kimaki 0.24.0 → 0.26.0

package/dist/opencode.js

@@ -5,11 +5,32 @@
 // specific project. The server lazily creates and caches an Instance per unique
 // directory path internally.
 //
-// Per-directory permissions (external_directory rules for worktrees, tmpdir,
-// etc.) are passed via session.create({ permission }) at session creation time,
-// NOT via the server config. The server config has permissive defaults
-// (edit: allow, bash: allow, external_directory: ask) and session-level rules
-// override them via opencode's findLast() evaluation (last matching rule wins).
+// Permission layering — READ THIS BEFORE ADDING A PERMISSION RULE.
+//
+// opencode evaluates permissions with findLast() over a flattened list, so the
+// last matching rule wins. The order is:
+//
+//   opencode built-in defaults
+//     ▼
+//   merged config files  ── kimaki's generated config, THEN the user's
+//     ▼                     project opencode.json (deep-merged on top)
+//   config.agent.<name>.permission
+//     ▼
+//   session.permission   ── buildSessionPermissions(), always wins
+//
+// Directory ALLOW rules therefore belong in the generated server config, never
+// in session rules or an agent block: a project opencode.json must still be
+// able to `deny` or `ask` for specific folders. Anything placed in
+// session.permission silently overrides the user.
+//
+// external_directory is `{ '*': 'allow' }` by default. opencode's own default
+// is `ask`, which meant the agent had to interrupt the user for ordinary reads
+// outside the project, and an unanswered prompt was auto-rejected on TTL. Users
+// who want stricter behaviour add `deny`/`ask` rules to their own
+// opencode.json, or start kimaki with --restrict-directories.
+//
+// session.permission carries exactly one thing: the worktree original-checkout
+// deny, which must beat user config on purpose.
 //
 // Uses errore for type-safe error handling.
 import { spawn, execFileSync } from 'node:child_process';
@@ -23,7 +44,7 @@ import { fileURLToPath } from 'node:url';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 import { createOpencodeClient, } from '@opencode-ai/sdk/v2';
 import { restartGlobalEventListener, waitForGlobalEventListener, } from './session-handler/global-event-listener.js';
-import { getDataDir, getLockPort, } from './config.js';
+import { getDataDir, getLockPort, getRestrictExternalDirectories, } from './config.js';
 import { store } from './store.js';
 import { getHranaUrl } from './hrana-server.js';
 import * as errore from 'errore';
@@ -369,8 +390,8 @@ async function waitForServer({ port, directory, maxAttempts = 300, startupStderr
 }
 // ── Single server lifecycle ──────────────────────────────────────
 // The server is started lazily on first initializeOpencodeForDirectory() call.
-// It uses permissive defaults (edit: allow, bash: allow, external_directory: ask).
-// Per-directory permissions are applied at session creation time instead.
+// It uses permissive defaults (edit: allow, bash: allow, webfetch: allow, and
+// external_directory: '*' allow unless --restrict-directories is set).
 // In-flight promise to prevent concurrent startups from racing
 let startingServer = null;
 let preferredStartupDirectory = null;
@@ -465,37 +486,15 @@ async function startSingleServer({ directory, } = {}) {
         resolvedCommand: resolveOpencodeCommand(),
         baseArgs: serveArgs,
     });
-    // Server config uses permissive defaults. Per-directory external_directory
-    // permissions are set at session creation time via session.create({ permission }).
-    // Common directories (tmpdir, ~/.config/opencode, ~/.kimaki) are pre-allowed
-    // at the server level so they never trigger permission prompts regardless of
-    // whether session-level rules compose correctly.
-    const tmpdir = os.tmpdir().replaceAll('\\', '/');
-    const opencodeConfigDir = path
-        .join(os.homedir(), '.config', 'opencode')
-        .replaceAll('\\', '/');
-    const opensrcDir = path
-        .join(os.homedir(), '.opensrc')
-        .replaceAll('\\', '/');
-    const kimakiDataDir = path
-        .join(os.homedir(), '.kimaki')
-        .replaceAll('\\', '/');
-    // No catch-all '*': 'ask' here — the user's opencode.json default is respected.
