fix(tui): add /cron command to list and cancel

[WilliamLambertCN]

Related Issue

Resolve #2968

Problem

See linked issue. Cron tasks created via the CronCreate tool are invisible to users: no slash command lists them, the /tasks panel does not show them, and the only way to cancel one is to ask the model — so a forgotten recurring task keeps spending tokens with no user-facing off switch.

What changed

Adds a /cron slash command that lists the current session's scheduled cron tasks in a selector (cron expression, next fire time, recurring/one-shot, prompt preview) and cancels the selected task with D after an inline [y/N] confirmation, following the existing dialog design spec (SELECT_POINTER, theme tokens, SearchableList).

Listing already existed over the SDK (Session.getCronTasks()); cancellation did not cross the engine boundary. This PR adds the missing delete path without inventing new engine machinery — both engines already had removal APIs, only the RPC/SDK exposure was missing:

• agent-core (v1): AgentAPI.deleteCronTask RPC wired to the existing CronManager.removeTasks, and CronTaskSnapshot gains the prompt field so hosts can show what a task does before canceling it
• agent-core-v2: the SDK v2 client bridges deleteCronTask to the existing ISessionCronService.removeTasks, mirroring getCronTasks' main-agent scoping (deleted: false for non-main agents instead of failing)
• @moonshot-ai/kimi-code-sdk: public Session.deleteCronTask(taskId) returning { deleted: boolean }
• TUI: command registration, dispatch, CronSelectorComponent, and bilingual slash-command reference rows

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue, or explained the problem above.
• I have added tests that prove my feature works.
• Ran gen-changesets skill, or this PR needs no changeset.
• Ran gen-docs skill, or this PR needs no doc update.

[changeset-bot]

🦋 Changeset detected

Latest commit: 9c1e742

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 5 packages

Name	Type
@moonshot-ai/kimi-code	Minor
@moonshot-ai/kimi-code-sdk	Minor
@moonshot-ai/agent-core	Patch
@moonshot-ai/acp-adapter	Patch
kimi-code	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 64c0a87b70

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Sanitize cron prompts before rendering

When a scheduled prompt contains terminal control bytes, this whitespace-only normalization leaves them intact and the resulting preview is written directly through pi-tui, which preserves ANSI/OSC sequences. Because CronCreateInputSchema accepts arbitrary prompt strings—including model-generated text influenced by untrusted repository content—opening /cron can execute sequences that clear or corrupt the display, spoof hyperlinks, or alter terminal state. Strip terminal sequences and remaining C0/C1 controls from the display-only preview before styling it.

Useful? React with 👍 / 👎.

[WilliamLambertCN]

Fixed in 9c1e742 — the prompt preview now goes through the existing sanitizeShellOutput (the same sanitizer #2863 applied to background task output) before whitespace flattening, so CSI/OSC/C0 bytes never reach pi-tui. Added a component test covering CSI, OSC 8 hyperlinks, and BEL injection.