typeclaw 0.33.0 → 0.34.1

package/src/init/line-auth.ts

@@ -0,0 +1,98 @@
+import { join } from 'node:path'
+
+import { LineClient as RealLineClient, LineCredentialManager, type LineLoginResult } from 'agent-messenger/line'
+
+import { SecretsLineCredentialStore } from '@/secrets/line-store'
+
+export type LineBootstrapStatus = { ok: true } | { ok: false; reason: string }
+
+export type LineLoginCallbacks = {
+  onQRUrl?: (url: string) => void
+  onPincode: (pin: string) => void
+}
+
+// QR is the default because a LINE account may have no usable e-mail/password
+// (social-login accounts), and QR only adds bootstrap-time UX — the persisted
+// credential (auth_token + certificate) is identical regardless of method.
+export type LineLoginInput =
+  | {
+      method: 'qr'
+      agentDir: string
+      callbacks: LineLoginCallbacks
+      client?: LineLoginClient
+    }
+  | {
+      method: 'email'
+      email: string
+      password: string
+      agentDir: string
+      callbacks: LineLoginCallbacks
+      client?: LineLoginClient
+    }
+
+// Structural subset of the upstream LineClient the bootstrap drives. Declared
+// here so tests can inject a fake without standing up the real LOCO client.
+export type LineLoginClient = {
+  loginWithQR(options: { onQRUrl: (url: string) => void; onPincode: (pin: string) => void }): Promise<LineLoginResult>
+  loginWithEmail(options: {
+    email: string
+    password: string
+    onPincode: (pin: string) => void
+  }): Promise<LineLoginResult>
+}
+
+export function lineSecretsPath(agentDir: string): string {
+  return join(agentDir, 'secrets.json')
+}
+
+export async function runLineBootstrap(input: LineLoginInput): Promise<LineBootstrapStatus> {
+  try {
+    const store = new SecretsLineCredentialStore({ mode: 'host', secretsPath: lineSecretsPath(input.agentDir) })
+    // The LINE SDK persists the minted auth_token + certificate by calling
+    // setAccount() on whatever credential manager the client was built with.
+    // Wiring our secrets.json-backed store in here means a successful login
+    // writes straight to secrets.json#channels.line — no second copy in
+    // ~/.config/agent-messenger to keep in sync.
+    const client = input.client ?? buildLineClient(store)
+
+    const result =
+      input.method === 'qr'
+        ? await client.loginWithQR({
+            onQRUrl: (url) => input.callbacks.onQRUrl?.(url),
+            onPincode: input.callbacks.onPincode,
+          })
+        : await client.loginWithEmail({
+            email: input.email,
+            password: input.password,
+            onPincode: input.callbacks.onPincode,
+          })
+
+    if (!result.authenticated || result.account_id === undefined) {
+      const reason = result.message ?? result.error ?? 'LINE login did not authenticate'
+      return { ok: false, reason }
+    }
+
+    // The SDK persists the account by calling setAccount() on the credential
+    // manager as a side effect of login. We can't assume it did: read the
+    // record back and require an auth_token before declaring success, so a
+    // login that authenticated but failed to persist surfaces as an error
+    // instead of a green "added" with an empty secrets.json#channels.line.
+    const persisted = await store.getAccount(result.account_id)
+    if (persisted === null || persisted.auth_token === '') {
+      return { ok: false, reason: 'LINE login authenticated but did not persist credentials' }
+    }
+
+    await store.setCurrentAccount(result.account_id)
+    return { ok: true }
+  } catch (err) {
+    return { ok: false, reason: err instanceof Error ? err.message : String(err) }
+  }
+}
+
+function buildLineClient(store: SecretsLineCredentialStore): LineLoginClient {
+  // The upstream LineClient constructor takes a LineCredentialManager. Our
+  // store implements the same setAccount/getAccount surface the login path
+  // calls, so it stands in as the credential manager via a structural cast.
+  const credManager = store as unknown as LineCredentialManager
+  return new RealLineClient(credManager) as unknown as LineLoginClient
+}

package/src/init/models-dev.ts

@@ -22,6 +22,7 @@ const PROVIDER_TO_MODELS_DEV: Record<KnownProviderId, string> = {
   'zai-coding': 'zai',
   xai: 'xai',
   minimax: 'minimax',
+  deepseek: 'deepseek',
 }
 
