sync: update from private repo (a360d15)

src/bridge/scheduled-tasks-api.ts

@@ -11,6 +11,14 @@ export interface ScheduledTasksApiOptions {
    * field is silently dropped (legacy / no-auth deployments).
    */
   sessRepo?: BrowserSessionRepo;
+  /**
+   * Whether the auth subsystem is wired. When `false` (no-auth single-user
+   * deployment) requests carry no `req.user`, so new scheduled tasks (and the
+   * jobs the scheduler spawns from them) are owned by the stable `local` user
+   * instead of NULL — keeping per-task reflection / visibility consistent with
+   * the rest of the no-auth path. Defaults to `true`.
+   */
+  authActive?: boolean;
 }
 
 export function mountScheduledTasksApi(
@@ -20,6 +28,7 @@ export function mountScheduledTasksApi(
   apiOpts: ScheduledTasksApiOptions = {},
 ): void {
   const { sessRepo } = apiOpts;
+  const noAuthOwner: string | null = (apiOpts.authActive ?? true) ? null : 'local';
 
   /**
    * Validate and resolve a browserSessionProfileId from a request body.
@@ -133,7 +142,7 @@ export function mountScheduledTasksApi(
           return;
         }
       }
-      const ownerId = (req.user as Express.User | undefined)?.id ?? null;
+      const ownerId = (req.user as Express.User | undefined)?.id ?? noAuthOwner;
 
       const profileBinding = resolveBrowserSessionProfileId(
         req.body?.browserSessionProfileId,