-    // Only allowlist specific known-safe directories at the server level.
-    const externalDirectoryPermissions = {
-        '/tmp': 'allow',
-        '/tmp/*': 'allow',
-        '/private/tmp': 'allow',
-        '/private/tmp/*': 'allow',
-        [tmpdir]: 'allow',
-        [`${tmpdir}/*`]: 'allow',
-        [opencodeConfigDir]: 'allow',
-        [`${opencodeConfigDir}/*`]: 'allow',
-        [opensrcDir]: 'allow',
-        [`${opensrcDir}/*`]: 'allow',
-        [kimakiDataDir]: 'allow',
-        [`${kimakiDataDir}/*`]: 'allow',
-    };
+    // Server config uses permissive defaults. By default every external directory
+    // is allowed: opencode's own 'ask' default produced constant permission
+    // prompts for ordinary reads, and users who want protection can add their own
+    // `deny`/`ask` rules in opencode.json (project config is loaded after this
+    // file, so it wins).
+    // With --restrict-directories the old behaviour comes back: only a small set
+    // of known-safe paths is pre-allowed and everything else falls through to the
+    // user's opencode.json default (which is 'ask' unless they changed it).
+    const externalDirectoryPermissions = buildServerExternalDirectoryPermissions();
     const kimakiShimDirectory = ensureKimakiCommandShim({
         dataDir: getDataDir(),
         execPath: process.execPath,
@@ -577,7 +576,11 @@ async function startSingleServer({ directory, } = {}) {
                     webfetch: 'allow',
                     websearch: 'allow',
                     codesearch: 'allow',
-                    external_directory: externalDirectoryPermissions,
+                    // No external_directory here on purpose. opencode composes agents as
+                    // merge(defaults, agentSpecific, userConfig) and then appends
+                    // config.agent.<name>.permission LAST, so anything set here would beat
+                    // the user's own top-level opencode.json rules. The top-level
+                    // permission block above already covers this agent.
                 },
             },
         },
@@ -817,71 +820,98 @@ export async function initializeOpencodeForDirectory(directory, _options) {
     };
 }
 /**
- * Build per-session permission rules for external_directory access.
- * These rules are passed to session.create({ permission }) and override
- * the server-level defaults via opencode's findLast() evaluation.
+ * Known-safe paths that never need an external_directory prompt, used only when
+ * --restrict-directories is active. Without the flag every path is allowed and
+ * this list is irrelevant.
+ */
+function knownSafeExternalDirectories() {
+    const tmpdir = os.tmpdir().replaceAll('\\', '/');
+    const homeDirectory = ({ relativePath }) => {
+        return path.resolve(os.homedir(), relativePath.replaceAll('\\', '/'));
+    };
+    return [
+        '/tmp',
+        '/private/tmp',
+        tmpdir,
+        // The agent can read the global AGENTS.md and opencode config; the path is
+        // visible in the system prompt so models routinely try to open it.
+        homeDirectory({ relativePath: '.config/opencode' }),
+        // The Anthropic plugin rewrites the name in the system prompt, so some
+        // models try this misspelled path instead.
+        homeDirectory({ relativePath: '.config/openc0de' }),
+        // Cached opensrc checkouts.
+        homeDirectory({ relativePath: '.opensrc' }),
+        // Kimaki data dir (logs, db, etc).
+        homeDirectory({ relativePath: '.kimaki' }),
+        // Prior opencode tool outputs.
+        homeDirectory({ relativePath: '.local/share/opencode/tool-output' }),
+        // Language toolchain caches, so builds can inspect downloaded modules.
+        homeDirectory({ relativePath: '.cache/zig' }),
+        homeDirectory({ relativePath: '.cargo' }),
+        homeDirectory({ relativePath: '.cache/go-build' }),
+        homeDirectory({ relativePath: 'go/pkg' }),
+    ];
+}
+/**
+ * Build the server-level `permission.external_directory` value.
  *
- * This replaces the old per-server OPENCODE_CONFIG_CONTENT external_directory
- * permissions — now each session carries its own directory-scoped rules.
