allowUnsafeExternalContent: Type.Optional(Type.Boolean()),

lightContext: Type.Optional(Type.Boolean()),

toolsAllow: Type.Optional(params.toolsAllow),

// Server-managed marker: set when toolsAllow is an auto-applied creator

// default (vs an explicit per-cron restriction). The cron tool stamps it,

// and it round-trips through persistence so a CLI-resolved run can drop an

// unenforceable default cap. Must be on the wire contract or the stamped

// payload is rejected by additionalProperties:false.

toolsAllowIsDefault: Type.Optional(Type.Boolean()),

},

{ additionalProperties: false },

);

expect(params?.patch?.payload).toEqual({

kind: "agentTurn",

toolsAllow: ["read", "cron"],

toolsAllowIsDefault: true,

});

});

payload: {

kind: "agentTurn",

toolsAllow: ["read", "cron"],

toolsAllowIsDefault: true,

},

},

},

});

});

it("preserves the default toolsAllow flag across an update that omits toolsAllow", async () => {

// Regression guard: a routine update (here, toggling enabled) of an

// agentTurn job whose cap was an auto-stamped default must keep

// toolsAllowIsDefault set. Otherwise the run-time CLI drop (which keys off

// the flag) stops applying and the job fails closed again after a restart —

// re-breaking the exact #91499 regression this change fixes.

callGatewayMock

.mockResolvedValueOnce({

id: "job-13",

payload: {

kind: "agentTurn",

message: "hi",

toolsAllow: ["read", "cron"],

toolsAllowIsDefault: true,

},

})

.mockResolvedValueOnce({ ok: true });

const tool = createTestCronTool({

agentSessionKey: "agent:main:telegram:group:restricted-room",

creatorToolAllowlist: ["read", "cron"],

});

await tool.execute("call-update-preserve-default-flag", {

action: "update",

id: "job-13",

patch: { enabled: false },

});

expect(callGatewayMock).toHaveBeenCalledTimes(2);

expect(readGatewayCall(1)).toEqual({

method: "cron.update",

params: {

id: "job-13",

patch: {

enabled: false,

payload: {

kind: "agentTurn",

toolsAllow: ["read", "cron"],

toolsAllowIsDefault: true,

},

},

},

});

});

it("adds the creator tool surface when converting an existing job to agentTurn", async () => {

callGatewayMock

.mockResolvedValueOnce({

kind: "agentTurn",

message: "run later",

toolsAllow: ["read", "cron"],

toolsAllowIsDefault: true,

},

},

},

? params.payload.toolsAllow

: params.defaultToolsAllow;

if (!Array.isArray(requestedRaw)) {

// No explicit user toolsAllow: stamp the full creator surface as the default

// cap and flag it so a CLI-resolved run (which cannot enforce a runtime

// toolsAllow) drops it rather than failing to start.

params.payload.toolsAllow = creatorToolNames;

params.payload.toolsAllowIsDefault = true;

return;

}

const requestedToolsAllow = normalizeCronToolsAllow(

requestedRaw.filter((entry): entry is string => typeof entry === "string"),

);

if (requestedToolsAllow.length === 0) {

// Explicit empty allow-list is a real restriction (no tools): keep it

// fail-closed, never flagged as a droppable default.

params.payload.toolsAllow = [];

delete params.payload.toolsAllowIsDefault;

return;

}

if (requestedToolsAllow.includes("*")) {

// Wildcard requests the creator's full surface with no narrowing — a

// non-restrictive default, droppable on a non-enforcing CLI backend.

params.payload.toolsAllow = creatorToolNames;

params.payload.toolsAllowIsDefault = true;

return;

}

const pluginGroups = buildPluginToolGroups({

{ allow: requestedToolsAllow },

pluginGroups,

);

// Explicit narrowing restriction: keep it fail-closed (no default flag) so a

// CLI backend that cannot enforce it surfaces the error instead of silently

// widening the requested tool surface.

params.payload.toolsAllow = creatorToolNames.filter((toolName) =>

isToolAllowedByPolicyName(toolName, requestedPolicy),

);

delete params.payload.toolsAllowIsDefault;

}

function capCronAgentTurnJobToolsAllow(

capCronAgentTurnToolsAllow({

payload: nextPayload,

creatorToolAllowlist: params.creatorToolAllowlist,

// Carry the existing cap forward across a no-toolsAllow update ONLY when it

// was an explicit per-cron restriction. A previously auto-stamped default

// (toolsAllowIsDefault === true) must NOT be carried forward as a literal

// value: that would route it through the explicit-narrowing branch, strip

// the default flag, and re-break the job on a CLI backend after the next

// restart (the run-time drop keys off the flag). Omitting it lets the cap

// be re-derived as a flagged default from the current creator surface.

