mixdog 1.3.3 → 1.3.5

package/src/session-runtime/model-route/route-tuning.mjs

@@ -17,10 +17,14 @@ export function createRouteTuning(deps, persist) {
    *  is already the Main model (persistAdoptedModelSettings: tunesNonMainModel),
    *  so the lead preset's model is rewritten with itself and never changes. A
    *  live route without a model normalizes to nothing and writes no preset. */
-  async function commitRouteTuning(fastCapable, modelMeta) {
-    persist.saveRouteModelSettings(getRoute(), fastCapable);
-    const leadRoute = persist.persistAdoptedModelSettings(getRoute());
-    if (leadRoute) setRouteState(resolveRoute(getConfig(), { model: workflowPresetId('lead') }));
+  async function commitRouteTuning(fastCapable, modelMeta, { sessionOnly = false } = {}) {
+    // sessionOnly: the live route and session change; the saved model
+    // settings and the config stay as the user left them.
+    if (!sessionOnly) {
+      persist.saveRouteModelSettings(getRoute(), fastCapable);
+      const leadRoute = persist.persistAdoptedModelSettings(getRoute());
+      if (leadRoute) setRouteState(resolveRoute(getConfig(), { model: workflowPresetId('lead') }));
+    }
     await refreshRouteEffort(modelMeta);
     persist.applySessionTuning();
   }
@@ -65,7 +69,7 @@ export function createRouteTuning(deps, persist) {
     async toggleFast() {
       return await setFast(!(getRoute().fast === true));
     },
-    async setEffort(value) {
+    async setEffort(value, { sessionOnly = false } = {}) {
       const normalized = normalizeEffortInput(value);
       // An explicit level is the user's choice for this route: Auto effort
       // would replace it on the next turn (its base is fixed), so the pick
@@ -73,7 +77,7 @@ export function createRouteTuning(deps, persist) {
       setRouteState({ ...getRoute(), effort: normalized, ...(normalized ? { autoEffort: false } : {}) });
       const modelMeta = await lookupModelMeta(getRoute().provider, getRoute().model);
       const fastCapable = selectionFastCapable(getRoute().provider, modelMeta, normalized, getRoute().modelParameters);
-      await commitRouteTuning(fastCapable, modelMeta);
+      await commitRouteTuning(fastCapable, modelMeta, { sessionOnly });
       return getRoute();
     },
   };

package/src/session-runtime/owned-automation-run.mjs

@@ -27,6 +27,21 @@ const defaultLog = (line) => process.stderr.write(`mixdog routines: ${line}\n`);
 // received webhooks and the app's "Run now" all come through here.
 const activeRuns = new Set();
 
