opencode-overclock 0.4.0 → 0.5.1

package/src/features/guard.ts

@@ -1,6 +1,7 @@
+import { isAbsolute, relative } from "node:path"
 import type { FeatureModule } from "../types.ts"
 import { inject, toast } from "../lib/inject.ts"
-import { execBash } from "../lib/exec.ts"
+import { execBash, redactSensitiveOutput, sanitizeEnv } from "../lib/exec.ts"
 
 export interface GuardHook {
   name: string
@@ -25,6 +26,150 @@ export const EDIT_ERROR_PATTERNS = [
 export const EDIT_RECOVERY_HINT =
   "\n\n[edit recovery hint]\nThe edit failed due to a content mismatch. Use the `read` tool to inspect the latest file state around the target lines before retrying the edit."
 
+export interface FloorGuardOptions {
+  allowSkips?: boolean
+  allowSuppressions?: boolean
+  allowAssertionRemoval?: boolean
+  [key: string]: unknown
+}
+
+export interface FloorViolationPattern {
+  name: string
+  pattern: RegExp
+  description: string
+  testFileOnly?: boolean
+}
+
+export const FLOOR_VIOLATIONS: FloorViolationPattern[] = [
+  {
+    name: "test-skip-js",
+    pattern:
+      /(?:^|[.\s])(?:skip\s*\(|xit\s*\(|xdescribe\s*\()|\b(?:test\.skip|it\.skip|describe\.skip)\b/,
+    description: "Skipping test execution (.skip / xit / xdescribe)",
+    testFileOnly: true,
+  },
+  {
+    name: "test-skip-python",
+    pattern: /@pytest\.mark\.skip|@unittest\.skip/,
+    description: "Skipping test execution (@pytest.mark.skip / @unittest.skip)",
+    testFileOnly: true,
+  },
+  {
+    name: "test-skip-go",
+    pattern: /\bt\.Skip(?:\(|f\()/,
+    description: "Skipping test execution (t.Skip)",
+    testFileOnly: true,
+  },
+  {
+    name: "test-skip-rust",
+    pattern: /#\[ignore(?:\s*=.*)?\]/,
+    description: "Skipping test execution (#[ignore])",
+    testFileOnly: true,
+  },
+  {
+    name: "ts-suppression",
+    pattern:
+      /\/\/\s*@ts-(?:ignore|nocheck)\b|\/\*\s*@ts-(?:ignore|nocheck)\s*\*\/|\{\s*\/\*\s*@ts-(?:ignore|nocheck)\s*\*\/\s*\}/,
+    description: "TypeScript error suppression (@ts-ignore / @ts-nocheck)",
+  },
+  {
+    name: "eslint-suppression",
+    pattern: /\/\*?\s*eslint-disable(?:-next-line)?\b/,
+    description: "ESLint diagnostic suppression (eslint-disable)",
+  },
+  {
+    name: "python-suppression",
+    pattern: /#\s*(?:noqa|type:\s*ignore)\b/,
+    description: "Python diagnostic suppression (# noqa / # type: ignore)",
+  },
+  {
+    name: "empty-catch",
+    pattern: /catch\s*(?:\([^)]*\))?\s*\{\s*\}/,
+    description: "Empty catch block swallowing errors silently",
+  },
+]
+
+export const ASSERTION_PATTERN =
+  /\b(?:expect\s*\(|assert\b|assert\.[a-zA-Z]+|assertEquals|assertTrue|assertFalse|self\.assert)/
+
+export function isTestFile(filePath: string): boolean {
+  const normalized = filePath.toLowerCase().replaceAll("\\", "/")
+  const segments = normalized.split("/")
+  const filename = segments[segments.length - 1] ?? ""
+
