@goodandready/dsh-cron 0.2.0 → 0.2.2

package/docs/design/DESIGN.md

@@ -16,7 +16,7 @@
   - Поисковая строка; сводная статистика (активные задачи, запуски, токены, стоимость).
   - Карточки задач: статус-переключатель, название, расписание (человекочитаемое + raw cron), действия (запуск, редактирование, удаление).
   - Блок «Рекомендуемые задачи»: готовые шаблоны (Daily digest, Weekly review, Follow-up monitor) в один клик.
-  - Карточка настроек в слоте settings.plugin.item, key = namespace `dsh-cron`; запасной путь — settings.section.
+  - Карточка настроек в слоте settings.plugin.item, key = namespace `dsh-cron`; отдельный раздел настроек не используется (#102).
 - LLM Tools: cron_create_task (+ alias cron_schedule_task), cron_list_tasks, cron_pause_task, cron_resume_task, cron_delete_task, cron_run_task.
 - API: HTTP эндпоинты /dsh-cron/* (tasks, models, chat/start, settings, telegram/test, kanban/test, tasks/:id/actions, legacy action/:id/:action). Мутирующие эндпоинты отклоняют cross-origin запросы; script-задачи по HTTP требуют заголовок x-dsh-cron-confirm.
 - Chat / Slash Commands: отсутствуют (ранее заявленные /cron-команды не были реализованы и удалены из документации; решение 2026-09-09).
@@ -46,7 +46,7 @@
   - SettingsModal: настройки Telegram/Kanban с тестами доставки.
   - TaskItem: строка задачи с переключателем состояния и действиями.
   - RecommendationCard: плашка с готовым шаблоном.
-  - CronSettingsCard: карточка параметров плагина в настройках.
+  - CronSettingsCard: карточка параметров плагина в настройках; свёрнута по умолчанию, шапка-кнопка с шевроном разворачивает тело (aria-expanded), кнопка «Открыть панель задач» — внутри раскрытого тела (решение 2026-09-10, #100).
 - States:
   - Loading: индикатор загрузки списка/истории.
   - Empty: дружелюбный пустой экран со списком рекомендаций.
@@ -63,7 +63,8 @@
 ## Locked Design Decisions
 - 2026-09-09 — Пакет надёжности ядра (v0.1.24): буфер shell-задач 10МБ, атомарное сохранение с PID, аудит пропущенных запусков при рестарте (missed), фоновый поллинг UI (8с).
 - 2026-09-03 — Публичный скоуп @goodandready/dsh-cron; оверлей через mountSidebarEntry/mountScreen аналогично dsh-kanban; двойная кнопка «Создать ⌄».
-- 2026-09-09 — Слот карточки настроек: settings.plugin.item с key/namespace `dsh-cron` (совпадение с серверной регистрацией); settings.section — только запасной путь. Причина: контракт слота настроек (#85).
+- 2026-09-09 — Слот карточки настроек: settings.plugin.item с key/namespace `dsh-cron` (совпадение с серверной регистрацией). Причина: контракт слота настроек (#85). Changed 2026-09-10 (#102): settings.section fallback удалён — карточка только во вкладке плагинов.
+- 2026-09-10 — Значения настроек пишутся через зарегистрированный settings-скоуп (`scope.set` → `watch` → store); REST /dsh-cron/settings остаётся транспортом для карточки и headless-сценариев; карточка проверяет статус снапшота и не рисует поля до его получения (#102).
 - 2026-09-09 — Английский — канонический язык строк; словарь STRINGS.en регистрируется в ctx.locale; русский — через translation-плагин. Причина: стандарт DSH-плагинов (#87).
 - 2026-09-09 — Same-origin проверка мутирующих эндпоинтов, лимит тела 1 МБ, confirm-заголовок для script-задач. Причина: закрытие CSRF→RCE поверхности (#86).
 - 2026-09-09 — Стилевая изоляция: динамические <style> с data-dsh-plugin="dsh-cron"; цвета только через токены темы + единый блок plugin-переменных. Причина: защита от очистки стилей соседями и поддержка светлой темы (#91).

