Merge PR #141 from chatgptkrylor/feat/scheduler: recurring cron-style scheduled jobs

Includes review fixes: multi-line prompt rejection, prompt-file confinement hardening (realpath + attachment-guard blocklist), per-job autoClosePreviousSession lifecycle, live-session-only concurrency counting, wired launchCommand.

src/web/ports/cron-port.ts

@@ -0,0 +1,10 @@
+/**
+ * @fileoverview Cron port — exposes the CronService to
+ * route handlers via the shared route context.
+ */
+
+import type { CronService } from '../../cron/cron-service.js';
+
+export interface CronPort {
+  readonly cron: CronService;
+}

src/web/ports/index.ts

@@ -13,3 +13,4 @@ export type { ConfigPort } from './config-port.js';
 export type { InfraPort, ScheduledRun } from './infra-port.js';
 export type { AuthPort } from './auth-port.js';
 export type { OrchestratorPort } from './orchestrator-port.js';
+export type { CronPort } from './cron-port.js';

src/web/public/app.js

@@ -183,6 +183,12 @@ const _SSE_HANDLER_MAP = [
   [SSE_EVENTS.SCHEDULED_COMPLETED, '_onScheduledCompleted'],
   [SSE_EVENTS.SCHEDULED_STOPPED, '_onScheduledStopped'],
 
+  // Scheduled jobs (cron-style scheduler)
+  [SSE_EVENTS.CRON_JOBS_CHANGED, '_onCronJobsChanged'],
+  [SSE_EVENTS.CRON_JOB_DELETED, '_onCronJobsChanged'],
+  [SSE_EVENTS.CRON_RUN_CREATED, '_onCronRunChanged'],
+  [SSE_EVENTS.CRON_RUN_UPDATED, '_onCronRunChanged'],
+
   // Respawn
   [SSE_EVENTS.RESPAWN_STARTED, '_onRespawnStarted'],
   [SSE_EVENTS.RESPAWN_STOPPED, '_onRespawnStopped'],

src/web/public/constants.js

@@ -307,6 +307,12 @@ const SSE_EVENTS = {
   SCHEDULED_LOG: 'scheduled:log',
   SCHEDULED_DELETED: 'scheduled:deleted',
 
+  // Cron jobs
+  CRON_JOBS_CHANGED: 'cron:jobsChanged',
+  CRON_JOB_DELETED: 'cron:jobDeleted',
+  CRON_RUN_CREATED: 'cron:runCreated',
+  CRON_RUN_UPDATED: 'cron:runUpdated',
+
   // Respawn
   RESPAWN_STARTED: 'respawn:started',
   RESPAWN_STOPPED: 'respawn:stopped',