defaultToolsAllow:

existingPayloadKind === "agentTurn" && isRecord(existingPayload)

existingPayloadKind === "agentTurn" &&

isRecord(existingPayload) &&

existingPayload.toolsAllowIsDefault !== true

? existingPayload.toolsAllow

: undefined,

});

].join("\n");

}

function resolveCliRuntimeToolsAllow(toolsAllow?: string[]): string[] | undefined {

return toolsAllow?.some((toolName) => normalizeToolName(toolName) === "*")

function resolveCliRuntimeToolsAllow(

toolsAllow?: string[],

toolsAllowIsDefault?: boolean,

): string[] | undefined {

if (toolsAllow === undefined) {

return undefined;

}

// CLI backends do not enforce a runtime toolsAllow: cli-runner/prepare.ts

// rejects any defined allow-list, and a CLI backend runs with its own

// configured tool set as the operator on the local machine — it is not a

// runtime tool-policy boundary. #91499 auto-stamps the creator surface as a

// *default* cap on agentTurn payloads (toolsAllowIsDefault); on a CLI backend

// that default is unenforceable theatre, so drop it and let the scheduled run

// proceed instead of failing to start.

//

// An EXPLICIT per-cron restriction (the user narrowed this job; no isDefault

// flag) is deliberately NOT dropped: it falls through and prepare.ts fails it

// closed, surfacing that the requested policy needs an embedded runtime. So

// only the unenforceable inherited default is relaxed on CLI; explicit intent

// is still honoured.

if (toolsAllowIsDefault) {

return undefined;

}

return toolsAllow.some((toolName) => normalizeToolName(toolName) === "*")

? undefined

: toolsAllow;

}

messageChannel,

sourceReplyDeliveryMode,

requireExplicitMessageTarget: params.sourceDelivery.messageTool.requireExplicitTarget,

toolsAllow: resolveCliRuntimeToolsAllow(params.agentPayload?.toolsAllow),

toolsAllow: resolveCliRuntimeToolsAllow(

params.agentPayload?.toolsAllow,

params.agentPayload?.toolsAllowIsDefault,

),

abortSignal: params.abortSignal,

onExecutionStarted: params.onExecutionStarted,

onExecutionPhase: params.onExecutionPhase,

expect(cliRun.prompt).toContain("Message delivery destination metadata");

});

it("drops the auto-applied default toolsAllow cap for CLI-backed runs instead of failing", async () => {

// A CLI backend cannot enforce a runtime toolsAllow, so the auto-applied

// creator-surface cap (#91499, flagged toolsAllowIsDefault) is dropped at

// run time rather than handed to the CLI runner — which would otherwise

// reject the run. An explicit user restriction (no flag) is still

// propagated; see the "restricted toolsAllow" case above.

mockRunCronFallbackPassthrough();

resolveCronDeliveryPlanMock.mockReturnValue(makeAnnounceDeliveryPlan());

isCliProviderMock.mockReturnValue(true);

runCliAgentMock.mockResolvedValue({

payloads: [{ text: "done" }],

meta: { agentMeta: { usage: { input: 10, output: 20 } } },

});

await runCronIsolatedAgentTurn({

...makeParams(),

job: makeMessageToolPolicyJob(

{ mode: "announce", channel: "messagechat", to: "123" },

{

kind: "agentTurn",

message: "send a message",

toolsAllow: ["read", "cron"],

toolsAllowIsDefault: true,

},

),

});

const cliRun = expectRecordFields(

getMockCallArg(runCliAgentMock, 0, 0, "CLI run"),

{},

"CLI run params",

);

expect(cliRun.toolsAllow).toBeUndefined();

});

it("keeps automatic exec completion notifications when announce delivery is active", async () => {

mockRunCronFallbackPassthrough();

resolveCronDeliveryPlanMock.mockReturnValue(makeAnnounceDeliveryPlan());

});

});

it("round-trips the toolsAllow default-cap flag through SQLite", async () => {

// The flag must survive a gateway restart: without it, a CLI-resolved run

// would re-hit the prepare.ts toolsAllow rejection after reload (#91499).

