opencode-supertask 0.1.19 → 0.1.21

package/dist/web/index.js

@@ -10,9 +10,6 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   if (typeof require !== "undefined") return require.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
 var __commonJS = (cb, mod) => function __require2() {
   return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
@@ -237,7 +234,7 @@ var require_CronField = __commonJS({
         if (!isValidRange) {
           throw new Error(`${this.constructor.name} Validation error, got value ${badValue} expected range ${this.min}-${this.max}${charsString}`);
         }
-        const duplicate = this.#values.find((value, index) => this.#values.indexOf(value) !== index);
+        const duplicate = this.#values.find((value, index2) => this.#values.indexOf(value) !== index2);
         if (duplicate) {
           throw new Error(`${this.constructor.name} Validation error, duplicate values found: ${duplicate}`);
         }
@@ -8082,11 +8079,11 @@ var require_CronFieldCollection = __commonJS({
           throw new Error("Unexpected range end");
         }
         if (step * multiplier > range.end) {
-          const mapFn = (_, index) => {
+          const mapFn = (_, index2) => {
             if (typeof range.start !== "number") {
               throw new Error("Unexpected range start");
             }
-            return index % step === 0 ? range.start + index : null;
+            return index2 % step === 0 ? range.start + index2 : null;
           };
           if (typeof range.start !== "number") {
             throw new Error("Unexpected range start");
@@ -8978,9 +8975,9 @@ var require_CronExpressionParser = __commonJS({
         if (field === CronUnit.DayOfWeek && max % 7 === 0) {
           stack.push(0);
         }
-        for (let index = min; index <= max; index += repeatInterval) {
-          if (stack.indexOf(index) === -1) {
-            stack.push(index);
+        for (let index2 = min; index2 <= max; index2 += repeatInterval) {
+          if (stack.indexOf(index2) === -1) {
+            stack.push(index2);
           }
         }
         return stack;
@@ -9202,48 +9199,16 @@ var require_dist = __commonJS({
   }
 });
 
-// src/core/cron-parser.ts
-var cron_parser_exports = {};
-__export(cron_parser_exports, {
-  getNextCronRun: () => getNextCronRun,
-  isValidCronExpr: () => isValidCronExpr
-});
-function getNextCronRun(expr, afterMs) {
-  try {
-    const fromDate = afterMs != null ? new Date(afterMs) : /* @__PURE__ */ new Date();
-    const interval = import_cron_parser.CronExpressionParser.parse(expr, { currentDate: fromDate });
-    const next = interval.next();
-    return next.getTime();
-  } catch {
-    return null;
-  }
-}
-function isValidCronExpr(expr) {
-  try {
-    import_cron_parser.CronExpressionParser.parse(expr);
-    return true;
-  } catch {
-    return false;
-  }
-}
-var import_cron_parser;
-var init_cron_parser = __esm({
-  "src/core/cron-parser.ts"() {
-    "use strict";
-    import_cron_parser = __toESM(require_dist(), 1);
-  }
-});
-
 // node_modules/hono/dist/compose.js
 var compose = (middleware, onError, onNotFound) => {
   return (context, next) => {
-    let index = -1;
+    let index2 = -1;
     return dispatch(0);
     async function dispatch(i) {
-      if (i <= index) {
+      if (i <= index2) {
         throw new Error("next() called multiple times");
       }
-      index = i;
+      index2 = i;
       let res;
       let isError = false;
       let handler;
@@ -9338,8 +9303,8 @@ var handleParsingAllValues = (form, key, value) => {
 var handleParsingNestedValues = (form, key, value) => {
   let nestedForm = form;
   const keys = key.split(".");
-  keys.forEach((key2, index) => {
-    if (index === keys.length - 1) {
+  keys.forEach((key2, index2) => {
+    if (index2 === keys.length - 1) {
       nestedForm[key2] = value;
     } else {
       if (!nestedForm[key2] || typeof nestedForm[key2] !== "object" || Array.isArray(nestedForm[key2]) || nestedForm[key2] instanceof File) {
@@ -9365,8 +9330,8 @@ var splitRoutingPath = (routePath) => {
 };
 var extractGroupsFromPath = (path) => {
   const groups = [];
-  path = path.replace(/\{[^}]+\}/g, (match2, index) => {
-    const mark = `@${index}`;
+  path = path.replace(/\{[^}]+\}/g, (match2, index2) => {
+    const mark = `@${index2}`;
     groups.push([mark, match2]);
     return mark;
   });
@@ -9869,10 +9834,10 @@ var escapeToBuffer = (str, buffer) => {
     return;
   }
   let escape;
-  let index;
+  let index2;
   let lastIndex = 0;
-  for (index = match2; index < str.length; index++) {
-    switch (str.charCodeAt(index)) {
+  for (index2 = match2; index2 < str.length; index2++) {
+    switch (str.charCodeAt(index2)) {
       case 34:
         escape = "&quot;";
         break;
@@ -9891,10 +9856,10 @@ var escapeToBuffer = (str, buffer) => {
       default:
         continue;
     }
-    buffer[0] += str.substring(lastIndex, index) + escape;
-    lastIndex = index + 1;
+    buffer[0] += str.substring(lastIndex, index2) + escape;
+    lastIndex = index2 + 1;
   }
-  buffer[0] += str.substring(lastIndex, index);
+  buffer[0] += str.substring(lastIndex, index2);
 };
 var resolveCallbackSync = (str) => {
   const callbacks = str.callbacks;
@@ -10738,8 +10703,8 @@ function match(method, path) {
     if (!match3) {
       return [[], emptyParam];
     }
-    const index = match3.indexOf("", 1);
-    return [matcher[1][index], match3];
+    const index2 = match3.indexOf("", 1);
+    return [matcher[1][index2], match3];
   });
   this.match = match2;
   return match2(method, path);
@@ -10774,7 +10739,7 @@ var Node = class _Node {
   #index;
   #varIndex;
   #children = /* @__PURE__ */ Object.create(null);
-  insert(tokens, index, paramMap, context, pathErrorCheckOnly) {
+  insert(tokens, index2, paramMap, context, pathErrorCheckOnly) {
     if (tokens.length === 0) {
       if (this.#index !== void 0) {
         throw PATH_ERROR;
@@ -10782,7 +10747,7 @@ var Node = class _Node {
       if (pathErrorCheckOnly) {
         return;
       }
-      this.#index = index;
+      this.#index = index2;
       return;
     }
     const [token, ...restTokens] = tokens;
@@ -10832,7 +10797,7 @@ var Node = class _Node {
         node = this.#children[token] = new _Node();
       }
     }
-    node.insert(restTokens, index, paramMap, context, pathErrorCheckOnly);
+    node.insert(restTokens, index2, paramMap, context, pathErrorCheckOnly);
   }
   buildRegExpStr() {
     const childKeys = Object.keys(this.#children).sort(compareKey);
@@ -10857,7 +10822,7 @@ var Node = class _Node {
 var Trie = class {
   #context = { varIndex: 0 };
   #root = new Node();
-  insert(path, index, pathErrorCheckOnly) {
+  insert(path, index2, pathErrorCheckOnly) {
     const paramAssoc = [];
     const groups = [];
     for (let i = 0; ; ) {
@@ -10883,7 +10848,7 @@ var Trie = class {
         }
       }
     }
-    this.#root.insert(tokens, index, paramAssoc, this.#context, pathErrorCheckOnly);
+    this.#root.insert(tokens, index2, paramAssoc, this.#context, pathErrorCheckOnly);
     return paramAssoc;
   }
   buildRegExp() {
@@ -12576,8 +12541,8 @@ function haveSameKeys(left, right) {
   if (leftKeys.length !== rightKeys.length) {
     return false;
   }
-  for (const [index, key] of leftKeys.entries()) {
-    if (key !== rightKeys[index]) {
+  for (const [index2, key] of leftKeys.entries()) {
+    if (key !== rightKeys[index2]) {
       return false;
     }
   }
@@ -14143,8 +14108,8 @@ var SQLiteDialect = class {
     }
     const joinsArray = [];
     if (joins) {
-      for (const [index, joinMeta] of joins.entries()) {
-        if (index === 0) {
+      for (const [index2, joinMeta] of joins.entries()) {
+        if (index2 === 0) {
           joinsArray.push(sql` `);
         }
         const table = joinMeta.table;
@@ -14161,7 +14126,7 @@ var SQLiteDialect = class {
             sql`${sql.raw(joinMeta.joinType)} join ${table} on ${joinMeta.on}`
           );
         }
-        if (index < joins.length - 1) {
+        if (index2 < joins.length - 1) {
           joinsArray.push(sql` `);
         }
       }
@@ -14174,9 +14139,9 @@ var SQLiteDialect = class {
   buildOrderBy(orderBy) {
     const orderByList = [];
     if (orderBy) {
-      for (const [index, orderByValue] of orderBy.entries()) {
+      for (const [index2, orderByValue] of orderBy.entries()) {
         orderByList.push(orderByValue);
-        if (index < orderBy.length - 1) {
+        if (index2 < orderBy.length - 1) {
           orderByList.push(sql`, `);
         }
       }
@@ -14225,9 +14190,9 @@ var SQLiteDialect = class {
     const havingSql = having ? sql` having ${having}` : void 0;
     const groupByList = [];
     if (groupBy) {
-      for (const [index, groupByValue] of groupBy.entries()) {
+      for (const [index2, groupByValue] of groupBy.entries()) {
         groupByList.push(groupByValue);
-        if (index < groupBy.length - 1) {
+        if (index2 < groupBy.length - 1) {
           groupByList.push(sql`, `);
         }
       }
@@ -16155,6 +16120,52 @@ var BaseSQLiteDatabase = class {
   }
 };
 
+// node_modules/drizzle-orm/sqlite-core/indexes.js
+var IndexBuilderOn = class {
+  constructor(name, unique) {
+    this.name = name;
+    this.unique = unique;
+  }
+  static [entityKind] = "SQLiteIndexBuilderOn";
+  on(...columns) {
+    return new IndexBuilder(this.name, columns, this.unique);
+  }
+};
+var IndexBuilder = class {
+  static [entityKind] = "SQLiteIndexBuilder";
+  /** @internal */
+  config;
+  constructor(name, columns, unique) {
+    this.config = {
+      name,
+      columns,
+      unique,
+      where: void 0
+    };
+  }
+  /**
+   * Condition for partial index.