src/web/public/cron-ui.js

@@ -0,0 +1,328 @@
+/**
+ * @fileoverview Cron Jobs UI mixed into
+ * CodemanApp.prototype. Renders the job list + create/edit form in the
+ * #cronModal, and reacts to cron:* SSE events.
+ *
+ * @mixin Extends CodemanApp.prototype via Object.assign
+ * @dependency app.js, api-client.js, constants.js (escapeHtml)
+ */
+
+Object.assign(CodemanApp.prototype, {
+  // ── SSE handlers ──────────────────────────────────────────────────────────
+
+  _onCronJobsChanged(data) {
+    if (data && Array.isArray(data.jobs)) {
+      this._cronJobs = data.jobs;
+      if (this._isCronOpen()) this.renderCronJobs();
+    } else if (this._isCronOpen()) {
+      this.refreshCron();
+    }
+  },
+
+  _onCronRunChanged() {
+    // A run's status changed — refresh the list so lastStatus stays current.
+    if (this._isCronOpen()) this.refreshCron();
+  },
+
+  // ── Modal open/close ──────────────────────────────────────────────────────
+
+  _isCronOpen() {
+    const el = document.getElementById('cronModal');
+    return !!el && el.classList.contains('active');
+  },
+
+  openCron() {
+    const el = document.getElementById('cronModal');
+    if (!el) return;
+    el.classList.add('active');
+    this.cancelCronJobForm();
+    this.refreshCron();
+  },
+
+  closeCron() {
+    const el = document.getElementById('cronModal');
+    if (el) el.classList.remove('active');
+  },
+
+  async refreshCron() {
+    const jobs = await this._apiJson('/api/cron/jobs');
+    this._cronJobs = Array.isArray(jobs) ? jobs : [];
+    this.renderCronJobs();
+  },
+
+  // ── List rendering ────────────────────────────────────────────────────────
+
+  renderCronJobs() {
+    const list = document.getElementById('cronJobList');
+    if (!list) return;
+    const jobs = this._cronJobs || [];
+    if (jobs.length === 0) {
+      list.innerHTML = '<div class="form-hint">No cron jobs yet. Click “+ New Job”.</div>';
+      return;
+    }
+    const rows = jobs.map((j) => {
+      const next = j.enabled ? this._fmtTime(j.nextRunAt) : '—';
+      const last = this._fmtTime(j.lastRunAt);
+      const status = j.lastStatus ? escapeHtml(j.lastStatus) : '—';
+      return `
+        <div class="cron-job-row">
+          <div class="cron-job-main">
+            <div class="cron-job-name">${escapeHtml(j.name || '(unnamed)')}
+              <span class="cron-badge">${escapeHtml(j.agentType)}</span>
+              <span class="cron-badge">${escapeHtml(this._fmtSchedule(j))}</span>
+              ${j.enabled ? '' : '<span class="cron-badge cron-badge-off">disabled</span>'}
+            </div>
+            <div class="cron-job-meta">
+              <span title="${escapeHtml(j.workingDir || '')}">${escapeHtml(j.workingDir || '')}</span>
+              · next: ${escapeHtml(next)} · last: ${escapeHtml(last)} · status: ${status}
+            </div>
+          </div>
+          <div class="cron-job-actions">
+            <button class="btn-toolbar btn-sm btn-primary" onclick="app.runCronJob('${j.id}')">Run Now</button>
+            <button class="btn-toolbar btn-sm" onclick="app.toggleCronJob('${j.id}', ${j.enabled ? 'false' : 'true'})">${j.enabled ? 'Disable' : 'Enable'}</button>
+            <button class="btn-toolbar btn-sm" onclick="app.editCronJob('${j.id}')">Edit</button>
+            <button class="btn-toolbar btn-sm btn-danger" onclick="app.deleteCronJob('${j.id}')">Delete</button>
+          </div>
+        </div>`;
+    });
+    list.innerHTML = rows.join('');
+  },
+
+  _fmtTime(ts) {
+    if (!ts) return '—';
+    try {
+      return new Date(ts).toLocaleString();
+    } catch {
+      return '—';
+    }
+  },
+
+  _fmtSchedule(j) {
+    switch (j.scheduleType) {
+      case 'once':
+        return 'once';
+      case 'interval':
+        return `every ${j.intervalMinutes}m`;
+      case 'daily':
+        return `daily ${j.dailyTime || ''}`;
+      case 'weekly': {
+        const names = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
+        const days = (j.weeklyDays || []).map((d) => names[d] || d).join(',');
+        return `weekly ${days} ${j.weeklyTime || ''}`;
+      }
+      default:
+        return j.scheduleType || '';
+    }
+  },
+
+  // ── Create / edit form ────────────────────────────────────────────────────
+
+  openCronJobForm(job) {
+    const form = document.getElementById('cronJobForm');
+    if (!form) return;
+    document.getElementById('cronFormError').textContent = '';
+    document.getElementById('cronFormTitle').textContent = job ? 'Edit Cron Job' : 'New Cron Job';