+  return (
+    filename.includes(".test.") ||
+    filename.includes(".spec.") ||
+    segments.includes("test") ||
+    segments.includes("tests") ||
+    segments.includes("__tests__") ||
+    filename.endsWith("_test.go") ||
+    filename.endsWith("_test.py") ||
+    filename.endsWith("_spec.rb") ||
+    filename.startsWith("test_")
+  )
+}
+
+export function checkFloorViolation(
+  tool: string,
+  args: Record<string, unknown> | undefined,
+  options: FloorGuardOptions = {},
+): string | null {
+  const toolLower = tool.toLowerCase()
+  if (toolLower !== "edit" && toolLower !== "write") return null
+  if (!args) return null
+
+  const filePath =
+    typeof args.filePath === "string"
+      ? args.filePath
+      : typeof args.path === "string"
+        ? args.path
+        : typeof args.file_path === "string"
+          ? args.file_path
+          : ""
+
+  const isTest = isTestFile(filePath)
+
+  if (toolLower === "edit") {
+    const oldStr = typeof args.oldString === "string" ? args.oldString : ""
+    const newStr = typeof args.newString === "string" ? args.newString : ""
+
+    for (const v of FLOOR_VIOLATIONS) {
+      if (v.testFileOnly && !isTest) continue
+      if (v.testFileOnly && options.allowSkips) continue
+      if (!v.testFileOnly && options.allowSuppressions) continue
+
+      if (v.pattern.test(newStr) && !v.pattern.test(oldStr)) {
+        return `Detected ${v.description} in ${filePath || "edited file"}. Modifying code to bypass tests or suppress warnings is prohibited by floor-guard policy. Fix the underlying issue instead.`
+      }
+    }
+
+    if (!options.allowAssertionRemoval && isTest) {
+      if (
+        ASSERTION_PATTERN.test(oldStr) &&
+        !ASSERTION_PATTERN.test(newStr) &&
+        newStr.trim().length > 0
+      ) {
+        return `Stripped test assertion(s) from ${filePath || "test file"} without replacement. Deleting assertions to make tests pass is prohibited by floor-guard policy. Fix the implementation to satisfy the assertion.`
+      }
+    }
+  } else if (toolLower === "write") {
+    const content = typeof args.content === "string" ? args.content : ""
+
+    for (const v of FLOOR_VIOLATIONS) {
+      if (v.testFileOnly && !isTest) continue
+      if (v.testFileOnly && options.allowSkips) continue
+      if (!v.testFileOnly && options.allowSuppressions) continue
+
+      if (v.pattern.test(content)) {
+        return `Detected ${v.description} in ${filePath || "written file"}. Introducing test skips or error suppressions is prohibited by floor-guard policy.`
+      }
+    }
+  }
+
+  return null
+}
+
 export function checkEditFailure(tool: string, outputText: string): string | null {
   if (tool.toLowerCase() !== "edit") return null
   const lower = outputText.toLowerCase()
@@ -112,6 +257,45 @@ export async function detectRecipes(directory: string): Promise<GuardHook[]> {
   return detected
 }
 