+   */
+  where(condition) {
+    this.config.where = condition;
+    return this;
+  }
+  /** @internal */
+  build(table) {
+    return new Index(this.config, table);
+  }
+};
+var Index = class {
+  static [entityKind] = "SQLiteIndex";
+  config;
+  constructor(config, table) {
+    this.config = { ...config, table };
+  }
+};
+function index(name) {
+  return new IndexBuilderOn(name, false);
+}
+
 // node_modules/drizzle-orm/sqlite-core/session.js
 var ExecuteResultSync = class extends QueryPromise {
   constructor(resultCb) {
@@ -16501,12 +16512,17 @@ var tasks = sqliteTable("tasks", {
   resultLog: text("result_log"),
   retryCount: integer("retry_count").default(0),
   maxRetries: integer("max_retries").default(3),
+  retryBackoffMs: integer("retry_backoff_ms").default(3e4),
   // Gateway 扩展字段（毫秒）
   retryAfter: integer("retry_after"),
   timeoutMs: integer("timeout_ms"),
   templateId: integer("template_id"),
   scheduledAt: integer("scheduled_at")
-});
+}, (table) => [
+  index("tasks_queue_idx").on(table.status, table.retryAfter, table.urgency, table.importance, table.createdAt, table.id),
+  index("tasks_batch_status_idx").on(table.batchId, table.status),
+  index("tasks_template_status_idx").on(table.templateId, table.status)
+]);
 var TASK_CATEGORIES = [
   "translate",
   "generate",
@@ -16516,7 +16532,7 @@ var TASK_CATEGORIES = [
 ];
 var taskRuns = sqliteTable("task_runs", {
   id: integer("id").primaryKey({ autoIncrement: true }),
-  taskId: integer("task_id").notNull().references(() => tasks.id),
+  taskId: integer("task_id").notNull().references(() => tasks.id, { onDelete: "cascade" }),
   sessionId: text("session_id"),
   model: text("model"),
   status: text("status").default("running"),
@@ -16529,7 +16545,10 @@ var taskRuns = sqliteTable("task_runs", {
   heartbeatAt: integer("heartbeat_at"),
   workerPid: integer("worker_pid"),
   childPid: integer("child_pid")
-});
+}, (table) => [
+  index("task_runs_task_started_idx").on(table.taskId, table.startedAt, table.id),
+  index("task_runs_status_heartbeat_idx").on(table.status, table.heartbeatAt)
+]);
 var taskTemplates = sqliteTable("task_templates", {
   id: integer("id").primaryKey({ autoIncrement: true }),
   name: text("name").notNull(),
@@ -16540,6 +16559,7 @@ var taskTemplates = sqliteTable("task_templates", {
   category: text("category").default("general"),
   importance: integer("importance").default(3),
   urgency: integer("urgency").default(3),
+  batchId: text("batch_id"),
   scheduleType: text("schedule_type").notNull(),
   cronExpr: text("cron_expr"),
   intervalMs: integer("interval_ms"),
@@ -16547,12 +16567,15 @@ var taskTemplates = sqliteTable("task_templates", {
   maxInstances: integer("max_instances").default(1),
   maxRetries: integer("max_retries").default(3),
   retryBackoffMs: integer("retry_backoff_ms").default(3e4),
+  timeoutMs: integer("timeout_ms"),
   lastRunAt: integer("last_run_at"),
   nextRunAt: integer("next_run_at"),
   enabled: integer("enabled", { mode: "boolean" }).default(true),
   createdAt: integer("created_at").default(0),
   updatedAt: integer("updated_at").default(0)
-});
+}, (table) => [
+  index("task_templates_due_idx").on(table.enabled, table.nextRunAt, table.id)
+]);
 
 // src/core/db/index.ts
 import { existsSync, mkdirSync } from "fs";
@@ -16566,7 +16589,15 @@ var _db = null;
 var _migrationRan = false;
 function getMigrationsFolder() {
   const __dirname = dirname(fileURLToPath(import.meta.url));
-  return join(__dirname, "../../../drizzle");
+  let dir = __dirname;
+  for (let i = 0; i < 5; i++) {
+    const candidate = join(dir, "drizzle", "meta", "_journal.json");
+    if (existsSync(candidate)) {
+      return join(dir, "drizzle");
+    }
+    dir = dirname(dir);
+  }
+  return join(__dirname, "../../drizzle");
 }
 function initDb() {
   const dataDir = dirname(DB_FILE_PATH);
@@ -16581,16 +16612,30 @@ function initDb() {
             id INTEGER PRIMARY KEY CHECK (id = 1),
             pid INTEGER NOT NULL,
             acquired_at INTEGER NOT NULL,
-            heartbeat_at INTEGER NOT NULL
+            heartbeat_at INTEGER NOT NULL,
+            ready_at INTEGER
         );
     `);
+  const gatewayLockColumns = _sqlite.query("PRAGMA table_info(gateway_lock)").all();
+  if (!gatewayLockColumns.some((column) => column.name === "ready_at")) {
+    _sqlite.exec("ALTER TABLE gateway_lock ADD COLUMN ready_at INTEGER;");
+  }
   _db = drizzle(_sqlite, { schema: schema_exports });
   if (!_migrationRan) {
-    _migrationRan = true;
     try {
       migrate(_db, { migrationsFolder: getMigrationsFolder() });
+      _sqlite.exec("PRAGMA foreign_keys = ON;");
+      const violations = _sqlite.query("PRAGMA foreign_key_check;").all();
+      if (violations.length > 0) {
+        throw new Error(`\u68C0\u6D4B\u5230 ${violations.length} \u6761\u5B64\u7ACB\u5173\u8054\u8BB0\u5F55\uFF0C\u8BF7\u5148\u4FEE\u590D\u6570\u636E\u518D\u542F\u52A8`);
+      }
+      _migrationRan = true;
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
+      _migrationRan = false;
+      _sqlite.close();
+      _sqlite = null;
+      _db = null;
       console.error(`[supertask] migration failed: ${msg}`);
       throw new Error(`[supertask] DB migration failed: ${msg}`);
     }
@@ -16629,7 +16674,7 @@ function computeBackoff(retryCount, baseMs = 3e4, maxMs = MAX_BACKOFF_MS) {
 }
 
 // src/core/services/task.service.ts
-var { tasks: tasks2 } = schema_exports;
+var { tasks: tasks2, taskRuns: taskRuns2 } = schema_exports;
 var TaskService = class {
   static buildScopeWhere(scope) {
     const conditions = [];
@@ -16639,9 +16684,27 @@ var TaskService = class {
     return conditions;
   }
   static async add(data) {
+    this.validateNewTask(data);
     const result = await db.insert(tasks2).values(data).returning();
     return result[0];
   }
+  static validateNewTask(data) {
+    if (!data.name.trim()) throw new Error("name \u4E0D\u80FD\u4E3A\u7A7A");
+    if (!data.agent.trim()) throw new Error("agent \u4E0D\u80FD\u4E3A\u7A7A");
+    if (!data.prompt.trim()) throw new Error("prompt \u4E0D\u80FD\u4E3A\u7A7A");
+    this.validateInteger("importance", data.importance, 1, 5);
+    this.validateInteger("urgency", data.urgency, 1, 5);
+    this.validateInteger("maxRetries", data.maxRetries, 0, 1e3);
+    this.validateInteger("retryBackoffMs", data.retryBackoffMs, 0, 864e5);
+    this.validateInteger("timeoutMs", data.timeoutMs, 1e3, 6048e5);
+    this.validateInteger("dependsOn", data.dependsOn, 1, Number.MAX_SAFE_INTEGER);
+  }
+  static validateInteger(name, value, min, max) {
+    if (value === void 0 || value === null) return;
+    if (!Number.isInteger(value) || value < min || value > max) {
+      throw new Error(`${name} \u5FC5\u987B\u662F ${min} \u5230 ${max} \u4E4B\u95F4\u7684\u6574\u6570`);
+    }
+  }
   static async next(scope = {}) {
     const baseConditions = [...this.buildScopeWhere(scope)];
     const nowMs = Date.now();
@@ -16664,7 +16727,7 @@ var TaskService = class {