+/**
+ * Reserve `kind:name` against runs in this process for a rename. Null when a
+ * run is in flight; otherwise a release function. The check and the reservation
+ * are one synchronous step, and a run that finds the reservation is skipped as
+ * an overlap (runOwnedAutomation), so none can start under the name meanwhile.
+ * "Run now" takes the same reservation to hold the name from its read of the
+ * row through its outcome stamps (runOwnedAutomation `reserved`).
+ */
+export function beginAutomationRename(kind, name, active = activeRuns) {
+  const key = `${kind}:${name}`;
+  if (active.has(key)) return null;
+  active.add(key);
+  return () => active.delete(key);
+}
+
 // The PG record of each kind, imported on first use.
 const RECORDS = {
   schedule: () =>
@@ -103,7 +118,8 @@ async function queueResult(row, item, entry, { deliver, recordDelivery, onDelive
  * result }` (`signal` is the caller's cancellation, if any). Resolves the
  * outcome, or `{ skipped: true, reason: 'owner' | 'overlap' | 'backoff' | 'paused' }`
  * (an owner skip also names `ownerProblem` and its `message`); a failed run
- * rejects.
+ * rejects. `reserved`: the caller already holds `kind:name` (beginAutomationRename)
+ * and releases it itself, so this run neither checks for nor releases it.
  */
 export async function runOwnedAutomation(kind, row, run, deps = {}) {
   if (!row?.name) throw new Error(`${kind} run: a ${kind} row is required`);
@@ -112,6 +128,7 @@ export async function runOwnedAutomation(kind, row, run, deps = {}) {
     active = activeRuns,
     limits = ROUTINE_LIMITS,
     attended = false,
+    reserved = false,
     signal = null,
     now = Date.now,
     ownerProblem = routineOwnerProblem,
@@ -125,17 +142,21 @@ export async function runOwnedAutomation(kind, row, run, deps = {}) {
       .catch((error) => log(`${kind} "${name}": skip record failed: ${errorText(error)}`));
     return { name, skipped: true, reason, sessionId: null, result: '', ...extra };
   };
-  // A routine runs only in its own bot's thread: without that bot it waits.
-  const problem = await Promise.resolve()
-    .then(() => ownerProblem(row.ownerAgentId))
-    .catch(() => '');
-  if (problem) {
-    log(`${kind} "${name}": paused, ${ROUTINE_OWNER_PROBLEMS[problem]}`);
-    return skip('owner', { ownerProblem: problem, message: ROUTINE_OWNER_PROBLEMS[problem] });
-  }
-  if (active.has(key)) return skip('overlap');
-  active.add(key);
+  // The name is reserved before the owner check, so a rename can neither
+  // complete while it waits nor leave this run to start under the old name.
+  const overlap = !reserved && active.has(key);
+  const holds = !reserved && !overlap;
+  if (holds) active.add(key);
   try {
+    // A routine runs only in its own bot's thread: without that bot it waits.
+    const problem = await Promise.resolve()
+      .then(() => ownerProblem(row.ownerAgentId))
+      .catch(() => '');
+    if (problem) {
+      log(`${kind} "${name}": paused, ${ROUTINE_OWNER_PROBLEMS[problem]}`);
+      return await skip('owner', { ownerProblem: problem, message: ROUTINE_OWNER_PROBLEMS[problem] });
+    }
+    if (overlap) return await skip('overlap');
     if (!attended) {
       const record = await withRecord(kind, deps);
       const state = await Promise.resolve()
@@ -156,7 +177,7 @@ export async function runOwnedAutomation(kind, row, run, deps = {}) {
     }
     return await run({ signal });
   } finally {
-    active.delete(key);
+    if (holds) active.delete(key);
   }
 }
 

package/src/session-runtime/provider-auth/login.mjs

@@ -8,6 +8,7 @@ import {
   saveOpenAIUsageSessionKey,
   saveProviderApiKey,
   saveCustomProvider,
+  saveCustomProviderKey,
   removeCustomProvider,
   updateCustomProviderModel,
   saveModelPreferences,
@@ -76,6 +77,12 @@ export function createLoginApi({ cfgMod, awaitKeychainPrewarm, reloadFullConfig,
       refresh.afterCredentialChange();
       return result;
     },
+    async saveCustomProviderKey(providerId, secret) {
+      await awaitKeychainPrewarm();
+      const result = await saveCustomProviderKey(cfgMod, providerId, secret);
+      refresh.afterCredentialChange();
+      return result;
+    },
     async updateCustomProviderModel(providerId, modelId, patch) {
       const result = await updateCustomProviderModel(cfgMod, providerId, modelId, patch);
       refresh.afterCredentialChange();

package/src/session-runtime/provider-models/row-hydration.mjs

@@ -14,6 +14,7 @@ import {
   effortConfigurationMode,
 } from '../../runtime/agent/orchestrator/providers/effort-configuration.mjs';
 import { getProvider } from '../../runtime/agent/orchestrator/providers/registry.mjs';
+import { providerAvailable } from '../../runtime/agent/orchestrator/providers/provider-availability.mjs';
 import {
   DAYBREAK_PARAMETER_OPTION,
   DAYBREAK_PROVIDER,
@@ -96,7 +97,17 @@ export function createRowHydration({
     hydrateProviderModelRow: (row) => hydrateProviderModelRow(config(), row),
     sortProviderModels,
     providerModelCacheRow,
-    providerModelsFromCacheRows: (rows) =>
-      sortProviderModels((rows || []).map((row) => hydrateProviderModelRow(config(), row))),
+    // Cached rows outlive a Developer option switch, so availability is
+    // applied at read time, once per provider per call.
+    providerModelsFromCacheRows: (rows) => {
+      const availability = new Map();
+      const available = (provider) => {
+        if (!availability.has(provider)) availability.set(provider, providerAvailable(provider));
+        return availability.get(provider);
+      };
+      return sortProviderModels(
+        (rows || []).filter((row) => available(row.provider)).map((row) => hydrateProviderModelRow(config(), row))
+      );
+    },
   };
 }

