sanook-cli 0.5.1 → 0.5.5

package/dist/gateway/mattermost.js

@@ -0,0 +1,322 @@
+import { BRAND } from '../brand.js';
+import { redactKey } from '../providers/keys.js';
+import { runGatewayAgent } from './session.js';
+const MATTERMOST_TEXT_LIMIT = 4000;
+const runningTargets = new Set();
+export function normalizeMattermostUrl(raw) {
+    const trimmed = raw?.trim().replace(/\/+$/, '');
+    if (!trimmed)
+        return undefined;
+    if (!/^https?:\/\//i.test(trimmed))
+        return undefined;
+    return trimmed;
+}
+export function mattermostApiUrl(config, path, params) {
+    const base = normalizeMattermostUrl(config.serverUrl);
+    if (!base)
+        throw new Error('Mattermost URL ต้องเป็น URL เช่น https://mm.example.com');
+    const url = new URL(`${base}/api/v4/${path.replace(/^\/+/, '')}`);
+    for (const [key, value] of Object.entries(params ?? {})) {
+        if (value != null && String(value).trim())
+            url.searchParams.set(key, String(value));
+    }
+    return url.toString();
+}
+export function mattermostWebSocketUrl(serverUrl) {
+    const base = normalizeMattermostUrl(serverUrl);
+    if (!base)
+        throw new Error('Mattermost URL ต้องเป็น URL เช่น https://mm.example.com');
+    const url = new URL(base);
+    url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';
+    const pathBase = url.pathname.replace(/\/+$/, '');
+    url.pathname = `${pathBase}/api/v4/websocket`;
+    url.search = '';
+    return url.toString();
+}
+export function mattermostAuthHeaders(token, extra = {}) {
+    const clean = token?.trim();
+    if (!clean)
+        throw new Error('Mattermost token ว่าง');
+    return { authorization: `Bearer ${clean}`, ...extra };
+}
+export function splitMattermostText(raw, limit = MATTERMOST_TEXT_LIMIT) {
+    let remaining = raw.trim() || '(ไม่มีผลลัพธ์)';
+    const chunks = [];
+    while (remaining.length > limit) {
+        const window = remaining.slice(0, limit + 1);
+        let cut = window.lastIndexOf('\n');
+        if (cut < Math.floor(limit * 0.4))
+            cut = window.lastIndexOf(' ');
+        if (cut < Math.floor(limit * 0.4))
+            cut = limit;
+        chunks.push(remaining.slice(0, cut).trim());
+        remaining = remaining.slice(cut).trimStart();
+    }
+    if (remaining)
+        chunks.push(remaining);
+    return chunks.length ? chunks : ['(ไม่มีผลลัพธ์)'];
+}
+async function readJsonOrThrow(response, label) {
+    const text = await response.text().catch(() => '');
+    if (!response.ok)
+        throw new Error(`${label} ${response.status}${text ? `: ${redactKey(text).slice(0, 200)}` : ''}`);
+    if (!text)
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error(`${label} ${response.status}: response ไม่ใช่ JSON: ${redactKey(text).slice(0, 200)}`);
+    }
+}
+export async function mattermostMe(config) {
+    const r = await fetch(mattermostApiUrl(config, '/users/me'), {
+        method: 'GET',
+        headers: mattermostAuthHeaders(config.token),
+    });
+    return readJsonOrThrow(r, 'Mattermost users/me');
+}
+export async function sendMattermostMessage(config, channelId, text, rootId) {
+    const channel = channelId.trim();
+    if (!channel)
+        throw new Error('Mattermost channel id ว่าง');
+    const chunks = splitMattermostText(text);
+    const postIds = [];
+    for (const chunk of chunks) {
+        const r = await fetch(mattermostApiUrl(config, '/posts'), {
+            method: 'POST',
+            headers: mattermostAuthHeaders(config.token, { 'content-type': 'application/json' }),
+            body: JSON.stringify({
+                channel_id: channel,
+                message: chunk,
+                ...(rootId?.trim() ? { root_id: rootId.trim() } : {}),
+            }),
+        });
+        const parsed = await readJsonOrThrow(r, 'Mattermost create post');
+        if (parsed.id)
+            postIds.push(parsed.id);
+    }
+    return { channelId: channel, postIds, messageCount: chunks.length };
+}
+function parsePost(raw) {
+    if (!raw)
+        return undefined;
+    if (typeof raw === 'string') {
+        try {
+            const parsed = JSON.parse(raw);
+            return parsed && typeof parsed === 'object' ? parsed : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return typeof raw === 'object' ? raw : undefined;
+}
+function parseMentions(raw) {
+    if (!raw)
+        return [];
+    if (Array.isArray(raw))
+        return raw.filter((v) => typeof v === 'string');
+    if (typeof raw !== 'string')
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed))
+            return parsed.filter((v) => typeof v === 'string');
+    }
+    catch {
+        // Some Mattermost-compatible gateways emit comma-separated mention IDs.
