Automation editor with graphical schedule and assistant; movable chat list groups

Automations
- Job files hold only the instructions; name, schedule, mode, model, approval
  mode and time limit are settings in the database (jobs.settings). Existing
  files are adopted on start-up (frontmatter into the database and removed from
  the file); plain Markdown files registered later get default settings and stay
  switched off until scheduled.
- New automation: name, project and a starting point (blank example structure or
  a template) create .codecraft/jobs/<name>.md and open the editor: settings with
  a graphical cron builder (next runs in server time via /jobs/schedule), the
  instructions in the Markdown editor and an assistant chat
  (POST /jobs/{id}/assistant) whose model edits the file; the editor reloads it
  after each turn and warns about conflicts with unsaved edits.
- The schedule tool writes prompt-only files with settings.

Chat list
- Folders and projects keep a user-defined order and can be pinned (drag and
  drop, or the group's menu), stored per user via /account/sidebar. A new
  message moves the chat to the top of its group, no longer the project itself.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/src/api.rs

@@ -137,6 +137,7 @@ pub fn router(app: AppState) -> Router {
         .route("/images/{id}/file", get(image_file))
         .route("/account/git", get(get_git_settings).put(put_git_settings))
         .route("/account/prefs", get(crate::cli_api::get_prefs).put(crate::cli_api::put_prefs))
+        .route("/account/sidebar", get(crate::cli_api::get_sidebar).put(crate::cli_api::put_sidebar))
         .route("/account/memory", get(crate::cli_api::get_memory).put(crate::cli_api::put_memory))
         .route("/account/modes", get(get_personal_modes).put(put_personal_modes))
         .route("/account/telegram", get(get_telegram).put(put_telegram).delete(delete_telegram))
@@ -150,7 +151,9 @@ pub fn router(app: AppState) -> Router {
         .route("/account/tokens/{id}", delete(auth::delete_api_token))
         .route("/jobs", get(list_jobs).post(register_job))
         .route("/jobs/create", post(create_job))
-        .route("/jobs/{id}", axum::routing::patch(update_job).delete(delete_job))
+        .route("/jobs/schedule", get(schedule_preview))
+        .route("/jobs/{id}", get(get_job).patch(update_job).delete(delete_job))
+        .route("/jobs/{id}/assistant", post(job_assistant))
         .route("/jobs/{id}/run", post(run_job))
         .route("/jobs/{id}/webhook", post(job_webhook_settings))
         .route("/terminals", get(list_terminals).post(open_terminal))
@@ -1621,15 +1624,24 @@ async fn list_jobs(Extension(user): Extension<User>, State(app): State<AppState>
     Ok(Json(json!(jobs)))
 }
 
+async fn get_job(Extension(user): Extension<User>, State(app): State<AppState>, Path(id): Path<String>) -> ApiResult {
+    let job = own_job(&app, &user, &id)?;
+    Ok(Json(crate::jobs::describe(&job)))
+}
+
 #[derive(Deserialize)]
 struct RegisterJob {
     path: String,
 }
 
+/// Register an existing Markdown file (older files: settings from their frontmatter).
 async fn register_job(Extension(user): Extension<User>, State(app): State<AppState>, Json(b): Json<RegisterJob>) -> ApiResult {
     let p = crate::files::checked_path(&app, &user, &b.path, true)?;
-    crate::jobs::parse(&p).map_err(|e| ApiError(StatusCode::BAD_REQUEST, format!("{e:#}")))?;
+    if !p.is_file() {
+        return Err(ApiError(StatusCode::BAD_REQUEST, format!("{} is not a file", p.display())));
+    }
     let job = app.store.job_register(&user.id, &p.display().to_string())?;
+    let job = crate::jobs::adopt(&app.store, job).map_err(|e| ApiError(StatusCode::BAD_REQUEST, format!("{e:#}")))?;
     app.audit(Some(&user), "job.register", &job.path, "");
     Ok(Json(crate::jobs::describe(&job)))
 }
@@ -1638,22 +1650,38 @@ async fn register_job(Extension(user): Extension<User>, State(app): State<AppSta
 struct CreateJob {
     /// Project folder; the file goes to <cwd>/.codecraft/jobs/<name>.md.
     cwd: String,
-    #[serde(flatten)]
-    job: crate::jobs::NewJob,
+    name: String,
+    /// Initial content of the instructions file (example or template).
+    prompt: String,
+    #[serde(default)]
+    schedule: Option<String>,
+    #[serde(default)]
+    agent: Option<String>,
+    #[serde(default)]
+    permission_mode: Option<String>,
+    /// Default false: the user switches it on once prompt and schedule are ready.
+    #[serde(default)]
+    enabled: bool,
 }
 
