janissary 0.5.0

package/dist/sandbox.js

@@ -0,0 +1,217 @@
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { homedir } from 'node:os';
+import path from 'node:path';
+import { SANDBOX_PROFILE, SANDBOX_PROFILE_OFFLINE } from './sandbox-profile.js';
+import { HOME_WRITE_CARVEOUTS, HOME_READ_CARVEINS, SECRET_DENY_PATHS, HOME_READ_LISTING_DIRS, HOME_WRITE_PREFIX_CARVEOUTS, WRITE_CARVEOUT_PARAMS, READ_CARVEIN_PARAMS, SECRET_DENY_PARAMS, LISTING_DIR_PARAMS, WRITE_PREFIX_PARAMS, ENV_SCRUB_PATTERNS, } from './sandbox-paths.js';
+import { getConfig } from './config.js';
+let cachedAvailable;
+// Whether Seatbelt sandboxing can be applied on this machine: darwin, with `sandbox-exec` on
+// `PATH`. Cached after the first check.
+export function sandboxAvailable() {
+    cachedAvailable ??= process.platform === 'darwin' && existsSync('/usr/bin/sandbox-exec');
+    return cachedAvailable;
+}
+// A one-line notice to append to a newly created workspaced tab's transcript when its processes
+// will NOT actually be confined — either the config toggle is off, or `sandbox-exec` isn't
+// available on this machine. Undefined when sandboxing is active, so callers only surface it when
+// there's something to say.
+export function sandboxNotice() {
+    if (!getConfig().sandboxWorkspaces)
+        return 'workspace isolation off: sandboxWorkspaces disabled in config';
+    if (!sandboxAvailable())
+        return 'workspace isolation off: sandbox-exec unavailable';
+    return undefined;
+}
+// Resolve a path through any symlinks (macOS's `/tmp` → `/private/tmp` being the common case) —
+// Seatbelt's `subpath` rules match against the resolved path, so an unresolved path silently
+// fails to carve in. Falls back to the input path if it doesn't exist (yet).
+function resolvePath(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return p;
+    }
+}
+let cachedDarwinUserCacheDir;
+// The real per-user `/var/folders/<xx>/<hash>/C/` cache directory macOS's `confstr(3)` hands out —
+// NOT the same as `$TMPDIR`, which `sandboxSpawn` overrides to a workspace-local path below, and
+// NOT its `.../T/` (temp) sibling, which stays denied (that's where `os.tmpdir()`-based scratch
+// dirs land — carving it in too would let a sandboxed process write anywhere a plain `mktemp`
+// call resolves to, defeating the outside-the-workspace write deny). System frameworks look the
+// cache path up directly via `confstr`, bypassing our `TMPDIR` override entirely, and write
+// lock/cache files into it regardless (e.g. Security.framework's legacy MDS subsystem locks
+// `.../C/mds/mds.lock` on every `SecItemCopyMatching` call — denied, the call silently fails
+// rather than erroring, so a sandboxed harness reads back "not logged in" even with a valid
+// Keychain item). Cached: it's fixed for the life of the host process.
+function darwinUserCacheDir() {
+    if (cachedDarwinUserCacheDir)
+        return cachedDarwinUserCacheDir;
+    try {
+        const cacheDir = execFileSync('getconf', ['DARWIN_USER_CACHE_DIR']).toString().trim();
+        cachedDarwinUserCacheDir = resolvePath(cacheDir);
+    }
+    catch {