package/src/session-runtime/routine-home-turn.mjs

@@ -14,14 +14,21 @@
  * (outbound actions are allowed within the bot's permissions; payments and
  * permanent deletes are refused, human-gate/run-policy.mjs). Resolves with the
  * reply once the turn ends; rejects when the turn fails, is cancelled, or the
- * caller's `signal` aborts (which also aborts the turn once it runs).
+ * caller's `signal` aborts (which also aborts the turn once it runs). A
+ * heartbeat turn past its wall-clock cap is aborted and resolves with no reply
+ * (`timedOut`).
  */
 import { randomUUID } from 'node:crypto';
 import { agentHomeSessionId } from '../runtime/agent/orchestrator/session/agent-home.mjs';
 import { routineHumanNeededText } from '../runtime/agent/orchestrator/session/routine-result.mjs';
 import { automationPromptContent } from '../runtime/shared/automation-attachments.mjs';
 import { ROUTINE_LIMITS } from '../runtime/shared/routine-limits.mjs';
-import { normalizeRoutineTrigger, routineTriggerHeader } from '../runtime/shared/routine-trigger.mjs';
+import {
+  HEARTBEAT_TURN_LIMITS,
+  isHeartbeatSession,
+  normalizeRoutineTrigger,
+  routineTriggerHeader,
+} from '../runtime/shared/routine-trigger.mjs';
 import { agentHomeLiveSurface, scheduleOwnerAgentId } from './agent-home-delivery.mjs';
 import { markUnattendedRun, unattendedRunOf } from './held-requests.mjs';
 
@@ -60,12 +67,18 @@ export async function runRoutineTurn(
     cwd = null,
     event = '',
     signal = null,
+    // A session the caller created for this turn and the turn's opening line
+    // (the heartbeat's hidden session and header); default the owner's home
+    // thread and the routine trigger header.
+    sessionId = null,
+    header = null,
   },
   {
     surface = agentHomeLiveSurface(),
     loadSession = defaultLoadSession,
     limit = ROUTINE_LIMITS.homeQueueLimit,
     log = (line) => process.stderr.write(`mixdog routines: ${line}\n`),
+    timers = globalThis,
   } = {}
 ) {
   const body = String(prompt || '').trim();
@@ -73,8 +86,8 @@ export async function runRoutineTurn(
   if (signal?.aborted) throw abortError(signal);
   if (typeof surface?.submit !== 'function') throw new Error('routine run: the session service is not running');
   const agentId = scheduleOwnerAgentId({ ownerAgentId });
-  const homeId = agentHomeSessionId(agentId);
-  const home = await loadSession(homeId);
+  const homeId = sessionId || agentHomeSessionId(agentId);
+  const home = sessionId ? true : await loadSession(homeId);
   if (!home || home.closed === true) {
     throw new Error(`the bot "${agentId}" has no chat yet: open it once in the app`);
   }
@@ -82,14 +95,15 @@ export async function runRoutineTurn(
   if (queued >= limit) throw new Error(`${limit} routine runs already wait in this bot's chat`);
   waiting.set(homeId, queued + 1);
   const trigger = normalizeRoutineTrigger({ kind, name, event });
-  const header = routineTriggerHeader({ kind, name, project: cwd ? String(cwd) : '' });
-  const content = automationPromptContent(`${header}\n\n${body}`, attachments);
+  const opening = header || routineTriggerHeader({ kind, name, project: cwd ? String(cwd) : '' });
+  const content = automationPromptContent(`${opening}\n\n${body}`, attachments);
   return new Promise((resolve, reject) => {
     let started = false;
     let aborted = false;
     let done = false;
     let unmark = () => {};
     let released = false;
+    let cutoff = null;
     const release = () => {
       if (released) return;
       released = true;
@@ -101,6 +115,7 @@ export async function runRoutineTurn(
     const finish = (fn, value) => {
       if (done) return;
       done = true;
+      if (cutoff) timers.clearTimeout(cutoff);
       fn(value);
     };
     const abortTurn = () =>
@@ -113,6 +128,18 @@ export async function runRoutineTurn(
       finish(reject, abortError(signal));
     }
     signal?.addEventListener?.('abort', onAbort, { once: true });
+    // Mixy's heartbeat turn (by its in-process mark) is cut off at its
+    // wall-clock cap: the turn is aborted and ends cleanly with no reply.
+    if (sessionId && isHeartbeatSession(homeId)) {
+      const ms = HEARTBEAT_TURN_LIMITS.wallClockMs;
+      cutoff = timers.setTimeout(() => {
+        log(`${kind} "${name}" in ${homeId} passed ${ms / 1000}s: ended without a reply`);
+        aborted = true;
+        if (started) void abortTurn();
+        finish(resolve, { sessionId: homeId, result: '', timedOut: true });
+      }, ms);
+      cutoff?.unref?.();
+    }
     const options = {
       id: `routine_${randomUUID()}`,
       mode: 'routine',