+ * Default: `{ '*': 'allow' }` — no prompt for any directory.
+ * With --restrict-directories: an allow-list of known-safe paths only. There is
+ * deliberately no catch-all '*': 'ask' entry so opencode's own 'ask' default
+ * still applies to everything else.
+ *
+ * Always an object, never the plain string 'allow'. opencode deep-merges config
+ * files (remeda mergeDeep) and this file is loaded before the project's
+ * opencode.json, so object keys from the project merge on top of these and win
+ * via findLast(). A plain string would instead be replaced wholesale by the
+ * project object, dropping allow-all for every unmatched path.
+ */
+function buildServerExternalDirectoryPermissions() {
+    if (!getRestrictExternalDirectories()) {
+        return { [ALL_EXTERNAL_DIRECTORIES_PATTERN]: 'allow' };
+    }
+    const permissions = {};
+    for (const directory of knownSafeExternalDirectories()) {
+        permissions[directory] = 'allow';
+        permissions[`${directory}/*`] = 'allow';
+    }
+    return permissions;
+}
+/**
+ * Build the per-session permission ruleset passed to session.create/update.
+ *
+ * Keep this list minimal. Session rules are the LAST ruleset opencode
+ * evaluates — `Permission.merge(agent.permission, session.permission)` in
+ * session/tools.ts, then `findLast()` in permission/index.ts — so every rule
+ * here silently overrides the user's own opencode.json. Only rules that must
+ * beat user config belong here.
+ *
+ * In particular, directory *allow* rules must NOT go here. They live in the
+ * server config so a project opencode.json can still deny or ask for specific
+ * folders. Putting an `external_directory: '*' allow` rule here would make
+ * every user `deny` rule a no-op.
+ *
+ * The session's own working directory never needs a rule either: opencode skips
+ * the external_directory gate entirely for paths inside the active instance
+ * (`containsPath` in tool/external-directory.ts).
+ *
+ * That leaves one rule: worktree isolation. Once a thread moves to a managed
+ * worktree, deny the original checkout so the agent stops editing the main repo.
  */
 export function buildSessionPermissions({ directory, originalRepoDirectory, }) {
     // Normalize path separators for cross-platform compatibility (Windows uses backslashes)
-    const tmpdir = os.tmpdir().replaceAll('\\', '/');
     const normalizedDirectory = directory.replaceAll('\\', '/');
     const originalRepo = originalRepoDirectory?.replaceAll('\\', '/');
-    const rules = [
-        // Allow tmpdir access
-        { permission: 'external_directory', pattern: '/tmp', action: 'allow' },
-        { permission: 'external_directory', pattern: '/tmp/*', action: 'allow' },
-        { permission: 'external_directory', pattern: '/private/tmp', action: 'allow' },
-        { permission: 'external_directory', pattern: '/private/tmp/*', action: 'allow' },
-        { permission: 'external_directory', pattern: tmpdir, action: 'allow' },
-        { permission: 'external_directory', pattern: `${tmpdir}/*`, action: 'allow' },
-        // Allow the project directory itself
-        { permission: 'external_directory', pattern: normalizedDirectory, action: 'allow' },
-        { permission: 'external_directory', pattern: `${normalizedDirectory}/*`, action: 'allow' },
-    ];
-    const homeDirectoryRules = ({ relativePath }) => {
-        const normalizedRelativePath = relativePath.replaceAll('\\', '/');
-        const basePattern = path.resolve(os.homedir(), normalizedRelativePath);
-        return [
-            { permission: 'external_directory', pattern: basePattern, action: 'allow' },
-            { permission: 'external_directory', pattern: `${basePattern}/*`, action: 'allow' },
-        ];
-    };
-    // Allow ~/.config/opencode so the agent doesn't get permission prompts when
-    // it tries to read the global AGENTS.md or opencode config (the path is
-    // visible in the system prompt, so models sometimes try to read it).
-    rules.push(...homeDirectoryRules({ relativePath: '.config/opencode' }));
-    // Allow ~/.config/openc0de too because the Anthropic plugin rewrites the
-    // name in the system prompt and some models may try to inspect that path.