+    document.getElementById('schJobId').value = job ? job.id : '';
+    document.getElementById('schName').value = job ? job.name || '' : '';
+    document.getElementById('schAgentType').value = job ? job.agentType || 'claude' : 'claude';
+    document.getElementById('schWorkingDir').value = job ? job.workingDir || '' : '';
+    document.getElementById('schLaunchCommand').value = job ? job.launchCommand || '' : '';
+    document.getElementById('schPromptMode').value = job ? job.promptMode || 'inline_text' : 'inline_text';
+    document.getElementById('schPromptText').value = job ? job.promptText || '' : '';
+    document.getElementById('schPromptFilePath').value = job ? job.promptFilePath || '' : '';
+    document.getElementById('schInputMode').value = job ? job.inputMode || 'typed' : 'typed';
+    document.getElementById('schScheduleType').value = job ? job.scheduleType || 'once' : 'once';
+    document.getElementById('schRunAt').value = job && job.runAt ? this._toLocalInput(job.runAt) : '';
+    document.getElementById('schIntervalMinutes').value = job && job.intervalMinutes ? job.intervalMinutes : 60;
+    document.getElementById('schDailyTime').value = job ? job.dailyTime || '' : '';
+    document.getElementById('schWeeklyTime').value = job ? job.weeklyTime || '' : '';
+    const weekly = (job && job.weeklyDays) || [];
+    document.querySelectorAll('#schWeeklyDays input[type=checkbox]').forEach((cb) => {
+      cb.checked = weekly.includes(Number(cb.value));
+    });
+    document.getElementById('schConcurrencyPolicy').value = job ? job.concurrencyPolicy || 'warn_only' : 'warn_only';
+    document.getElementById('schAutoClosePrev').checked = job ? job.autoClosePreviousSession !== false : true;
+    document.getElementById('schEnabled').checked = job ? !!job.enabled : true;
+    document.getElementById('schNotes').value = job ? job.notes || '' : '';
+
+    this.onCronAgentTypeChange();
+    this.onCronPromptModeChange();
+    this.onCronScheduleTypeChange();
+    form.classList.remove('hidden');
+  },
+
+  editCronJob(id) {
+    const job = (this._cronJobs || []).find((j) => j.id === id);
+    if (job) this.openCronJobForm(job);
+  },
+
+  cancelCronJobForm() {
+    const form = document.getElementById('cronJobForm');
+    if (form) form.classList.add('hidden');
+  },
+
+  onCronAgentTypeChange() {
+    // Launch command is only meaningful for shell mode (first input line).
+    const isShell = document.getElementById('schAgentType').value === 'shell';
+    document.getElementById('schLaunchCommandRow').classList.toggle('hidden', !isShell);
+  },
+
+  onCronPromptModeChange() {
+    const mode = document.getElementById('schPromptMode').value;
+    document.getElementById('schPromptTextRow').classList.toggle('hidden', mode !== 'inline_text');
+    document.getElementById('schPromptFileRow').classList.toggle('hidden', mode !== 'prompt_file_path');
+  },
+
+  onCronScheduleTypeChange() {
+    const t = document.getElementById('schScheduleType').value;
+    document.getElementById('schRunAtRow').classList.toggle('hidden', t !== 'once');
+    document.getElementById('schIntervalRow').classList.toggle('hidden', t !== 'interval');
+    document.getElementById('schDailyRow').classList.toggle('hidden', t !== 'daily');
+    document.getElementById('schWeeklyDaysRow').classList.toggle('hidden', t !== 'weekly');
+    document.getElementById('schWeeklyTimeRow').classList.toggle('hidden', t !== 'weekly');
+  },
+
+  _toLocalInput(ts) {
+    // epoch-ms → 'YYYY-MM-DDTHH:MM' in local time for <input datetime-local>.
+    const d = new Date(ts);
+    const pad = (n) => String(n).padStart(2, '0');
+    return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}T${pad(d.getHours())}:${pad(d.getMinutes())}`;
+  },
+
+  _collectCronForm() {
+    const t = document.getElementById('schScheduleType').value;
+    const promptMode = document.getElementById('schPromptMode').value;
+    const body = {
+      name: document.getElementById('schName').value.trim(),
+      agentType: document.getElementById('schAgentType').value,
+      workingDir: document.getElementById('schWorkingDir').value.trim(),
+      promptMode,
+      inputMode: document.getElementById('schInputMode').value,
+      scheduleType: t,
+      concurrencyPolicy: document.getElementById('schConcurrencyPolicy').value,
+      autoClosePreviousSession: document.getElementById('schAutoClosePrev').checked,
+      enabled: document.getElementById('schEnabled').checked,
+      notes: document.getElementById('schNotes').value.trim() || undefined,
+    };