package/src/session-runtime/schedule-session-run.mjs

@@ -11,9 +11,13 @@ import { runRoutineTurn } from './routine-home-turn.mjs';
 /**
  * One fire of `schedule`. `prompt` overrides schedule.prompt when the caller
  * (channels worker) already resolved the body; `attended` marks a person's
- * "Run now" (no failure backoff).
+ * "Run now" (no failure backoff); `reserved` that the caller holds the name
+ * (owned-automation-run.mjs beginAutomationRename).
  */
-export async function runScheduleSession(schedule, { attended = false, prompt = null, signal = null } = {}) {
+export async function runScheduleSession(
+  schedule,
+  { attended = false, prompt = null, signal = null, reserved = false } = {}
+) {
   const body = String(prompt ?? schedule.prompt ?? '').trim();
   return runOwnedSchedule(
     schedule,
@@ -27,7 +31,7 @@ export async function runScheduleSession(schedule, { attended = false, prompt =
         cwd: schedule.cwd || null,
         signal: runSignal,
       }),
-    { attended, signal }
+    { attended, signal, reserved }
   );
 }
 

package/src/session-runtime/services/agent-tool/close-flow.mjs

@@ -5,7 +5,7 @@ import {
   listBackgroundTasks,
   taskIdFromArgs,
 } from '../../../runtime/shared/background-tasks.mjs';
-import { agentScope, clean, clearAgentStatuslineRoute } from './helpers.mjs';
+import { agentScope, clean, clearAgentStatuslineRoute, sessionMatchesContext } from './helpers.mjs';
 import { isLeadPoolAgent } from './worker-rows.mjs';
 import { createCloseAll } from './close-flow/close-all.mjs';
 import { closeManagedSession } from '../../lifecycle/shared.mjs';
@@ -20,6 +20,16 @@ export function createCloseFlow({ mgr, registry, views }) {
   // Stale local metadata only: resolveTag found no session in this
   // terminal/scope, so there is no sessionId-safe worker row to delete. Never
   // turn it into a tag-wide persisted-row removal.
+  // `tags`/`tagAgents` are shared by every caller on the canonical agent, so a
+  // binding alone does not prove the caller owns it: only a live session or a
+  // persisted row inside the caller's scope does. Another session's tag must
+  // stay untouched.
+  function tagBoundByCaller(target, scopedContext) {
+    const live = registry.getLiveSession(tags.get(target));
+    if (live) return sessionMatchesContext(live, scopedContext);
+    return registry.readWorkerRows(scopedContext).some((row) => clean(row.tag) === target);
+  }
+
   function forgetStaleLocalTag(target, task) {
     registry.unbindTag(target);
     if (task?.taskId) cancelBackgroundTask(task.taskId, CLOSE_REASON);
@@ -55,7 +65,9 @@ export function createCloseFlow({ mgr, registry, views }) {
     }
     const sessionId = registry.resolveTag(target, scopedContext, { scanSessions: registry.wantsSessionScan(args) });
     if (!sessionId) {
-      if (!target.startsWith('sess_') && tagAgents.has(target)) return forgetStaleLocalTag(target, task);
+      if (!target.startsWith('sess_') && tagAgents.has(target) && tagBoundByCaller(target, scopedContext)) {
+        return forgetStaleLocalTag(target, task);
+      }
       throw new Error(`agent close: target "${target}" not found`);
     }
     if (isLeadPoolAgent(registry.getLiveSession(sessionId)?.agent)) {

package/src/session-runtime/services/agent-tool/execute.mjs

@@ -67,7 +67,12 @@ export function createAgentExecute({
           }
           // Targetless status is the same compact overview as list.
           return renderResult({
-            workers: views.list({ scanSessions: registry.wantsSessionScan(args), context: scopedContext }),
+            // Idle workers stay open for follow-ups; the model must see them to close them.
+            workers: views.list({
+              scanSessions: registry.wantsSessionScan(args),
+              context: scopedContext,
+              includeIdle: true,
+            }),
             jobs: views.listJobs(scopedContext),
           });
         case 'read':

package/src/session-runtime/services/agent-tool/job-views/agent-list.mjs

@@ -25,6 +25,14 @@ export function isActiveWorkerRow(row = {}) {
   return !isTerminalWorkerStatus(effective);
 }
 