-    rules.push(...homeDirectoryRules({ relativePath: '.config/openc0de' }));
-    // Allow ~/.opensrc so agents can inspect cached opensrc checkouts without
-    // permission prompts.
-    rules.push(...homeDirectoryRules({ relativePath: '.opensrc' }));
-    // Allow ~/.kimaki so the agent can access kimaki data dir (logs, db, etc.)
-    // without permission prompts.
-    rules.push(...homeDirectoryRules({ relativePath: '.kimaki' }));
-    // Allow opencode tool output artifacts under XDG data so agents can inspect
-    // prior tool outputs without interactive permission prompts.
-    rules.push(...homeDirectoryRules({ relativePath: '.local/share/opencode/tool-output' }));
-    // Allow common language caches under the user's home directory so toolchains
-    // can inspect downloaded modules and artifacts without external_directory prompts.
-    rules.push(...homeDirectoryRules({ relativePath: '.cache/zig' }), ...homeDirectoryRules({ relativePath: '.cargo' }), ...homeDirectoryRules({ relativePath: '.cache/go-build' }), ...homeDirectoryRules({ relativePath: 'go/pkg' }));
-    // For worktree sessions: explicitly deny the original checkout so agents do
-    // not keep editing the main repo after the thread has moved to a managed
-    // worktree. Deny rules are appended last so they override earlier allow/
-    // ask defaults via opencode's findLast() evaluation.
-    if (originalRepo && originalRepo !== normalizedDirectory) {
-        rules.push(...buildExternalDirectoryPermissionRules({
-            resolvedPattern: originalRepo,
-            action: 'deny',
-        }));
+    if (!originalRepo || originalRepo === normalizedDirectory) {
+        return [];
     }
-    return rules;
+    return buildExternalDirectoryPermissionRules({
+        resolvedPattern: originalRepo,
+        action: 'deny',
+    });
 }
 const ALL_EXTERNAL_DIRECTORIES_PATTERN = '*';
-export function buildExternalDirectoryPermissionRules({ resolvedPattern, action, }) {
+function buildExternalDirectoryPermissionRules({ resolvedPattern, action, }) {
     if (resolvedPattern === ALL_EXTERNAL_DIRECTORIES_PATTERN) {
         return [
             {

package/dist/queue-advanced-e2e-setup.js

@@ -34,8 +34,8 @@ export function chooseLockPort({ channelId }) {
     }
     return 51_000 + (Math.abs(hash) % 2_000);
 }
-export const CHANNEL_REFERENCE_EXTERNAL_DIR = path.resolve(process.cwd(), 'tmp', 'kimaki-channel-reference-external');
-export const CHANNEL_REFERENCE_EXTERNAL_FILE = `${CHANNEL_REFERENCE_EXTERNAL_DIR}/allowed.txt`;
+export const EXTERNAL_DIRECTORY_PROBE_DIR = path.resolve(process.cwd(), 'tmp', 'kimaki-external-directory-probe');
+export const EXTERNAL_DIRECTORY_PROBE_FILE = `${EXTERNAL_DIRECTORY_PROBE_DIR}/probe.txt`;
 export function createDiscordJsClient({ restUrl }) {
     return new Client({
         intents: [
@@ -265,28 +265,28 @@ export function createDeterministicMatchers() {
             partDelaysMs: [0, 0, 0, 0, 8_000],
         },
     };
-    const channelReferencePermissionMatcher = {
-        id: 'channel-reference-permission-marker',
+    const externalDirectoryProbeMatcher = {
+        id: 'external-directory-probe-marker',
         priority: 106,
         when: {
             lastMessageRole: 'user',
-            latestUserTextIncludes: 'CHANNEL_REFERENCE_PERMISSION_MARKER',
+            latestUserTextIncludes: 'EXTERNAL_DIRECTORY_PROBE_MARKER',
         },
         then: {
             parts: [
                 { type: 'stream-start', warnings: [] },
-                { type: 'text-start', id: 'channel-reference-permission-start' },
+                { type: 'text-start', id: 'external-directory-probe-start' },
                 {
                     type: 'text-delta',
-                    id: 'channel-reference-permission-start',
-                    delta: 'reading referenced channel directory',
+                    id: 'external-directory-probe-start',
+                    delta: 'reading external directory',
                 },
-                { type: 'text-end', id: 'channel-reference-permission-start' },
+                { type: 'text-end', id: 'external-directory-probe-start' },
                 {
                     type: 'tool-call',
-                    toolCallId: 'channel-reference-read-call',
+                    toolCallId: 'external-directory-read-call',
                     toolName: 'read',
-                    input: JSON.stringify({ filePath: CHANNEL_REFERENCE_EXTERNAL_FILE }),
+                    input: JSON.stringify({ filePath: EXTERNAL_DIRECTORY_PROBE_FILE }),
                 },
                 {
                     type: 'finish',
@@ -296,23 +296,52 @@ export function createDeterministicMatchers() {
             ],
         },
     };
-    const channelReferencePermissionFollowupMatcher = {
-        id: 'channel-reference-permission-followup',
+    // Fires only when the read above was rejected by a permission rule. Scoped to
+    // the probe marker so it cannot cascade into unrelated turns. This is what
+    // makes a project-level `deny` visible in Discord: without it an allowed read
+    // and a denied read produce identical thread output.