 async fn create_job(Extension(user): Extension<User>, State(app): State<AppState>, Json(b): Json<CreateJob>) -> ApiResult {
     let dir = crate::files::checked_path(&app, &user, &b.cwd, true)?;
-    if b.job.name.trim().is_empty() || b.job.prompt.trim().is_empty() {
-        return Err(ApiError(StatusCode::BAD_REQUEST, "name and prompt are required".into()));
+    if b.prompt.trim().is_empty() {
+        return Err(ApiError(StatusCode::BAD_REQUEST, "the instructions are empty".into()));
     }
-    if !crate::permission::MODES.contains(&b.job.permission_mode.as_str()) {
-        return Err(ApiError(StatusCode::BAD_REQUEST, "invalid permission mode".into()));
+    let mut settings = crate::jobs::JobSettings::new(&b.name);
+    if let Some(x) = b.schedule {
+        settings.schedule = x;
+    }
+    if let Some(x) = b.agent {
+        settings.agent = x;
+    }
+    if let Some(x) = b.permission_mode {
+        settings.permission_mode = x;
     }
     // Inside the checked folder: the file name is a slug of the name.
-    let path = crate::jobs::new_job_path(&dir, &b.job.name);
-    crate::jobs::write_file(&path, &b.job).map_err(|e| ApiError(StatusCode::BAD_REQUEST, format!("{e:#}")))?;
-    let job = app.store.job_register(&user.id, &path.display().to_string())?;
+    let path = crate::jobs::new_job_path(&dir, &b.name);
+    let job = crate::jobs::create(&app.store, &user.id, &path, settings, &b.prompt, b.enabled).map_err(|e| ApiError(StatusCode::BAD_REQUEST, format!("{e:#}")))?;
     app.audit(Some(&user), "job.create", &job.path, "");
     Ok(Json(crate::jobs::describe(&job)))
 }
@@ -1661,15 +1689,45 @@ async fn create_job(Extension(user): Extension<User>, State(app): State<AppState
 #[derive(Deserialize)]
 struct UpdateJob {
     enabled: Option<bool>,
-    /// Written into the job file's frontmatter.
+    name: Option<String>,
+    schedule: Option<String>,
+    agent: Option<String>,
+    /// "" = the server's default model.
+    model: Option<String>,
     permission_mode: Option<String>,
+    timeout_minutes: Option<u64>,
 }
 
 async fn update_job(Extension(user): Extension<User>, State(app): State<AppState>, Path(id): Path<String>, Json(b): Json<UpdateJob>) -> ApiResult {
     let job = own_job(&app, &user, &id)?;
-    if let Some(m) = b.permission_mode.as_deref() {
-        crate::jobs::set_permission_mode(std::path::Path::new(&job.path), m).map_err(|e| ApiError(StatusCode::BAD_REQUEST, format!("{e:#}")))?;
-        app.audit(Some(&user), "job.permission_mode", &job.path, m);
+    let job = crate::jobs::adopt(&app.store, job).map_err(|e| ApiError(StatusCode::BAD_REQUEST, format!("{e:#}")))?;
+    let changes = b.name.is_some() || b.schedule.is_some() || b.agent.is_some() || b.model.is_some() || b.permission_mode.is_some() || b.timeout_minutes.is_some();
+    if changes {
+        let mut st = job.settings.clone().unwrap_or_else(|| crate::jobs::JobSettings::new("automation"));
+        if let Some(x) = b.name {
+            st.name = x;
+        }
+        if let Some(x) = b.schedule {
+            st.schedule = x;
+        }
+        if let Some(x) = b.agent {
+            st.agent = x;
+        }
+        if let Some(x) = b.model {
+            if !x.is_empty() {
+                app.registry().resolve(&x)?;
+            }
+            st.model = Some(x);
+        }
+        if let Some(x) = b.permission_mode {
+            st.permission_mode = x;
+        }
+        if let Some(x) = b.timeout_minutes {
+            st.timeout_minutes = x;
+        }
+        st.validate().map_err(|e| ApiError(StatusCode::BAD_REQUEST, format!("{e:#}")))?;
+        app.store.job_set_settings(&job.id, &st)?;
+        app.audit(Some(&user), "job.settings", &job.path, &st.schedule);
     }
     if let Some(e) = b.enabled {
         app.store.job_set_enabled(&job.id, e)?;
@@ -1678,6 +1736,96 @@ async fn update_job(Extension(user): Extension<User>, State(app): State<AppState
     Ok(Json(crate::jobs::describe(&job)))
 }
 