+    // Always sent for shell (an emptied field must clear a saved command on edit).
+    if (body.agentType === 'shell') body.launchCommand = document.getElementById('schLaunchCommand').value.trim();
+    if (promptMode === 'inline_text') {
+      // Prompt delivery is single-line only; trailing newlines are harmless, strip them.
+      body.promptText = document.getElementById('schPromptText').value.replace(/[\r\n]+$/, '');
+    } else {
+      body.promptFilePath = document.getElementById('schPromptFilePath').value.trim();
+    }
+
+    if (t === 'once') {
+      const v = document.getElementById('schRunAt').value;
+      body.runAt = v ? new Date(v).getTime() : undefined;
+    } else if (t === 'interval') {
+      body.intervalMinutes = Number(document.getElementById('schIntervalMinutes').value);
+    } else if (t === 'daily') {
+      body.dailyTime = document.getElementById('schDailyTime').value;
+    } else if (t === 'weekly') {
+      body.weeklyTime = document.getElementById('schWeeklyTime').value;
+      body.weeklyDays = Array.from(document.querySelectorAll('#schWeeklyDays input:checked')).map((cb) =>
+        Number(cb.value)
+      );
+    }
+    return body;
+  },
+
+  async saveCronJob() {
+    const errEl = document.getElementById('cronFormError');
+    errEl.textContent = '';
+    const body = this._collectCronForm();
+    if (!body.name) {
+      errEl.textContent = 'Name is required.';
+      return;
+    }
+    if (!body.workingDir) {
+      errEl.textContent = 'Working directory is required.';
+      return;
+    }
+    if (body.promptText !== undefined && /[\r\n]/.test(body.promptText)) {
+      errEl.textContent = 'Prompt must be a single line — multi-line prompts are not supported.';
+      return;
+    }
+    const id = document.getElementById('schJobId').value;
+    const res = id ? await this._apiPut(`/api/cron/jobs/${id}`, body) : await this._apiPost('/api/cron/jobs', body);
+    if (!res || !res.ok) {
+      let msg = 'Failed to save job.';
+      try {
+        const j = await res.json();
+        if (j && j.error) msg = j.error;
+      } catch {
+        /* ignore */
+      }
+      errEl.textContent = msg;
+      return;
+    }
+    this.showToast?.(id ? 'Cron job updated' : 'Cron job created', 'success');
+    this.cancelCronJobForm();
+    this.refreshCron();
+  },
+
+  // ── Actions ───────────────────────────────────────────────────────────────
+
+  async runCronJob(id) {
+    const job = (this._cronJobs || []).find((j) => j.id === id);
+    if (job) {
+      const active = this._countActiveAgents(job.agentType);
+      if (active > 0 && !confirm(`${active} ${job.agentType} session(s) already active. Run this job anyway?`)) {
+        return;
+      }
+    }
+    const res = await this._apiPost(`/api/cron/jobs/${id}/run`, {});
+    if (res && res.ok) {
+      this.showToast?.('Run started — opening session', 'success');
+      let data = null;
+      try {
+        data = await res.json();
+      } catch {
+        /* ignore */
+      }
+      const run = data && (data.data ? data.data.run : data.run);
+      if (run && run.sessionId) this._focusCronSession(run.sessionId);
+      this.refreshCron();
+    } else {
+      this.showToast?.('Failed to run job', 'error');
+    }
+  },
+
+  _focusCronSession(sessionId) {
+    // Best-effort: switch to the created session tab if it exists.
+    if (this.sessions && this.sessions.has(sessionId) && typeof this.switchSession === 'function') {
+      this.closeCron();
+      this.switchSession(sessionId);
+    }
+  },
+
+  _countActiveAgents(agentType) {
+    // Mirrors the server's countActiveAgents: only LIVE sessions count — a
+    // tab whose CLI already exited (stopped/error) doesn't block anything.
+    if (!this.sessions) return 0;
+    let n = 0;
+    for (const s of this.sessions.values()) {
+      if (s && s.mode === agentType && s.status !== 'stopped' && s.status !== 'error') n++;
+    }
+    return n;
+  },
+
+  async toggleCronJob(id, enabled) {
+    const res = await this._apiPut(`/api/cron/jobs/${id}/enabled`, { enabled });
+    if (res && res.ok) this.refreshCron();
+    else this.showToast?.('Failed to update job', 'error');
+  },
+
+  async deleteCronJob(id) {
+    if (!confirm('Delete this cron job and its run history?')) return;
+    const res = await this._apiDelete(`/api/cron/jobs/${id}`);
+    if (res && res.ok) {
+      this.showToast?.('Cron job deleted', 'success');
+      this.refreshCron();
+    } else {
+      this.showToast?.('Failed to delete job', 'error');
+    }
+  },
+});