+        cachedDarwinUserCacheDir = '/nonexistent-janissary-darwin-user-cache-dir-placeholder';
+    }
+    return cachedDarwinUserCacheDir;
+}
+let cachedClaudeScratchDir;
+// The harness CLI's own per-user scratch tree, `/private/tmp/claude-<uid>/`, under which it creates
+// a per-project/session scratchpad directory before running any tool — including a plain shell
+// command. This is a fixed, UID-keyed path entirely outside `$HOME`, our workspace-local `TMPDIR`
+// override, and the Darwin user cache dir above, so without carving it in, every tool invocation
+// inside a sandboxed harness session fails at that housekeeping step, before the tool's own command
+// ever runs. Cached: the UID is fixed for the life of the host process.
+function claudeScratchDir() {
+    if (cachedClaudeScratchDir)
+        return cachedClaudeScratchDir;
+    const uid = typeof process.getuid === 'function' ? process.getuid() : 0;
+    cachedClaudeScratchDir = resolvePath(`/private/tmp/claude-${uid}`);
+    return cachedClaudeScratchDir;
+}
+// Walk up from a resolved executable's path to the nearest ancestor directory literally named
+// `node_modules`, if any. A globally-installed npm package (`npm` itself included) is laid out as
+// `.../node_modules/<pkg>/bin/<script>`, where the script requires sibling files from `<pkg>/lib/`
+// and beyond — carving in only the immediate `bin/` directory (as for a single bundled binary like
+// claude.exe) leaves those sibling requires denied. Carving in the whole `node_modules/` directory
+// instead covers every globally-installed package uniformly (not just the one being run), which is
+// harmless — it's still just $HOME-scoped code, not secrets. Falls back to the script's own
+// directory when there's no `node_modules` ancestor (a single-file bundled binary).
+function packageRootDir(resolvedBin) {
+    let dir = path.dirname(resolvedBin);
+    for (;;) {
+        if (path.basename(dir) === 'node_modules')
+            return dir;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return path.dirname(resolvedBin);
+        dir = parent;
+    }
+}
+// Resolve `command` to an absolute path the way `execvp`/`posix_spawn` would (a `PATH` search for a
+// bare name, or the path itself if it already contains a separator) so its containing directory can
+// be carved into the read allow-list. Without this, a harness binary installed under `$HOME` (e.g.
+// via nvm, or `~/.opencode/bin`) can't read its own executable — which some system frameworks need
+// to do internally (Keychain's `SecItemCopyMatching` calls `CFBundleGetMainBundle`, which reopens the
+// calling process's own binary and its directory to determine code identity for ACL matching; denied,
+// the harness looks logged out even though its Keychain item is intact). Returns both the literal
+// (unresolved — e.g. many npm-global installs are a `bin/foo` symlink into `lib/node_modules/...`)
+// and fully realpath-resolved directory (widened to the enclosing `node_modules/` via
+// `packageRootDir` above, for packages — like npm — that are more than a single bundled file), same
+// dual reasoning as `dualParams` in sandbox-profile.ts: a framework may `opendir`/`lstat` the