+/**
+ * Patterns matching dangerous command idioms that are inappropriate for quality-gate hooks,
+ * such as reverse shells, remote script piping, and arbitrary socket relays.
+ */
+export const DANGEROUS_COMMAND_PATTERNS: { pattern: RegExp; reason: string }[] = [
+  { pattern: /\/dev\/(?:tcp|udp)\//i, reason: "network socket redirection (/dev/tcp or /dev/udp)" },
+  { pattern: /\bmkfifo\b/i, reason: "named pipe creation (mkfifo)" },
+  {
+    pattern: /\b(?:nc|netcat)\b.*(?:\s+-e\s+|\s+-c\s+)/i,
+    reason: "netcat remote command execution flag (-e/-c)",
+  },
+  {
+    pattern: /\b(?:curl|wget|fetch)\b.*\|\s*(?:bash|sh|zsh|python|perl|ruby)\b/i,
+    reason: "remote script execution via pipe (curl/wget | shell)",
+  },
+  {
+    pattern: /\bbase64\s+(?:-d|--decode)\b.*\|\s*(?:bash|sh|zsh)\b/i,
+    reason: "encoded payload execution via pipe (base64 -d | shell)",
+  },
+  { pattern: /\bbash\s+-i\b.*>&/i, reason: "interactive reverse shell redirection (bash -i >&)" },
+  { pattern: /\bsocat\s+/i, reason: "socket relay execution (socat)" },
+]
+
+/**
+ * Validates a hook command string against dangerous patterns.
+ * Returns the rejection reason or null if valid.
+ */
+export function validateHookCommand(command: string): string | null {
+  for (const { pattern, reason } of DANGEROUS_COMMAND_PATTERNS) {
+    if (pattern.test(command)) {
+      return reason
+    }
+  }
+  return null
+}
+
+/** Maximum character length of failure payload tail to prevent prompt flooding. */
+export const MAX_FAILURE_PAYLOAD_CHARS = 4000
+
 /** options.hooks -> validated GuardHook[]. Invalid entries -> console.warn, skipped, never throw. */
 export function parseHooks(raw: unknown): GuardHook[] {
   if (!Array.isArray(raw)) return []
@@ -124,7 +308,19 @@ export function parseHooks(raw: unknown): GuardHook[] {
       console.warn(`[overclock] guard: skipping invalid hook config: ${JSON.stringify(entry)}`)
       continue
     }
+
+    const danger = validateHookCommand(e.run)
+    if (danger) {
+      console.warn(`[overclock] guard: rejecting unsafe hook "${e.name}": ${danger}`)
+      continue
+    }
+
     const pathFilter = typeof e.pathFilter === "string" ? e.pathFilter : undefined
+    if (pathFilter && pathFilter.includes("..")) {
+      console.warn(`[overclock] guard: rejecting hook "${e.name}": pathFilter cannot contain ".."`)
+      continue
+    }
+
     hooks.push({
       name: e.name,
       tools: e.tools as string[],
@@ -132,10 +328,11 @@ export function parseHooks(raw: unknown): GuardHook[] {
       glob: pathFilter ? new Bun.Glob(pathFilter) : undefined,
       run: e.run,
       mode: e.mode === "append" ? "append" : "inject",
-      debounceMs: typeof e.debounceMs === "number" ? e.debounceMs : 2000,
-      timeoutMs: typeof e.timeoutMs === "number" ? e.timeoutMs : 60000,
+      debounceMs: typeof e.debounceMs === "number" ? Math.max(50, Math.min(e.debounceMs, 60000)) : 2000,
+      timeoutMs: typeof e.timeoutMs === "number" ? Math.max(100, Math.min(e.timeoutMs, 300000)) : 60000,
       onSuccess: e.onSuccess === "notify" ? "notify" : "silent",
-      maxDeferMs: typeof e.maxDeferMs === "number" ? e.maxDeferMs : 300000,
+      maxDeferMs:
+        typeof e.maxDeferMs === "number" ? Math.max(1000, Math.min(e.maxDeferMs, 600000)) : 300000,
     })
   }
   return hooks
@@ -147,6 +344,7 @@ export function matchHook(
   toolName: string,
   filePath: string | undefined,
   resolveTool?: (name: string) => string,
+  cwd?: string,
 ): boolean {
   const matches = hook.tools.some((t) => {
     if (t === toolName) return true
@@ -156,18 +354,32 @@ export function matchHook(
   if (!matches) return false
   if (!hook.pathFilter) return true
   if (typeof filePath !== "string") return false
-  return (hook.glob ?? new Bun.Glob(hook.pathFilter)).match(filePath)
+
+  const glob = hook.glob ?? new Bun.Glob(hook.pathFilter)
+  const normalized = filePath.replaceAll("\\", "/")
+  if (glob.match(normalized)) return true
+
+  if (cwd && isAbsolute(normalized)) {
+    const rel = relative(cwd, normalized).replaceAll("\\", "/")
+    if (glob.match(rel)) return true
+  }
+
+  return false
 }
 