+    }
+    return raw
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+export function mattermostMentionsBot(text, envelope, botUsername, botUserId) {
+    const mentions = parseMentions(envelope.data?.mentions);
+    if (botUserId && mentions.includes(botUserId))
+        return true;
+    const username = botUsername?.trim().replace(/^@/, '');
+    if (!username)
+        return false;
+    return new RegExp(`(^|\\s)@${escapeRegExp(username)}(\\b|\\s|:)`, 'i').test(text);
+}
+export function parseMattermostPostedEvent(raw, bot = {}) {
+    let envelope;
+    try {
+        envelope = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (envelope.event !== 'posted')
+        return null;
+    const post = parsePost(envelope.data?.post);
+    const userId = post?.user_id?.trim();
+    const channelId = (post?.channel_id ?? envelope.broadcast?.channel_id)?.trim();
+    const text = post?.message?.trim();
+    if (!userId || !channelId || !text)
+        return null;
+    if (bot.userId && userId === bot.userId)
+        return null;
+    const channelType = envelope.data?.channel_type?.trim();
+    return {
+        channelId,
+        userId,
+        text,
+        postId: post?.id,
+        rootId: post?.root_id || undefined,
+        channelType,
+        createAt: post?.create_at,
+        isDirect: channelType === 'D',
+        mentionsBot: mattermostMentionsBot(text, envelope, bot.username, bot.userId),
+    };
+}
+export function isAllowedMattermostEvent(config, event) {
+    if (!event.isDirect && config.allowedChannels.length && !config.allowedChannels.includes(event.channelId))
+        return false;
+    if (config.allowAllUsers)
+        return true;
+    return config.allowedUsers.includes(event.userId);
+}
+export function mattermostShouldRespond(config, event) {
+    if (event.isDirect)
+        return true;
+    if (config.freeResponseChannels.includes(event.channelId))
+        return true;
+    if (!config.requireMention)
+        return true;
+    return event.mentionsBot;
+}
+export function mattermostUserText(event, botUsername) {
+    let text = event.text.replace(/^!(new|reset|status|help)\b/i, '/$1').trim();
+    const username = botUsername?.trim().replace(/^@/, '');
+    if (username)
+        text = text.replace(new RegExp(`(^|\\s)@${escapeRegExp(username)}(\\b|\\s|:)`, 'gi'), ' ').trim();
+    return text || event.text;
+}
+function mattermostPrompt(event) {
+    return [`Mattermost ${event.isDirect ? 'DM' : 'channel'} ${event.channelId} from ${event.userId}:`, event.text].join('\n');
+}
+function mattermostReplyRootId(config, event) {
+    return event.rootId || (config.replyMode === 'thread' ? event.postId : undefined);
+}
+function mattermostSessionTarget(config, event) {
+    if (event.isDirect)
+        return event.channelId;
+    const threadId = event.rootId || (config.replyMode === 'thread' ? event.postId : undefined);
+    if (threadId)
+        return config.groupSessionsPerUser ? `${event.channelId}:${threadId}:${event.userId}` : `${event.channelId}:${threadId}`;
+    return config.groupSessionsPerUser ? `${event.channelId}:${event.userId}` : event.channelId;
+}
+export async function handleMattermostEvent(opts) {
+    const event = opts.event;
+    if (!isAllowedMattermostEvent(opts.config, event)) {
+        opts.onLog?.(`Mattermost: ปฏิเสธ ${event.userId} ใน ${event.channelId} (ไม่อยู่ใน allowlist)`);
+        return { handled: false, reason: 'not_allowed' };
+    }
+    if (!mattermostShouldRespond(opts.config, event))
+        return { handled: false, reason: 'not_mentioned' };
+    const target = mattermostSessionTarget(opts.config, event);
+    const running = opts.runningTargets ?? runningTargets;
+    if (running.has(target))
+        return { handled: false, reason: 'busy' };
+    running.add(target);
+    try {
+        const result = await runGatewayAgent({
+            platform: 'mattermost',
+            target,