+// symlink's own directory as well as the resolved target's. Falls back to a path that matches
+// nothing so the profile's params always have a bound value.
+function resolveExecutableDirs(command) {
+    const fallback = '/nonexistent-janissary-self-bin-placeholder';
+    const literalBin = command.includes('/')
+        ? (existsSync(command) ? command : undefined)
+        : (process.env.PATH ?? '').split(':').filter(Boolean)
+            .map((dir) => path.join(dir, command))
+            .find((candidate) => existsSync(candidate));
+    if (!literalBin)
+        return { literal: fallback, real: fallback };
+    return { literal: path.dirname(literalBin), real: packageRootDir(resolvePath(literalBin)) };
+}
+// The directory of the Node binary currently running the janissary server itself
+// (`process.execPath`), in both literal and realpath-resolved form (same dual reasoning as
+// `resolveExecutableDirs` above — an nvm-managed `node` is commonly a symlink). Carved into the
+// read allow-list so a script running inside the sandbox (e.g. a project's own `.claude/settings.json`
+// hook) can reliably invoke a known-good `node` via the `JANISSARY_NODE` env var below, instead of
+// hoping a bare `node` on the sandboxed process's PATH resolves to a working binary — PATH
+// resolution order inside a spawned/hook context doesn't always match the server's own.
+function serverNodeDirs() {
+    const execPath = process.execPath;
+    return { literal: path.dirname(execPath), real: path.dirname(resolvePath(execPath)) };
+}
+// The workspace clone's own git objects directory. Falls back to a parent repo's real objects
+// directory via a `--shared` alternates file, if one is present (older, locally-shared clones) —
+// today's independent clones of `origin` have no alternates file, so this always hits the fallback.
+function parentGitObjectsDir(workspaceDir) {
+    const fallback = path.join(workspaceDir, '.git', 'objects');
+    try {
+        const alternatesPath = path.join(workspaceDir, '.git', 'objects', 'info', 'alternates');
+        const target = readFileSync(alternatesPath, 'utf8').trim().split('\n', 1)[0];
+        return target ? resolvePath(target) : fallback;
+    }
+    catch {
+        return fallback;
+    }
+}
+// Drop credential-shaped vars and agent-socket escape vectors (see `sandbox-profile.ts`).
+function scrubEnv(env) {
+    const scrubbed = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (ENV_SCRUB_PATTERNS.some((pattern) => pattern.test(key)))
+            continue;
+        scrubbed[key] = value;
+    }
+    return scrubbed;
+}
+// `-D <param>=<path>` for each home-relative table entry, in both its literal (`~/…`, as named —
+// covers an `lstat`/`readlink` of a symlinked dotfile) and fully realpath-resolved (covers a
+// `read`/`open` that follows the symlink) forms. See the comment on `dualParams` in
+// sandbox-profile.ts for why both are needed.
+function homeDParams(home, relPaths, params) {
+    const args = [];
+    for (const [i, rel] of relPaths.entries()) {
+        const literalPath = path.join(home, rel);