       ),
       and(
         eq(tasks2.status, "failed"),
-        sql`${tasks2.retryCount} < ${tasks2.maxRetries}`,
+        sql`${tasks2.retryCount} <= ${tasks2.maxRetries}`,
         retryAfterFilter
       )
     );
@@ -16678,7 +16741,8 @@ var TaskService = class {
     const allTasks = await db.select().from(tasks2).where(and(...conditions)).orderBy(
       desc(tasks2.urgency),
       desc(tasks2.importance),
-      asc(tasks2.createdAt)
+      asc(tasks2.createdAt),
+      asc(tasks2.id)
     );
     for (const task of allTasks) {
       if (task.dependsOn) {
@@ -16699,7 +16763,7 @@ var TaskService = class {
         eq(tasks2.status, "pending"),
         and(
           eq(tasks2.status, "failed"),
-          sql`${tasks2.retryCount} < ${tasks2.maxRetries}`
+          sql`${tasks2.retryCount} <= ${tasks2.maxRetries}`
         )
       ),
       ...this.buildScopeWhere(scope)
@@ -16712,7 +16776,11 @@ var TaskService = class {
     return result[0] || null;
   }
   static async done(id, log, scope = {}) {
-    const conditions = [eq(tasks2.id, id), ...this.buildScopeWhere(scope)];
+    const conditions = [
+      eq(tasks2.id, id),
+      eq(tasks2.status, "running"),
+      ...this.buildScopeWhere(scope)
+    ];
     const result = await db.update(tasks2).set({
       status: "done",
       finishedAt: /* @__PURE__ */ new Date(),
@@ -16723,17 +16791,24 @@ var TaskService = class {
   }
   static async fail(id, log, scope = {}, options) {
     const current = await this.getById(id, scope);
-    if (!current) return null;
+    if (!current || current.status !== "running") return null;
     const newRetryCount = (current.retryCount ?? 0) + 1;
     const maxRetries = current.maxRetries ?? 3;
-    const isDeadLetter = options?.setDeadLetter ?? newRetryCount >= maxRetries;
-    const conditions = [eq(tasks2.id, id), ...this.buildScopeWhere(scope)];
+    const isDeadLetter = options?.setDeadLetter ?? newRetryCount > maxRetries;
+    const conditions = [
+      eq(tasks2.id, id),
+      eq(tasks2.status, "running"),
+      ...this.buildScopeWhere(scope)
+    ];
     const result = await db.update(tasks2).set({
       status: isDeadLetter ? "dead_letter" : "failed",
       finishedAt: /* @__PURE__ */ new Date(),
       resultLog: log,
       retryCount: newRetryCount,
-      retryAfter: isDeadLetter ? null : options?.retryAfterMs ?? Date.now() + computeBackoff(newRetryCount)
+      retryAfter: isDeadLetter ? null : options?.retryAfterMs ?? Date.now() + computeBackoff(
+        newRetryCount,
+        current.retryBackoffMs ?? 3e4
+      )
     }).where(and(...conditions)).returning();
     return result[0] || null;
   }
@@ -16766,8 +16841,20 @@ var TaskService = class {
     return result.length;
   }
   static async cancel(id, scope = {}) {
-    const conditions = [eq(tasks2.id, id), ...this.buildScopeWhere(scope)];
-    const result = await db.update(tasks2).set({ status: "cancelled" }).where(and(...conditions)).returning();
+    const conditions = [
+      eq(tasks2.id, id),
+      or(
+        eq(tasks2.status, "pending"),
+        eq(tasks2.status, "running"),
+        eq(tasks2.status, "failed")
+      ),
+      ...this.buildScopeWhere(scope)
+    ];
+    const result = await db.update(tasks2).set({
+      status: "cancelled",
+      finishedAt: /* @__PURE__ */ new Date(),
+      retryAfter: null
+    }).where(and(...conditions)).returning();
     return result[0] || null;
   }
   static async retry(id, scope = {}) {
@@ -16779,7 +16866,8 @@ var TaskService = class {
       status: "pending",
       startedAt: null,
       finishedAt: null,
-      retryAfter: null
+      retryAfter: null,
+      retryCount: 0
     }).where(and(...conditions)).returning();
     return result[0] || null;
   }
@@ -16793,7 +16881,8 @@ var TaskService = class {
       status: "pending",
       startedAt: null,
       finishedAt: null,
-      retryAfter: null
+      retryAfter: null,
+      retryCount: 0
     }).where(and(...conditions)).returning();
     return result.length;
   }
@@ -16861,6 +16950,9 @@ var TaskService = class {
   }
   static async delete(id, scope = {}) {
     const conditions = [eq(tasks2.id, id), ...this.buildScopeWhere(scope)];
+    const existing = await db.select({ id: tasks2.id }).from(tasks2).where(and(...conditions)).limit(1);
+    if (!existing[0]) return false;
+    await db.delete(taskRuns2).where(eq(taskRuns2.taskId, id));
     const result = await db.delete(tasks2).where(and(...conditions)).returning();
     return result.length > 0;
   }
@@ -16878,59 +16970,59 @@ var TaskService = class {
 };
 
 // src/core/services/task-run.service.ts
-var { taskRuns: taskRuns2 } = schema_exports;
+var { taskRuns: taskRuns3 } = schema_exports;
 var TaskRunService = class {
   static async create(data) {
-    const result = await db.insert(taskRuns2).values(data).returning();
+    const result = await db.insert(taskRuns3).values(data).returning();
     return result[0];
   }
   static async updateSessionId(id, sessionId) {
-    const result = await db.update(taskRuns2).set({ sessionId }).where(eq(taskRuns2.id, id)).returning();
+    const result = await db.update(taskRuns3).set({ sessionId }).where(and(eq(taskRuns3.id, id), eq(taskRuns3.status, "running"))).returning();
     return result[0] || null;
   }
   static async done(id, log) {
-    const result = await db.update(taskRuns2).set({
+    const result = await db.update(taskRuns3).set({
       status: "done",
       finishedAt: /* @__PURE__ */ new Date(),
       log
-    }).where(eq(taskRuns2.id, id)).returning();
+    }).where(and(eq(taskRuns3.id, id), eq(taskRuns3.status, "running"))).returning();
     return result[0] || null;
   }
   static async fail(id, log) {
-    const result = await db.update(taskRuns2).set({
+    const result = await db.update(taskRuns3).set({
       status: "failed",
       finishedAt: /* @__PURE__ */ new Date(),
       log
-    }).where(eq(taskRuns2.id, id)).returning();
+    }).where(and(eq(taskRuns3.id, id), eq(taskRuns3.status, "running"))).returning();
     return result[0] || null;
   }
   static async heartbeat(id) {
-    const result = await db.update(taskRuns2).set({ heartbeatAt: Date.now() }).where(and(eq(taskRuns2.id, id), eq(taskRuns2.status, "running"))).returning();
+    const result = await db.update(taskRuns3).set({ heartbeatAt: Date.now() }).where(and(eq(taskRuns3.id, id), eq(taskRuns3.status, "running"))).returning();
     return result[0] || null;
   }
   static async updatePid(id, workerPid, childPid) {
-    const result = await db.update(taskRuns2).set({
+    const result = await db.update(taskRuns3).set({
       workerPid,
       childPid,
       lockedAt: Date.now(),
       lockedBy: `gateway-${process.pid}`
-    }).where(eq(taskRuns2.id, id)).returning();
+    }).where(and(eq(taskRuns3.id, id), eq(taskRuns3.status, "running"))).returning();
     return result[0] || null;
   }
   static async getById(id) {
-    const result = await db.select().from(taskRuns2).where(eq(taskRuns2.id, id));