package/lib/client.js

@@ -119,7 +119,9 @@ window.__ModuleLoader__.load({
         'form.notifyOnlyFailure': 'Only on failures (onlyOnFailure / silent on success)',
         'form.nextRunLabel': 'Next run: ',
         'form.notScheduled': 'not scheduled',
-        'settings.sectionLabel': 'Cron tasks',
+        'settings.loading': 'Loading settings...',
+        'settings.unavailable': 'Settings are unavailable right now.',
+        'settings.retry': 'Retry',
         'settings.cardTitle': '⏰ Task scheduler (Cron)',
         'settings.cardDesc': 'Scheduled task execution (cron/intervals), background agent scenarios and Telegram/Kanban integration.',
         'settings.openPanel': 'Open task panel',
@@ -170,20 +172,65 @@ window.__ModuleLoader__.load({
     };
     const T = (key, vars) => translate(key, vars);
 
-    // Status colors: core semantic tokens first, plugin fallbacks as a single
-    // point of change (Issue #91 — no scattered hardcoded hex).
+    // Core chevron primitive when the build ships it; own SVG fallback otherwise.
+    let CoreChevron = null;
+    try {
+      const primitives = require('@deepseek-ai/dsh-client-ui-primitives');
+      CoreChevron = primitives && primitives.IconChevronDownOutline14;
+    } catch (e) {}
+    const chevronNode = () => (CoreChevron ? React.createElement(CoreChevron) : React.createElement('span', { style: { display: 'flex', alignItems: 'center' }, dangerouslySetInnerHTML: { __html: ICON_CHEVRON_DOWN } }));
+
+    // Own React error boundary (#106): the core's SlotErrorBoundary renders an
+    // empty div on crash, so a slot failure would silently vanish. Ours keeps
+    // the failure visible with a retry.
+    function createErrorBoundary() {
+      if (!React || typeof React.Component !== 'function') {
+        return function NoopBoundary(props) { return (props && props.children) || null; };
+      }
+      return class ErrorBoundary extends React.Component {
+        constructor(props) {
+          super(props);
+          this.state = { hasError: false, error: null };
+        }
+        static getDerivedStateFromError(error) {
+          return { hasError: true, error };
+        }
+        componentDidCatch(error, errorInfo) {
+          console.error('[dsh-cron] React error:', error, errorInfo);
+        }
+        render() {
+          if (this.state.hasError) {
+            return React.createElement('div', { className: 'dsh-cron-status-banner', 'data-type': 'error', style: { margin: '12px 0' } },
+              React.createElement('div', { style: { fontWeight: 600, marginBottom: '6px' } }, '⚠️ Cron UI error:'),
+              React.createElement('div', { style: { fontSize: '12px', wordBreak: 'break-all' } }, String((this.state.error && this.state.error.message) || this.state.error)),
+              React.createElement('button', {
+                type: 'button',
+                className: 'dsh-cron-btn-secondary',
+                style: { marginTop: '10px', fontSize: '12px', padding: '4px 10px' },
+                onClick: () => this.setState({ hasError: false, error: null })
+              }, 'Retry')
+            );
+          }
+          return (this.props && this.props.children) || null;
+        }
+      };
+    }
+    const ErrorBoundary = createErrorBoundary();
+
+    // Status colors: core semantic state tokens first (same set dsh-clinebot
+    // uses), plugin fallbacks as a single point of change (#105).