+/// Chat in which the user works out the instructions with a model (created once, reused
+/// while it exists). The model edits the job file directly.
+async fn job_assistant(Extension(user): Extension<User>, State(app): State<AppState>, Path(id): Path<String>) -> ApiResult {
+    let job = own_job(&app, &user, &id)?;
+    let job = crate::jobs::adopt(&app.store, job).map_err(|e| ApiError(StatusCode::BAD_REQUEST, format!("{e:#}")))?;
+    let mut st = job.settings.clone().ok_or_else(|| ApiError(StatusCode::BAD_REQUEST, "automation without settings".into()))?;
+    if let Some(sid) = st.assistant_session.as_deref() {
+        if app.store.get_session(sid)?.is_some_and(|s| s.owner_id.as_deref() == Some(user.id.as_str())) {
+            return Ok(Json(json!({"session_id": sid})));
+        }
+    }
+    let path = std::path::Path::new(&job.path);
+    let cwd = crate::jobs::cwd_of(&job.path, st.cwd.as_deref());
+    let cfg = app.config();
+    let model = st
+        .model
+        .clone()
+        .or_else(|| Some(cfg.server.default_model.clone()).filter(|m| !m.is_empty()))
+        .or_else(|| app.registry().first_model())
+        .ok_or_else(|| ApiError(StatusCode::BAD_REQUEST, "no model configured – ask an admin to add a provider".into()))?;
+    let now = now_ms();
+    let instructions = format!(
+        "You help the user write the instructions of the automation \"{name}\". They live in the Markdown file {file} \
+         and are executed unattended by an agent (mode {agent}) on a schedule the user sets in the UI. That run starts a \
+         fresh session and sees only this file – no conversation, nobody to ask.\n\
+         - Work on that file directly with your edit tools and keep it up to date after every round; the user sees it next to this chat.\n\
+         - Find out what the automation should achieve, then shape the file into clear, self-contained instructions: \
+         goal, steps, expected result (e.g. a short report), limits (what must not be done).\n\
+         - Write only the instructions: no frontmatter, no schedule or settings in the file.\n\
+         - Do not carry out the automation's task yourself and do not create other files. Use the language the user writes in.",
+        name = st.name,
+        file = path.display(),
+        agent = st.agent,
+    );
+    let s = Session {
+        id: new_id(),
+        title: format!("{} – {}", st.name, if crate::telegram::german(&app, &user.id) { "Anweisungen" } else { "instructions" }),
+        cwd: cwd.display().to_string(),
+        model,
+        agent: "build".into(),
+        permission_mode: "auto".into(),
+        parent_id: None,
+        owner_id: Some(user.id.clone()),
+        created_at: now,
+        updated_at: now,
+        todos: Value::Null,
+        last_usage: None,
+        clean_room: None,
+        phase: None,
+        worktree: None,
+        pinned: false,
+        archived: false,
+        folder: None,
+        instructions,
+        telegram_quiet: true,
+    };
+    let s = app.save_session(s)?;
+    st.assistant_session = Some(s.id.clone());
+    app.store.job_set_settings(&job.id, &st)?;
+    Ok(Json(json!({"session_id": s.id})))
+}
+
+#[derive(Deserialize)]
+struct ScheduleQ {
+    expr: String,
+}
+
+/// Check a cron expression and list its next runs (for the schedule editor).
+async fn schedule_preview(Query(q): Query<ScheduleQ>) -> ApiResult {
+    let expr = q.expr.trim();
+    if let Err(e) = crate::jobs::check_schedule(expr) {
+        return Ok(Json(json!({"ok": false, "error": format!("{e:#}")})));
+    }
+    let mut next = Vec::new();
+    let mut t = now_ms();
+    for _ in 0..5 {
+        match crate::jobs::next_run(expr, t) {
+            Some(n) => {
+                next.push(n);
+                t = n + 1000;
+            }
+            None => break,
+        }
+    }
+    // Wall-clock times of the server: cron works in its time zone, the browser may be elsewhere.
+    let local: Vec<String> = next.iter().filter_map(|n| chrono::DateTime::from_timestamp_millis(*n)).map(|t| t.with_timezone(&chrono::Local).format("%Y-%m-%dT%H:%M").to_string()).collect();
+    let tz = std::env::var("TZ").ok().filter(|z| !z.is_empty()).unwrap_or_else(|| chrono::Local::now().format("UTC%:z").to_string());
+    Ok(Json(json!({"ok": true, "next": next, "next_local": local, "tz": tz})))
+}
+
 async fn delete_job(Extension(user): Extension<User>, State(app): State<AppState>, Path(id): Path<String>) -> ApiResult {
     let job = own_job(&app, &user, &id)?;
     app.store.job_delete(&job.id)?;