+        args.push('-D', `${params.literal[i]}=${literalPath}`, '-D', `${params.real[i]}=${resolvePath(literalPath)}`);
+    }
+    return args;
+}
+// Wrap a spawn invocation (`command` + `args` — the same shape `child_process.spawn`/node-pty's
+// `spawn` take) for a workspaced tab. Returns the input unchanged when there's nothing to
+// sandbox: no `workspaceDir`, the `sandboxWorkspaces` config toggle is off, or `sandbox-exec`
+// isn't available (e.g. non-darwin). Otherwise returns `sandbox-exec -p <profile> -D … -- <command>
+// <args>` plus a credential-scrubbed environment with `TMPDIR` set to the workspace's private
+// temp dir.
+export function sandboxSpawn(options, command, args, env = process.env) {
+    if (!options.workspaceDir || !getConfig().sandboxWorkspaces || !sandboxAvailable()) {
+        return { command, args, env };
+    }
+    const workspaceDir = resolvePath(options.workspaceDir);
+    const tmpDir = resolvePath(`${options.workspaceDir}.tmp`);
+    const home = resolvePath(homedir());
+    const gitObjects = parentGitObjectsDir(options.workspaceDir);
+    const selfDirs = resolveExecutableDirs(options.selfBinaryHint ?? command);
+    const darwinCacheDir = darwinUserCacheDir();
+    const scratchDir = claudeScratchDir();
+    const serverNodeDir = serverNodeDirs();
+    const scrubbed = scrubEnv(env);
+    scrubbed.TMPDIR = tmpDir;
+    scrubbed.JANISSARY_NODE = process.execPath;
+    if (options.githubToken) {
+        scrubbed.GH_TOKEN = options.githubToken;
+        // `gh` reads `~/.config/gh/hosts.yml` on every invocation regardless of `GH_TOKEN`, and its
+        // config loader treats the sandbox's EPERM deny on that file (see SECRET_DENY_PATHS in
+        // sandbox-profile.ts) as fatal, refusing to run at all. Pointing `GH_CONFIG_DIR` at an empty,
+        // workspace-private directory instead gives `gh` a genuinely absent hosts.yml (real ENOENT),
+        // which it handles by falling through to `GH_TOKEN` normally.
+        scrubbed.GH_CONFIG_DIR = path.join(tmpDir, 'gh-config');
+    }
+    const profile = options.offline ? SANDBOX_PROFILE_OFFLINE : SANDBOX_PROFILE;
+    const dParams = [
+        '-D', `WORKSPACE=${workspaceDir}`,
+        '-D', `TMPDIR=${tmpDir}`,
+        '-D', `HOME=${home}`,
+        '-D', `GIT_OBJECTS=${gitObjects}`,
+        '-D', `SELF_DIR_L=${selfDirs.literal}`,
+        '-D', `SELF_DIR_R=${selfDirs.real}`,
+        '-D', `DARWIN_USER_CACHE_DIR=${darwinCacheDir}`,
+        '-D', `CLAUDE_SCRATCH_DIR=${scratchDir}`,
+        '-D', `SERVER_NODE_DIR_L=${serverNodeDir.literal}`,
+        '-D', `SERVER_NODE_DIR_R=${serverNodeDir.real}`,
+        ...homeDParams(home, HOME_WRITE_CARVEOUTS, WRITE_CARVEOUT_PARAMS),
+        ...homeDParams(home, HOME_READ_CARVEINS, READ_CARVEIN_PARAMS),
+        ...homeDParams(home, SECRET_DENY_PATHS, SECRET_DENY_PARAMS),
+        ...homeDParams(home, HOME_READ_LISTING_DIRS, LISTING_DIR_PARAMS),
+        ...homeDParams(home, HOME_WRITE_PREFIX_CARVEOUTS, WRITE_PREFIX_PARAMS),
+    ];
+    return {
+        command: 'sandbox-exec',
+        args: ['-p', profile, ...dParams, '--', command, ...args],
+        env: scrubbed,
+    };
+}