+            model: opts.model,
+            prompt: mattermostPrompt(event),
+            userText: mattermostUserText(event, opts.botUsername),
+            budgetUsd: opts.budgetUsd,
+            permissionMode: opts.permissionMode ?? 'ask',
+        });
+        if (!result.suppressDelivery) {
+            await sendMattermostMessage(opts.config, event.channelId, result.text || '(ไม่มีผลลัพธ์)', mattermostReplyRootId(opts.config, event));
+        }
+        return { handled: true };
+    }
+    catch (e) {
+        opts.onLog?.(`Mattermost run error (${event.channelId}): ${redactKey(e.message)}`);
+        await sendMattermostMessage(opts.config, event.channelId, 'เกิดข้อผิดพลาดภายใน', mattermostReplyRootId(opts.config, event)).catch(() => { });
+        return { handled: false, reason: 'error' };
+    }
+    finally {
+        running.delete(target);
+    }
+}
+function defaultWebSocketFactory(url) {
+    const WS = globalThis.WebSocket;
+    if (!WS)
+        throw new Error('WebSocket runtime ไม่พร้อมใช้งานใน Node นี้');
+    return new WS(url);
+}
+export async function startMattermost(opts) {
+    if (!normalizeMattermostUrl(opts.config.serverUrl)) {
+        opts.onLog?.('Mattermost ไม่เริ่ม: ต้องตั้ง MATTERMOST_URL เช่น https://mm.example.com');
+        return () => { };
+    }
+    if (!opts.config.token?.trim()) {
+        opts.onLog?.('Mattermost ไม่เริ่ม: ต้องตั้ง MATTERMOST_TOKEN');
+        return () => { };
+    }
+    if (!opts.config.allowAllUsers && !opts.config.allowedUsers.length) {
+        opts.onLog?.('Mattermost ไม่เริ่ม: ต้องตั้ง MATTERMOST_ALLOWED_USERS เพื่อ fail-closed');
+        return () => { };
+    }
+    const me = await mattermostMe(opts.config);
+    if (!me.id)
+        throw new Error('Mattermost users/me response ไม่มี id');
+    const ws = (opts.webSocketFactory ?? defaultWebSocketFactory)(mattermostWebSocketUrl(opts.config.serverUrl));
+    const bot = { userId: me.id, username: me.username };
+    let stopped = false;
+    ws.addEventListener('open', () => {
+        opts.onLog?.(`Mattermost: websocket connecting as @${me.username ?? me.id}`);
+        ws.send(JSON.stringify({
+            seq: 1,
+            action: 'authentication_challenge',
+            data: { token: opts.config.token },
+        }));
+    });
+    ws.addEventListener('message', (event) => {
+        const raw = String(event.data ?? '');
+        if (!raw)
+            return;
+        try {
+            const envelope = JSON.parse(raw);
+            if (envelope.status === 'OK' && envelope.seq_reply === 1) {
+                opts.onLog?.('Mattermost: websocket authenticated');
+                return;
+            }
+        }
+        catch {
+            return;
+        }
+        const inbound = parseMattermostPostedEvent(raw, bot);
+        if (!inbound)
+            return;
+        void handleMattermostEvent({
+            config: opts.config,
+            event: inbound,
+            model: opts.model,
+            budgetUsd: opts.budgetUsd,
+            permissionMode: opts.permissionMode,
+            botUsername: bot.username,
+            runningTargets,
+            onLog: opts.onLog,
+        });
+    });
+    ws.addEventListener('close', () => {
+        if (!stopped)
+            opts.onLog?.('Mattermost: websocket closed');
+    });
+    ws.addEventListener('error', () => opts.onLog?.('Mattermost: websocket error'));
+    return () => {
+        stopped = true;
+        ws.close();
+    };
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}

package/dist/gateway/ntfy.js

@@ -0,0 +1,218 @@
+import { BRAND } from '../brand.js';
+import { redactKey } from '../providers/keys.js';
+import { runGatewayAgent } from './session.js';
+const NTFY_MESSAGE_LIMIT_BYTES = 4096;
+const NTFY_REPLY_TITLE = BRAND.productName;
+const runningTargets = new Set();
+function truthyHeader(value) {
+    return value === 'true' || value === '1' || value === 'yes';