-/** `[guard "<name>" failed (exit <code>)]` + last 40 lines of combined stdout+stderr. */
+/** `[guard "<name>" failed (exit <code>)]` + sanitized last 40 lines of combined stdout+stderr. */
 export function failurePayload(name: string, code: number | null, combined: string): string {
-  const tail = combined.split("\n").slice(-40).join("\n")
+  const sanitized = redactSensitiveOutput(combined)
+  let tail = sanitized.split("\n").slice(-40).join("\n")
+  if (tail.length > MAX_FAILURE_PAYLOAD_CHARS) {
+    tail = tail.slice(-MAX_FAILURE_PAYLOAD_CHARS) + "\n... [truncated for security & length]"
+  }
   return `\n\n[guard "${name}" failed (exit ${code})]\n${tail}`
 }
 
 function buildEnv(toolName: string, filePath: string | undefined): Record<string, string | undefined> {
   return {
-    ...process.env,
+    ...sanitizeEnv(process.env),
     GUARD_TOOL: toolName,
     ...(filePath !== undefined ? { GUARD_FILE: filePath } : {}),
   }
@@ -179,7 +391,13 @@ async function runCommand(
   env: Record<string, string | undefined>,
   register?: (proc: Bun.Subprocess) => void,
 ): Promise<{ code: number | null; combined: string }> {
-  return execBash(hook.run, { cwd, env, timeoutMs: hook.timeoutMs, onSpawn: register })
+  return execBash(hook.run, {
+    cwd,
+    env,
+    timeoutMs: hook.timeoutMs,
+    onSpawn: register,
+    sanitizeEnv: true,
+  })
 }
 
 interface HookState {
@@ -352,9 +570,18 @@ export const guard: FeatureModule = {
       hooks.push(...autoHooks)
     }
 
+    const floorGuardEnabled =
+      options.floorGuard === true ||
+      options.auto === true ||
+      (typeof options.floorGuard === "object" && options.floorGuard !== null)
+    const floorGuardOpts: FloorGuardOptions =
+      typeof options.floorGuard === "object" && options.floorGuard !== null
+        ? (options.floorGuard as FloorGuardOptions)
+        : {}
+
     const editRecovery =
       options.editRecovery === true || (hooks.length > 0 && options.editRecovery !== false)
-    if (hooks.length === 0 && !editRecovery) return {}
+    if (hooks.length === 0 && !editRecovery && !floorGuardEnabled) return {}
 
     const runner =
       hooks.length > 0
@@ -380,13 +607,32 @@ export const guard: FeatureModule = {
           if (hint) output.output += hint
         }
 
+        if (floorGuardEnabled && typeof output.output === "string") {
+          const violation = checkFloorViolation(
+            input.tool,
+            input.args as Record<string, unknown> | undefined,
+            floorGuardOpts,
+          )
+          if (violation) {
+            output.output += `\n\n[overclock floor-guard warning]\n${violation}`
+            void toast(ctx.client, "guard: floor-guard violation detected", "warning")
+          }
+        }
+
         if (!runner || hooks.length === 0) return
 
         const args = input.args as Record<string, unknown> | undefined
-        const filePath = typeof args?.filePath === "string" ? args.filePath : undefined
+        const filePath =
+          typeof args?.filePath === "string"
+            ? args.filePath
+            : typeof args?.path === "string"
+              ? args.path
+              : typeof args?.file_path === "string"
+                ? args.file_path
+                : undefined
 
         for (const hook of hooks) {
-          if (!matchHook(hook, input.tool, filePath, shared?.toolName)) continue
+          if (!matchHook(hook, input.tool, filePath, shared?.toolName, ctx.directory)) continue
           if (hook.mode === "append") {
             const payload = await runner.runAppend(hook, input.tool, filePath)
             if (payload && typeof output.output === "string") output.output += payload

package/src/features/index.ts

@@ -1,4 +1,6 @@
 import type { FeatureModule } from "../types.ts"
+import { safety } from "./safety.ts"
+import { workflow } from "./workflow.ts"
 import { tasks } from "./tasks.ts"
 import { sched } from "./sched.ts"
 import { guard } from "./guard.ts"
@@ -10,4 +12,14 @@ import { recovery } from "./recovery.ts"
 /**
  * Registry, ordered. Order = hook composition order.
  */
-export const features: FeatureModule[] = [tasks, sched, guard, usage, buddy, truncator, recovery]
+export const features: FeatureModule[] = [
+  safety,
+  workflow,
+  tasks,
+  sched,
+  guard,
+  usage,
+  buddy,
+  truncator,
+  recovery,
+]

package/src/features/recovery.ts

@@ -68,7 +68,11 @@ export function createRecoveryTracker(maxAttempts = 3, cooldownMs = 60_000): Rec
     canAttempt(sessionID: string): boolean {
       const now = Date.now()
       const list = (attempts.get(sessionID) ?? []).filter((t) => now - t < cooldownMs)
-      attempts.set(sessionID, list)
+      if (list.length === 0) {
+        attempts.delete(sessionID)
+      } else {
+        attempts.set(sessionID, list)
+      }
       return list.length < maxAttempts
     },
     recordAttempt(sessionID: string): void {
@@ -101,8 +105,9 @@ export const recovery: FeatureModule = {
     return {
       event: async ({ event }) => {
         if (event.type === "session.deleted") {
-          const props = event.properties as { info?: { id?: string } } | undefined
-          if (props?.info?.id) tracker.reset(props.info.id)
+          const props = event.properties as { sessionID?: string; info?: { id?: string } } | undefined
+          const id = props?.sessionID ?? props?.info?.id
+          if (id) tracker.reset(id)
           return
         }
 
