fix(dispatch): review findings — dispatch outcome, secrets boundary, target strictness

- AgentDispatchOutcome threads Started/QueuedToActiveRun{effective_run_id,
  pending_input_id} from the bridge through AgentDispatcher and
  InboundResult. A message queued into an already-active run now aborts the
  fresh-run response subscription instead of leaking it (internal dispatch
  and chat API), cron bookkeeping records the effective run id, and the
  pending input carries allowlisted attribution metadata
  (source/automation_id/origin_run_id) into the acknowledged user record.
- Runtime-only run metadata (garyx_mcp_auth_token, remote_mcp_servers) is
  stripped at the bridge persistence chokepoint so provider wiring and MCP
  env secrets never reach transcript records.
- An explicit cron target (thread-like or channel) whose thread record is
  missing now fails instead of silently succeeding through the bare-run
  bypass; only the thread-less cron::<job id> pseudo-target keeps it.
- Thread-bound automations reject an explicit workspace_dir (the thread's
  workspace always applies) and the desktop dialog hides the agent picker
  and omits agent/workspace for thread-bound automations; docs updated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Pyiner

desktop/garyx-desktop/src/main/garyx-client/automations.ts

@@ -159,7 +159,7 @@ export async function createRemoteAutomation(
   input: {
     label: string;
     prompt: string;
-    agentId: string;
+    agentId?: string;
     workspacePath?: string;
     targetThreadId?: string | null;
     schedule: DesktopAutomationSchedule;
@@ -174,7 +174,7 @@ export async function createRemoteAutomation(
       body: JSON.stringify({
         label: input.label,
         prompt: input.prompt,
-        agentId: input.agentId,
+        agentId: input.agentId || undefined,
         workspaceDir: input.workspacePath || undefined,
         targetThreadId: input.targetThreadId || undefined,
         schedule: input.schedule,

desktop/garyx-desktop/src/main/store.ts

@@ -1464,14 +1464,14 @@ export async function createDesktopAutomation(
     targetThread?.workspacePath || null,
     targetThreadId,
   );
-  const explicitWorkspacePath = normalizeWorkspacePathInput(input.workspacePath);
-  const remoteWorkspacePath = targetThreadId
-    ? explicitWorkspacePath || undefined
-    : workspacePath;
+  // A thread-bound automation always runs with the thread's own agent and
+  // workspace; the gateway rejects explicit overrides for that combination.
+  const remoteWorkspacePath = targetThreadId ? undefined : workspacePath;
+  const agentId = targetThreadId ? undefined : input.agentId?.trim() || undefined;
   const created = await createRemoteAutomation(current.settings, {
     label: input.label.trim(),
     prompt: input.prompt.trim(),
-    agentId: input.agentId.trim(),
+    agentId,
     workspacePath: remoteWorkspacePath,
     targetThreadId: targetThreadId || null,
     schedule: input.schedule,
@@ -1487,7 +1487,7 @@ export async function createDesktopAutomation(
     state,
     automation: state.automations.find((entry) => entry.id === created.id) || {
       ...created,
-      agentId: input.agentId.trim(),
+      agentId: agentId || created.agentId,
       workspacePath,
       targetThreadId,
     },
@@ -1526,14 +1526,13 @@ export async function updateDesktopAutomation(input: {
     fallbackWorkspacePath,
     targetThreadId,
   );
-  const explicitWorkspacePath = normalizeWorkspacePathInput(input.workspacePath);
-  const remoteWorkspacePath = targetThreadId
-    ? explicitWorkspacePath || undefined
-    : workspacePath;
+  // A thread-bound automation always runs with the thread's own agent and
+  // workspace; the gateway rejects explicit overrides for that combination.
+  const remoteWorkspacePath = targetThreadId ? undefined : workspacePath;
   const updated = await updateRemoteAutomation(current.settings, input.automationId, {
     label: input.label?.trim(),
     prompt: input.prompt?.trim(),
-    agentId: input.agentId?.trim(),
+    agentId: targetThreadId ? undefined : input.agentId?.trim(),
     workspacePath: remoteWorkspacePath,
     targetThreadId: hasTargetThreadInput ? targetThreadId || null : undefined,
     schedule: input.schedule,