src/web/public/index.html

@@ -541,6 +541,7 @@
       <div class="toolbar-right">
         <!-- Orchestrator button hidden until feature is ready -->
         <!-- <button class="btn-toolbar btn-sm" onclick="app.toggleOrchestratorPanel()" title="Orchestrator Loop">&#x2699; Orchestrator</button> -->
+        <button class="btn-toolbar btn-sm" onclick="app.openCron()" title="Cron Jobs">&#x23F0; Cron</button>
         <span class="version-display" id="versionDisplay" title="Codeman version">v0.0.0</span>
       </div>
     </footer>
@@ -571,6 +572,99 @@
       </div>
     </div>
 
+    <!-- Cron Jobs Modal -->
+    <div class="modal" id="cronModal">
+      <div class="modal-backdrop" onclick="app.closeCron()"></div>
+      <div class="modal-content modal-lg">
+        <div class="modal-header">
+          <h3>Cron Jobs</h3>
+          <button class="modal-close" onclick="app.closeCron()" aria-label="Close cron">&times;</button>
+        </div>
+        <div class="modal-body">
+          <p class="form-hint" style="margin-bottom:10px;">Times use the server's local timezone.</p>
+          <div style="margin-bottom:10px;">
+            <button class="btn-toolbar btn-sm btn-primary" onclick="app.openCronJobForm()">+ New Job</button>
+            <button class="btn-toolbar btn-sm" onclick="app.refreshCron()">Refresh</button>
+          </div>
+          <!-- Job list -->
+          <div id="cronJobList" class="cron-job-list"></div>
+
+          <!-- Create/Edit form (hidden until New/Edit) -->
+          <div id="cronJobForm" class="cron-job-form hidden">
+            <div class="form-section-header" id="cronFormTitle">New Cron Job</div>
+            <input type="hidden" id="schJobId">
+            <div class="form-row"><label>Name</label><input type="text" id="schName" placeholder="My nightly job"></div>
+            <div class="form-row"><label>Agent Type</label>
+              <select id="schAgentType" onchange="app.onCronAgentTypeChange()">
+                <option value="claude">Claude</option>
+                <option value="shell">Terminal / Shell</option>
+                <option value="opencode">OpenCode</option>
+                <option value="codex">Codex</option>
+                <option value="gemini">Gemini</option>
+              </select>
+            </div>
+            <div class="form-row"><label>Working Directory</label><input type="text" id="schWorkingDir" placeholder="/absolute/path"></div>
+            <div class="form-row hidden" id="schLaunchCommandRow"><label>Launch Command</label><input type="text" id="schLaunchCommand" placeholder="Optional — runs as the first command in the new shell"></div>
+            <div class="form-row"><label>Prompt Source</label>
+              <select id="schPromptMode" onchange="app.onCronPromptModeChange()">
+                <option value="inline_text">Inline text</option>
+                <option value="prompt_file_path">Prompt file path</option>
+              </select>
+            </div>
+            <div class="form-row" id="schPromptTextRow"><label>Prompt</label><textarea id="schPromptText" rows="4" placeholder="Prompt to send into the session"></textarea></div>
+            <div class="form-row hidden" id="schPromptFileRow"><label>Prompt File Path</label><input type="text" id="schPromptFilePath" placeholder="/absolute/path/to/prompt.md"></div>
+            <div class="form-row"><label>Input Mode</label>
+              <select id="schInputMode">
+                <option value="typed">Typed (via tmux)</option>
+                <option value="paste">Paste (direct)</option>
+              </select>
+            </div>
+            <div class="form-row"><label>Schedule Type</label>
+              <select id="schScheduleType" onchange="app.onCronScheduleTypeChange()">
+                <option value="once">Once</option>
+                <option value="interval">Interval</option>
+                <option value="daily">Daily</option>
+                <option value="weekly">Weekly</option>
+              </select>
+            </div>
+            <div class="form-row" id="schRunAtRow"><label>Run At</label><input type="datetime-local" id="schRunAt"></div>
+            <div class="form-row hidden" id="schIntervalRow"><label>Every (minutes)</label><input type="number" id="schIntervalMinutes" min="1" value="60"></div>
+            <div class="form-row hidden" id="schDailyRow"><label>Daily Time (HH:MM)</label><input type="time" id="schDailyTime"></div>
+            <div class="form-row hidden" id="schWeeklyDaysRow"><label>Weekdays</label>
+              <span id="schWeeklyDays" class="cron-weekdays">
+                <label><input type="checkbox" value="0">Sun</label>
+                <label><input type="checkbox" value="1">Mon</label>
+                <label><input type="checkbox" value="2">Tue</label>
+                <label><input type="checkbox" value="3">Wed</label>
+                <label><input type="checkbox" value="4">Thu</label>
+                <label><input type="checkbox" value="5">Fri</label>
+                <label><input type="checkbox" value="6">Sat</label>
+              </span>
+            </div>
+            <div class="form-row hidden" id="schWeeklyTimeRow"><label>Weekly Time (HH:MM)</label><input type="time" id="schWeeklyTime"></div>
+            <div class="form-row"><label>On auto-run, if same agent running</label>
+              <select id="schConcurrencyPolicy">
+                <option value="warn_only">Run anyway</option>
+                <option value="skip_if_same_agent_running">Skip this run</option>
+              </select>
+            </div>
+            <div class="form-row form-row-switch"><label title="Recurring schedules only: when the next run fires, the still-open session created by this job's previous run is closed first">Auto-close previous run's session</label>
+              <label class="switch"><input type="checkbox" id="schAutoClosePrev" checked><span class="slider"></span></label>
+            </div>
+            <div class="form-row form-row-switch"><label>Enabled</label>
+              <label class="switch"><input type="checkbox" id="schEnabled" checked><span class="slider"></span></label>
+            </div>
+            <div class="form-row"><label>Notes</label><input type="text" id="schNotes" placeholder="Optional"></div>
+            <div id="cronFormError" class="form-hint" style="color:var(--danger,#e55);"></div>
+            <div style="margin-top:10px;">
+              <button class="btn-toolbar btn-sm btn-primary" onclick="app.saveCronJob()">Save</button>
+              <button class="btn-toolbar btn-sm" onclick="app.cancelCronJobForm()">Cancel</button>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+
     <!-- Monitor Panel (Tmux Sessions + Background Tasks) -->
     <div class="monitor-panel" id="monitorPanel">
       <div class="monitor-panel-header" id="monitorPanelHeader">
@@ -2064,6 +2158,7 @@
   <script defer src="respawn-ui.js"></script>
   <script defer src="ralph-panel.js"></script>
   <script defer src="orchestrator-panel.js"></script>
+  <script defer src="cron-ui.js"></script>
   <script defer src="settings-ui.js"></script>
   <script defer src="panels-ui.js"></script>
   <script defer src="ultracode-panel.js"></script>