+}
+export function ntfyAuthHeader(token) {
+    const trimmed = token?.trim();
+    if (!trimmed)
+        return undefined;
+    if (trimmed.includes(':'))
+        return `Basic ${Buffer.from(trimmed, 'utf8').toString('base64')}`;
+    return `Bearer ${trimmed}`;
+}
+export function ntfyTopicUrl(serverUrl, topic, suffix = '') {
+    const base = (serverUrl || 'https://ntfy.sh').replace(/\/+$/, '');
+    return `${base}/${encodeURIComponent(topic.trim())}${suffix}`;
+}
+export function truncateNtfyMessage(raw, limitBytes = NTFY_MESSAGE_LIMIT_BYTES) {
+    const text = raw.trim() || '(ไม่มีผลลัพธ์)';
+    if (Buffer.byteLength(text, 'utf8') <= limitBytes)
+        return { text, truncated: false };
+    const suffix = '...';
+    const budget = Math.max(1, limitBytes - Buffer.byteLength(suffix, 'utf8'));
+    let out = '';
+    let used = 0;
+    for (const ch of text) {
+        const next = Buffer.byteLength(ch, 'utf8');
+        if (used + next > budget)
+            break;
+        out += ch;
+        used += next;
+    }
+    return { text: `${out.trimEnd()}${suffix}`, truncated: true };
+}
+export async function sendNtfyMessage(config, topic, text, options = {}) {
+    const targetTopic = topic.trim();
+    if (!targetTopic)
+        throw new Error('ntfy topic ว่าง');
+    const body = truncateNtfyMessage(text);
+    const headers = {
+        'content-type': options.markdown ?? config.markdown ? 'text/markdown; charset=utf-8' : 'text/plain; charset=utf-8',
+        title: options.title?.trim() || NTFY_REPLY_TITLE,
+    };
+    const auth = ntfyAuthHeader(config.token);
+    if (auth)
+        headers.authorization = auth;
+    if (options.markdown ?? config.markdown)
+        headers.markdown = 'yes';
+    const r = await fetch(ntfyTopicUrl(config.serverUrl, targetTopic), {
+        method: 'POST',
+        headers,
+        body: body.text,
+    });
+    if (!r.ok) {
+        const detail = await r.text().catch(() => '');
+        throw new Error(`ntfy publish ${r.status}${detail ? `: ${redactKey(detail).slice(0, 200)}` : ''}`);
+    }
+    const parsed = (await r.json().catch(() => ({})));
+    return { topic: targetTopic, messageId: parsed.id, messageCount: 1, truncated: body.truncated };
+}
+export function parseNtfyJsonLine(line) {
+    const trimmed = line.trim();
+    if (!trimmed)
+        return null;
+    const parsed = JSON.parse(trimmed);
+    if (!parsed || typeof parsed !== 'object')
+        return null;
+    const event = parsed;
+    if (event.event !== 'message')
+        return null;
+    if (typeof event.message !== 'string' || !event.message.trim())
+        return null;
+    return event;
+}
+export function isAllowedNtfyTopic(config, topic) {
+    if (config.allowAllUsers)
+        return true;
+    const target = topic?.trim();
+    if (!target)
+        return false;
+    const allowed = new Set([config.topic, config.homeChannel, ...config.allowedUsers].filter((v) => Boolean(v?.trim())));
+    return allowed.has(target);
+}
+function ntfyPrompt(event, topic) {
+    const parts = [`ntfy topic ${topic}:`, event.message?.trim() || '(empty)'];
+    if (event.title?.trim() && event.title !== NTFY_REPLY_TITLE)
+        parts.splice(1, 0, `title: ${event.title.trim()}`);
+    return parts.join('\n');
+}
+export async function handleNtfyEvent(opts) {
+    const event = opts.event;
+    if (event.event !== 'message' || !event.message?.trim())
+        return { handled: false, reason: 'ignored_event' };
+    if (event.title === NTFY_REPLY_TITLE || truthyHeader(String(event.sanookReply ?? ''))) {
+        return { handled: false, reason: 'self_message' };
+    }
+    const topic = event.topic?.trim() || opts.config.topic?.trim();
+    if (!isAllowedNtfyTopic(opts.config, topic)) {
+        opts.onLog?.(`ntfy: ปฏิเสธ topic ${topic ?? '(unknown)'} (ไม่อยู่ใน allowlist)`);
+        return { handled: false, reason: 'not_allowed' };
+    }
+    if (!topic)