+    const externalDirectoryProbeDeniedMatcher = {
+        id: 'external-directory-probe-denied',
+        priority: 107,
+        when: {
+            latestUserTextIncludes: 'EXTERNAL_DIRECTORY_PROBE_MARKER',
+            rawPromptIncludes: 'prevents you from using this specific tool call',
+        },
+        then: {
+            parts: [
+                { type: 'stream-start', warnings: [] },
+                { type: 'text-start', id: 'external-directory-probe-denied' },
+                {
+                    type: 'text-delta',
+                    id: 'external-directory-probe-denied',
+                    delta: 'external-directory-probe-denied',
+                },
+                { type: 'text-end', id: 'external-directory-probe-denied' },
+                {
+                    type: 'finish',
+                    finishReason: 'stop',
+                    usage: { inputTokens: 1, outputTokens: 1, totalTokens: 2 },
+                },
+            ],
+        },
+    };
+    const externalDirectoryProbeFollowupMatcher = {
+        id: 'external-directory-probe-followup',
         priority: 105,
         when: {
-            latestUserTextIncludes: 'CHANNEL_REFERENCE_PERMISSION_MARKER',
-            rawPromptIncludes: 'reading referenced channel directory',
+            latestUserTextIncludes: 'EXTERNAL_DIRECTORY_PROBE_MARKER',
+            rawPromptIncludes: 'reading external directory',
         },
         then: {
             parts: [
                 { type: 'stream-start', warnings: [] },
-                { type: 'text-start', id: 'channel-reference-permission-followup' },
+                { type: 'text-start', id: 'external-directory-probe-followup' },
                 {
                     type: 'text-delta',
-                    id: 'channel-reference-permission-followup',
-                    delta: 'channel-reference-read-done',
+                    id: 'external-directory-probe-followup',
+                    delta: 'external-directory-probe-done',
                 },
-                { type: 'text-end', id: 'channel-reference-permission-followup' },
+                { type: 'text-end', id: 'external-directory-probe-followup' },
                 {
                     type: 'finish',
                     finishReason: 'stop',
@@ -733,8 +762,9 @@ export function createDeterministicMatchers() {
         questionSelectQueueMatcher,
         permissionTypingMatcher,
         permissionTypingFollowupMatcher,
-        channelReferencePermissionMatcher,
-        channelReferencePermissionFollowupMatcher,
+        externalDirectoryProbeMatcher,
+        externalDirectoryProbeDeniedMatcher,
+        externalDirectoryProbeFollowupMatcher,
         multiToolMatcher,
         multiToolFollowupMatcher,
         undoFileMatcher,
@@ -757,7 +787,7 @@ export const TEST_USER_ID = '200000000000000991';
  * Each caller should use a unique channelId and dirName to avoid collisions
  * when vitest runs files in parallel.
