.0`. Then open `http://<your-PC-IP>:3000` in your phone's browser.
 
 **Q: Can I access it from outside my home network?**
-A: Yes. Use a tunneling service like [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/) to securely expose your local server without opening router ports. Alternatively, a VPN or an authenticated reverse proxy (Basic Auth, OIDC, etc.) also works. **Do not** expose the server directly to the internet without authentication.
+A: Yes. Use a tunneling service to securely expose your local server without opening router ports:
+
+- [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/) — free, requires Cloudflare account
+- [ngrok](https://ngrok.com/) — free tier available, easy setup
+- [Pinggy](https://pinggy.io/) — no sign-up required, simple SSH-based tunnel
+
+Alternatively, a VPN or an authenticated reverse proxy (Basic Auth, OIDC, etc.) also works. **Do not** expose the server directly to the internet without authentication.
 
 **Q: Does it work on iPhone / Android?**
 A: Yes. CommandMate's Web UI is responsive and works on any modern mobile browser (Safari, Chrome, etc.). No app install required.

package/dist/cli/utils/docs-reader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docs-reader.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/docs-reader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAkDH;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,EAAE,CAE/C;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAOnD;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA0BvF"}
+{"version":3,"file":"docs-reader.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/docs-reader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAmDH;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,EAAE,CAE/C;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAOnD;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA0BvF"}

package/dist/cli/utils/docs-reader.js

@@ -66,6 +66,7 @@ const SECTION_MAP = {
     'workflow-examples': 'docs/user-guide/workflow-examples.md',
     'cli-setup': 'docs/user-guide/cli-setup-guide.md',
     'agents': 'docs/user-guide/agents-guide.md',
+    'cmate-schedules': 'docs/user-guide/cmate-schedules-guide.md',
     'architecture': 'docs/architecture.md',
     'readme': 'README.md',
 };

package/dist/server/server.js

@@ -39,6 +39,7 @@ const worktrees_1 = require("./src/lib/worktrees");
 const db_instance_1 = require("./src/lib/db-instance");
 const response_poller_1 = require("./src/lib/response-poller");
 const auto_yes_manager_1 = require("./src/lib/auto-yes-manager");
+const schedule_manager_1 = require("./src/lib/schedule-manager");
 const db_migrations_1 = require("./src/lib/db-migrations");
 const env_1 = require("./src/lib/env");
 const db_repository_1 = require("./src/lib/db-repository");
@@ -227,6 +228,8 @@ app.prepare().then(() => {
         console.log(`> WebSocket server ready`);
         // Initialize worktrees after server starts
         await initializeWorktrees();
+        // [S3-010] Initialize schedule manager AFTER worktrees are ready
+        (0, schedule_manager_1.initScheduleManager)();
     });
     // Graceful shutdown with timeout
     let isShuttingDown = false;
@@ -241,6 +244,8 @@ app.prepare().then(() => {
         (0, response_poller_1.stopAllPolling)();
         // Issue #138: Stop all auto-yes pollers
         (0, auto_yes_manager_1.stopAllAutoYesPolling)();
+        // Issue #294: Stop all scheduled executions (SIGKILL fire-and-forget)
+        (0, schedule_manager_1.stopAllSchedules)();
         // Close WebSocket connections immediately (don't wait)
         (0, ws_server_1.closeWebSocket)();
         // Force exit after 3 seconds if graceful shutdown fails

package/dist/server/src/config/cmate-constants.js

@@ -0,0 +1,79 @@
+"use strict";
+/**
+ * CMATE.md Shared Constants
+ * Issue #294: Constants shared between server-side parser and client-side validator
+ *
+ * This module has NO Node.js dependencies (no 'fs'), so it can be safely
+ * imported from both server and client code.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_SCHEDULE_ENTRIES = exports.MAX_CRON_EXPRESSION_LENGTH = exports.NAME_PATTERN = exports.CONTROL_CHAR_PATTERN = exports.CMATE_FILENAME = void 0;
+exports.sanitizeContent = sanitizeContent;
+exports.isValidCronExpression = isValidCronExpression;
+// =============================================================================
+// File
+// =============================================================================
+/** CMATE.md filename */
+exports.CMATE_FILENAME = 'CMATE.md';
+// =============================================================================
+// Sanitization
+// =============================================================================
+/**
+ * Unicode control character regex for sanitization.
+ * Matches: C0 control chars (except \t \n \r), C1 control chars,
+ * zero-width characters, directional control characters.
+ *
+ * NOTE: No /g flag on the export — callers must use String.replace(pattern, '')
+ * with /g or String.replaceAll() to avoid lastIndex state issues.
+ *
+ * [S4-002] Strips potentially dangerous Unicode control characters
+ */
+exports.CONTROL_CHAR_PATTERN = 
+// eslint-disable-next-line no-control-regex
+/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F\x80-\x9F\u200B-\u200F\u2028-\u202F\uFEFF]/;
+/**
+ * Remove Unicode control characters from a string.
+ * Preserves tabs (\t), newlines (\n), and carriage returns (\r).
+ *
+ * @param content - Raw string to sanitize
+ * @returns Sanitized string with control characters removed
+ */
+function sanitizeContent(content) {
+    // Use RegExp constructor with /g to avoid lastIndex state on the shared pattern
+    return content.replace(new RegExp(exports.CONTROL_CHAR_PATTERN.source, 'g'), '');
+}
+// =============================================================================
+// Name Validation
+// =============================================================================
+/**
+ * Name validation pattern.
+ * Allows: ASCII word chars, Japanese chars (CJK, Hiragana, Katakana, Symbols),
+ * spaces, and hyphens. Length: 1-100 characters.
+ *
+ * [S4-011] Prevents injection through name field
+ */
+exports.NAME_PATTERN = /^[\w\u3000-\u303F\u3040-\u309F\u30A0-\u30FF\u4E00-\u9FFF\uF900-\uFAFF\s-]{1,100}$/;
+// =============================================================================
+// Limits
+// =============================================================================
+/** Maximum cron expression length */
+exports.MAX_CRON_EXPRESSION_LENGTH = 100;
+/** Maximum number of schedule entries per worktree */
+exports.MAX_SCHEDULE_ENTRIES = 100;
+// =============================================================================
+// Cron Validation
+// =============================================================================
+/**
+ * Validate a cron expression.
+ * Checks length and basic format (5-6 fields separated by spaces).
+ *
+ * @param expression - Cron expression to validate
+ * @returns true if the expression appears valid
+ */
+function isValidCronExpression(expression) {
+    if (expression.length > exports.MAX_CRON_EXPRESSION_LENGTH) {
+        return false;
+    }
+    const parts = expression.trim().split(/\s+/);
+    return parts.length >= 5 && parts.length <= 6;
+}