@@ -130,6 +135,11 @@ export const recovery: FeatureModule = {
         await toast(ctx.client, `recovering session from ${classified.reason}...`, "warning")
 
         if (autoResume) {
+          if (classified.reason === "rate_limit") {
+            // Apply a brief backoff delay before retrying a throttled endpoint
+            await new Promise((r) => setTimeout(r, 2000))
+          }
+
           const resumeText =
             classified.reason === "context_limit"
               ? "[session recovered: context limit reached; summarize recent progress and continue with minimal output]"

package/src/features/safety.ts

@@ -0,0 +1,147 @@
+import type { FeatureModule } from "../types.ts"
+import { toast } from "../lib/inject.ts"
+import { shellQuote } from "../lib/exec.ts"
+
+export interface DangerousPattern {
+  name: string
+  pattern: RegExp
+  reason: string
+}
+
+const GIT_PREFIX =
+  "\\bgit(?:\\s+(?:-[a-zA-Z0-9_.-]+|--[a-zA-Z0-9_.-]+(?:=\\S+)?|-[a-zA-Z]\\s+(?:\"[^\"]*\"|'[^']*'|\\S+)|--(?:git-dir|work-tree|namespace)\\s+(?:\"[^\"]*\"|'[^']*'|\\S+)))*\\s+"
+
+export const DANGEROUS_GIT_PATTERNS: DangerousPattern[] = [
+  {
+    name: "force-push",
+    pattern: new RegExp(
+      `${GIT_PREFIX}push\\b[^;&|\\n]*(?:\\s(?:--force(?:-with-lease)?\\b|-f\\b)|\\s\\+[^\\s:]+(?::\\S+)?)`,
+    ),
+    reason: "Force-pushing can overwrite remote history.",
+  },
+  {
+    name: "hard-reset",
+    pattern: new RegExp(`${GIT_PREFIX}reset\\b[^;&|\\n]*(?:\\s|^)--hard\\b`),
+    reason: "Hard-reset discards uncommitted changes permanently.",
+  },
+  {
+    name: "force-clean",
+    pattern: new RegExp(`${GIT_PREFIX}clean\\b[^;&|\\n]*(?:\\s-[a-zA-Z]*f[a-zA-Z]*|\\s--force\\b)`),
+    reason: "Force clean deletes untracked files irreversibly.",
+  },
+  {
+    name: "branch-force-delete",
+    pattern: new RegExp(
+      `${GIT_PREFIX}branch\\b[^;&|\\n]*(?:\\s-[a-zA-Z]*D[a-zA-Z]*|\\s--delete\\s+--force\\b|\\s--force\\s+--delete\\b|\\s-[a-zA-Z]*d[a-zA-Z]*\\s+-[a-zA-Z]*f[a-zA-Z]*|\\s-[a-zA-Z]*f[a-zA-Z]*\\s+-[a-zA-Z]*d[a-zA-Z]*)`,
+    ),
+    reason: "Force deleting a branch bypasses unmerged commit checks.",
+  },
+  {
+    name: "remote-branch-delete",
+    pattern: new RegExp(`${GIT_PREFIX}push\\b[^;&|\\n]*(?:\\s--delete\\b|\\s-d\\b|\\s:[\\w/.-]+)`),
+    reason: "Deleting a remote branch can impact other collaborators.",
+  },
+  {
+    name: "discard-all-worktree",
+    pattern: new RegExp(
+      `${GIT_PREFIX}(?:restore|checkout)\\b[^;&|\\n]*?(?:\\s(?:--\\s+)?(?:\\.|\\*|:\\/))(?=\\s|$|[;&|])`,
+    ),
+    reason: "Discarding entire worktree changes loses all in-progress edits.",
+  },
+  {
+    name: "stash-destroy",
+    pattern: new RegExp(`${GIT_PREFIX}stash\\s+(?:drop|clear)\\b`),
+    reason: "Dropping or clearing stashes deletes saved work.",
+  },
+  {
+    name: "rebase-skip",
+    pattern: new RegExp(`${GIT_PREFIX}rebase\\s+--skip\\b`),
+    reason: "Rebase skip drops the conflicting commit completely.",
+  },
+]
+
+export interface SafetyOptions {
+  blockDestructiveGit?: boolean
+  allowForcePush?: boolean
+  allowStashDrop?: boolean
+  customPatterns?: { name: string; pattern: string; reason: string }[]