package/dist/schedule/display.js

@@ -0,0 +1,19 @@
+import { MONTHS } from './parsing.js';
+export function fmtTime({ hour, minute }) {
+    const ap = hour < 12 ? 'am' : 'pm';
+    const h = hour % 12 === 0 ? 12 : hour % 12;
+    return `${h}:${String(minute).padStart(2, '0')}${ap}`;
+}
+export function fmtNextRun(ts) {
+    const d = new Date(ts);
+    const mon = MONTHS[d.getMonth()];
+    const month = mon[0].toUpperCase() + mon.slice(1, 3);
+    return `${month} ${d.getDate()} ${fmtTime({ hour: d.getHours(), minute: d.getMinutes() })}`;
+}
+export function formatSchedule(entries) {
+    if (entries.length === 0)
+        return 'No scheduled commands.';
+    return entries
+        .map((e) => `${e.id}  ${e.spec}  (next: ${fmtNextRun(e.nextRun)})  ${e.command}`)
+        .join('\n');
+}

package/dist/schedule/helpers.js

@@ -0,0 +1,76 @@
+const MONTHS = [
+    'january', 'february', 'march', 'april', 'may', 'june',
+    'july', 'august', 'september', 'october', 'november', 'december',
+];
+const WEEKDAYS = ['sunday', 'monday', 'tuesday', 'wednesday', 'thursday', 'friday', 'saturday'];
+const SCHEDULE_USAGE = 'Usage: schedule NAME <at TIME | on DATE [at TIME] | every N(m|h|d|w) | every DAY at TIME> COMMAND | schedule list | schedule cancel <name> | schedule clear';
+export function parseAtSchedule(tokens, now, parseTimeOfDay, fmtTime, nextOccurrenceOfTime) {
+    const tod = parseTimeOfDay(tokens[1] ?? '');
+    if (!tod)
+        return { error: `Invalid time: "${tokens[1] ?? ''}".` };
+    const command = tokens.slice(2).join(' ').trim();
+    if (!command)
+        return { error: 'No command to schedule.' };
+    return { action: 'add', entry: {
+            command, spec: `at ${fmtTime(tod)}`, recurring: false,
+            nextRun: nextOccurrenceOfTime(tod.hour, tod.minute, now),
+        } };
+}
+export function parseOnSchedule(tokens, now, parseMonthDay, parseTimeOfDay, fmtTime, nextDateTime) {
+    const md = parseMonthDay(tokens.slice(1));
+    if (!md)
+        return { error: 'Invalid date. Try "on august 12th" or "on 8/12".' };
+    let index = 1 + md.consumed;
+    let tod = { hour: 9, minute: 0 };
+    if (tokens[index]?.toLowerCase() === 'at') {
+        const t = parseTimeOfDay(tokens[index + 1] ?? '');
+        if (!t)
+            return { error: `Invalid time: "${tokens[index + 1] ?? ''}".` };
+        tod = t;
+        index += 2;
+    }
+    const command = tokens.slice(index).join(' ').trim();
+    if (!command)
+        return { error: 'No command to schedule.' };
+    return { action: 'add', entry: {
+            command, spec: `on ${MONTHS[md.month].slice(0, 3)} ${md.day} at ${fmtTime(tod)}`, recurring: false,
+            nextRun: nextDateTime(md.month, md.day, tod.hour, tod.minute, now),
+        } };
+}
+export function parseEverySchedule(tokens, now, parseInterval, parseTimeOfDay, fmtTime, nextOccurrenceOfTime, nextWeekday) {
+    const second = tokens[1] ?? '';
+    const interval = parseInterval(second);
+    if (interval !== undefined) {
+        const command = tokens.slice(2).join(' ').trim();
+        if (!command)
+            return { error: 'No command to schedule.' };
+        return { action: 'add', entry: {
+                command, spec: `every ${second.toLowerCase()}`, recurring: true,
+                intervalMs: interval, nextRun: now.getTime() + interval,
+            } };
+    }
+    const dayWord = second.toLowerCase();
+    let weekday;
+    if (dayWord !== 'day') {
+        const wd = dayWord.length >= 3 ? WEEKDAYS.findIndex((w) => w.startsWith(dayWord)) : -1;
+        if (wd < 0)
+            return { error: `Invalid interval or day: "${second}".` };
+        weekday = wd;
+    }
+    if (tokens[2]?.toLowerCase() !== 'at')
+        return { error: SCHEDULE_USAGE };
+    const tod = parseTimeOfDay(tokens[3] ?? '');
+    if (!tod)
+        return { error: `Invalid time: "${tokens[3] ?? ''}".` };
+    const command = tokens.slice(4).join(' ').trim();
+    if (!command)
+        return { error: 'No command to schedule.' };
+    const label = weekday === undefined ? 'day' : WEEKDAYS[weekday];
+    return { action: 'add', entry: {
+            command, spec: `every ${label} at ${fmtTime(tod)}`, recurring: true,
+            timeOfDay: tod, weekday,
+            nextRun: weekday === undefined
+                ? nextOccurrenceOfTime(tod.hour, tod.minute, now)
+                : nextWeekday(weekday, tod.hour, tod.minute, now),
+        } };
+}