  */
-export function setupQueueAdvancedSuite({ channelId, channelName, extraChannels = [], dirName, username, }) {
+export function setupQueueAdvancedSuite({ channelId, channelName, dirName, username, restrictExternalDirectories = false, projectPermission, }) {
     const ctx = {
         directories: undefined,
         discord: undefined,
@@ -765,6 +795,7 @@ export function setupQueueAdvancedSuite({ channelId, channelName, extraChannels
         testStartTime: Date.now(),
     };
     let previousDefaultVerbosity = null;
+    let previousRestrictExternalDirectories = null;
     beforeAll(async () => {
         ctx.testStartTime = Date.now();
         ctx.directories = createRunDirectories({ name: dirName });
@@ -777,15 +808,13 @@ export function setupQueueAdvancedSuite({ channelId, channelName, extraChannels
         process.env['KIMAKI_OPENCODE_SESSION_EVENTS_DIR'] = sessionEventsDir;
         setDataDir(ctx.directories.dataDir);
         previousDefaultVerbosity = store.getState().defaultVerbosity;
-        store.setState({ defaultVerbosity: 'tools_and_text' });
+        previousRestrictExternalDirectories = store.getState().restrictExternalDirectories;
+        store.setState({ defaultVerbosity: 'tools_and_text', restrictExternalDirectories });
         const digitalDiscordDbPath = path.join(ctx.directories.dataDir, 'digital-discord.db');
         ctx.discord = new DigitalDiscord({
             guild: { name: `${dirName} Guild`, ownerId: TEST_USER_ID },
             channels: [
                 { id: channelId, name: channelName, type: ChannelType.GuildText },
-                ...extraChannels.map((channel) => {
-                    return { id: channel.id, name: channel.name, type: ChannelType.GuildText };
-                }),
             ],
             users: [{ id: TEST_USER_ID, username }],
             dbUrl: `file:${digitalDiscordDbPath}`,
@@ -801,7 +830,9 @@ export function setupQueueAdvancedSuite({ channelId, channelName, extraChannels
             smallModel: 'deterministic-v3',
             settings: { strict: false, matchers: createDeterministicMatchers() },
         });
-        fs.writeFileSync(path.join(ctx.directories.projectDirectory, 'opencode.json'), JSON.stringify(opencodeConfig, null, 2));
+        fs.writeFileSync(path.join(ctx.directories.projectDirectory, 'opencode.json'), JSON.stringify(projectPermission
+            ? { ...opencodeConfig, permission: projectPermission }
+            : opencodeConfig, null, 2));
         const dbPath = path.join(ctx.directories.dataDir, 'discord-sessions.db');
         const hranaResult = await startHranaServer({ dbPath });
         if (hranaResult instanceof Error) {
@@ -853,6 +884,11 @@ export function setupQueueAdvancedSuite({ channelId, channelName, extraChannels
         if (previousDefaultVerbosity) {
             store.setState({ defaultVerbosity: previousDefaultVerbosity });
         }
+        if (previousRestrictExternalDirectories !== null) {
+            store.setState({
+                restrictExternalDirectories: previousRestrictExternalDirectories,
+            });
+        }
         if (ctx.directories) {
             fs.rmSync(ctx.directories.dataDir, { recursive: true, force: true });
         }

package/dist/queue-advanced-permissions-typing.e2e.test.js

@@ -27,6 +27,10 @@ describe('queue advanced: typing around permissions', () => {
         channelName: 'qa-permission-typing-e2e',
         dirName: 'qa-permission-typing-e2e',
         username: 'queue-permission-tester',
+        // These tests are about the permission button + typing lifecycle, so they
+        // need a permission prompt to actually fire. The shipped default allows
+        // every directory, so opt into the --restrict-directories behaviour here.