const store = await makeStorePath();

const payload = makeStore("tools-allow-default-job", true);

payload.jobs[0].sessionTarget = "isolated";

payload.jobs[0].payload = {

kind: "agentTurn",

message: "scheduled continuation",

toolsAllow: ["read", "cron"],

toolsAllowIsDefault: true,

};

await saveCronStore(store.storePath, payload);

expect((await loadCronStore(store.storePath)).jobs[0]?.payload).toMatchObject({

kind: "agentTurn",

toolsAllow: ["read", "cron"],

toolsAllowIsDefault: true,

});

});

it("does not persist a default-cap flag for an explicit toolsAllow restriction", async () => {

// An explicit user restriction is fail-closed: it carries no flag, so a CLI

// run still surfaces the prepare.ts rejection rather than silently dropping

// the requested policy.

const store = await makeStorePath();

const payload = makeStore("tools-allow-explicit-job", true);

payload.jobs[0].sessionTarget = "isolated";

payload.jobs[0].payload = {

kind: "agentTurn",

message: "scheduled continuation",

toolsAllow: ["read"],

};

await saveCronStore(store.storePath, payload);

const reloaded = (await loadCronStore(store.storePath)).jobs[0]?.payload;

expect(reloaded).toMatchObject({ kind: "agentTurn", toolsAllow: ["read"] });

expect(reloaded && "toolsAllowIsDefault" in reloaded).toBe(false);

});

it("round-trips command payloads through SQLite", async () => {

const store = await makeStorePath();

const payload = makeStore("command-job", true);

| "payload_thinking"

| "payload_timeout_seconds"

| "payload_tools_allow_json"

| "payload_tools_allow_is_default"

> {

if (payload.kind === "systemEvent") {

return {

payload_external_content_source_json: null,

payload_light_context: null,

payload_tools_allow_json: null,

payload_tools_allow_is_default: null,

};

}

if (payload.kind === "command") {

payload_external_content_source_json: null,

payload_light_context: null,

payload_tools_allow_json: null,

payload_tools_allow_is_default: null,

};

}

return {

payload_external_content_source_json: serializeJson(payload.externalContentSource),

payload_light_context: booleanToInteger(payload.lightContext),

payload_tools_allow_json: serializeJson(payload.toolsAllow),

// Persist whether toolsAllow is the auto-applied creator-surface default

// (#91499) so a CLI-resolved run can drop the unenforceable cap after a

// restart instead of failing. Only meaningful when toolsAllow is set.

payload_tools_allow_is_default: payload.toolsAllow

? booleanToInteger(payload.toolsAllowIsDefault)

: null,

};

}

const toolsAllow = row.payload_tools_allow_json

? parseJsonArray(row.payload_tools_allow_json)

: undefined;

const toolsAllowIsDefault =

row.payload_tools_allow_is_default != null

? integerToBoolean(row.payload_tools_allow_is_default)

: undefined;

return {

kind: "agentTurn",

message: row.payload_message,

...(externalContentSource ? { externalContentSource } : {}),

...(lightContext != null ? { lightContext } : {}),

...(toolsAllow ? { toolsAllow } : {}),

...(toolsAllow && toolsAllowIsDefault ? { toolsAllowIsDefault: true } : {}),

};

}

if (row.payload_kind === "command") {

lightContext?: boolean;

/** Optional tool allow-list; when set, only these tools are sent to the model. */

toolsAllow?: string[];

/**

* Set by the server when `toolsAllow` is the auto-applied creator-surface cap

* (#91499) rather than an explicit user restriction. CLI backends cannot

* enforce a runtime `toolsAllow`, so a CLI-resolved run drops this default cap

* (it is unenforceable) instead of failing; an explicit user restriction has

* no flag and stays fail-closed. Not user-settable.

*/

toolsAllowIsDefault?: boolean;

};

type CronAgentTurnPayload = {

payload_model: string | null;

payload_thinking: string | null;

payload_timeout_seconds: number | null;

payload_tools_allow_is_default: number | null;

payload_tools_allow_json: string | null;

running_at_ms: number | null;

runtime_updated_at_ms: number | null;

ensureColumn(db, "cron_jobs", "payload_external_content_source_json TEXT");

ensureColumn(db, "cron_jobs", "payload_light_context INTEGER");

ensureColumn(db, "cron_jobs", "payload_tools_allow_json TEXT");

ensureColumn(db, "cron_jobs", "payload_tools_allow_is_default INTEGER");

ensureColumn(db, "cron_jobs", "delivery_mode TEXT");

ensureColumn(db, "cron_jobs", "delivery_channel TEXT");

ensureColumn(db, "cron_jobs", "delivery_to TEXT");