+    const result = await db.select().from(taskRuns3).where(eq(taskRuns3.id, id));
     return result[0] || null;
   }
   static async listByTaskId(taskId) {
-    return await db.select().from(taskRuns2).where(eq(taskRuns2.taskId, taskId)).orderBy(desc(taskRuns2.startedAt), desc(taskRuns2.id));
+    return await db.select().from(taskRuns3).where(eq(taskRuns3.taskId, taskId)).orderBy(desc(taskRuns3.startedAt), desc(taskRuns3.id));
   }
   static async getLatestByTaskId(taskId) {
-    const result = await db.select().from(taskRuns2).where(eq(taskRuns2.taskId, taskId)).orderBy(desc(taskRuns2.startedAt), desc(taskRuns2.id)).limit(1);
+    const result = await db.select().from(taskRuns3).where(eq(taskRuns3.taskId, taskId)).orderBy(desc(taskRuns3.startedAt), desc(taskRuns3.id)).limit(1);
     return result[0] || null;
   }
   static async getLatestByTaskIds(taskIds) {
     if (taskIds.length === 0) return /* @__PURE__ */ new Map();
-    const latestRuns = await db.select().from(taskRuns2).where(inArray(taskRuns2.taskId, taskIds)).orderBy(desc(taskRuns2.startedAt));
+    const latestRuns = await db.select().from(taskRuns3).where(inArray(taskRuns3.taskId, taskIds)).orderBy(desc(taskRuns3.startedAt), desc(taskRuns3.id));
     const result = /* @__PURE__ */ new Map();
     for (const run of latestRuns) {
       if (!result.has(run.taskId)) {
@@ -16944,22 +17036,23 @@ var TaskRunService = class {
     const cutoffSec = Math.floor(cutoffMs / 1e3);
     const { tasks: tasksTable } = schema_exports;
     const result = await db.select({
-      runId: taskRuns2.id,
-      taskId: taskRuns2.taskId,
-      childPid: taskRuns2.childPid,
+      runId: taskRuns3.id,
+      taskId: taskRuns3.taskId,
+      childPid: taskRuns3.childPid,
       taskRetryCount: tasksTable.retryCount,
-      taskMaxRetries: tasksTable.maxRetries
-    }).from(taskRuns2).innerJoin(tasksTable, eq(taskRuns2.taskId, tasksTable.id)).where(
+      taskMaxRetries: tasksTable.maxRetries,
+      taskRetryBackoffMs: tasksTable.retryBackoffMs
+    }).from(taskRuns3).innerJoin(tasksTable, eq(taskRuns3.taskId, tasksTable.id)).where(
       and(
-        eq(taskRuns2.status, "running"),
+        eq(taskRuns3.status, "running"),
         or(
           and(
-            sql`${taskRuns2.heartbeatAt} IS NULL`,
-            sql`${taskRuns2.startedAt} < ${cutoffSec}`
+            sql`${taskRuns3.heartbeatAt} IS NULL`,
+            sql`${taskRuns3.startedAt} < ${cutoffSec}`
           ),
           and(
-            sql`${taskRuns2.heartbeatAt} IS NOT NULL`,
-            sql`${taskRuns2.heartbeatAt} < ${cutoffMs}`
+            sql`${taskRuns3.heartbeatAt} IS NOT NULL`,
+            sql`${taskRuns3.heartbeatAt} < ${cutoffMs}`
           )
         )
       )
@@ -16969,28 +17062,50 @@ var TaskRunService = class {
       taskId: row.taskId,
       childPid: row.childPid,
       taskRetryCount: row.taskRetryCount ?? 0,
-      taskMaxRetries: row.taskMaxRetries ?? 3
+      taskMaxRetries: row.taskMaxRetries ?? 3,
+      taskRetryBackoffMs: row.taskRetryBackoffMs ?? 3e4
     }));
   }
   static async getRunningRunByTaskId(taskId) {
-    const result = await db.select().from(taskRuns2).where(and(eq(taskRuns2.taskId, taskId), eq(taskRuns2.status, "running"))).orderBy(desc(taskRuns2.startedAt), desc(taskRuns2.id)).limit(1);
+    const result = await db.select().from(taskRuns3).where(and(eq(taskRuns3.taskId, taskId), eq(taskRuns3.status, "running"))).orderBy(desc(taskRuns3.startedAt), desc(taskRuns3.id)).limit(1);
     return result[0] || null;
   }
   static async deleteByTaskIds(taskIds) {
     if (taskIds.length === 0) return 0;
-    const result = await db.delete(taskRuns2).where(inArray(taskRuns2.taskId, taskIds)).returning();
+    const result = await db.delete(taskRuns3).where(inArray(taskRuns3.taskId, taskIds)).returning();
     return result.length;
   }
   static async getAllRunningRuns() {
-    return await db.select().from(taskRuns2).where(eq(taskRuns2.status, "running"));
+    return await db.select().from(taskRuns3).where(eq(taskRuns3.status, "running"));
   }
 };
 
+// src/core/cron-parser.ts
+var import_cron_parser = __toESM(require_dist(), 1);
+function getNextCronRun(expr, afterMs) {
+  try {
+    const fromDate = afterMs != null ? new Date(afterMs) : /* @__PURE__ */ new Date();
+    const interval = import_cron_parser.CronExpressionParser.parse(expr, { currentDate: fromDate });
+    const next = interval.next();
+    return next.getTime();
+  } catch {
+    return null;
+  }
+}
+function isValidCronExpr(expr) {
+  try {
+    import_cron_parser.CronExpressionParser.parse(expr);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // src/core/services/task-template.service.ts
-init_cron_parser();
 var { taskTemplates: taskTemplates2 } = schema_exports;
 var TaskTemplateService = class {
   static async create(data) {
+    this.validate(data);
     const now = Date.now();
     const result = await db.insert(taskTemplates2).values({ ...data, createdAt: now, updatedAt: now }).returning();
     const tmpl = result[0];
@@ -17006,8 +17121,38 @@ var TaskTemplateService = class {
     }
     return tmpl;
   }
+  static validate(data) {
+    if (!data.name.trim()) throw new Error("name \u4E0D\u80FD\u4E3A\u7A7A");
+    if (!data.agent.trim()) throw new Error("agent \u4E0D\u80FD\u4E3A\u7A7A");
+    if (!data.prompt.trim()) throw new Error("prompt \u4E0D\u80FD\u4E3A\u7A7A");
+    const scheduleType = data.scheduleType;
+    if (!["cron", "delayed", "recurring"].includes(scheduleType)) {
+      throw new Error("scheduleType \u5FC5\u987B\u662F cron\u3001delayed \u6216 recurring");
+    }
+    if (scheduleType === "cron" && (!data.cronExpr || !isValidCronExpr(data.cronExpr))) {
+      throw new Error("cronExpr \u7F3A\u5931\u6216\u683C\u5F0F\u65E0\u6548");
+    }
+    if (scheduleType === "recurring" && (!Number.isInteger(data.intervalMs) || (data.intervalMs ?? 0) <= 0)) {
+      throw new Error("intervalMs \u5FC5\u987B\u662F\u6B63\u6574\u6570");
+    }
+    if (scheduleType === "delayed" && (!Number.isInteger(data.runAt) || (data.runAt ?? 0) <= 0)) {
+      throw new Error("runAt \u5FC5\u987B\u662F\u6B63\u6574\u6570\u65F6\u95F4\u6233");
+    }
+    this.validateInteger("importance", data.importance, 1, 5);
+    this.validateInteger("urgency", data.urgency, 1, 5);
+    this.validateInteger("maxInstances", data.maxInstances, 1, 1e3);
+    this.validateInteger("maxRetries", data.maxRetries, 0, 1e3);
+    this.validateInteger("retryBackoffMs", data.retryBackoffMs, 0, 864e5);
+    this.validateInteger("timeoutMs", data.timeoutMs, 1e3, 6048e5);
+  }
+  static validateInteger(name, value, min, max) {
+    if (value === void 0 || value === null) return;
+    if (!Number.isInteger(value) || value < min || value > max) {
+      throw new Error(`${name} \u5FC5\u987B\u662F ${min} \u5230 ${max} \u4E4B\u95F4\u7684\u6574\u6570`);
+    }
+  }
   static async list(limit = 50) {
-    return await db.select().from(taskTemplates2).orderBy(desc(taskTemplates2.createdAt)).limit(limit);