package/dist/schedule/index.js

@@ -0,0 +1,76 @@
+// Parsing and next-run math for the `schedule` command. Pure (no I/O) so it is fully
+// unit-testable; callers (the command + the scheduler tick) own the side effects.
+import { parseAtSchedule, parseOnSchedule, parseEverySchedule } from './helpers.js';
+import { parseTimeOfDay, parseInterval, parseMonthDay } from './parsing.js';
+export { parseTimeOfDay, parseInterval, parseMonthDay } from './parsing.js';
+import { nextOccurrenceOfTime, nextWeekday, nextDateTime } from './time.js';
+export { nextOccurrenceOfTime, nextWeekday, computeNextRun } from './time.js';
+import { fmtTime } from './display.js';
+export { fmtNextRun, formatSchedule } from './display.js';
+export const SCHEDULE_USAGE = 'Usage: schedule NAME [in TAB] <at TIME | on DATE [at TIME] | every N(m|h|d|w) | every DAY at TIME> COMMAND'
+    + ' | schedule list [in TAB] | schedule cancel <name> [in TAB] | schedule clear [in TAB]';
+// Parse a trailing `in <tab>` clause starting at `tokens[index]`. Returns the target label,
+// an empty object when the clause is absent, or an error when it is malformed or followed
+// by extra tokens (the clause must end the command).
+function parseInClause(tokens, index) {
+    const [keyword, target, ...extra] = tokens.slice(index);
+    if (keyword === undefined)
+        return {};
+    if (keyword.toLowerCase() !== 'in' || target === undefined || extra.length > 0)
+        return { error: SCHEDULE_USAGE };
+    return { target };
+}
+export function parseScheduleCommand(rest, now) {
+    const trimmed = rest.trim();
+    if (!trimmed)
+        return { error: SCHEDULE_USAGE };
+    const tokens = trimmed.split(/\s+/);
+    const head = tokens[0].toLowerCase();
+    if (head === 'list' || head === 'clear') {
+        const clause = parseInClause(tokens, 1);
+        if ('error' in clause)
+            return clause;
+        return { action: head, ...clause };
+    }
+    if (head === 'cancel') {
+        if (!tokens[1])
+            return { error: 'Usage: schedule cancel <name> [in TAB]' };
+        const clause = parseInClause(tokens, 2);
+        if ('error' in clause)
+            return clause;
+        return { action: 'cancel', id: tokens[1], ...clause };
+    }
+    // Otherwise the first token names the timer (becoming its id, shown in the schedule window
+    // and used by `schedule cancel <name>`), an optional `in <tab>` picks the tab the timer
+    // belongs to, and the remainder is the schedule form.
+    const name = tokens[0];
+    let bodyTokens = tokens.slice(1);
+    let target;
+    if (bodyTokens[0]?.toLowerCase() === 'in') {
+        if (!bodyTokens[1])
+            return { error: SCHEDULE_USAGE };
+        target = bodyTokens[1];
+        bodyTokens = bodyTokens.slice(2);
+    }
+    const body = parseScheduleBody(bodyTokens.join(' '), now);
+    if ('error' in body)
+        return body;
+    return { ...body, name, ...(target !== undefined && { target }) };
+}
+function parseScheduleBody(rest, now) {
+    const trimmed = rest.trim();
+    if (!trimmed)
+        return { error: SCHEDULE_USAGE };
+    const tokens = trimmed.split(/\s+/);
+    const head = tokens[0].toLowerCase();
+    if (head === 'at') {
+        return parseAtSchedule(tokens, now, parseTimeOfDay, fmtTime, nextOccurrenceOfTime);
+    }
+    if (head === 'on') {
+        return parseOnSchedule(tokens, now, parseMonthDay, parseTimeOfDay, fmtTime, nextDateTime);
+    }
+    if (head === 'every') {
+        return parseEverySchedule(tokens, now, parseInterval, parseTimeOfDay, fmtTime, nextOccurrenceOfTime, nextWeekday);
+    }
+    return { error: SCHEDULE_USAGE };
+}