 export type ModelOption = {

package/src/init/run-owner-claim.ts

@@ -10,6 +10,7 @@ const CHANNEL_LABELS: Record<ChannelKind, string> = {
   'discord-bot': 'Discord',
   github: 'GitHub',
   'telegram-bot': 'Telegram',
+  line: 'LINE',
   kakaotalk: 'KakaoTalk',
 }
 

package/src/init/validate-api-key.ts

@@ -9,6 +9,7 @@ const PROVIDER_PROBE: Partial<Record<KnownProviderId, { url: string; authHeader:
   'zai-coding': { url: 'https://api.z.ai/api/coding/paas/v4/models', authHeader: 'bearer' },
   xai: { url: 'https://api.x.ai/v1/models', authHeader: 'bearer' },
   minimax: { url: 'https://api.minimax.io/v1/models', authHeader: 'bearer' },
+  deepseek: { url: 'https://api.deepseek.com/models', authHeader: 'bearer' },
 }
 
 // When a base-URL override (ANTHROPIC_BASE_URL / OPENAI_BASE_URL) points at a
@@ -163,6 +164,7 @@ export const API_KEY_DASHBOARD_URL: Partial<Record<KnownProviderId, string>> = {
   'zai-coding': 'https://docs.z.ai/devpack/tool/claude#api-key',
   xai: 'https://console.x.ai',
   minimax: 'https://platform.minimax.io/user-center/basic-information/interface-key',
+  deepseek: 'https://platform.deepseek.com/api_keys',
 }
 
 // MiniMax sells the same `minimax` provider under two billing surfaces that

package/src/inspect/label.ts

@@ -5,6 +5,7 @@ const ADAPTER_DISPLAY: Record<string, string> = {
   'discord-bot': 'Discord',
   github: 'GitHub',
   'telegram-bot': 'Telegram',
+  line: 'LINE',
   kakaotalk: 'KakaoTalk',
 }
 

package/src/permissions/match-rule.ts

@@ -16,7 +16,7 @@
 // error messages with typo suggestions; a single big regex would only ever
 // say "didn't match".
 
-export const PLATFORMS = ['slack', 'discord', 'telegram', 'kakao', 'github'] as const
+export const PLATFORMS = ['slack', 'discord', 'telegram', 'line', 'kakao', 'github'] as const
 export type Platform = (typeof PLATFORMS)[number]
 
 const SUBAGENT_NAME = /^[a-z][a-z0-9-]*$/
@@ -35,9 +35,10 @@ export type MatchRule =
       workspace?: string
       chat?: string
       // Buckets for DM-style scopes. `slack:dm/*`, `discord:dm/*`,
-      // `kakao:dm/*`, `kakao:group/*`, `kakao:open/*` produce `bucket` only
-      // (no workspace, no chat).
-      bucket?: 'dm' | 'group' | 'open'
+      // `kakao:dm/*`, `kakao:group/*`, `kakao:open/*`, `line:dm/*`,
+      // `line:group/*`, `line:square/*` produce `bucket` only (no workspace,
+      // no chat).
+      bucket?: 'dm' | 'group' | 'open' | 'square'
       author?: string
     }
 
@@ -50,7 +51,7 @@ export type ParseMatchRuleResult = { ok: true; value: MatchRule } | { ok: false;
 // this to `author:` only, the JSON schema would reject typos with a generic
 // "did not match pattern" error and the user would lose the actionable hint.
 export const MATCH_RULE_REGEX_SOURCE =
-  '^(tui|cron|subagent(:[a-z][a-z0-9-]*)?|\\*|(slack|discord|telegram|kakao|github):[^\\s]+)(\\s+[a-zA-Z][a-zA-Z0-9_]*:[^\\s]+)*$'
+  '^(tui|cron|subagent(:[a-z][a-z0-9-]*)?|\\*|(slack|discord|telegram|line|kakao|github):[^\\s]+)(\\s+[a-zA-Z][a-zA-Z0-9_]*:[^\\s]+)*$'
 
 export function parseMatchRule(input: string): ParseMatchRuleResult {
   if (input !== input.trim() || input.length === 0) {
@@ -164,15 +165,16 @@ function parseChannelScope(platform: Platform, rest: string, author: string | un
       }
     }
 