+    return await db.select().from(taskTemplates2).orderBy(desc(taskTemplates2.createdAt), desc(taskTemplates2.id)).limit(limit);
   }
   static async getById(id) {
     const result = await db.select().from(taskTemplates2).where(eq(taskTemplates2.id, id));
@@ -17046,72 +17191,236 @@ var TaskTemplateService = class {
 };
 
 // src/gateway/config.ts
-import { readFileSync, existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync2, readFileSync } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
 var DEFAULT_CONFIG = {
+  configVersion: 2,
   worker: {
     maxConcurrency: 2,
     pollIntervalMs: 1e3,
     heartbeatIntervalMs: 3e4,
-    taskTimeoutMs: 18e5
+    taskTimeoutMs: 18e5,
+    shutdownGracePeriodMs: 3e4
   },
   scheduler: {
     enabled: true,
-    checkIntervalMs: 1e3,
-    catchUp: "next"
+    checkIntervalMs: 1e3
   },
   watchdog: {
     heartbeatTimeoutMs: 6e5,
-    cleanupIntervalMs: 6e4,
+    checkIntervalMs: 6e4,
+    cleanupIntervalMs: 864e5,
     retentionDays: 30
   },
   dashboard: {
     enabled: true,
     port: 4680
-  },
-  logging: {
-    level: "info",
-    format: "json"
   }
 };
-var CONFIG_PATH = join2(homedir2(), ".config/opencode/supertask.json");
-function deepMerge(base, override) {
-  const result = { ...base };
-  for (const key of Object.keys(override)) {
-    const val = override[key];
-    if (val !== null && typeof val === "object" && !Array.isArray(val) && key in result) {
-      const baseVal = result[key];
-      if (baseVal !== null && typeof baseVal === "object" && !Array.isArray(baseVal)) {
-        result[key] = deepMerge(baseVal, val);
-        continue;
-      }
-    }
-    if (val !== void 0) {
-      result[key] = val;
-    }
+var DEFAULT_CONFIG_PATH = join2(homedir2(), ".config/opencode/supertask.json");
+function getConfigPath() {
+  return process.env.SUPERTASK_CONFIG_PATH ?? DEFAULT_CONFIG_PATH;
+}
+function objectAt(value, path) {
+  if (value === void 0) return {};
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${path} \u5FC5\u987B\u662F\u5BF9\u8C61`);
   }
-  return result;
+  return value;
+}
+function integerAt(source, key, fallback, min, max, path) {
+  const value = source[key];
+  if (value === void 0) return fallback;
+  if (typeof value !== "number" || !Number.isInteger(value) || value < min || value > max) {
+    throw new Error(`${path}.${key} \u5FC5\u987B\u662F ${min} \u5230 ${max} \u4E4B\u95F4\u7684\u6574\u6570`);
+  }
+  return value;
+}
+function booleanAt(source, key, fallback, path) {
+  const value = source[key];
+  if (value === void 0) return fallback;
+  if (typeof value !== "boolean") throw new Error(`${path}.${key} \u5FC5\u987B\u662F\u5E03\u5C14\u503C`);
+  return value;
 }
-function loadConfig() {
-  if (!existsSync2(CONFIG_PATH)) {
-    return DEFAULT_CONFIG;
+function validateConfig(input) {
+  const root = objectAt(input, "config");
+  const version2 = root.configVersion ?? 1;
+  if (version2 !== 1 && version2 !== 2) {
+    throw new Error("config.configVersion \u53EA\u652F\u6301 1 \u6216 2");
+  }
+  const worker = objectAt(root.worker, "worker");
+  const scheduler = objectAt(root.scheduler, "scheduler");
+  const watchdog = objectAt(root.watchdog, "watchdog");
+  const dashboard = objectAt(root.dashboard, "dashboard");
+  const heartbeatIntervalMs = integerAt(worker, "heartbeatIntervalMs", DEFAULT_CONFIG.worker.heartbeatIntervalMs, 1e3, 36e5, "worker");
+  const heartbeatTimeoutMs = integerAt(watchdog, "heartbeatTimeoutMs", DEFAULT_CONFIG.watchdog.heartbeatTimeoutMs, 1e3, 864e5, "watchdog");
+  let checkIntervalMs;
+  let cleanupIntervalMs;
+  if (version2 === 1 && watchdog.checkIntervalMs === void 0 && watchdog.cleanupIntervalMs !== void 0) {
+    checkIntervalMs = integerAt(watchdog, "cleanupIntervalMs", DEFAULT_CONFIG.watchdog.checkIntervalMs, 1e3, 36e5, "watchdog");
+    cleanupIntervalMs = DEFAULT_CONFIG.watchdog.cleanupIntervalMs;
+  } else {
+    checkIntervalMs = integerAt(watchdog, "checkIntervalMs", DEFAULT_CONFIG.watchdog.checkIntervalMs, 1e3, 36e5, "watchdog");
+    cleanupIntervalMs = integerAt(watchdog, "cleanupIntervalMs", DEFAULT_CONFIG.watchdog.cleanupIntervalMs, 6e4, 6048e5, "watchdog");
+  }
+  if (heartbeatIntervalMs >= heartbeatTimeoutMs) {
+    throw new Error("worker.heartbeatIntervalMs \u5FC5\u987B\u5C0F\u4E8E watchdog.heartbeatTimeoutMs");
   }
+  if (checkIntervalMs > heartbeatTimeoutMs) {
+    throw new Error("watchdog.checkIntervalMs \u4E0D\u80FD\u5927\u4E8E watchdog.heartbeatTimeoutMs");
+  }
+  return {
+    configVersion: 2,
+    worker: {
+      maxConcurrency: integerAt(worker, "maxConcurrency", DEFAULT_CONFIG.worker.maxConcurrency, 1, 64, "worker"),
+      pollIntervalMs: integerAt(worker, "pollIntervalMs", DEFAULT_CONFIG.worker.pollIntervalMs, 50, 6e4, "worker"),
+      heartbeatIntervalMs,
+      taskTimeoutMs: integerAt(worker, "taskTimeoutMs", DEFAULT_CONFIG.worker.taskTimeoutMs, 1e3, 6048e5, "worker"),
+      shutdownGracePeriodMs: integerAt(worker, "shutdownGracePeriodMs", DEFAULT_CONFIG.worker.shutdownGracePeriodMs, 0, 36e5, "worker")
+    },
+    scheduler: {
+      enabled: booleanAt(scheduler, "enabled", DEFAULT_CONFIG.scheduler.enabled, "scheduler"),
+      checkIntervalMs: integerAt(scheduler, "checkIntervalMs", DEFAULT_CONFIG.scheduler.checkIntervalMs, 100, 6e4, "scheduler")
+    },
+    watchdog: {
+      heartbeatTimeoutMs,
+      checkIntervalMs,
+      cleanupIntervalMs,
+      retentionDays: integerAt(watchdog, "retentionDays", DEFAULT_CONFIG.watchdog.retentionDays, 1, 3650, "watchdog")
+    },
+    dashboard: {
+      enabled: booleanAt(dashboard, "enabled", DEFAULT_CONFIG.dashboard.enabled, "dashboard"),
+      port: integerAt(dashboard, "port", DEFAULT_CONFIG.dashboard.port, 1, 65535, "dashboard")
+    }
+  };
+}
+function loadConfig(path = getConfigPath()) {
+  if (!existsSync2(path)) return validateConfig({ configVersion: 2 });
   try {
-    const raw2 = readFileSync(CONFIG_PATH, "utf-8");
-    const userConfig = JSON.parse(raw2);
-    return deepMerge(DEFAULT_CONFIG, userConfig);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), level: "warn", msg: "config load failed, using defaults", path: CONFIG_PATH, error: msg }));
-    return DEFAULT_CONFIG;
+    return validateConfig(JSON.parse(readFileSync(path, "utf-8")));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`\u65E0\u6CD5\u8BFB\u53D6\u914D\u7F6E ${path}: ${message}`);
   }
 }
 
 // src/web/index.tsx
-import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync, mkdirSync as mkdirSync2 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync, mkdirSync as mkdirSync2, renameSync } from "fs";
 import { dirname as dirname2 } from "path";
+
+// src/gateway/health.ts
+var LOCK_STALE_MS = 3e4;
+var state = null;
+function componentStatus(component, enabled, maxAgeMs, now) {
+  const lastActivityAt = state?.lastActivityAt[component] ?? null;
+  const ageMs = lastActivityAt == null ? null : Math.max(0, now - lastActivityAt);