desktop/garyx-desktop/src/renderer/src/app-shell/useAutomationController.ts

@@ -208,13 +208,15 @@ export function useAutomationController({
       setError('Automation prompt is required.');
       return;
     }
-    if (!automationDialog.draft.agentId.trim()) {
-      setError('Choose an agent for this automation.');
-      return;
-    }
     const targetThreadId = automationDialog.draft.targetMode === 'existing_thread'
       ? automationDialog.draft.targetThreadId.trim()
       : '';
+    // A thread-bound automation runs under the thread's own agent; the agent
+    // picker only applies to generated-thread automations.
+    if (!targetThreadId && !automationDialog.draft.agentId.trim()) {
+      setError('Choose an agent for this automation.');
+      return;
+    }
     const workspacePath = automationDialog.draft.workspacePath.trim();
     if (automationDialog.draft.targetMode === 'existing_thread' && !targetThreadId) {
       setError('Choose the thread this automation should post into.');
@@ -250,7 +252,7 @@ export function useAutomationController({
         ? await window.garyxDesktop.createAutomation({
             label,
             prompt,
-            agentId: automationDialog.draft.agentId,
+            agentId: targetThreadId ? undefined : automationDialog.draft.agentId,
             workspacePath: targetThreadId ? undefined : workspacePath || undefined,
             targetThreadId: targetThreadId || null,
             schedule: automationDialog.draft.schedule,
@@ -259,7 +261,7 @@ export function useAutomationController({
             automationId: automationDialog.automationId || '',
             label,
             prompt,
-            agentId: automationDialog.draft.agentId,
+            agentId: targetThreadId ? undefined : automationDialog.draft.agentId,
             workspacePath: targetThreadId ? undefined : workspacePath || undefined,
             targetThreadId: targetThreadId || null,
             schedule: automationDialog.draft.schedule,

desktop/garyx-desktop/src/renderer/src/components/AutomationDialog.tsx

@@ -358,6 +358,7 @@ export function AutomationDialog({
             />
           </Field>
 
+          {draft.targetMode === 'existing_thread' ? null : (
           <Field>
             <FieldLabel>{t('Agent')}</FieldLabel>
             <Select
@@ -392,6 +393,7 @@ export function AutomationDialog({
               </SelectContent>
             </Select>
           </Field>
+          )}
 
           <Field>
             <FieldLabel>{t('Run In')}</FieldLabel>
@@ -427,7 +429,7 @@ export function AutomationDialog({
             </ToggleGroup>
             <FieldDescription>
               {draft.targetMode === 'existing_thread'
-                ? t('Each run posts the prompt into the selected thread.')
+                ? t("Each run posts the prompt into the selected thread, handled by the thread's own agent and workspace.")
                 : t('Each run creates a fresh automation thread in the selected directory.')}
             </FieldDescription>
           </Field>

desktop/garyx-desktop/src/shared/contracts/automation.ts

@@ -55,7 +55,9 @@ export interface DesktopAutomationActivityFeed {
 export interface CreateAutomationInput {
   label: string;
   prompt: string;
-  agentId: string;
+  /// Omitted for thread-bound automations: the thread's own agent handles
+  /// each run, so an automation-level agent choice does not apply.
+  agentId?: string;
   workspacePath?: string;
   targetThreadId?: string | null;
   schedule: DesktopAutomationSchedule;

docs/configuration.md

@@ -466,9 +466,10 @@ garyx automation delete <automation-id>
 By default a scheduled automation creates a fresh automation thread for each
 run using `--workspace-dir`. Passing `--thread-id` instead binds the automation
 to an existing Garyx thread; each scheduled or manual run sends the configured
-prompt into that thread and keeps the transcript in one conversation. When an
-automation is bound to a thread, the thread's workspace is used unless an
-explicit workspace is provided.
+prompt into that thread exactly like a user message and keeps the transcript
+in one conversation. A thread-bound automation always uses the thread's own
+workspace — combining `--thread-id` with an explicit `--workspace-dir` is
+rejected.
 
 Automation schedules can be represented as hourly intervals, daily or weekday
 cron-style runs, one-shot timestamps, or monthly day-of-month runs. The mobile

garyx-bridge/src/multi_provider.rs

@@ -2,7 +2,7 @@ use std::collections::HashMap;
 use std::sync::Arc;
 
 use async_trait::async_trait;
-use garyx_models::provider::{AgentRunRequest, StreamEvent};
+use garyx_models::provider::{AgentDispatchOutcome, AgentRunRequest, StreamEvent};
 use garyx_models::thread_logs::ThreadLogSink;
 use garyx_models::CustomAgentProfile;
 use garyx_router::{AgentDispatcher, ThreadHistoryRepository, ThreadStore};
@@ -230,7 +230,7 @@ impl AgentDispatcher for MultiProviderBridge {
         &self,
         request: AgentRunRequest,
         response_callback: Option<Arc<dyn Fn(StreamEvent) + Send + Sync>>,
-    ) -> Result<(), String> {
+    ) -> Result<AgentDispatchOutcome, String> {
         self.start_agent_run(request, response_callback)
             .await
             .map_err(|e| e.to_string())

garyx-bridge/src/multi_provider/persistence.rs

@@ -245,6 +245,11 @@ pub(super) struct PendingUserInput {
     pub queued_at: String,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub origin_id: Option<String>,
+    /// Attribution metadata carried from the originating dispatch (e.g.
+    /// `source`/`automation_id` for scheduled turns queued into an active
+    /// run) and merged into the acknowledged user record.
+    #[serde(default, skip_serializing_if = "HashMap::is_empty")]
+    pub metadata: HashMap<String, Value>,
     pub status: PendingUserInputStatus,
 }
 