src/web/public/styles.css

@@ -11071,3 +11071,25 @@ html[data-skin="daylight-blue"] .welcome-btn-tunnel.active:hover {
   background: linear-gradient(135deg, #7c3aed, #8b5cf6);
   box-shadow: 0 0 28px -4px rgba(124, 58, 237, 0.5);
 }
+
+/* ── Cron Jobs ───────────────────────────────── */
+.cron-job-list { display: flex; flex-direction: column; gap: 8px; }
+.cron-job-row {
+  display: flex; justify-content: space-between; align-items: center; gap: 12px;
+  padding: 10px 12px; border: 1px solid var(--border, #333); border-radius: 8px;
+  background: var(--panel-bg, rgba(255,255,255,0.02));
+}
+.cron-job-main { min-width: 0; flex: 1; }
+.cron-job-name { font-weight: 600; display: flex; align-items: center; gap: 6px; flex-wrap: wrap; }
+.cron-job-meta { font-size: 12px; opacity: 0.7; margin-top: 4px; overflow: hidden; text-overflow: ellipsis; }
+.cron-job-actions { display: flex; gap: 6px; flex-shrink: 0; flex-wrap: wrap; justify-content: flex-end; }
+.cron-badge {
+  font-size: 11px; padding: 1px 6px; border-radius: 10px;
+  background: var(--accent-bg, rgba(120,160,255,0.15)); opacity: 0.9;
+}
+.cron-badge-off { background: rgba(200,80,80,0.18); }
+.cron-weekdays { display: flex; gap: 10px; flex-wrap: wrap; }
+.cron-weekdays label { display: inline-flex; align-items: center; gap: 3px; font-weight: 400; }
+.cron-job-form {
+  margin-top: 14px; padding-top: 12px; border-top: 1px solid var(--border, #333);
+}

src/web/routes/cron-routes.ts

@@ -0,0 +1,80 @@
+/**
+ * @fileoverview Cron Jobs routes.
+ *
+ * CRUD + enable/disable + Run Now + run history for `CronJob`s. These are
+ * separate from the legacy `/api/scheduled` (ScheduledRun) endpoints — see
+ * docs/cron-discovery.md §0.
+ */
+
+import { FastifyInstance } from 'fastify';
+import { ApiErrorCode, createErrorResponse } from '../../types.js';
+import { CronJobSchema, CronJobUpdateSchema, CronJobEnabledSchema } from '../schemas.js';
+import { parseBody } from '../route-helpers.js';
+import type { CronPort } from '../ports/index.js';
+
+export function registerCronRoutes(app: FastifyInstance, ctx: CronPort): void {
+  // ── Jobs ────────────────────────────────────────────────────────────────
+
+  app.get('/api/cron/jobs', async () => {
+    return ctx.cron.listJobs();
+  });
+
+  app.post('/api/cron/jobs', async (req) => {
+    // No custom errorMessage: surface the schema's field-specific messages
+    // (e.g. "runAt is required for a one-time schedule").
+    const body = parseBody(CronJobSchema, req.body);
+    return { job: ctx.cron.createJob(body) };
+  });
+
+  app.get('/api/cron/jobs/:id', async (req) => {
+    const { id } = req.params as { id: string };
+    const job = ctx.cron.getJob(id);
+    if (!job) return createErrorResponse(ApiErrorCode.NOT_FOUND, 'Cron job not found');
+    return job;
+  });
+
+  app.put('/api/cron/jobs/:id', async (req) => {
+    const { id } = req.params as { id: string };
+    const body = parseBody(CronJobUpdateSchema, req.body);
+    const job = ctx.cron.updateJob(id, body);
+    if (!job) return createErrorResponse(ApiErrorCode.NOT_FOUND, 'Cron job not found');
+    return { job };
+  });
+
+  app.delete('/api/cron/jobs/:id', async (req) => {
+    const { id } = req.params as { id: string };
+    if (!ctx.cron.deleteJob(id)) {
+      return createErrorResponse(ApiErrorCode.NOT_FOUND, 'Cron job not found');
+    }
+    return {};
+  });
+
+  app.put('/api/cron/jobs/:id/enabled', async (req) => {
+    const { id } = req.params as { id: string };
+    const { enabled } = parseBody(CronJobEnabledSchema, req.body, 'Invalid request body');
+    const job = ctx.cron.setEnabled(id, enabled);
+    if (!job) return createErrorResponse(ApiErrorCode.NOT_FOUND, 'Cron job not found');
+    return { job };
+  });
+
+  // ── Run Now ──────────────────────────────────────────────────────────────
+
+  app.post('/api/cron/jobs/:id/run', async (req) => {
+    const { id } = req.params as { id: string };
+    const job = ctx.cron.getJob(id);
+    if (!job) return createErrorResponse(ApiErrorCode.NOT_FOUND, 'Cron job not found');
+    const run = await ctx.cron.runNow(id);
+    return { run, activeAgents: ctx.cron.countActiveAgents(job.agentType, job.id) };
+  });
+
+  // ── Run history ──────────────────────────────────────────────────────────
+
+  app.get('/api/cron/jobs/:id/runs', async (req) => {
+    const { id } = req.params as { id: string };
+    return ctx.cron.listRuns(id);
+  });
+
+  app.get('/api/cron/runs', async () => {
+    return ctx.cron.listRuns();
+  });
+}