+  return {
+    enabled,
+    healthy: !enabled || ageMs != null && ageMs <= maxAgeMs,
+    lastActivityAt,
+    ageMs,
+    maxAgeMs
+  };
+}
+function getGatewayHealth(now = Date.now()) {
+  const worker = componentStatus(
+    "worker",
+    true,
+    Math.max((state?.config.workerPollIntervalMs ?? 1e3) * 5, 5e3),
+    now
+  );
+  const scheduler = componentStatus(
+    "scheduler",
+    state?.config.schedulerEnabled ?? false,
+    Math.max((state?.config.schedulerCheckIntervalMs ?? 1e3) * 5, 5e3),
+    now
+  );
+  const watchdog = componentStatus(
+    "watchdog",
+    true,
+    Math.max((state?.config.watchdogCheckIntervalMs ?? 6e4) * 3, 5e3),
+    now
+  );
+  let lock = { pid: null, heartbeatAt: null, readyAt: null, ageMs: null, healthy: false };
+  try {
+    const row = sqlite.prepare(
+      "SELECT pid, heartbeat_at, ready_at FROM gateway_lock WHERE id = 1"
+    ).get();
+    if (row) {
+      const ageMs = Math.max(0, now - row.heartbeat_at);
+      lock = {
+        pid: row.pid,
+        heartbeatAt: row.heartbeat_at,
+        readyAt: row.ready_at,
+        ageMs,
+        healthy: row.pid === process.pid && row.ready_at != null && ageMs < LOCK_STALE_MS
+      };
+    }
+  } catch {
+  }
+  const healthy = state != null && lock.healthy && worker.healthy && scheduler.healthy && watchdog.healthy;
+  return {
+    status: healthy ? "ok" : "degraded",
+    pid: process.pid,
+    uptimeMs: state ? Math.max(0, now - state.startedAt) : 0,
+    lock,
+    components: { worker, scheduler, watchdog }
+  };
+}
+
+// src/web/index.tsx
 var app = new Hono2();
+var TASK_STATUSES = /* @__PURE__ */ new Set([
+  "pending",
+  "running",
+  "done",
+  "failed",
+  "dead_letter",
+  "cancelled"
+]);
+function parsePositiveInteger(value) {
+  if (!/^\d+$/.test(value)) return null;
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : null;
+}
+function parseTaskStatus(value) {
+  return TASK_STATUSES.has(value) ? value : null;
+}
+function safeStatus(value) {
+  return value && TASK_STATUSES.has(value) ? value : "unknown";
+}
+app.use("*", async (c, next) => {
+  await next();
+  c.header("X-Content-Type-Options", "nosniff");
+  c.header("X-Frame-Options", "DENY");
+  c.header("Referrer-Policy", "no-referrer");
+});
+app.use("/api/*", async (c, next) => {
+  if (["GET", "HEAD", "OPTIONS"].includes(c.req.method)) return next();
+  const fetchSite = c.req.header("Sec-Fetch-Site");
+  if (fetchSite && !["same-origin", "none"].includes(fetchSite)) {
+    return c.json({ error: "cross-site request rejected" }, 403);
+  }
+  const origin = c.req.header("Origin");
+  if (origin) {
+    try {
+      const originUrl = new URL(origin);
+      const requestUrl = new URL(c.req.url);
+      const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(originUrl.hostname);
+      if (!loopback || originUrl.origin !== requestUrl.origin) {
+        return c.json({ error: "cross-site request rejected" }, 403);
+      }
+    } catch {
+      return c.json({ error: "invalid origin" }, 403);
+    }
+  }
+  return next();
+});
+app.get("/health", (c) => {
+  const health = getGatewayHealth();
+  return c.json(health, health.status === "ok" ? 200 : 503);
+});
 function formatDuration(startAt, endAt) {
   if (!startAt) return "-";
   const start = new Date(startAt).getTime();
@@ -17149,17 +17458,21 @@ function esc(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 function readCurrentConfig() {
-  if (!existsSync3(CONFIG_PATH)) return {};
+  const configPath = getConfigPath();
+  if (!existsSync3(configPath)) return {};
   try {
-    return JSON.parse(readFileSync2(CONFIG_PATH, "utf-8"));
+    return JSON.parse(readFileSync2(configPath, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeConfig(cfg) {
-  const dir = dirname2(CONFIG_PATH);
+  const configPath = getConfigPath();
+  const dir = dirname2(configPath);
   if (!existsSync3(dir)) mkdirSync2(dir, { recursive: true });
-  writeFileSync(CONFIG_PATH, JSON.stringify(cfg, null, 2) + "\n");
+  const tempPath = `${configPath}.${process.pid}.tmp`;
+  writeFileSync(tempPath, JSON.stringify(cfg, null, 2) + "\n", { mode: 384 });
+  renameSync(tempPath, configPath);
 }
 var SHARED_STYLES = html`
 <style>
@@ -17273,11 +17586,11 @@ async function saveConfig(){
     scheduler:{
       enabled:form.se.checked,
       checkIntervalMs:Number(form.si.value),
-      catchUp:form.cu.value,
     },
     watchdog:{
       heartbeatTimeoutMs:Number(form.wt.value)*1000,
-      cleanupIntervalMs:Number(form.wc.value)*1000,
+      checkIntervalMs:Number(form.wci.value)*1000,
+      cleanupIntervalMs:Number(form.wcl.value)*3600000,
       retentionDays:Number(form.rd.value),
     }
   };
@@ -17309,12 +17622,16 @@ async function saveConfig(){
 </body></html>`;
 }
 app.get("/", async (c) => {
-  const page = Number(c.req.query("page") || "1");
+  const pageParam = c.req.query("page") || "1";
+  const page = parsePositiveInteger(pageParam);
+  if (page === null) return c.text("invalid page", 400);
   const statusFilter = c.req.query("status") || "";
+  const parsedStatus = statusFilter ? parseTaskStatus(statusFilter) : null;
+  if (statusFilter && !parsedStatus) return c.text("invalid status", 400);
   const limit = 50;
   const offset = (page - 1) * limit;
   const [tasks3, statsData] = await Promise.all([
-    TaskService.list({ limit, offset, ...statusFilter ? { status: statusFilter } : {} }),
+    TaskService.list({ limit, offset, ...parsedStatus ? { status: parsedStatus } : {} }),
     TaskService.stats({})
   ]);
   const taskIds = tasks3.map((t) => t.id);
@@ -17337,12 +17654,13 @@ app.get("/", async (c) => {
     </div>`;
   let rows = "";
   for (const task of tasks3) {
-    const st = (task.status ?? "").toUpperCase();
+    const status = safeStatus(task.status);
+    const st = status.toUpperCase();
     rows += `<tr>
           <td class="mu">#${task.id}</td>
           <td><div style="font-weight:500">${esc(task.name)}</div><div class="mu sm el">${esc(task.prompt.substring(0, 120))}</div></td>
           <td><span class="tag">${esc(task.agent)}</span></td>
-          <td><span class="badge b-${task.status}">${st}</span></td>
+          <td><span class="badge b-${status}">${st}</span></td>
           <td class="sm ${task.status === "running" ? "" : "mu"}">${formatDuration(task.startedAt, task.finishedAt)}</td>
           <td class="mu sm">${(task.retryCount ?? 0) > 0 ? task.retryCount : "-"}</td>
           <td>
@@ -17374,21 +17692,13 @@ app.get("/", async (c) => {
 });
 app.get("/templates", async (c) => {
   const templates = await TaskTemplateService.list(100);
-  for (const tmpl of templates) {
-    if (tmpl.enabled && tmpl.scheduleType === "cron" && tmpl.cronExpr) {
-      try {
-        const { getNextCronRun: getNextCronRun2 } = await Promise.resolve().then(() => (init_cron_parser(), cron_parser_exports));
-        tmpl.nextRunAt = getNextCronRun2(tmpl.cronExpr, Date.now());
-      } catch {
-      }
-    }
-  }
   const enabled = templates.filter((t) => t.enabled).length;