-    if (head === 'dm' || head === 'group' || head === 'open') {
-      if (platform !== 'kakao' && (head === 'group' || head === 'open')) {
-        return { ok: false, error: `bucket '${head}' is only valid for kakao` }
+    if (head === 'dm' || head === 'group' || head === 'open' || head === 'square') {
+      const bucketError = invalidBucketForPlatform(head, platform)
+      if (bucketError !== null) {
+        return { ok: false, error: bucketError }
       }
       if (tail === '') {
         return { ok: false, error: `bucket '${platform}:${head}/' requires '*' or a chat id` }
       }
       if (tail === '*') {
-        return { ok: true, value: buildChannelRule(platform, { bucket: head as 'dm' | 'group' | 'open', author }) }
+        return { ok: true, value: buildChannelRule(platform, { bucket: head, author }) }
       }
       // `slack:dm/<id>` — keep the bucket plus the specific chat. We omit a
       // separate workspace field; DM IDs are globally unique within a
@@ -180,7 +182,7 @@ function parseChannelScope(platform: Platform, rest: string, author: string | un
       return {
         ok: true,
         value: buildChannelRule(platform, {
-          bucket: head as 'dm' | 'group' | 'open',
+          bucket: head,
           chat: tail,
           author,
         }),
@@ -199,12 +201,26 @@ function parseChannelScope(platform: Platform, rest: string, author: string | un
   }
 
   // No slash: `slack:T0123` or `kakao:dm` (bare bucket — error).
-  if (rest === 'dm' || rest === 'group' || rest === 'open') {
+  if (rest === 'dm' || rest === 'group' || rest === 'open' || rest === 'square') {
     return { ok: false, error: `bucket '${platform}:${rest}' requires a chat id or '*'` }
   }
   return { ok: true, value: buildChannelRule(platform, { workspace: rest, author }) }
 }
 
+// `dm` is universal. `group`/`open` are KakaoTalk buckets; `group`/`square`
+// are LINE buckets. Reject a bucket on a platform whose workspace shapes don't
+// produce it, so a typo'd rule fails loudly instead of silently never matching.
+function invalidBucketForPlatform(bucket: 'dm' | 'group' | 'open' | 'square', platform: Platform): string | null {
+  if (bucket === 'dm') return null
+  if (bucket === 'open') {
+    return platform === 'kakao' ? null : `bucket 'open' is only valid for kakao`
+  }
+  if (bucket === 'square') {
+    return platform === 'line' ? null : `bucket 'square' is only valid for line`
+  }
+  return platform === 'kakao' || platform === 'line' ? null : `bucket 'group' is only valid for kakao or line`
+}
+
 function parseGithubChannelScope(rest: string, author: string | undefined): ParseMatchRuleResult {
   const [owner, repo, ...chatParts] = rest.split('/')
   if (owner === undefined || owner === '' || repo === undefined || repo === '') {
@@ -230,7 +246,7 @@ function buildChannelRule(
   parts: {
     workspace?: string
     chat?: string
-    bucket?: 'dm' | 'group' | 'open'
+    bucket?: 'dm' | 'group' | 'open' | 'square'
     author?: string
   },
 ): MatchRule {

package/src/permissions/resolve.ts

@@ -7,6 +7,7 @@ const ADAPTER_TO_PLATFORM: Record<AdapterId, Platform> = {
   'discord-bot': 'discord',
   github: 'github',
   'telegram-bot': 'telegram',
+  line: 'line',
   kakaotalk: 'kakao',
 }
 
@@ -63,10 +64,16 @@ function matchesChannel(rule: Extract<MatchRule, { kind: 'channel' }>, origin: M
 // the origin's workspace is `@dm` (Slack) or `dm` (Discord). KakaoTalk uses
 // the workspace prefix itself.
 function matchesBucket(
-  bucket: 'dm' | 'group' | 'open',
+  bucket: 'dm' | 'group' | 'open' | 'square',
   origin: Extract<MatchableOrigin, { kind: 'channel' }>,
 ): boolean {
   const platform = ADAPTER_TO_PLATFORM[origin.adapter]
+  if (platform === 'line') {
+    if (bucket === 'dm') return origin.workspace === '@line-dm'
+    if (bucket === 'group') return origin.workspace === '@line-group'
+    if (bucket === 'square') return origin.workspace === '@line-square'
+    return false
+  }
   if (platform === 'kakao') {
     if (bucket === 'dm') return origin.workspace === '@kakao-dm'
     if (bucket === 'group') return origin.workspace === '@kakao-group'