@@ -698,6 +703,13 @@ impl StreamingRunSnapshot {
         if let Some(origin_id) = pending_input.origin_id.as_deref() {
             metadata.insert("origin_id".to_owned(), Value::String(origin_id.to_owned()));
         }
+        // Attribution carried from the originating dispatch; built-in queue
+        // markers above win on conflict.
+        for (key, value) in &pending_input.metadata {
+            metadata
+                .entry(key.clone())
+                .or_insert_with(|| value.clone());
+        }
         self.session_messages.push(ProviderMessage {
             role: ProviderMessageRole::User,
             content: pending_input.content.clone(),
@@ -1091,8 +1103,18 @@ fn build_run_record_drafts(
     drafts
 }
 
+/// Run metadata that exists only to configure the provider runtime and must
+/// never be persisted into transcript records: the gateway bearer token and
+/// the managed MCP server definitions (whose `env` blocks carry secrets).
+/// This is the single persistence chokepoint — every dispatch source (chat
+/// API, internal dispatch, scheduled turns) funnels through it.
+const RUNTIME_ONLY_METADATA_KEYS: &[&str] = &["garyx_mcp_auth_token", "remote_mcp_servers"];
+
 fn run_message_metadata(run: &PersistedRun<'_>) -> HashMap<String, Value> {
     let mut metadata = run.metadata.clone();
+    for key in RUNTIME_ONLY_METADATA_KEYS {
+        metadata.remove(*key);
+    }
     match run
         .sdk_session_id
         .map(str::trim)

garyx-bridge/src/multi_provider/persistence/tests.rs

@@ -669,6 +669,54 @@ async fn test_save_thread_messages_overrides_stale_metadata_sdk_session_id() {
     assert_eq!(stored["sdk_session_id"], "new-session");
 }
 
+#[tokio::test]
+async fn test_save_thread_messages_strips_runtime_only_metadata() {
+    let store: Arc<dyn ThreadStore> = Arc::new(InMemoryThreadStore::new());
+    let history = make_history(store.clone());
+    let session_messages = vec![ProviderMessage::assistant_text("answer")];
+    let mut metadata = HashMap::new();
+    // Runtime-only provider wiring: the gateway bearer token and managed MCP
+    // definitions (whose env can carry secrets) must never reach transcript
+    // records. Synthetic placeholder values only.
+    metadata.insert("garyx_mcp_auth_token".to_owned(), json!("${TOKEN}"));
+    metadata.insert(
+        "remote_mcp_servers".to_owned(),
+        json!({ "example": { "command": "example-mcp", "env": { "API_KEY": "${SECRET}" } } }),
+    );
+    metadata.insert("source".to_owned(), json!("automation"));
+    metadata.insert("run_id".to_owned(), json!("run-runtime-only"));
+
+    save_thread_messages(
+        &store,
+        &history,
+        PersistedRun {
+            thread_id: "thread::runtime-only-metadata",
+            user_message: "scheduled prompt",
+            user_timestamp: Some("2026-03-01T00:00:00Z"),
+            user_images: &[],
+            assistant_response: "answer",
+            sdk_session_id: None,
+            provider_key: "provider::runtime-only",
+            provider_type: ProviderType::ClaudeCode,
+            session_messages: &session_messages,
+            metadata: &metadata,
+        },
+    )
+    .await;
+
+    let messages = committed_content(&history, "thread::runtime-only-metadata").await;
+    assert!(!messages.is_empty());
+    for message in &messages {
+        let raw = message.to_string();
+        assert!(
+            !raw.contains("garyx_mcp_auth_token") && !raw.contains("remote_mcp_servers"),
+            "runtime-only metadata leaked into transcript record: {raw}"
+        );
+    }
+    // Ordinary metadata still rides along.
+    assert_eq!(messages[0]["metadata"]["source"], "automation");
+}
+
 #[test]
 fn test_streaming_run_snapshot_splits_assistant_segments() {
     let mut snapshot = StreamingRunSnapshot::default();