+// A finished worker that is still open: it takes follow-ups and can be closed.
+function isOpenIdleRow(row = {}) {
+  const status = String(row.status ?? '').trim().toLowerCase();
+  const stage = String(row.stage ?? '').trim().toLowerCase();
+  if (CANCELLED_WORKER_STATUS.test(stage) || CANCELLED_WORKER_STATUS.test(status)) return false;
+  return (status || stage) === 'idle';
+}
+
 function rowState(session, runtime) {
   const status = session.closed === true ? 'closed' : session.status || 'idle';
   const stage =
@@ -78,7 +86,7 @@ function agentRow({ tag, session, runtime, progress, now, indexRow = null }) {
 }
 
 export function createAgentList({ mgr, refreshTagsFromSessions, agentSessionEntries, progress }) {
-  return function list({ scanSessions = false, context = {}, includeTerminal = false } = {}) {
+  return function list({ scanSessions = false, context = {}, includeTerminal = false, includeIdle = false } = {}) {
     refreshTagsFromSessions({ scanSessions, context });
     const now = Date.now();
     const rows = [];
@@ -89,7 +97,8 @@ export function createAgentList({ mgr, refreshTagsFromSessions, agentSessionEntr
       // loads the worker's stored session, and a Lead's status pulse (every
       // 2 s) would otherwise read every worker it ever ran, whole transcripts
       // on first sight, synchronously on the daemon loop.
-      if (!includeTerminal && !isActiveWorkerRow(rowState(session, runtime))) continue;
+      const state = rowState(session, runtime);
+      if (!includeTerminal && !isActiveWorkerRow(state) && !(includeIdle && isOpenIdleRow(state))) continue;
       rows.push(
         agentRow({
           tag,

package/src/session-runtime/services/agent-tool/render.mjs

@@ -156,9 +156,11 @@ export function renderResult(value, { includeDiagnostics = false } = {}) {
   if (typeof value === 'string') return value;
   if (value && typeof value === 'object') {
     if (Array.isArray(value.workers) || Array.isArray(value.jobs)) return renderRoster(value);
+    // close-flow results carry `closed` plus task_id: render the close outcome.
+    // close-flow results carry `closed` plus task_id: render the close outcome.
+    if (value.closed !== undefined) return renderClosed(value);
     if (value.task_id) return renderTask(value, includeDiagnostics);
     if (value.queued) return renderQueued(value);
-    if (value.closed !== undefined) return renderClosed(value);
     if (value.content !== undefined) return renderContent(value);
   }
   return JSON.stringify(value, null, 2);

package/src/session-runtime/services/agent-tool/spawn-flow/spawn-plan.mjs

@@ -20,9 +20,8 @@ import { resolveAgentSpawnPreset } from '../spawn-preset.mjs';
 import { AGENT_OWNER } from '../../../../runtime/agent/orchestrator/agent-owner.mjs';
 import { workspaceCwdLock } from '../../../workspace/admission-gate.mjs';
 import { isContactAgentId } from '../../../../runtime/agent/orchestrator/runtime-core/workflow-ids.mjs';
-import { AGENT_MODE, resolveSessionMode } from '../../../../runtime/agent/orchestrator/session/agent-mode.mjs';
-import { MIXY_AGENT_ID } from '../../../../runtime/agent/orchestrator/session/agent-home.mjs';
-import { mixyDisplayName } from '../../../../runtime/agent/orchestrator/session/mixy-name.mjs';
+import { assertBotChainTarget } from '../../../../runtime/shared/bot-hops.mjs';
+import { actingAgentOf, delegationChainOf } from '../../../bot-chain.mjs';
 