package/src/role-claim/match-rule.ts

@@ -25,11 +25,15 @@ export type PartialChannelOrigin = {
   authorId: string
 }
 
-const ADAPTER_TO_PLATFORM: Record<ChannelKey['adapter'], 'slack' | 'discord' | 'telegram' | 'kakao' | 'github'> = {
+const ADAPTER_TO_PLATFORM: Record<
+  ChannelKey['adapter'],
+  'slack' | 'discord' | 'telegram' | 'kakao' | 'line' | 'github'
+> = {
   'slack-bot': 'slack',
   'discord-bot': 'discord',
   github: 'github',
   'telegram-bot': 'telegram',
+  line: 'line',
   kakaotalk: 'kakao',
 }
 

package/src/run/index.ts

@@ -30,9 +30,11 @@ import {
 import { createTunnelBridge, type TunnelBridge } from '@/channels/tunnel-bridge'
 import { createConfigReloadable, getConfig, loadConfigSync, loadPluginConfigsSync, reloadConfig } from '@/config'
 import {
+  type CountStore,
   type CronConsumer,
   type CronJob,
   type CronFile,
+  createCountStore,
   createCronConsumer,
   createCronReloadable,
   createScheduler,
@@ -77,7 +79,12 @@ type BunServer = ReturnType<Server['start']>
 export type TuiFactory = (options: TuiOptions) => { run: () => Promise<unknown> }
 
 export type LoadCronFn = (agentDir: string, options?: { subagents?: SubagentRegistry }) => Promise<LoadCronResult>
-export type SchedulerFactory = (options: { cwd: string; file: CronFile; onFire: (job: CronJob) => void }) => Scheduler
+export type SchedulerFactory = (options: {
+  cwd: string
+  file: CronFile
+  onFire: (job: CronJob) => void
+  onCountStore?: (store: CountStore) => void
+}) => Scheduler | Promise<Scheduler>
 export type ChannelManagerFactory = typeof createChannelManager
 export type TunnelManagerFactory = (options: TunnelManagerOptions) => TunnelManager
 
@@ -419,9 +426,23 @@ export async function startAgent({
   })
   subagentConsumer.start()
 
+  // Populated by startScheduler's factory (onCountStore). The consumer
+  // subscribes before this is set, but only touches the holder at fire time
+  // (reading the count via `get` and recording it via `increment`) — and the
+  // scheduler (the sole cron publisher) is armed only AFTER the holder is
+  // populated, so no count-limited fire can observe an undefined holder. If
+  // another cron publisher is ever added, create the store before this point.
+  let cronCountStore: CountStore | undefined
   const cronConsumer = createCronConsumer({
     stream,
     cwd,
+    countStore: {
+      get: (id, job) => cronCountStore?.get(id, job) ?? 0,
+      // Holder is always set before any fire (see above); the `false` fallback
+      // fails safe — skip dispatch rather than run an uncounted count-job — for
+      // the unreachable case where a fire somehow predates the holder.
+      increment: (id, job, at) => cronCountStore?.increment(id, job, at) ?? Promise.resolve(false),
+    },
     invokeHandler: async (job) => {
       const snap = pluginRuntime.get()
       const registered = snap.registry.cronJobs.find((j) => j.globalId === job.id)
@@ -532,6 +553,11 @@ export async function startAgent({
 
   const internalJobs = () => pluginCronJobs(pluginRuntime.get().registry)
   const factory = createSchedulerFor ?? makeDefaultSchedulerFactory(internalJobs)
+  // Subscribe the consumer BEFORE the scheduler arms any timers. The stream
+  // delivers only to live subscribers (no replay), so a fire published before
+  // the subscription exists would be lost. Subscribing to an empty stream is
+  // harmless when there are no jobs.
+  cronConsumer.start()
   const scheduler = await startScheduler({
     cwd,
     loadCron,
@@ -539,10 +565,12 @@ export async function startAgent({
     stream,
     hasInternalJobs: internalJobs().length > 0,
     getSubagents: () => pluginRuntime.get().subagents,
+    onCountStore: (store) => {
+      cronCountStore = store
+    },
   })
 