     const STYLES = `
       :root {
-        --dsh-cron-success: var(--dsw-alias-label-success, #10b981);
-        --dsh-cron-success-bg: var(--dsw-alias-bg-success, rgba(16, 185, 129, 0.15));
-        --dsh-cron-danger: var(--dsw-alias-label-danger, #ef4444);
-        --dsh-cron-danger-bg: var(--dsw-alias-bg-danger, rgba(239, 68, 68, 0.15));
-        --dsh-cron-info: var(--dsw-alias-label-info, #60a5fa);
-        --dsh-cron-info-bg: var(--dsw-alias-bg-info, rgba(59, 130, 246, 0.15));
-        --dsh-cron-accent: var(--dsw-alias-label-accent, #c084fc);
-        --dsh-cron-accent-bg: var(--dsw-alias-bg-accent, rgba(168, 85, 247, 0.15));
-        --dsh-cron-warning: var(--dsw-alias-label-warning, #eab308);
-        --dsh-cron-warning-bg: var(--dsw-alias-bg-warning, rgba(234, 179, 8, 0.15));
+        --dsh-cron-success: var(--dsw-alias-state-success-primary, #10b981);
+        --dsh-cron-success-bg: rgba(16, 185, 129, 0.1);
+        --dsh-cron-danger: var(--dsw-alias-state-error-primary, #ef4444);
+        --dsh-cron-danger-bg: rgba(239, 68, 68, 0.1);
+        --dsh-cron-info: var(--dsw-alias-state-brand-primary, #60a5fa);
+        --dsh-cron-info-bg: rgba(96, 165, 250, 0.12);
+        --dsh-cron-accent: var(--dsw-alias-state-info-primary, #c084fc);
+        --dsh-cron-accent-bg: rgba(168, 85, 247, 0.12);
+        --dsh-cron-warning: var(--dsw-alias-state-warning-primary, #eab308);
+        --dsh-cron-warning-bg: rgba(234, 179, 8, 0.12);
       }
       [data-pane=conversation], [class*=centerCol] {
         position: relative !important;
@@ -208,43 +255,46 @@ window.__ModuleLoader__.load({
       .dsh-cron-entry-label { text-overflow: ellipsis; overflow: hidden; }
       [data-dsh-frame][data-sidebar-collapsed] .dsh-cron-entry-label { display: none; }
 
-      .dsh-cron-overlay { position: absolute; inset: 0; display: flex; flex-direction: column; background: var(--dsw-alias-bg-base, #171717); color: var(--dsw-alias-label-primary, #ededed); overflow-y: auto; padding: 32px 48px; z-index: 100; box-sizing: border-box; }
-      .dsh-cron-container { max-width: 860px; width: 100%; margin: 0 auto; }
+      .dsh-cron-overlay { position: absolute; inset: 0; display: flex; flex-direction: column; background: var(--dsw-alias-bg-base, #171717); color: var(--dsw-alias-label-primary, #ededed); overflow-y: auto; padding: 24px 48px 32px; z-index: 100; box-sizing: border-box; }
+      .dsh-cron-container { max-width: 960px; width: 100%; margin: 0 auto; display: flex; flex-direction: column; gap: 20px; padding: 8px 0 32px; box-sizing: border-box; }
 
-      .dsh-cron-top-bar { display: flex; align-items: center; gap: 12px; margin-bottom: 20px; }
+      .dsh-cron-top-bar { display: flex; align-items: center; gap: 12px; }
       .dsh-cron-back-btn { appearance: none; font: inherit; cursor: pointer; color: var(--dsw-alias-label-secondary, #9ca3af); background: 0 0; border: 1px solid var(--dsw-alias-border-l2, #383838); border-radius: 8px; align-items: center; gap: 6px; padding: 4px 12px; font-size: 13px; display: inline-flex; flex: none; height: 32px; box-sizing: border-box; }
-      .dsh-cron-back-btn:hover { color: var(--dsw-alias-label-primary, #ededed); background: var(--dsw-alias-interactive-bg-hover, rgba(255,255,255,0.06)); }
+      .dsh-cron-back-btn:hover { color: var(--dsw-alias-label-primary, #ededed); background: var(--dsw-alias-bg-layer-4, var(--dsw-alias-interactive-bg-hover, rgba(255,255,255,0.06))); }
 
-      .dsh-cron-header { display: flex; justify-content: space-between; align-items: flex-start; margin-bottom: 24px; }