package/dist/schedule/manager.js

@@ -0,0 +1,101 @@
+import { computeNextRun, fmtNextRun } from './index.js';
+import { messageBus } from '../bus.js';
+import { notify } from '../notifications.js';
+// Owns the per-tab scheduled commands (keyed by tab label) and the 1-second firing loop: at each tick
+// it fires any entry whose next-run time has passed, reschedules recurring ones, and drops one-shots.
+// The controller owns the tabs and persistence; this module owns the schedule state and timing.
+export class ScheduleManager {
+    managers;
+    schedules = new Map();
+    timer;
+    constructor(managers) {
+        this.managers = managers;
+    }
+    // Begin the firing loop. `unref` so a pending tick never keeps the process alive on its own.
+    start() {
+        this.timer = setInterval(() => this.tick(), 1000);
+        this.timer.unref?.();
+    }
+    // Stop the firing loop (app shutdown).
+    stop() {
+        clearInterval(this.timer);
+    }
+    // A tab's scheduled commands, or undefined when it has none (raw — for persistence and the command
+    // context, both of which distinguish "no schedule" from "empty schedule").
+    get(label) {
+        return this.schedules.get(label);
+    }
+    // Replace a tab's scheduled commands. Persisting is the caller's concern (rehydrate/profile load
+    // restore without re-persisting; the `schedule` command persists separately).
+    set(label, entries) {
+        this.schedules.set(label, entries);
+    }
+    // Forget a tab's schedule (on tab close).
+    delete(label) {
+        this.schedules.delete(label);
+    }
+    // The schedule rows for a tab's view: id, spec, humanized next-run time, and the recurring flag.
+    view(label) {
+        return (this.schedules.get(label) ?? []).map((e) => ({
+            id: e.id, spec: e.spec, next: fmtNextRun(e.nextRun), recurring: e.recurring,
+        }));
+    }
+    // Fire any commands whose next-run time has passed, in every still-open tab. A recurring entry is
+    // rescheduled to its next run; a one-shot drops off. Tabs whose schedule changed are persisted
+    // (harness tabs excepted — they have no persisted agent state).
+    tick() {
+        const now = Date.now();
+        let changed = false;
+        for (const label of this.managers.tab.allLabels()) {
+            const tab = this.managers.tab.tabs.find((t) => t.label === label);
+            const sched = this.schedules.get(label);
+            if (!tab || !sched || sched.length === 0)
+                continue;
+            const remaining = this.fireDue(tab, sched, now);
+            if (!remaining)
+                continue;
+            this.schedules.set(label, remaining);
+            changed = true;
+            if (tab.view !== 'harness')
+                this.managers.tab.persist(this.managers.tab.buildAgentState(tab, { schedule: this.get(label) }));
+        }
+        if (changed)
+            messageBus.emit('state', { type: 'dirty' });
+    }
+    // Fire one tab's due entries, returning the surviving schedule (recurring entries rescheduled,
+    // one-shots dropped), or undefined when nothing fired.
+    fireDue(tab, sched, now) {
+        let isChanged = false;
+        const remaining = [];
+        for (const e of sched) {
+            if (e.nextRun > now || !this.fire(tab, e)) {
+                remaining.push(e);
+                continue;
+            }
+            isChanged = true;
+            if (e.recurring)
+                remaining.push({ ...e, nextRun: computeNextRun(e, new Date()) });
+        }
+        return isChanged ? remaining : undefined;
+    }
+    // Deliver a due entry to its tab: typed into a harness PTY as a line of input, or dispatched
+    // through an agent tab's command pipeline. Returns false when delivery must wait (the harness
+    // is not running), leaving the entry due so it retries on a later tick.
+    fire(tab, e) {
+        if (tab.view === 'harness') {
+            if (tab.harness?.status !== 'running' || !tab.harness.ptyId)
+                return false;
+            // Sent as one write, a long command's trailing \r can land inside the same burst the harness's
+            // own input parser treats as a paste, so it's read as inserted text rather than submit. Splitting
+            // the \r into its own write after the text has been processed mimics organic typing and avoids that.
+            const ptyId = tab.harness.ptyId;
+            this.managers.pty.input(ptyId, e.command);
+            setTimeout(() => this.managers.pty.input(ptyId, '\r'), 50);
+            notify(this.managers, 'schedule-fire', tab.label, e.command);
+            return true;
+        }
+        this.managers.command.dispatchTo(tab.label, `${e.command} ## scheduled ##`);
+        notify(this.managers, 'schedule-fire', tab.label, e.command);
+        return true;
+    }
+}