   const disabled = templates.length - enabled;
   let rows = "";
   for (const t of templates) {
-    const typeLabel = t.scheduleType === "cron" ? "Cron" : t.scheduleType === "recurring" ? "\u5FAA\u73AF" : "\u5B9A\u65F6";
-    const typeClass = "tag t-" + t.scheduleType;
+    const scheduleType = ["cron", "recurring", "delayed"].includes(t.scheduleType) ? t.scheduleType : "unknown";
+    const typeLabel = scheduleType === "cron" ? "Cron" : scheduleType === "recurring" ? "\u5FAA\u73AF" : scheduleType === "delayed" ? "\u5B9A\u65F6" : "\u672A\u77E5";
+    const typeClass = "tag t-" + scheduleType;
     let rule = "-";
     if (t.scheduleType === "cron") rule = t.cronExpr || "-";
     else if (t.scheduleType === "recurring") rule = t.intervalMs ? `${Math.floor(t.intervalMs / 6e4)}\u5206\u949F` : "-";
@@ -17400,7 +17710,7 @@ app.get("/templates", async (c) => {
           <td><div style="font-weight:500">${esc(t.name)}</div><div class="mu sm el">${esc(t.prompt.substring(0, 100))}</div>
             <div class="sm" style="margin-top:2px"><span class="tag">${esc(t.agent)}</span>${t.model && t.model !== "default" ? ` <span class="tag">${esc(t.model)}</span>` : ""}</div></td>
           <td><span class="${typeClass}">${typeLabel}</span></td>
-          <td class="m sm">${rule}</td>
+          <td class="m sm">${esc(rule)}</td>
           <td>${statusBadge}</td>
           <td class="sm">${t.lastRunAt ? timeAgo(t.lastRunAt) : "-"}</td>
           <td class="sm">${t.nextRunAt ? timeUntil(t.nextRunAt) : "-"}</td>
@@ -17428,7 +17738,8 @@ app.get("/templates", async (c) => {
   return c.html(renderLayout("\u5B9A\u65F6\u4EFB\u52A1", "templates", body));
 });
 app.get("/runs", async (c) => {
-  const page = Number(c.req.query("page") || "1");
+  const page = parsePositiveInteger(c.req.query("page") || "1");
+  if (page === null) return c.text("invalid page", 400);
   const limit = 50;
   const offset = (page - 1) * limit;
   const { taskRuns: tr, tasks: tk } = schema_exports;
@@ -17446,13 +17757,14 @@ app.get("/runs", async (c) => {
     childPid: tr.childPid,
     taskName: tk.name,
     taskAgent: tk.agent
-  }).from(tr).innerJoin(tk, eq(tr.taskId, tk.id)).orderBy(desc(tr.startedAt)).limit(limit).offset(offset);
+  }).from(tr).innerJoin(tk, eq(tr.taskId, tk.id)).orderBy(desc(tr.startedAt), desc(tr.id)).limit(limit).offset(offset);
   const totalResult = await db.select({ count: sql`count(*)` }).from(tr);
   const total = Number(totalResult[0]?.count ?? 0);
   const totalPages = Math.ceil(total / limit);
   let rows = "";
   const logsHtml = [];
   for (const run of runs) {
+    const status = safeStatus(run.status);
     const shortSession = run.sessionId ? run.sessionId.slice(4, 7) + "***" + run.sessionId.slice(-3) : "-";
     const logBtn = run.log ? `<button class="btn btn-sm" onclick="toggleLog(${run.id})">\u65E5\u5FD7</button>` : "";
     rows += `<tr>
@@ -17460,15 +17772,15 @@ app.get("/runs", async (c) => {
           <td><div style="font-weight:500">${esc(run.taskName)} <span class="mu">(#${run.taskId})</span></div>
             ${run.model ? `<div class="sm"><span class="tag">${esc(run.model)}</span></div>` : ""}</td>
           <td><span class="tag">${esc(run.taskAgent)}</span></td>
-          <td><span class="badge b-${run.status}">${(run.status ?? "").toUpperCase()}</span></td>
+          <td><span class="badge b-${status}">${status.toUpperCase()}</span></td>
           <td class="sm">${formatDuration(run.startedAt, run.finishedAt)}</td>
           <td class="sm mu">${run.heartbeatAt ? timeAgo(run.heartbeatAt) : "-"}</td>
           <td><button class="btn btn-sm" onclick="showRunDetail(${run.id})">\u8BE6\u60C5</button>${logBtn}</td>
         </tr>`;
     if (run.log) {
       logsHtml.push(`<div id="log-${run.id}" style="display:none" class="mt8">
-              <div class="panel"><div class="ph"><h3>Run #${run.id} \u65E5\u5FD7 \u2014 ${run.taskName}</h3></div>
-              <div class="log-box">${run.log.replace(/</g, "&lt;")}</div></div></div>`);
+              <div class="panel"><div class="ph"><h3>Run #${run.id} \u65E5\u5FD7 \u2014 ${esc(run.taskName)}</h3></div>
+              <div class="log-box">${esc(run.log)}</div></div></div>`);
     }
   }
   let paging = `<div class="pn">`;
@@ -17494,17 +17806,18 @@ app.get("/runs", async (c) => {
 });
 app.get("/system", async (c) => {
   const config = loadConfig();
+  const configPath = getConfigPath();
   const stats = await TaskService.stats({});
   const runningRuns = await TaskRunService.getAllRunningRuns();
   const templates = await TaskTemplateService.list(100);
-  const configExists = existsSync3(CONFIG_PATH);
+  const configExists = existsSync3(configPath);
   let runRows = "";
   if (runningRuns.length > 0) {
     for (const run of runningRuns) {
       const shortS = run.sessionId ? run.sessionId.slice(4, 7) + "***" + run.sessionId.slice(-3) : "-";
       runRows += `<tr>
               <td class="mu">#${run.id}</td><td>#${run.taskId}</td>
-              <td class="m sm">${shortS}</td>
+              <td class="m sm">${esc(shortS)}</td>
               <td class="sm">${esc(run.model) || "-"}</td>
               <td class="sm">${formatDate(run.startedAt)}</td>
               <td class="sm">${run.heartbeatAt ? timeAgo(run.heartbeatAt) : "-"}</td>
@@ -17529,19 +17842,14 @@ app.get("/system", async (c) => {
           <h3 style="margin:0 0 12px;font-size:14px">Scheduler \u914D\u7F6E</h3>
           <div class="form-row"><label>\u542F\u7528\u8C03\u5EA6</label><input type="checkbox" name="se" ${config.scheduler.enabled ? "checked" : ""}></div>
           <div class="form-row"><label>\u68C0\u67E5\u95F4\u9694(ms)</label><input type="number" name="si" value="${config.scheduler.checkIntervalMs}" min="100" style="width:100px"></div>
-          <div class="form-row"><label>\u8FFD\u8D76\u6A21\u5F0F</label><select name="cu" style="width:100px">
-            <option value="next" ${config.scheduler.catchUp === "next" ? "selected" : ""}>next</option>
-            <option value="all" ${config.scheduler.catchUp === "all" ? "selected" : ""}>all</option>
-            <option value="latest" ${config.scheduler.catchUp === "latest" ? "selected" : ""}>latest</option>
-          </select></div>
           <div class="ir"><span class="ik">\u6D3B\u8DC3\u6A21\u677F</span><span class="iv">${templates.filter((t) => t.enabled).length} / ${templates.length}</span></div>
         </div>
         <div class="card">
           <h3 style="margin:0 0 12px;font-size:14px">Watchdog \u914D\u7F6E</h3>
           <div class="form-row"><label>\u5FC3\u8DF3\u8D85\u65F6(\u79D2)</label><input type="number" name="wt" value="${config.watchdog.heartbeatTimeoutMs / 1e3}" min="10" style="width:100px"></div>
-          <div class="form-row"><label>\u6E05\u7406\u95F4\u9694(\u79D2)</label><input type="number" name="wc" value="${config.watchdog.cleanupIntervalMs / 1e3}" min="10" style="width:100px"></div>
