fix(storage): decode stored Automations instead of trusting the record

Scheduled tasks are read back with a bare `JSON.parse(...) as ScheduledTask`,
so a record written before a permission mode was retired carried that value
straight into `compilePermissionProfile`, which no longer has a branch for it.
`normalizeCreateScheduledTaskInput` could not catch this: it validates new
input and stored records never pass through it.

Add `decodePersistedScheduledTask` next to the type it decodes and call it on
the store's read path. It folds retired representations to their live
equivalents and leaves everything else as stored — it is a compatibility fold,
not a schema validator.

Refs #3385

Generated-by: Claude Code

Author: Astro-Han

packages/core/src/__tests__/scheduled-task.test.ts

@@ -2,6 +2,7 @@ import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
 import {
   computeNextFireAt,
+  decodePersistedScheduledTask,
   isScheduledTaskDue,
   nextScheduledTaskStateAfterFire,
   normalizeCreateScheduledTaskInput,
@@ -200,3 +201,55 @@ describe('scheduled-task catalog', () => {
     }
   });
 });
+
+describe('decodePersistedScheduledTask', () => {
+  const base: ScheduledTask = {
+    id: 't1',
+    title: 'Nightly',
+    intent: { kind: 'text', body: 'run it' },
+    schedule: { kind: 'once', runAt: 1000 },
+    effect: {
+      kind: 'agent_run',
+      execution: {
+        cwd: '/repo',
+        backend: 'fake',
+        llmConnectionSlug: 'anthropic',
+        model: 'claude',
+        permissionMode: 'ask',
+        collaborationMode: 'agent',
+        orchestrationMode: 'default',
+      },
+    },
+    status: 'active',
+    nextFireAt: 1000,
+    lastFireAt: null,
+    fireCount: 0,
+    maxFires: null,
+    expiresAt: null,
+    createdBy: { kind: 'user' },
+    createdAt: 0,
+    updatedAt: 0,
+    runs: [],
+    lastError: null,
+  };
+
+  it('folds a retired permission mode to its live equivalent', () => {
+    const stored = JSON.parse(
+      JSON.stringify(base).replace('"permissionMode":"ask"', '"permissionMode":"execute"'),
+    ) as ScheduledTask;
+    const decoded = decodePersistedScheduledTask(stored);
+    assert.equal(
+      decoded.effect.kind === 'agent_run' ? decoded.effect.execution.permissionMode : undefined,
+      'ask',
+    );
+  });
+
+  it('returns the same task when nothing needs folding', () => {
+    assert.equal(decodePersistedScheduledTask(base), base);
+  });
+
+  it('leaves effects without an execution template alone', () => {
+    const notify: ScheduledTask = { ...base, effect: { kind: 'notify', channel: 'local' } };
+    assert.equal(decodePersistedScheduledTask(notify), notify);
+  });
+});

packages/core/src/scheduled-task.ts

@@ -9,7 +9,11 @@ import { compileCronExpression } from './cron-expression.js';
 import { isCollaborationMode, type CollaborationMode } from './collaboration.js';
 import { isOrchestrationMode, type OrchestrationMode } from './orchestration.js';
 import { isThinkingLevel, type ThinkingLevel } from './model-thinking.js';
-import { isPermissionMode, type PermissionMode } from './permission.js';
+import {
+  decodePersistedPermissionMode,
+  isPermissionMode,
+  type PermissionMode,
+} from './permission.js';
 import { isBotDeliveryProvider, type BotProvider } from './bot-chat-settings.js';
 import type { PersistedBackendKind } from './session.js';
 
@@ -644,3 +648,27 @@ function addMonthsClamped(anchor: Date, base: Date, offset: number): number {
 function fail(message: string): { ok: false; message: string } {
   return { ok: false, message };
 }
+
+/**
+ * Fold retired representations in a stored ScheduledTask to their live
+ * equivalents.
+ *
+ * Stored tasks are read back with `JSON.parse` and never pass through
+ * `normalizeCreateScheduledTaskInput`, which validates *new* input and is
+ * deliberately strict. Without this fold a task written before a value was
+ * retired would carry that value straight into execution, where nothing
+ * recognizes it any more. This is not a schema validator: a record that is
+ * malformed in any other way stays as stored.
+ */
+export function decodePersistedScheduledTask(task: ScheduledTask): ScheduledTask {
+  const { effect } = task;
+  if (effect.kind !== 'agent_run') return task;
+  const permissionMode = decodePersistedPermissionMode(effect.execution.permissionMode);
+  if (permissionMode === undefined || permissionMode === effect.execution.permissionMode) {
+    return task;
+  }
+  return {
+    ...task,
+    effect: { ...effect, execution: { ...effect.execution, permissionMode } },
+  };
+}

packages/storage/src/scheduled-task-store.ts

@@ -3,6 +3,7 @@ import { resolve } from 'node:path';
 import {
   compareScheduledTasksForList,
   computeNextFireAt,
+  decodePersistedScheduledTask,
   isScheduledTaskDue,
   nextScheduledTaskStateAfterFire,
   normalizeCreateScheduledTaskInput,
@@ -577,7 +578,7 @@ class SqliteScheduledTaskStore implements ScheduledTaskStore {
       if (typeof row.record_json !== 'string') {
         throw new Error(`Invalid scheduled task at row ${index + 1}`);
       }
-      return JSON.parse(row.record_json) as ScheduledTask;
+      return decodePersistedScheduledTask(JSON.parse(row.record_json) as ScheduledTask);
     });
     const claimRows = this.#lease.database
       .prepare(`