+        restrictExternalDirectories: true,
     });
     test('permission prompt pauses typing until user click, then typing resumes for long follow-up step', async () => {
         await ctx.discord.channel(TEXT_CHANNEL_ID).user(TEST_USER_ID).sendMessage({

package/dist/schema.js

@@ -164,6 +164,20 @@ export const scheduled_tasks = sqliteCore.sqliteTable('scheduled_tasks', {
     sqliteCore.index('scheduled_tasks_channel_id_status_idx').on(table.channel_id, table.status),
     sqliteCore.index('scheduled_tasks_thread_id_status_idx').on(table.thread_id, table.status),
 ]);
+export const scheduled_task_runs = sqliteCore.sqliteTable('scheduled_task_runs', {
+    id: sqliteCore.integer('id', { mode: 'number' }).primaryKey({ autoIncrement: true }).notNull(),
+    scheduled_task_id: sqliteCore.integer('scheduled_task_id', { mode: 'number' }).notNull().references(() => scheduled_tasks.id, { onDelete: 'cascade', onUpdate: 'cascade' }),
+    status: sqliteCore.text('status', { enum: ['pending', 'running', 'completed', 'skipped', 'failed'] }).notNull().default('pending'),
+    thread_id: sqliteCore.text('thread_id'),
+    session_id: sqliteCore.text('session_id'),
+    project_directory: sqliteCore.text('project_directory'),
+    started_at: datetime('started_at').notNull(),
+    completed_at: datetime('completed_at'),
+    error: sqliteCore.text('error'),
+}, (table) => [
+    sqliteCore.index('scheduled_task_runs_task_status_idx').on(table.scheduled_task_id, table.status),
+    sqliteCore.index('scheduled_task_runs_session_status_idx').on(table.session_id, table.status),
+]);
 export const session_start_sources = sqliteCore.sqliteTable('session_start_sources', {
     session_id: sqliteCore.text('session_id').primaryKey().notNull(),
     schedule_kind: sqliteCore.text('schedule_kind', { enum: ['at', 'cron'] }).notNull(),
@@ -215,6 +229,7 @@ export const relations = defineRelations({
     channel_mention_mode,
     global_models,
     scheduled_tasks,
+    scheduled_task_runs,
     session_start_sources,
     forum_sync_configs,
     ipc_requests,
@@ -278,8 +293,12 @@ export const relations = defineRelations({
     scheduled_tasks: {
         channel: r.one.channel_directories({ from: r.scheduled_tasks.channel_id, to: r.channel_directories.channel_id }),
         thread: r.one.thread_sessions({ from: r.scheduled_tasks.thread_id, to: r.thread_sessions.thread_id }),
+        runs: r.many.scheduled_task_runs(),
         session_start_sources: r.many.session_start_sources(),
     },
+    scheduled_task_runs: {
+        scheduled_task: r.one.scheduled_tasks({ from: r.scheduled_task_runs.scheduled_task_id, to: r.scheduled_tasks.id }),
+    },
     session_start_sources: {
         scheduled_task: r.one.scheduled_tasks({ from: r.session_start_sources.scheduled_task_id, to: r.scheduled_tasks.id }),
     },

package/dist/session-handler/event-stream-state.js

@@ -184,6 +184,153 @@ export function getCurrentTurnStartTime({ events, sessionId, upToIndex, }) {
 function getTokenTotal(tokens) {
     return tokens.input + tokens.output + tokens.reasoning + tokens.cache.read + tokens.cache.write;
 }
+function emptyTurnTokenUsage() {
+    return {
+        input: 0,
+        output: 0,
+        reasoning: 0,
+        cacheRead: 0,
+        cacheWrite: 0,
+        total: 0,
+        cost: 0,
+        model: undefined,
+        providerID: undefined,
+        assistantMessageCount: 0,
+        userMessageId: undefined,
+    };
+}
+// Latest billed token snapshot for the current user turn.
+// Sums the last message.updated tokens per assistant message id so streaming
+// updates are not double-counted. Scoped to sessionId so subagent idles
+// report their own usage.