+  [key: string]: unknown
+}
+
+export function resolvePatterns(options: SafetyOptions = {}): DangerousPattern[] {
+  let list = [...DANGEROUS_GIT_PATTERNS]
+
+  if (options.allowForcePush === true) {
+    list = list.filter((p) => p.name !== "force-push")
+  }
+
+  if (options.allowStashDrop === true) {
+    list = list.filter((p) => p.name !== "stash-destroy")
+  }
+
+  if (Array.isArray(options.customPatterns)) {
+    for (const c of options.customPatterns) {
+      if (typeof c.name === "string" && typeof c.pattern === "string") {
+        try {
+          list.push({
+            name: c.name,
+            pattern: new RegExp(c.pattern),
+            reason: typeof c.reason === "string" ? c.reason : "Blocked by custom safety policy.",
+          })
+        } catch (e) {
+          console.warn(`[overclock] safety: invalid custom pattern "${c.name}": ${e}`)
+        }
+      }
+    }
+  }
+
+  return list
+}
+
+export function checkDangerousCommand(
+  command: string,
+  patterns: DangerousPattern[],
+): DangerousPattern | null {
+  for (const p of patterns) {
+    if (p.pattern.test(command)) {
+      return p
+    }
+  }
+  return null
+}
+
+export const safety: FeatureModule = {
+  name: "safety",
+  tools: [],
+  defaultEnabled: true,
+  async init(ctx, options, shared) {
+    const opts = (options ?? {}) as SafetyOptions
+    if (opts.blockDestructiveGit === false) {
+      return {}
+    }
+
+    const patterns = resolvePatterns(opts)
+    const bashToolName = shared?.toolName ? shared.toolName("bash").toLowerCase() : "bash"
+
+    return {
+      "tool.execute.before": async (input, output) => {
+        const toolLower = input.tool.toLowerCase()
+        if (toolLower !== "bash" && toolLower !== bashToolName) return
+
+        const args = output.args as Record<string, unknown> | undefined
+        if (!args || typeof args.command !== "string") return
+
+        const matched = checkDangerousCommand(args.command, patterns)
+        if (!matched) return
+
+        const blockedMessage = `[overclock safety] Blocked destructive git command (${matched.name}): ${matched.reason}\nCommand requested: ${args.command}\nAction: To prevent accidental code loss, destructive git actions are blocked by overclock safety policy. Use safe alternatives like 'git stash push', 'git revert', or selective file restore.`
+
+        // Rewrite command to exit with error rather than crashing the execution fiber
+        // Use shellQuote to ensure no shell expansion/substitution occurs on the blocked command
+        output.args.command = `printf '%s\\n' ${shellQuote(blockedMessage)} >&2 && exit 1`
+
+        void toast(ctx.client, `safety: blocked ${matched.name}`, "warning")
+      },
+    }
+  },
+}

package/src/features/sched.ts

@@ -11,12 +11,25 @@ const z = tool.schema
 export type Spec = { kind: "interval"; ms: number } | { kind: "cron"; expr: string }
 
 const UNITS: Record<string, number> = { s: 1000, m: 60_000, h: 3_600_000, d: 86_400_000 }
+export const MIN_INTERVAL_MS = 5000
+export const MAX_SCHEDULES = 50
+export const MAX_CONSECUTIVE_FAILURES = 5
 