-      .dsh-cron-title { font-size: 24px; font-weight: 600; letter-spacing: -0.02em; margin-bottom: 6px; }
-      .dsh-cron-subtitle { font-size: 14px; color: var(--dsw-alias-label-secondary, #9ca3af); }
-      .dsh-cron-create-btn { appearance: none; display: inline-flex; align-items: center; gap: 6px; background: var(--dsw-alias-bg-layer-4, #262626); color: var(--dsw-alias-label-primary, #fff); border: 1px solid var(--dsw-alias-border-l2, #383838); border-radius: 9999px; padding: 8px 16px; font-size: 14px; font-weight: 500; cursor: pointer; position: relative; }
+      .dsh-cron-header { display: flex; justify-content: space-between; align-items: flex-start; gap: 12px; padding-bottom: 16px; border-bottom: 1px solid var(--dsw-alias-border-l2, #383838); }
+      .dsh-cron-title { font-size: 22px; font-weight: 700; letter-spacing: -0.02em; margin-bottom: 6px; }
+      .dsh-cron-subtitle { font-size: 14px; color: var(--dsw-alias-label-secondary, #9ca3af); line-height: 1.5; }
+      .dsh-cron-create-btn { appearance: none; display: inline-flex; align-items: center; gap: 6px; background: var(--dsw-alias-bg-layer-2, #262626); color: var(--dsw-alias-label-primary, #fff); border: 1px solid var(--dsw-alias-border-l2, #383838); border-radius: 9999px; padding: 8px 16px; font-size: 14px; font-weight: 500; cursor: pointer; position: relative; }
       .dsh-cron-create-btn:hover { background: var(--dsw-alias-bg-layer-hover, var(--dsw-alias-interactive-bg-hover, #333)); }
       .dsh-cron-dropdown { position: absolute; top: calc(100% + 6px); right: 0; width: 200px; background: var(--dsw-alias-bg-layer-3, #212121); border: 1px solid var(--dsw-alias-border-l2, #383838); border-radius: 12px; padding: 6px; box-shadow: 0 10px 25px rgba(0,0,0,0.5); z-index: 200; }
       .dsh-cron-dropdown-item { display: flex; align-items: center; gap: 10px; width: 100%; padding: 10px 12px; background: transparent; border: none; border-radius: 8px; color: var(--dsw-alias-label-primary, #ededed); font-size: 13.5px; text-align: left; cursor: pointer; }
       .dsh-cron-dropdown-item:hover { background: var(--dsw-alias-interactive-bg-hover, #2a2a2a); }
-      .dsh-cron-search-bar { position: relative; margin-bottom: 20px; }
-      .dsh-cron-search-input { width: 100%; background: var(--dsw-alias-bg-layer-3, #1f1f1f); border: 1px solid var(--dsw-alias-border-l2, #333); border-radius: 10px; padding: 10px 14px 10px 38px; color: var(--dsw-alias-label-primary, inherit); font-size: 14px; outline: none; box-sizing: border-box; }
+      .dsh-cron-search-bar { position: relative; margin-bottom: 0; }
+      .dsh-cron-search-input { width: 100%; height: 36px; background: var(--dsw-alias-bg-layer-2, #1f1f1f); border: 1px solid var(--dsw-alias-border-l2, #333); border-radius: 8px; padding: 0 12px 0 38px; color: var(--dsw-alias-label-primary, inherit); font-size: 13px; outline: none; box-sizing: border-box; }
+      .dsh-cron-search-input:focus { outline: none; border-color: var(--dsh-cron-info); }
       .dsh-cron-search-icon { position: absolute; left: 12px; top: 50%; transform: translateY(-50%); color: var(--dsw-alias-label-tertiary, #666); }
-      .dsh-cron-tabs { display: flex; gap: 8px; margin-bottom: 24px; }
-      .dsh-cron-tab { appearance: none; background: transparent; border: none; padding: 6px 14px; border-radius: 9999px; color: var(--dsw-alias-label-secondary, #9ca3af); font-size: 13.5px; cursor: pointer; }
-      .dsh-cron-tab[data-active="true"] { background: var(--dsw-alias-bg-layer-4, #2a2a2a); color: var(--dsw-alias-label-primary, #fff); font-weight: 500; }