+        return { handled: false, reason: 'missing_topic' };
+    const running = opts.runningTargets ?? runningTargets;
+    if (running.has(topic))
+        return { handled: false, reason: 'busy' };
+    running.add(topic);
+    try {
+        const result = await runGatewayAgent({
+            platform: 'ntfy',
+            target: topic,
+            model: opts.model,
+            prompt: ntfyPrompt(event, topic),
+            userText: event.message.trim(),
+            budgetUsd: opts.budgetUsd,
+            permissionMode: opts.permissionMode ?? 'ask',
+        });
+        if (!result.suppressDelivery) {
+            await sendNtfyMessage(opts.config, opts.config.publishTopic || topic, result.text || '(ไม่มีผลลัพธ์)', { title: NTFY_REPLY_TITLE });
+        }
+        return { handled: true };
+    }
+    catch (e) {
+        opts.onLog?.(`ntfy run error (${topic}): ${redactKey(e.message)}`);
+        await sendNtfyMessage(opts.config, opts.config.publishTopic || topic, 'เกิดข้อผิดพลาดภายใน', { title: NTFY_REPLY_TITLE }).catch(() => { });
+        return { handled: false, reason: 'error' };
+    }
+    finally {
+        running.delete(topic);
+    }
+}
+async function delay(ms, signal) {
+    if (signal.aborted)
+        return;
+    await new Promise((resolve) => {
+        const timer = setTimeout(resolve, ms);
+        signal.addEventListener('abort', () => {
+            clearTimeout(timer);
+            resolve();
+        }, { once: true });
+    });
+}
+async function readNtfyStream(response, opts, signal) {
+    if (!response.body)
+        throw new Error('ntfy stream ไม่มี response body');
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let pending = '';
+    for (;;) {
+        const { done, value } = await reader.read();
+        pending += decoder.decode(value, { stream: !done });
+        const lines = pending.split(/\r?\n/);
+        pending = lines.pop() ?? '';
+        for (const line of lines) {
+            if (signal.aborted)
+                return;
+            try {
+                const event = parseNtfyJsonLine(line);
+                if (event)
+                    await handleNtfyEvent({ ...opts, event, runningTargets });
+            }
+            catch (e) {
+                opts.onLog?.(`ntfy parse error: ${redactKey(e.message)}`);
+            }
+        }
+        if (done)
+            break;
+    }
+    const last = pending.trim();
+    if (last && !signal.aborted) {
+        const event = parseNtfyJsonLine(last);
+        if (event)
+            await handleNtfyEvent({ ...opts, event, runningTargets });
+    }
+}
+export function startNtfy(opts) {
+    const topic = opts.config.topic?.trim();
+    if (!topic) {
+        opts.onLog?.('ntfy ไม่เริ่ม: ต้องตั้ง NTFY_TOPIC หรือ gateway setup ntfy --topic');
+        return () => { };
+    }
+    if (!isAllowedNtfyTopic(opts.config, topic)) {
+        opts.onLog?.('ntfy ไม่เริ่ม: ต้องตั้ง NTFY_ALLOWED_USERS ให้รวม topic หรือระบุ --allow-all-users เพื่อ fail-closed');
+        return () => { };
+    }
+    const controller = new AbortController();
+    const reconnectMs = opts.reconnectMs ?? 5000;
+    const headers = { accept: 'application/x-ndjson' };
+    const auth = ntfyAuthHeader(opts.config.token);
+    if (auth)
+        headers.authorization = auth;
+    const loop = async () => {
+        opts.onLog?.(`ntfy: subscribe ${ntfyTopicUrl(opts.config.serverUrl, topic, '/json?since=1s')}`);
+        while (!controller.signal.aborted) {
+            try {
+                const r = await fetch(ntfyTopicUrl(opts.config.serverUrl, topic, '/json?since=1s'), {
+                    method: 'GET',
+                    headers,
+                    signal: controller.signal,
+                });
+                if (!r.ok)
+                    throw new Error(`ntfy subscribe ${r.status}`);
+                await readNtfyStream(r, opts, controller.signal);
+            }