src/web/routes/index.ts

@@ -7,6 +7,7 @@ export { registerTeamRoutes } from './team-routes.js';
 export { registerMuxRoutes } from './mux-routes.js';
 export { registerFileRoutes } from './file-routes.js';
 export { registerScheduledRoutes } from './scheduled-routes.js';
+export { registerCronRoutes } from './cron-routes.js';
 export { registerSystemRoutes } from './system-routes.js';
 export { registerHookEventRoutes } from './hook-event-routes.js';
 export { registerStatusTelemetryRoutes } from './status-telemetry-routes.js';

src/web/schemas.ts

@@ -603,6 +603,73 @@ export const ScheduledRunSchema = z.object({
   durationMinutes: z.number().int().min(1).max(14400).optional(),
 });
 
+// ========== Cron Jobs ==========
+
+/** 'HH:MM' 24-hour time. */
+const hhmmSchema = z.string().regex(/^([01]?\d|2[0-3]):[0-5]\d$/, 'Time must be HH:MM (24-hour)');
+
+/** Prompt delivery is single-line only (writeViaMux/Ink constraint) — reject newlines outright. */
+const noNewlines = (v: string) => !/[\r\n]/.test(v);
+
+/** Shared field shape for creating/updating a scheduled job. */
+const CronJobBaseSchema = z.object({
+  name: z.string().min(1).max(200),
+  agentType: z.enum(['claude', 'shell', 'opencode', 'codex', 'gemini']),
+  workingDir: safePathSchema,
+  launchCommand: z.string().max(2000).refine(noNewlines, 'launchCommand must be a single line').optional(),
+  promptMode: z.enum(['inline_text', 'prompt_file_path']),
+  promptText: z
+    .string()
+    .max(100000)
+    .refine(noNewlines, 'promptText must be a single line (multi-line prompts are not supported)')
+    .optional(),
+  promptFilePath: safePathSchema.optional(),
+  inputMode: z.enum(['paste', 'typed']),
+  scheduleType: z.enum(['once', 'interval', 'daily', 'weekly']),
+  runAt: z.number().int().positive().optional(),
+  intervalMinutes: z.number().int().min(1).max(525600).optional(),
+  dailyTime: hhmmSchema.optional(),
+  weeklyDays: z.array(z.number().int().min(0).max(6)).min(1).max(7).optional(),
+  weeklyTime: hhmmSchema.optional(),
+  enabled: z.boolean(),
+  notes: z.string().max(2000).optional(),
+  concurrencyPolicy: z.enum(['warn_only', 'skip_if_same_agent_running']),
+  autoClosePreviousSession: z.boolean().optional(),
+});
+
+/** Cross-field validation: required fields depend on promptMode + scheduleType. */
+function refineCronJob(val: z.infer<typeof CronJobBaseSchema>, ctx: z.RefinementCtx): void {
+  const add = (message: string, path: string) => ctx.addIssue({ code: 'custom', message, path: [path] });
+
+  if (val.promptMode === 'inline_text' && !val.promptText) {
+    add('promptText is required when promptMode is inline_text', 'promptText');
+  }
+  if (val.promptMode === 'prompt_file_path' && !val.promptFilePath) {
+    add('promptFilePath is required when promptMode is prompt_file_path', 'promptFilePath');
+  }
+  if (val.scheduleType === 'once' && val.runAt === undefined) {
+    add('runAt is required for a one-time schedule', 'runAt');
+  }
+  if (val.scheduleType === 'interval' && val.intervalMinutes === undefined) {
+    add('intervalMinutes is required for an interval schedule', 'intervalMinutes');
+  }
+  if (val.scheduleType === 'daily' && !val.dailyTime) {
+    add('dailyTime is required for a daily schedule', 'dailyTime');
+  }
+  if (val.scheduleType === 'weekly' && (!val.weeklyTime || !val.weeklyDays?.length)) {
+    add('weeklyDays and weeklyTime are required for a weekly schedule', 'weeklyTime');
+  }
+}
+
+/** POST /api/cron/jobs — full job definition. */
+export const CronJobSchema = CronJobBaseSchema.superRefine(refineCronJob);
+
+/** PUT /api/cron/jobs/:id — partial update. */
+export const CronJobUpdateSchema = CronJobBaseSchema.partial();
+
+/** PUT /api/cron/jobs/:id/enabled */
+export const CronJobEnabledSchema = z.object({ enabled: z.boolean() });
+
 /** POST /api/cases/link */
 export const LinkCaseSchema = z.object({
   name: z.string().regex(/^[a-zA-Z0-9_-]+$/, 'Invalid case name format'),