-      .dsh-cron-task-list { display: flex; flex-direction: column; gap: 12px; margin-bottom: 40px; }
+      .dsh-cron-tabs { display: flex; flex-wrap: wrap; gap: 8px; }
+      .dsh-cron-tab { appearance: none; background: transparent; border: 1px solid var(--dsw-alias-border-l2, #383838); padding: 4px 12px; border-radius: 999px; color: var(--dsw-alias-label-secondary, #9ca3af); font-size: 12px; font-weight: 500; cursor: pointer; }
+      .dsh-cron-tab[data-active="true"] { background: var(--dsw-alias-bg-layer-4, #2a2a2a); color: var(--dsw-alias-label-primary, #fff); border-color: var(--dsw-alias-label-dimmed, var(--dsw-alias-border-l2, #383838)); }
+      .dsh-cron-task-list { display: flex; flex-direction: column; gap: 12px; margin-bottom: 0; }
       .dsh-cron-task-item { display: flex; align-items: center; gap: 16px; padding: 14px 18px; background: var(--dsw-alias-bg-layer-3, #1e1e1e); border: 1px solid var(--dsw-alias-border-l2, #2e2e2e); border-radius: 12px; cursor: pointer; transition: background 0.15s, border-color 0.15s; }
-      .dsh-cron-task-item:hover, .dsh-cron-task-item:focus-visible { background: var(--dsw-alias-bg-layer-4, #242424); border-color: var(--dsw-alias-border-l1, #444); outline: none; }
-      .dsh-cron-task-prompt-preview { font-size: 12.5px; color: var(--dsw-alias-label-tertiary, #888); margin-top: 5px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; max-width: 520px; line-height: 1.3; }
-      .dsh-cron-type-tag { display: inline-block; font-size: 10.5px; padding: 1px 6px; border-radius: 4px; text-transform: uppercase; font-weight: 600; margin-left: 8px; vertical-align: middle; }
-      .dsh-cron-task-model-tag { display: inline-block; font-size: 11px; padding: 2px 7px; border-radius: 4px; background: var(--dsw-alias-interactive-bg-hover, rgba(255,255,255,0.06)); color: var(--dsw-alias-label-secondary, #aaa); margin-left: 8px; vertical-align: middle; }
+      .dsh-cron-task-item:hover, .dsh-cron-task-item:focus-visible { background: var(--dsw-alias-bg-layer-4, #242424); border-color: var(--dsw-alias-label-dimmed, var(--dsw-alias-border-l1, #444)); outline: none; }
+      .dsh-cron-task-prompt-preview { font-size: 12.5px; color: var(--dsw-alias-label-secondary, #888); margin-top: 5px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; max-width: 520px; line-height: 1.3; }
+      .dsh-cron-type-tag { display: inline-flex; align-items: center; font-size: 11px; padding: 2px 8px; border-radius: 999px; border: 1px solid var(--dsw-alias-border-l2, #383838); text-transform: uppercase; font-weight: 500; margin-left: 8px; vertical-align: middle; }
+      .dsh-cron-task-model-tag { display: inline-flex; align-items: center; font-size: 11px; padding: 2px 8px; border-radius: 999px; border: 1px solid var(--dsw-alias-border-l2, #383838); background: var(--dsw-alias-bg-layer-2, rgba(255,255,255,0.06)); color: var(--dsw-alias-label-secondary, #aaa); margin-left: 8px; vertical-align: middle; }
       .dsh-cron-task-actions { display: flex; gap: 8px; }
-      .dsh-cron-icon-btn { background: transparent; border: 1px solid var(--dsw-alias-border-l2, #333); border-radius: 8px; padding: 6px 12px; font-size: 12.5px; color: var(--dsw-alias-label-secondary, #aaa); cursor: pointer; }
-      .dsh-cron-icon-btn:hover { background: var(--dsw-alias-interactive-bg-hover, #2a2a2a); color: var(--dsw-alias-label-primary, #fff); }
-      .dsh-cron-task-status-btn { background: none; border: 1px solid var(--dsw-alias-border-l1, #444); border-radius: 50%; width: 28px; height: 28px; display: flex; align-items: center; justify-content: center; color: var(--dsw-alias-label-tertiary, #888); cursor: pointer; flex-shrink: 0; }