   if (scheduler) {
-    cronConsumer.start()
     reloadRegistry.register(
       createCronReloadable({ cwd, scheduler, internalJobs, getSubagents: () => pluginRuntime.get().subagents }),
     )
@@ -721,6 +749,7 @@ export async function startAgent({
     ...mcpManagerOpt,
     agentDir: cwd,
     pluginRuntime,
+    getFiredCount: (job) => cronCountStore?.get(job.id, job) ?? 0,
     claimController,
     commandRunnerFactory,
     tunnelManager,
@@ -838,6 +867,7 @@ async function startScheduler({
   stream,
   hasInternalJobs,
   getSubagents,
+  onCountStore,
 }: {
   cwd: string
   loadCron: LoadCronFn
@@ -845,6 +875,7 @@ async function startScheduler({
   stream: Stream
   hasInternalJobs: boolean
   getSubagents?: () => SubagentRegistry
+  onCountStore?: (store: CountStore) => void
 }): Promise<Scheduler | null> {
   let result: LoadCronResult
   const subagents = getSubagents?.()
@@ -864,13 +895,19 @@ async function startScheduler({
   const onFire = (job: CronJob) => {
     stream.publish({ target: { kind: 'cron', jobId: job.id }, payload: job })
   }
-  const scheduler = createSchedulerFor({ cwd, file, onFire })
+  const scheduler = await createSchedulerFor({ cwd, file, onFire, onCountStore })
   scheduler.start()
   return scheduler
 }
 
 function makeDefaultSchedulerFactory(internalJobs: () => CronJob[]): SchedulerFactory {
-  return ({ file, onFire }) => createScheduler({ jobs: [...file.jobs, ...internalJobs()], onFire })
+  return async ({ cwd, file, onFire, onCountStore }) => {
+    const jobs = [...file.jobs, ...internalJobs()]
+    const countStore = await createCountStore(cwd, jobs)
+    // Share the one store instance with the consumer's authoritative count gate.
+    onCountStore?.(countStore)
+    return createScheduler({ jobs, onFire, countStore })
+  }
 }
 
 // Exported for the regression test in `merge-subagents.test.ts`. The shim

package/src/secrets/line-store.ts

@@ -0,0 +1,112 @@
+import type { LineAccountCredentials, LineConfig } from 'agent-messenger/line'
+
+import { sendHttp } from '@/hostd/client'
+
+import { type LineChannelBlock, lineChannelBlockSchema } from './schema'
+import { SecretsBackend } from './storage'
+
+export type SecretsLineCredentialStoreOptions =
+  | { mode: 'host'; secretsPath: string }
+  | { mode: 'container'; secretsPath: string; hostdUrl: string; restartToken: string; containerName: string }
+
+const EMPTY_BLOCK: LineChannelBlock = { currentAccount: null, accounts: {} }
+
+export class SecretsLineCredentialStore {
+  private readonly backend: SecretsBackend
+  private writeChain: Promise<void> = Promise.resolve()
+
+  constructor(private readonly options: SecretsLineCredentialStoreOptions) {
+    this.backend = new SecretsBackend(options.secretsPath)
+  }
+
+  async load(): Promise<LineConfig> {
+    return toLineConfig(this.readBlock())
+  }
+
+  async save(config: LineConfig): Promise<void> {
+    await this.writeBlock(() => fromLineConfig(config))
+  }
+
+  async getAccount(id?: string): Promise<LineAccountCredentials | null> {
+    const config = await this.load()
+    if (id) return config.accounts[id] ?? null
+    if (!config.current_account) return null
+    return config.accounts[config.current_account] ?? null
+  }
+
+  async setAccount(account: LineAccountCredentials): Promise<void> {
+    await this.writeBlock((block) => {
+      const accounts = { ...block.accounts, [account.account_id]: account }
+      return { ...block, currentAccount: block.currentAccount ?? account.account_id, accounts }
+    })
+  }
+
+  async removeAccount(id: string): Promise<void> {
+    await this.writeBlock((block) => {
+      const accounts = { ...block.accounts }
+      delete accounts[id]
+      const currentAccount = block.currentAccount === id ? (Object.keys(accounts)[0] ?? null) : block.currentAccount
+      return { ...block, currentAccount, accounts }
+    })
+  }
+
+  async listAccounts(): Promise<Array<LineAccountCredentials & { is_current: boolean }>> {
+    const config = await this.load()
+    return Object.values(config.accounts).map((account) => ({
+      ...account,
+      is_current: account.account_id === config.current_account,
+    }))
+  }
+
+  async setCurrentAccount(id: string): Promise<void> {
+    await this.writeBlock((block) => ({ ...block, currentAccount: id }))
+  }
+
+  private readBlock(): LineChannelBlock {
+    const channels =
+      this.options.mode === 'container' ? this.backend.tryReadChannelsSync() : this.backend.readChannelsSync()
+    return parseBlock(channels?.line)
+  }
+
+  private async writeBlock(update: (current: LineChannelBlock) => LineChannelBlock): Promise<void> {
+    return this.enqueueWrite(async () => {
+      if (this.options.mode === 'container') {
+        const next = update(this.readBlock())
+        const response = await sendHttp(
+          {
+            kind: 'secrets-patch',
+            containerName: this.options.containerName,
+            patch: { channels: { line: next } },
+          },
+          { url: this.options.hostdUrl, token: this.options.restartToken },
+        )
+        if (!response.ok) throw new Error(`secrets-patch failed: ${response.reason}`)
+        return
+      }
+
+      await this.backend.updateChannelsAsync(async (channels) => {
+        const next = { ...channels, line: update(parseBlock(channels.line)) }
+        return { result: undefined, next }
+      })
+    })
+  }
+
+  private enqueueWrite(op: () => Promise<void>): Promise<void> {
+    const next = this.writeChain.then(op, op)
+    this.writeChain = next.catch(() => {})
+    return next
+  }
+}
+
+function parseBlock(value: unknown): LineChannelBlock {
+  if (value === undefined) return EMPTY_BLOCK
+  return lineChannelBlockSchema.parse(value)
+}
+
+function toLineConfig(block: LineChannelBlock): LineConfig {
+  return { current_account: block.currentAccount, accounts: block.accounts }
+}
+
+function fromLineConfig(config: LineConfig): LineChannelBlock {
+  return { currentAccount: config.current_account, accounts: config.accounts }
+}