 export function createSpawnPlanner({
   mgr = null,
@@ -50,17 +49,14 @@ export function createSpawnPlanner({
     if (isAgentDisabled(config, agent)) {
       throw new Error(`agent spawn: agent "${agent}" is turned off`);
     }
-    // Only Mixy hands work to a contact agent; any other agent-mode Lead
-    // delegates to sub-agents alone (its catalog lists no contact either).
+    // Any agent-mode Lead (Mixy or a bot) may hand work to a contact agent,
+    // never to one already in its delegation chain (itself included): the
+    // session's ancestry and the bot chain its turn was handed (bot-chain.mjs).
     if (isContactAgentId(agent, readAgentFrontmatterKind(agent, dataDir, STANDALONE_SOURCE_ROOT))) {
       const callerId = clean(context?.callerSessionId || context?.sessionId);
-      const caller = (callerId && mgr?.getSession?.(callerId)) || null;
-      const { mode, agentId } = resolveSessionMode({ session: caller, sessionId: callerId });
-      if (mode === AGENT_MODE && agentId !== MIXY_AGENT_ID) {
-        throw new Error(
-          `agent spawn: only ${mixyDisplayName()} (the representative agent) can hand work to the contact agent "${agent}"; delegate to a sub-agent instead`
-        );
-      }
+      const getSession = (id) => mgr?.getSession?.(id) || null;
+      const chain = delegationChainOf(callerId, getSession);
+      assertBotChainTarget(agent, { chain, self: actingAgentOf(getSession(callerId), callerId) }, 'agent spawn');
     }
     const agentPermission = readAgentFrontmatterPermission(agent, dataDir, STANDALONE_SOURCE_ROOT);
     const agentPerm = normalizeAgentPermission(agentPermission) || null;

package/src/session-runtime/services/agent-tool/tool-def.mjs

@@ -28,7 +28,7 @@ export const AGENT_TOOL = {
     agentHidden: false,
   },
   description:
-    'Run scoped agent work as background tasks. spawn/send return task_id immediately. Reuse one tag for one scope for its whole lifetime; give distinct tags only to independent scopes. Never mint a new tag because a session expired or was lost — same-tag spawn respawns it with the full brief. Wait for completion notifications; use status/read only for manual recovery.',
+    'Run scoped agent work as background tasks. spawn/send return task_id immediately. Reuse one tag for one scope for its whole lifetime; give distinct tags only to independent scopes. Never mint a new tag because a session expired or was lost — same-tag spawn respawns it with the full brief. Wait for completion notifications; use status/read only for manual recovery. Close finished agents yourself.',
   inputSchema: {
     type: 'object',
     properties: {

package/src/session-runtime/services/channel-admin.mjs

@@ -11,6 +11,7 @@ import {
   listSchedules as dbListSchedules,
   getSchedule as dbGetSchedule,
   upsertSchedule,
+  renameSchedule as dbRenameSchedule,
   deleteSchedule as dbDeleteSchedule,
   setEnabled as dbSetEnabled,
 } from '../../runtime/channels/lib/schedules-db.mjs';
@@ -26,6 +27,7 @@ import { normalizeAutomationAttachments } from '../../runtime/shared/automation-
 import { assertRoutineOwner, routineOwnerProblem } from '../routine-owner.mjs';
 import { hasEnabledAutomation } from '../../runtime/shared/automation-presence.mjs';
 import { resolveScheduleTimezone, validateScheduleCron } from '../../runtime/shared/schedule-time.mjs';
+import { scheduleNameTakenError, scheduleRenameRunningError } from '../../runtime/channels/lib/schedule-errors.mjs';
 import { pgClusterExists } from '../../runtime/memory/lib/pg/adapter.mjs';
 import { resolvePluginData } from '../../runtime/shared/plugin-paths.mjs';
 import { readHookPublicBase } from '../../runtime/channels/lib/webhook/relay-tunnel.mjs';
@@ -270,26 +272,62 @@ export async function listSchedules() {
   return Promise.all(rows.map(async (row) => scheduleToDisplay(row, await problemOf(row.ownerAgentId))));
 }
 