+      .dsh-cron-icon-btn { appearance: none; font: inherit; background: var(--dsw-alias-bg-layer-2, transparent); border: 1px solid var(--dsw-alias-border-l2, #333); border-radius: 8px; padding: 6px 12px; font-size: 12.5px; font-weight: 500; color: var(--dsw-alias-label-primary, #aaa); cursor: pointer; display: inline-flex; align-items: center; gap: 6px; transition: all 0.15s ease; }
+      .dsh-cron-icon-btn:hover { background: var(--dsw-alias-bg-layer-4, #2a2a2a); border-color: var(--dsw-alias-label-dimmed, var(--dsw-alias-border-l2, #444)); }
+      .dsh-cron-icon-btn.dsh-cron-danger { color: var(--dsh-cron-danger); border-color: var(--dsh-cron-danger-bg); }
+      .dsh-cron-icon-btn.dsh-cron-danger:hover { background: var(--dsh-cron-danger-bg); border-color: var(--dsh-cron-danger); }
+      .dsh-cron-task-status-btn { background: none; border: 1px solid var(--dsw-alias-border-l2, #444); border-radius: 50%; width: 28px; height: 28px; display: flex; align-items: center; justify-content: center; color: var(--dsw-alias-label-tertiary, #888); cursor: pointer; flex-shrink: 0; }
       .dsh-cron-task-status-btn[data-active="true"] { color: var(--dsh-cron-success); border-color: var(--dsh-cron-success); }
-      .dsh-cron-recs-title { font-size: 17px; font-weight: 600; margin-bottom: 14px; }
+      .dsh-cron-recs-title { font-size: 16px; font-weight: 600; margin-bottom: 14px; }
       .dsh-cron-recs-list { display: flex; flex-direction: column; gap: 10px; }
-      .dsh-cron-rec-card { display: flex; align-items: center; gap: 16px; padding: 16px 20px; background: var(--dsw-alias-bg-layer-3, #1c1c1c); border: 1px solid var(--dsw-alias-border-l1, #282828); border-radius: 12px; cursor: pointer; transition: background 0.15s; }
-      .dsh-cron-rec-card:hover, .dsh-cron-rec-card:focus-visible { background: var(--dsw-alias-bg-layer-4, #242424); border-color: var(--dsw-alias-border-l2, #383838); outline: none; }
-      .dsh-cron-rec-icon { width: 36px; height: 36px; border-radius: 10px; background: var(--dsw-alias-interactive-bg-hover, rgba(255,255,255,0.03)); display: flex; align-items: center; justify-content: center; flex-shrink: 0; }
+      .dsh-cron-rec-card { display: flex; align-items: center; gap: 16px; padding: 14px 18px; background: var(--dsw-alias-bg-layer-3, #1c1c1c); border: 1px solid var(--dsw-alias-border-l2, #282828); border-radius: 12px; cursor: pointer; transition: background 0.15s; }
+      .dsh-cron-rec-card:hover, .dsh-cron-rec-card:focus-visible { background: var(--dsw-alias-bg-layer-4, #242424); border-color: var(--dsw-alias-label-dimmed, var(--dsw-alias-border-l2, #383838)); outline: none; }
+      .dsh-cron-rec-icon { width: 36px; height: 36px; border-radius: 10px; background: var(--dsw-alias-bg-layer-2, rgba(255,255,255,0.03)); display: flex; align-items: center; justify-content: center; flex-shrink: 0; }
       .dsh-cron-rec-content { flex: 1; min-width: 0; }
       .dsh-cron-rec-title { font-size: 14.5px; font-weight: 500; margin-bottom: 4px; }
       .dsh-cron-rec-time { font-size: 13px; color: var(--dsw-alias-label-secondary, #9ca3af); font-weight: normal; margin-left: 8px; }
@@ -255,14 +305,17 @@ window.__ModuleLoader__.load({
       .dsh-cron-modal-title { font-size: 18px; font-weight: 600; margin-bottom: 18px; }
       .dsh-cron-form-group { margin-bottom: 16px; }
       .dsh-cron-form-group label { display: block; font-size: 13px; color: var(--dsw-alias-label-secondary, #aaa); margin-bottom: 6px; }