src/web/server.ts

@@ -153,8 +153,10 @@ import {
   registerClipboardRoutes,
   registerSearchRoutes,
   registerOrchestratorRoutes,
+  registerCronRoutes,
   registerWsRoutes,
 } from './routes/index.js';
+import { CronService } from '../cron/cron-service.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -176,6 +178,7 @@ import {
   ITERATION_PAUSE_MS,
   STATS_COLLECTION_INTERVAL_MS,
   INACTIVITY_TIMEOUT_MS,
+  CRON_TICK_INTERVAL,
 } from '../config/server-timing.js';
 
 /**
@@ -224,6 +227,8 @@ export class WebServer extends EventEmitter {
   // Store session listener references for explicit cleanup (prevents memory leaks)
   private sessionListenerRefs: Map<string, SessionListenerRefs> = new Map();
   private scheduledRuns: Map<string, ScheduledRun> = new Map();
+  /** Cron service (assigned in setupRoutes). */
+  private cronService!: CronService;
   private sse: SseStreamManager;
   private store = getStore();
   private port: number;
@@ -892,6 +897,13 @@ export class WebServer extends EventEmitter {
     registerClipboardRoutes(this.app, ctx);
     registerSearchRoutes(this.app, ctx);
     registerOrchestratorRoutes(this.app, ctx);
+
+    // Cron: build the service from the same context, recompute
+    // due times for any persisted jobs, then expose it to its routes.
+    this.cronService = new CronService(ctx);
+    this.cronService.init();
+    registerCronRoutes(this.app, { ...ctx, cron: this.cronService });
+
     registerWsRoutes(this.app, ctx, () => this.getHostPolicy());
   }
 
@@ -1972,6 +1984,17 @@ export class WebServer extends EventEmitter {
       { description: 'scheduled runs cleanup' }
     );
 
+    // Start the cron loop (fires due CronJobs).
+    this.cleanup.setInterval(
+      () => {
+        this.cronService.tickDueJobs().catch((err) => {
+          console.error('[cron] tick failed:', getErrorMessage(err));
+        });
+      },
+      CRON_TICK_INTERVAL,
+      { description: 'scheduled jobs due-checker' }
+    );
+
     // Start SSE client health check timer (prevents memory leaks from dead connections)
     this.cleanup.setInterval(
       () => {

src/web/sse-events.ts

@@ -240,6 +240,17 @@ export const ScheduledLog = 'scheduled:log' as const;
 /** Scheduled run deleted. */
 export const ScheduledDeleted = 'scheduled:deleted' as const;
 
+// ─── Cron Jobs ───────────────────────────────────
+
+/** The scheduled-jobs list changed (created/updated/enabled/run-status). Payload: { jobs }. */
+export const CronJobsChanged = 'cron:jobsChanged' as const;
+/** A scheduled job was deleted. Payload: { id }. */
+export const CronJobDeleted = 'cron:jobDeleted' as const;
+/** A scheduled-job run (history record) was created. Payload: CronJobRun. */
+export const CronRunCreated = 'cron:runCreated' as const;
+/** A scheduled-job run (history record) was updated. Payload: CronJobRun. */
+export const CronRunUpdated = 'cron:runUpdated' as const;
+
 // ─── Teams ───────────────────────────────────────────────────────────────────
 
 /** Agent team created. */
@@ -469,6 +480,12 @@ export const SseEvent = {
   ScheduledLog,
   ScheduledDeleted,
 
+  // Cron jobs
+  CronJobsChanged,
+  CronJobDeleted,
+  CronRunCreated,
+  CronRunUpdated,
+
   // Teams
   TeamCreated,
   TeamUpdated,