+/**
+ * Run `step` (the move of schedule `name`'s row) with `name` reserved against
+ * runs in this process (the app's "Run now"). Refused when one is in flight.
+ */
+export async function withScheduleRenameReserved(name, step) {
+  const { beginAutomationRename } = await import('../owned-automation-run.mjs');
+  const release = beginAutomationRename('schedule', name);
+  if (!release) throw scheduleRenameRunningError(name);
+  try {
+    return await step();
+  } finally {
+    release();
+  }
+}
+
+// Whether `next` fires when `existing` does: the same cron in the same zone (a
+// stored row without a zone runs in the default one, as the scheduler arms
+// it), or the same instant, whatever its spelling.
+function sameTiming(existing, next) {
+  const instant = (value) => (value ? new Date(value).getTime() : null);
+  if ((existing.whenCron || null) !== next.whenCron) return false;
+  if (next.whenCron && resolveScheduleTimezone(existing.timezone) !== next.timezone) return false;
+  return instant(existing.whenAt) === instant(next.whenAt);
+}
+
+// The rename when no channels worker owns the scheduler: this process's runs
+// are the only ones there are.
+export const renameScheduleHere = (oldName, def, opts) =>
+  withScheduleRenameReserved(oldName, () => dbRenameSchedule(oldName, def, opts));
+
 // Register or update a schedule in the PG store. Recurring input maps `time`
 // (+ optional `days`) to a cron; one-shot input maps an `at` datetime; the two
 // are mutually exclusive (also enforced by the store's when_at/when_cron XOR).
 // Every schedule runs as a turn in its owner bot's chat; a bot that does not
 // exist (no representative bot yet, an archived bot) cannot own one.
-export async function saveSchedule({
-  name,
-  description = '',
-  time,
-  at,
-  timezone,
-  days,
-  cwd,
-  attachments,
-  enabled,
-  instructions,
-  owner,
-  overwrite = false,
-} = {}) {
+export async function saveSchedule(
+  {
+    name,
+    description = '',
+    time,
+    at,
+    timezone,
+    days,
+    cwd,
+    attachments,
+    enabled,
+    instructions,
+    owner,
+    overwrite = false,
+    newName,
+  } = {},
+  { rename = renameScheduleHere } = {}
+) {
   const id = assertScheduleName(name);
+  const renameTo = newName != null && String(newName).trim() !== '' ? assertScheduleName(newName) : id;
+  const renaming = renameTo !== id;
   const body = String(instructions || '').trim();
   if (!body) throw new Error('schedule instructions are required');
   const hasTime = time != null && String(time).trim() !== '';
@@ -297,16 +335,17 @@ export async function saveSchedule({
   if (hasTime && hasAt) throw new Error('provide either `time` (recurring) or `at` (one-shot), not both');
   if (!hasTime && !hasAt) throw new Error('either `time` (recurring cron) or `at` (one-shot datetime) is required');
   const existing = await dbGetSchedule(id);
+  if (renaming && !existing) throw new Error(`schedule "${id}" does not exist`);
   if (overwrite !== true && existing) {
-    throw new Error(`schedule "${id}" already exists`);
+    throw scheduleNameTakenError(id);
   }
   const ownerAgentId = scheduleOwner(owner, existing);
   await assertRoutineOwner(ownerAgentId);
   const whenCron = hasTime ? validateScheduleCron(foldDaysIntoCron(normalizeCron(time), days)) : null;
   const whenAt = hasAt ? parseAtDatetime(at) : null;
   const scheduleTimezone = hasTime ? resolveScheduleTimezone(timezone) : null;
-  const saved = await upsertSchedule({
-    name: id,
+  const def = {
+    name: renameTo,
     description: String(description || '').trim(),
     whenCron,
     whenAt,
@@ -320,7 +359,16 @@ export async function saveSchedule({
     enabled: enabled !== false,
     nextFireAt: whenAt,
     ownerAgentId,
-  });
+  };
+  let saved;
+  if (renaming) {
+    if (await dbGetSchedule(renameTo)) throw scheduleNameTakenError(renameTo);
+    const timingChanged = !sameTiming(existing, { whenCron, whenAt, timezone: scheduleTimezone });
+    saved = await rename(id, def, { timingChanged });
+    if (!saved) throw new Error(`schedule "${id}" does not exist`);
+  } else {
+    saved = await upsertSchedule(def);
+  }
   automationProbe.invalidate();
   return scheduleToDisplay(saved);
 }

package/src/session-runtime/services/channel-worker.mjs

@@ -18,7 +18,7 @@ import { daemonEnv, spawnDaemonCandidate } from './channel-worker/daemon-spawn.m
 
 export { pruneStaleChannelClientHeartbeats };
 
-const CHANNEL_TOOLS = new Set(['activate_channel_bridge', 'reload_config']);
+const CHANNEL_TOOLS = new Set(['activate_channel_bridge', 'reload_config', 'rename_schedule']);
 const CALL_RETRIES = 3;
 
 function logLine(path, line) {