fix(webui): harden automation management API

Maintainer edit: redact external channel chat identifiers from the WebUI automation payload and reject malformed or unschedulable automation updates before they mutate cron jobs.

webui/src/components/settings/SettingsView.tsx

@@ -3583,7 +3583,7 @@ function AutomationRow({
     t(key, { defaultValue: fallback, ...(values ?? {}) });
   const status = automationStatus(job, tx);
   const origin = automationOriginLabel(job, tx);
-  const originHref = job.origin?.channel === "websocket"
+  const originHref = job.origin?.channel === "websocket" && job.origin.session_key
     ? `#/chat/${encodeURIComponent(job.origin.session_key)}`
     : null;
   const history = job.state.run_history ?? [];
@@ -4257,7 +4257,7 @@ function automationOriginLabel(
   }
   if (!origin) return tx("settings.automations.origin.unknown", "No linked chat");
   if (origin.channel !== "websocket") return automationChannelLabel(origin.channel, tx);
-  return origin.title || origin.preview || origin.session_key;
+  return origin.title || origin.preview || origin.session_key || automationChannelLabel(origin.channel, tx);
 }
 
 function automationChannelLabel(

webui/src/lib/types.ts

@@ -132,9 +132,9 @@ export interface SessionAutomationJob {
     }>;
   };
   origin?: {
-    session_key: string;
+    session_key?: string;
     channel: string;
-    chat_id: string;
+    chat_id?: string;
     title?: string;
     preview?: string;
   } | null;

webui/src/tests/app-layout.test.tsx

@@ -395,9 +395,7 @@ describe("App layout", () => {
             payload: {
               message: "Send a quiz",
               kind: "agent_turn",
-              session_key: "weixin:wx-chat",
               origin_channel: "weixin",
-              origin_chat_id: "wx-chat",
             },
             state: {
               next_run_at_ms: Date.UTC(2026, 3, 17, 11, 30, 0),
@@ -406,11 +404,9 @@ describe("App layout", () => {
               run_history: [],
             },
             origin: {
-              session_key: "weixin:wx-chat",
               channel: "weixin",
-              chat_id: "wx-chat",
-              title: "Scheduled cron job triggered",
-              preview: "memory with dream state",
+              title: "",
+              preview: "",
             },
           },
           {