package/src/secrets/oauth-xai.ts

@@ -240,7 +240,7 @@ export async function loginXai(callbacks: OAuthLoginCallbacks, fetchImpl: FetchF
     callbacks.onAuth({
       url: `${AUTHORIZE_URL}?${authParams.toString()}`,
       instructions:
-        'Complete login in your browser. If the browser is on another machine, paste the final redirect URL here.',
+        'Complete login in your browser. Grok shows a code to copy on the "could not establish connection" page — paste that code here. If the browser is on another machine, paste the code (or the final redirect URL) here.',
     })
 
     if (server && callbacks.onManualCodeInput) {

package/src/secrets/schema.ts

@@ -55,6 +55,28 @@ const githubChannelSchema = z.object({
   webhookSecret: secretFieldSchema,
 })
 
+const lineDeviceSchema = z.enum(['DESKTOPWIN', 'DESKTOPMAC', 'ANDROID', 'ANDROIDSECONDARY', 'IOS', 'IOSIPAD'])
+
+// LINE persists a long-lived auth token (+ optional certificate that lets a
+// later re-login skip the e-mail/PIN step on the same device). There is no
+// encrypted-password / renewal-cron path the way KakaoTalk has — LINE tokens
+// don't expire on a fixed short schedule, so the renewal fields are absent by
+// design.
+export const lineAccountRecordSchema = z.object({
+  account_id: z.string(),
+  auth_token: z.string(),
+  certificate: z.string().optional(),
+  device: lineDeviceSchema,
+  display_name: z.string().optional(),
+  created_at: z.string(),
+  updated_at: z.string(),
+})
+
+export const lineChannelBlockSchema = z.object({
+  currentAccount: z.string().nullable(),
+  accounts: z.record(z.string(), lineAccountRecordSchema),
+})
+
 // Encrypted password envelope produced by src/secrets/encryption.ts. Optional
 // in the schema because legacy v2 accounts (pre-renewal feature) don't have
 // one; the renewal cron treats a missing envelope as "reauth required" and
@@ -109,6 +131,7 @@ export const channelsSchema = z
     'discord-bot': discordBotChannelSchema.optional(),
     github: githubChannelSchema.optional(),
     'telegram-bot': telegramBotChannelSchema.optional(),
+    line: lineChannelBlockSchema.optional(),
     kakaotalk: kakaoChannelBlockSchema.optional(),
   })
   .catchall(z.unknown())
@@ -130,6 +153,8 @@ export type Channels = z.infer<typeof channelsSchema>
 export type GithubPatAuthBlock = z.infer<typeof githubPatAuthSchema>
 export type GithubAppAuthBlock = z.infer<typeof githubAppAuthSchema>
 export type GithubSecretsBlock = z.infer<typeof githubChannelSchema>
+export type LineAccountRecord = z.infer<typeof lineAccountRecordSchema>
+export type LineChannelBlock = z.infer<typeof lineChannelBlockSchema>
 export type KakaoAccountRecord = z.infer<typeof kakaoAccountRecordSchema>
 export type PendingLoginRecord = z.infer<typeof kakaoPendingLoginRecordSchema>
 export type KakaoChannelBlock = z.infer<typeof kakaoChannelBlockSchema>