+export function getLatestTurnTokenUsage({ events, sessionId, upToIndex, }) {
+    const latestUserMessage = getLatestUserMessage({
+        events,
+        sessionId,
+        upToIndex,
+    });
+    if (!latestUserMessage) {
+        return emptyTurnTokenUsage();
+    }
+    const end = upToIndex ?? events.length - 1;
+    const latestByMessageId = new Map();
+    for (let i = 0; i <= end; i++) {
+        const entry = events[i];
+        if (!entry) {
+            continue;
+        }
+        const event = entry.event;
+        if (event.type !== 'message.updated') {
+            continue;
+        }
+        const info = event.properties.info;
+        if (info.sessionID !== sessionId || info.role !== 'assistant') {
+            continue;
+        }
+        if (info.parentID !== latestUserMessage.id) {
+            continue;
+        }
+        latestByMessageId.set(info.id, info);
+    }
+    if (latestByMessageId.size === 0) {
+        return {
+            ...emptyTurnTokenUsage(),
+            userMessageId: latestUserMessage?.id,
+        };
+    }
+    const usage = emptyTurnTokenUsage();
+    usage.userMessageId = latestUserMessage.id;
+    usage.assistantMessageCount = latestByMessageId.size;
+    for (const message of latestByMessageId.values()) {
+        if (message.tokens) {
+            usage.input += message.tokens.input;
+            usage.output += message.tokens.output;
+            usage.reasoning += message.tokens.reasoning;
+            usage.cacheRead += message.tokens.cache.read;
+            usage.cacheWrite += message.tokens.cache.write;
+            usage.total += message.tokens.total ?? getTokenTotal(message.tokens);
+        }
+        usage.cost += message.cost;
+        usage.model = message.modelID;
+        usage.providerID = message.providerID;
+    }
+    return usage;
+}
+function findFirstUserMessageIndex({ events, userMessageId, upToIndex, }) {
+    for (let i = 0; i <= upToIndex; i++) {
+        const event = events[i]?.event;
+        if (event?.type !== 'message.updated') {
+            continue;
+        }
+        if (event.properties.info.id === userMessageId) {
+            return i;
+        }
+    }
+    return undefined;
+}
+function findPreviousIdleIndexInTurn({ events, sessionId, firstUserMessageIndex, beforeIndex, }) {
+    for (let i = beforeIndex - 1; i > firstUserMessageIndex; i--) {
+        const event = events[i]?.event;
+        if (event?.type === 'session.idle' && event.properties.sessionID === sessionId) {
+            return i;
+        }
+    }
+    return undefined;
+}
+function subtractTokenUsage({ current, previous, }) {
+    return {
+        input: current.input - previous.input,
+        output: current.output - previous.output,
+        reasoning: current.reasoning - previous.reasoning,
+        cacheRead: current.cacheRead - previous.cacheRead,
+        cacheWrite: current.cacheWrite - previous.cacheWrite,
+        total: current.total - previous.total,
+        cost: current.cost - previous.cost,
+        model: current.model,
+        providerID: current.providerID,
+        assistantMessageCount: current.assistantMessageCount,
+        userMessageId: current.userMessageId,
+    };
+}
+// Tokens billed since the previous session.idle in this user turn.
+// Survives process restart because both idles stay in the event buffer.
+export function getIdleTokenUsageDelta({ events, sessionId, idleEventIndex, }) {
+    const current = getLatestTurnTokenUsage({
+        events,
+        sessionId,
+        upToIndex: idleEventIndex,
+    });
+    if (!current.userMessageId) {
+        return undefined;
+    }
+    const firstUserMessageIndex = findFirstUserMessageIndex({
+        events,
+        userMessageId: current.userMessageId,
+        upToIndex: idleEventIndex,
+    });
+    if (firstUserMessageIndex === undefined) {
+        return undefined;
+    }
+    const previousIdleIndex = findPreviousIdleIndexInTurn({
+        events,
+        sessionId,
+        firstUserMessageIndex,
+        beforeIndex: idleEventIndex,
+    });
+    if (previousIdleIndex === undefined) {
+        return current.total > 0 ? current : undefined;
+    }
+    const previous = getLatestTurnTokenUsage({
+        events,
+        sessionId,
+        upToIndex: previousIdleIndex,
+    });
+    const delta = subtractTokenUsage({ current, previous });
+    if (delta.total <= 0) {
+        return undefined;
+    }
+    return delta;
+}
 // Scans backward for most recent message.updated with role=assistant for sessionId.
 // Extracts model, providerID, agent, tokensUsed.
 export function getLatestRunInfo({ events, sessionId, upToIndex, }) {