-/** "30s" | "5m" | "2h" | "1d" -> interval; else cron expr (validated). Throws on garbage. */
+/** "30s" | "5m" | "2h" | "1d" -> interval; else cron expr (validated). Throws on garbage or frequency < 5s. */
 export function parseSpec(spec: string): Spec {
   const m = spec.trim().match(/^(\d+)([smhd])$/)
-  if (m) return { kind: "interval", ms: Number(m[1]) * UNITS[m[2]!]! }
-  new Cron(spec) // throws if invalid
+  if (m) {
+    const ms = Number(m[1]) * UNITS[m[2]!]!
+    if (ms < MIN_INTERVAL_MS) {
+      throw new Error(`Schedule interval must be at least 5s (got ${spec})`)
+    }
+    return { kind: "interval", ms }
+  }
+  const cron = new Cron(spec) // throws if invalid
+  const runs = cron.nextRuns(2)
+  if (runs.length >= 2 && runs[1]!.getTime() - runs[0]!.getTime() < MIN_INTERVAL_MS) {
+    throw new Error(`Schedule frequency must be at least 5s (got ${spec})`)
+  }
   return { kind: "cron", expr: spec }
 }
 
@@ -34,6 +47,7 @@ export interface ScheduleManager {
   delete(id: string): Promise<boolean>
   arm(s: ScheduleEntry): void
   disarm(id: string): void
+  fire(s: ScheduleEntry): Promise<void>
   nextRun(s: ScheduleEntry): string
   dispose(): void
 }
@@ -52,10 +66,19 @@ export interface ScheduleManagerDeps {
 export async function createScheduleManager(deps: ScheduleManagerDeps): Promise<ScheduleManager> {
   const schedules = new Map<string, ScheduleEntry>()
   const timers = new Map<string, { stop(): void }>()
+  const consecutiveFailures = new Map<string, number>()
   const skipIfBusy = deps.skipIfBusy !== false
 
   const persist = async () => writeJson(deps.storePath, [...schedules.values()])
 
+  async function remove(id: string): Promise<boolean> {
+    if (!schedules.delete(id)) return false
+    disarm(id)
+    consecutiveFailures.delete(id)
+    await persist()
+    return true
+  }
+
   async function fire(s: ScheduleEntry) {
     try {
       if (s.target === "current") {
@@ -64,7 +87,21 @@ export async function createScheduleManager(deps: ScheduleManagerDeps): Promise<
           return
         }
         const ok = await inject(deps.client, s.sessionID, `[schedule ${s.id} fired]\n${s.prompt}`)
-        if (!ok) await toast(deps.client, `schedule ${s.id}: target session gone`, "warning")
+        if (!ok) {
+          const fails = (consecutiveFailures.get(s.id) ?? 0) + 1
+          consecutiveFailures.set(s.id, fails)
+          if (fails >= MAX_CONSECUTIVE_FAILURES) {
+            console.warn(
+              `[overclock] schedule ${s.id}: target session ${s.sessionID} unreachable ${fails} times, auto-removing`,
+            )
+            await toast(deps.client, `schedule ${s.id}: session unreachable, auto-removed`, "warning")
+            await remove(s.id)
+            return
+          }
+          await toast(deps.client, `schedule ${s.id}: target session gone`, "warning")
+        } else {
+          consecutiveFailures.delete(s.id)
+        }
       } else {
         const res = await deps.client.session.create({ body: { title: `sched:${s.id}` } })
         const id = res.data?.id
@@ -117,8 +154,12 @@ export async function createScheduleManager(deps: ScheduleManagerDeps): Promise<
     schedules,
     arm,
     disarm,
+    fire,
     nextRun,
     async create(input) {
+      if (schedules.size >= MAX_SCHEDULES) {
+        throw new Error(`Maximum schedules limit reached (${MAX_SCHEDULES})`)
+      }
       parseSpec(input.spec)
       const s: ScheduleEntry = {
         id: `s-${crypto.randomUUID().slice(0, 6)}`,
@@ -136,12 +177,7 @@ export async function createScheduleManager(deps: ScheduleManagerDeps): Promise<
     list() {
       return [...schedules.values()].map((s) => ({ schedule: s, next: nextRun(s) }))
     },
-    async delete(id: string) {
-      if (!schedules.delete(id)) return false
-      disarm(id)
-      await persist()
-      return true
-    },
+    delete: remove,
     dispose() {
       for (const id of [...timers.keys()]) disarm(id)
     },