+            catch (e) {
+                if (!controller.signal.aborted)
+                    opts.onLog?.(`ntfy stream error: ${redactKey(e.message)}; reconnecting`);
+            }
+            await delay(reconnectMs, controller.signal);
+        }
+    };
+    void loop();
+    return () => controller.abort();
+}

package/dist/gateway/schedule.js

@@ -2,7 +2,23 @@
 // support: interval ("every 30m" / "2h"), daily ("09:00"), ISO timestamp (one-shot), "now"
 // pure — รับ now เป็น param (ไม่เรียก Date.now ใน body หลัก) เพื่อ test ได้
 const UNIT_MS = { s: 1_000, m: 60_000, h: 3_600_000, d: 86_400_000 };
+const MAX_DATE_MS = 8_640_000_000_000_000;
 const pad = (n) => String(n).padStart(2, '0');
+function isValidEpochMs(value) {
+    return Number.isSafeInteger(value) && Math.abs(value) <= MAX_DATE_MS;
+}
+function isLeapYear(year) {
+    return year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+}
+function isValidCalendarDate(year, month, day) {
+    if (month < 1 || month > 12 || day < 1)
+        return false;
+    const daysInMonth = [31, isLeapYear(year) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+    return day <= daysInMonth[month - 1];
+}
+function isValidClockTime(hour, minute) {
+    return hour >= 0 && hour <= 23 && minute >= 0 && minute <= 59;
+}
 /** next occurrence ของ HH:MM (local time) หลัง now */
 function nextDaily(minutesOfDay, now) {
     const target = new Date(now);
@@ -15,6 +31,8 @@ export function parseSchedule(input, now) {
     const s = input.trim().toLowerCase();
     if (!s)
         return null;
+    if (!isValidEpochMs(now))
+        return null;
     if (s === 'now' || s === 'immediately') {
         return { runAt: now, recurring: false, kind: 'once', normalized: 'now' };
     }
@@ -24,10 +42,11 @@ export function parseSchedule(input, now) {
         const n = parseInt(iv[1], 10);
         const unit = iv[2][0]; // s/m/h/d (ตัวแรกพอ)
         const ms = n * (UNIT_MS[unit] ?? 0);
+        const runAt = now + ms;
         // กัน overflow → runAt เป็น Invalid Date ที่ due() ไม่มีวันยิง
-        if (!Number.isSafeInteger(ms) || ms <= 0 || !Number.isFinite(now + ms))
+        if (!Number.isSafeInteger(ms) || ms <= 0 || !isValidEpochMs(runAt))
             return null;
-        return { runAt: now + ms, recurring: true, kind: 'cron', normalized: `every ${n}${unit}` };
+        return { runAt, recurring: true, kind: 'cron', normalized: `every ${n}${unit}` };
     }
     // daily time: "09:00" | "at 9:00" | "daily 09:30"
     const dt = s.match(/^(?:at\s+|daily\s+(?:at\s+)?)?(\d{1,2}):(\d{2})$/);
@@ -37,7 +56,10 @@ export function parseSchedule(input, now) {
         if (hh > 23 || mm > 59)
             return null;
         const mins = hh * 60 + mm;
-        return { runAt: nextDaily(mins, now), recurring: true, kind: 'cron', normalized: `${pad(hh)}:${pad(mm)}` };
+        const runAt = nextDaily(mins, now);
+        if (!isValidEpochMs(runAt))
+            return null;
+        return { runAt, recurring: true, kind: 'cron', normalized: `${pad(hh)}:${pad(mm)}` };
     }
     // ── NL ภาษาไทย / aliases → map เป็น canonical แล้ว parse ซ้ำ ──
     if (/^(ทุก\s*ๆ?\s*)?(ชั่วโมง|ชม\.?|hourly)$/.test(s))
@@ -57,7 +79,12 @@ export function parseSchedule(input, now) {
         return parseSchedule(`${thDaily[1]}:${thDaily[2]}`, now);
     // ISO timestamp (one-shot) — รับเฉพาะรูปแบบที่มี date จริง (กัน Date.parse รับ bare number/year-only กำกวม)
     const raw = input.trim();
-    if (/^\d{4}-\d{2}-\d{2}([T ]\d{2}:\d{2}|$)/.test(raw)) {
+    const iso = raw.match(/^(\d{4})-(\d{2})-(\d{2})(?:[T ](\d{2}):(\d{2})|$)/);
+    if (iso) {
+        if (!isValidCalendarDate(Number(iso[1]), Number(iso[2]), Number(iso[3])))
+            return null;
+        if (iso[4] !== undefined && !isValidClockTime(Number(iso[4]), Number(iso[5])))
+            return null;
         const t = Date.parse(raw);
         if (!Number.isNaN(t)) {
             if (t < now)