package/dist/schedule/parsing.js

@@ -0,0 +1,63 @@
+const MONTHS = [
+    'january', 'february', 'march', 'april', 'may', 'june',
+    'july', 'august', 'september', 'october', 'november', 'december',
+];
+const UNIT_MS = { m: 60_000, h: 3_600_000, d: 86_400_000, w: 604_800_000 };
+export { MONTHS };
+export function parseTimeOfDay(tok) {
+    // Anchored at both ends; bounded quantifiers only — not a ReDoS risk.
+    // eslint-disable-next-line security/detect-unsafe-regex
+    const m = /^(\d{1,2})(?::(\d{2}))?\s*(am|pm)?$/i.exec(tok.trim());
+    if (!m)
+        return undefined;
+    let hour = Number(m[1]);
+    const minute = m[2] ? Number(m[2]) : 0;
+    const ap = m[3]?.toLowerCase();
+    if (ap) {
+        if (hour < 1 || hour > 12)
+            return undefined;
+        if (ap === 'pm' && hour !== 12)
+            hour += 12;
+        if (ap === 'am' && hour === 12)
+            hour = 0;
+    }
+    else if (hour > 23) {
+        return undefined;
+    }
+    if (minute > 59)
+        return undefined;
+    return { hour, minute };
+}
+export function parseInterval(tok) {
+    const m = /^(\d+)(m|h|d|w)$/i.exec(tok.trim());
+    if (!m)
+        return undefined;
+    const n = Number(m[1]);
+    if (n <= 0)
+        return undefined;
+    return n * UNIT_MS[m[2].toLowerCase()];
+}
+export function parseMonthDay(tokens) {
+    const first = tokens[0];
+    if (!first)
+        return undefined;
+    const slash = /^(\d{1,2})\/(\d{1,2})$/.exec(first);
+    if (slash) {
+        const month = Number(slash[1]) - 1;
+        const day = Number(slash[2]);
+        if (month < 0 || month > 11 || day < 1 || day > 31)
+            return undefined;
+        return { month, day, consumed: 1 };
+    }
+    const lc = first.toLowerCase();
+    const month = lc.length >= 3 ? MONTHS.findIndex((m) => m.startsWith(lc)) : -1;
+    if (month < 0)
+        return undefined;
+    const dm = /^(\d{1,2})(?:st|nd|rd|th)?$/i.exec(tokens[1] ?? '');
+    if (!dm)
+        return undefined;
+    const day = Number(dm[1]);
+    if (day < 1 || day > 31)
+        return undefined;
+    return { month, day, consumed: 2 };
+}

package/dist/schedule/time.js

@@ -0,0 +1,34 @@
+export function nextOccurrenceOfTime(hour, minute, now) {
+    const d = new Date(now);
+    d.setHours(hour, minute, 0, 0);
+    if (d.getTime() <= now.getTime())
+        d.setDate(d.getDate() + 1);
+    return d.getTime();
+}
+export function nextWeekday(weekday, hour, minute, now) {
+    const d = new Date(now);
+    d.setHours(hour, minute, 0, 0);
+    let diff = (weekday - d.getDay() + 7) % 7;
+    if (diff === 0 && d.getTime() <= now.getTime())
+        diff = 7;
+    d.setDate(d.getDate() + diff);
+    return d.getTime();
+}
+export function nextDateTime(month, day, hour, minute, now) {
+    const year = now.getFullYear();
+    const d = new Date(year, month, day, hour, minute, 0, 0);
+    if (d.getTime() <= now.getTime())
+        d.setFullYear(year + 1);
+    return d.getTime();
+}
+export function computeNextRun(entry, now) {
+    if (entry.intervalMs)
+        return now.getTime() + entry.intervalMs;
+    if (entry.timeOfDay) {
+        const { hour, minute } = entry.timeOfDay;
+        return entry.weekday === undefined
+            ? nextOccurrenceOfTime(hour, minute, now)
+            : nextWeekday(entry.weekday, hour, minute, now);
+    }
+    return now.getTime();
+}

package/dist/schedule-display.js

@@ -0,0 +1,19 @@
+import { MONTHS } from './schedule-parsing.js';
+export function fmtTime({ hour, minute }) {
+    const ap = hour < 12 ? 'am' : 'pm';
+    const h = hour % 12 === 0 ? 12 : hour % 12;
+    return `${h}:${String(minute).padStart(2, '0')}${ap}`;
+}
+export function fmtNextRun(ts) {
+    const d = new Date(ts);
+    const mon = MONTHS[d.getMonth()];
+    const month = mon[0].toUpperCase() + mon.slice(1, 3);
+    return `${month} ${d.getDate()} ${fmtTime({ hour: d.getHours(), minute: d.getMinutes() })}`;
+}
+export function formatSchedule(entries) {
+    if (entries.length === 0)
+        return 'No scheduled commands.';
+    return entries
+        .map((e) => `${e.id}  ${e.spec}  (next: ${fmtNextRun(e.nextRun)})  ${e.command}`)
+        .join('\n');
+}