+          <div class="form-row"><label>\u68C0\u67E5\u95F4\u9694(\u79D2)</label><input type="number" name="wci" value="${config.watchdog.checkIntervalMs / 1e3}" min="1" style="width:100px"></div>
+          <div class="form-row"><label>\u6E05\u7406\u95F4\u9694(\u5C0F\u65F6)</label><input type="number" name="wcl" value="${config.watchdog.cleanupIntervalMs / 36e5}" min="1" style="width:100px"></div>
           <div class="form-row"><label>\u6570\u636E\u4FDD\u7559(\u5929)</label><input type="number" name="rd" value="${config.watchdog.retentionDays}" min="1" style="width:100px"></div>
-          <div class="ir"><span class="ik">\u65E5\u5FD7\u683C\u5F0F</span><span class="iv">${config.logging.format}</span></div>
         </div>
       </div>
       <div style="text-align:center;margin-bottom:24px">
@@ -17570,7 +17878,7 @@ app.get("/system", async (c) => {
 
       <div class="card mt16">
         <h3 style="margin:0 0 12px;font-size:14px">\u914D\u7F6E\u6587\u4EF6</h3>
-        <div class="ir"><span class="ik">\u8DEF\u5F84</span><span class="iv m sm">${CONFIG_PATH}</span></div>
+        <div class="ir"><span class="ik">\u8DEF\u5F84</span><span class="iv m sm">${esc(configPath)}</span></div>
         <div class="ir"><span class="ik">\u6587\u4EF6\u5B58\u5728</span><span class="iv">${configFileStatus}</span></div>
       </div>
 
@@ -17582,46 +17890,61 @@ app.get("/system", async (c) => {
   return c.html(renderLayout("\u7CFB\u7EDF\u72B6\u6001", "system", body));
 });
 app.get("/api/tasks/:id", async (c) => {
-  const id = Number(c.req.param("id"));
+  const id = parsePositiveInteger(c.req.param("id"));
+  if (id === null) return c.json({ error: "invalid id" }, 400);
   const task = await TaskService.getById(id);
   if (!task) return c.json({ error: "not found" }, 404);
   const runs = await TaskRunService.listByTaskId(id);
   return c.json({ ...task, _runs: runs });
 });
 app.get("/api/runs/:id", async (c) => {
-  const id = Number(c.req.param("id"));
+  const id = parsePositiveInteger(c.req.param("id"));
+  if (id === null) return c.json({ error: "invalid id" }, 400);
   const run = await TaskRunService.getById(id);
   if (!run) return c.json({ error: "not found" }, 404);
   return c.json(run);
 });
 app.get("/api/templates/:id", async (c) => {
-  const id = Number(c.req.param("id"));
+  const id = parsePositiveInteger(c.req.param("id"));
+  if (id === null) return c.json({ error: "invalid id" }, 400);
   const tmpl = await TaskTemplateService.getById(id);
   if (!tmpl) return c.json({ error: "not found" }, 404);
   return c.json(tmpl);
 });
 app.post("/api/tasks/:id/retry", async (c) => {
-  await TaskService.retry(Number(c.req.param("id")));
-  return c.json({ success: true });
+  const id = parsePositiveInteger(c.req.param("id"));
+  if (id === null) return c.json({ error: "invalid id" }, 400);
+  const task = await TaskService.retry(id);
+  if (task) return c.json({ success: true });
+  return await TaskService.getById(id) ? c.json({ error: "task status does not allow retry" }, 409) : c.json({ error: "not found" }, 404);
 });
 app.delete("/api/tasks/:id", async (c) => {
-  await TaskService.delete(Number(c.req.param("id")));
-  return c.json({ success: true });
+  const id = parsePositiveInteger(c.req.param("id"));
+  if (id === null) return c.json({ error: "invalid id" }, 400);
+  const deleted = await TaskService.delete(id);
+  return deleted ? c.json({ success: true }) : c.json({ error: "not found" }, 404);
 });
 app.post("/api/templates/:id/enable", async (c) => {
-  const result = await TaskTemplateService.enable(Number(c.req.param("id")));
-  return c.json({ success: !!result });
+  const id = parsePositiveInteger(c.req.param("id"));
+  if (id === null) return c.json({ error: "invalid id" }, 400);
+  const result = await TaskTemplateService.enable(id);
+  return result ? c.json({ success: true }) : c.json({ error: "not found" }, 404);
 });
 app.post("/api/templates/:id/disable", async (c) => {
-  const result = await TaskTemplateService.disable(Number(c.req.param("id")));
-  return c.json({ success: !!result });
+  const id = parsePositiveInteger(c.req.param("id"));
+  if (id === null) return c.json({ error: "invalid id" }, 400);
+  const result = await TaskTemplateService.disable(id);
+  return result ? c.json({ success: true }) : c.json({ error: "not found" }, 404);
 });
 app.delete("/api/templates/:id", async (c) => {
-  const ok = await TaskTemplateService.delete(Number(c.req.param("id")));
-  return c.json({ success: ok });
+  const id = parsePositiveInteger(c.req.param("id"));
+  if (id === null) return c.json({ error: "invalid id" }, 400);
+  const ok = await TaskTemplateService.delete(id);
+  return ok ? c.json({ success: true }) : c.json({ error: "not found" }, 404);
 });
 app.post("/api/templates/:id/trigger", async (c) => {
-  const id = Number(c.req.param("id"));
+  const id = parsePositiveInteger(c.req.param("id"));
+  if (id === null) return c.json({ error: "invalid id" }, 400);
   const tmpl = await TaskTemplateService.getById(id);
   if (!tmpl) return c.json({ error: "not found" }, 404);
   const task = await TaskService.add({
@@ -17633,7 +17956,10 @@ app.post("/api/templates/:id/trigger", async (c) => {
     category: tmpl.category,
     importance: tmpl.importance,
     urgency: tmpl.urgency,
+    batchId: tmpl.batchId,
     maxRetries: tmpl.maxRetries,
+    retryBackoffMs: tmpl.retryBackoffMs,
+    timeoutMs: tmpl.timeoutMs,
     templateId: tmpl.id
   });
   return c.json({ success: true, taskId: task.id });
@@ -17648,22 +17974,29 @@ app.put("/api/config", async (c) => {
     const bW = body.worker ?? {};
     const bS = body.scheduler ?? {};
     const bD = body.watchdog ?? {};
-    const merged = { ...current, ...body, worker: { ...curW, ...bW }, scheduler: { ...curS, ...bS }, watchdog: { ...curD, ...bD } };
-    writeConfig(merged);
+    const merged = {
+      ...current,
+      ...body,
+      configVersion: 2,
+      worker: { ...curW, ...bW },
+      scheduler: { ...curS, ...bS },
+      watchdog: { ...curD, ...bD }
+    };
+    writeConfig(validateConfig(merged));
     return c.json({ success: true });
   } catch (err) {
-    return c.json({ success: false, error: err instanceof Error ? err.message : String(err) });
+    return c.json({ success: false, error: err instanceof Error ? err.message : String(err) }, 400);
   }
 });
 app.post("/api/database/clear", async (c) => {
   try {
-    const { tasks: tasks3, taskRuns: taskRuns3, taskTemplates: taskTemplates3 } = schema_exports;
-    await db.delete(taskRuns3);
+    const { tasks: tasks3, taskRuns: taskRuns4, taskTemplates: taskTemplates3 } = schema_exports;
+    await db.delete(taskRuns4);
     await db.delete(taskTemplates3);
     await db.delete(tasks3);
     return c.json({ success: true });
   } catch (err) {
-    return c.json({ success: false, error: err instanceof Error ? err.message : String(err) });
+    return c.json({ success: false, error: err instanceof Error ? err.message : String(err) }, 500);
   }
 });
 var dashboardApp = app;