package/src/server/index.ts

@@ -28,7 +28,7 @@ import {
 } from '@/agent/todo/continuation-wiring'
 import { SUBAGENT_OUTPUT_TOOL_NAME } from '@/agent/tools/subagent-output'
 import type { ChannelRouter } from '@/channels/router'
-import { aggregateCronList, type CronListEntry, loadCron } from '@/cron'
+import { aggregateCronList, type CronJob, type CronListEntry, loadCron } from '@/cron'
 import type { McpManager } from '@/mcp'
 import type { HookBus } from '@/plugin'
 import type { BrokerWsData, ContainerBroker } from '@/portbroker'
@@ -75,6 +75,9 @@ export type ServerOptions = {
   mcpManager?: McpManager
   agentDir?: string
   pluginRuntime?: PluginRuntime
+  // Durable cron fire-progress lookup so `cron list` marks count-exhausted jobs
+  // as retired instead of showing a stale future fire time. Omit in tests/dev.
+  getFiredCount?: (job: CronJob) => number
   containerName?: string
   runtimeVersion?: string
   tuiToken?: string
@@ -252,6 +255,7 @@ export function createServer({
   mcpManager,
   agentDir,
   pluginRuntime,
+  getFiredCount,
   containerName,
   runtimeVersion,
   tuiToken,
@@ -716,7 +720,7 @@ export function createServer({
           }
 
           if (msg.type === 'cron_list') {
-            await handleCronList(ws, msg.requestId, pluginRuntime, agentDir)
+            await handleCronList(ws, msg.requestId, pluginRuntime, agentDir, getFiredCount)
             return
           }
 
@@ -1186,6 +1190,7 @@ async function handleCronList(
   requestId: string,
   pluginRuntime: PluginRuntime | undefined,
   agentDir: string | undefined,
+  getFiredCount?: (job: CronJob) => number,
 ): Promise<void> {
   if (agentDir === undefined) {
     send(ws, { type: 'cron_list_result', requestId, result: { ok: false, reason: 'agentDir not configured' } })
@@ -1208,7 +1213,12 @@ async function handleCronList(
     const userJobs = loadResult.file?.jobs ?? []
     const pluginJobs = snapshot?.registry.cronJobs ?? []
     const nowMs = Date.now()
-    const entries = aggregateCronList({ userJobs, pluginJobs, now: nowMs })
+    const entries = aggregateCronList({
+      userJobs,
+      pluginJobs,
+      now: nowMs,
+      ...(getFiredCount !== undefined ? { firedCount: getFiredCount } : {}),
+    })
     send(ws, {
       type: 'cron_list_result',
       requestId,
@@ -1541,9 +1551,12 @@ function toPayload(entry: CronListEntry): CronListEntryPayload {
     id: entry.id,
     source,
     kind: entry.kind,
-    schedule: entry.schedule,
     enabled: entry.enabled,
     nextFireMs: entry.nextFireMs,
+    ...(entry.schedule !== undefined ? { schedule: entry.schedule } : {}),
+    ...(entry.at !== undefined ? { at: entry.at } : {}),
+    ...(entry.until !== undefined ? { until: entry.until } : {}),
+    ...(entry.count !== undefined ? { count: entry.count } : {}),
     ...(entry.timezone !== undefined ? { timezone: entry.timezone } : {}),
     ...(entry.scheduledByRole !== undefined ? { scheduledByRole: entry.scheduledByRole } : {}),
     ...(entry.scheduleError !== undefined ? { scheduleError: entry.scheduleError } : {}),

package/src/shared/protocol.ts

@@ -165,7 +165,10 @@ export type CronListEntryPayload = {
   id: string
   source: CronListSourcePayload
   kind: 'prompt' | 'exec' | 'handler'
-  schedule: string
+  schedule?: string
+  at?: string
+  until?: string
+  count?: number
   timezone?: string
   enabled: boolean
   scheduledByRole?: string