-      .dsh-cron-form-group input, .dsh-cron-form-group textarea, .dsh-cron-form-group select { width: 100%; background: var(--dsw-alias-bg-base, #141414); border: 1px solid var(--dsw-alias-border-l2, #333); border-radius: 8px; padding: 9px 12px; color: var(--dsw-alias-label-primary, #fff); font-size: 13.5px; outline: none; box-sizing: border-box; }
+      .dsh-cron-form-group input, .dsh-cron-form-group textarea, .dsh-cron-form-group select { width: 100%; background: var(--dsw-alias-bg-layer-2, #141414); border: 1px solid var(--dsw-alias-border-l2, #333); border-radius: 8px; padding: 8px 12px; color: var(--dsw-alias-label-primary, #fff); font-size: 13px; outline: none; box-sizing: border-box; }
+      .dsh-cron-form-group input:focus, .dsh-cron-form-group textarea:focus, .dsh-cron-form-group select:focus { outline: none; border-color: var(--dsh-cron-info); }
       .dsh-cron-form-group select { cursor: pointer; }
       .dsh-cron-form-group textarea { min-height: 80px; resize: vertical; }
       .dsh-cron-form-row { display: grid; grid-template-columns: 1fr 1fr; gap: 12px; }
       .dsh-cron-modal-foot { display: flex; justify-content: flex-end; align-items: center; gap: 10px; margin-top: 20px; }
-      .dsh-cron-btn-primary { background: var(--dsw-alias-label-primary, #ededed); color: var(--dsw-alias-bg-base, #111); border: none; border-radius: 8px; padding: 7px 16px; font-size: 13.5px; font-weight: 500; cursor: pointer; display: inline-flex; align-items: center; gap: 6px; }
+      .dsh-cron-btn-primary { background: var(--dsw-alias-label-primary, #ededed); color: var(--dsw-alias-bg-layer-3, #111); border: 1px solid transparent; border-radius: 8px; padding: 7px 14px; font-size: 13px; font-weight: 500; cursor: pointer; display: inline-flex; align-items: center; gap: 6px; }
+      .dsh-cron-btn-primary:hover:not(:disabled) { opacity: 0.88; }
       .dsh-cron-btn-primary:disabled { opacity: 0.5; cursor: not-allowed; }
-      .dsh-cron-btn-secondary { background: transparent; color: var(--dsw-alias-label-secondary, #999); border: 1px solid var(--dsw-alias-border-l2, #383838); border-radius: 8px; padding: 7px 16px; font-size: 13.5px; cursor: pointer; }
+      .dsh-cron-btn-secondary { appearance: none; font: inherit; background: var(--dsw-alias-bg-layer-2, transparent); color: var(--dsw-alias-label-primary, #999); border: 1px solid var(--dsw-alias-border-l2, #383838); border-radius: 8px; padding: 7px 14px; font-size: 13px; font-weight: 500; cursor: pointer; display: inline-flex; align-items: center; gap: 6px; transition: all 0.15s ease; }
+      .dsh-cron-btn-secondary:hover:not(:disabled) { background: var(--dsw-alias-bg-layer-4, #2a2a2a); border-color: var(--dsw-alias-label-dimmed, var(--dsw-alias-border-l2, #444)); }
       .dsh-cron-chat-box { position: relative; background: var(--dsw-alias-bg-base, #141414); border: 1px solid var(--dsw-alias-border-l2, #333); border-radius: 12px; padding: 12px; }
       .dsh-cron-chat-input { width: 100%; background: transparent; border: none; color: var(--dsw-alias-label-primary, #fff); font-size: 14px; min-height: 100px; resize: vertical; outline: none; box-sizing: border-box; line-height: 1.5; }
       .dsh-cron-chat-foot { display: flex; justify-content: space-between; align-items: center; margin-top: 8px; padding-top: 8px; border-top: 1px solid var(--dsw-alias-border-l1, #222); }
@@ -271,10 +324,15 @@ window.__ModuleLoader__.load({
       .dsh-cron-send-btn:hover:not(:disabled) { transform: translateY(-1px); }
       .dsh-cron-send-btn:disabled { opacity: 0.4; cursor: not-allowed; }
 
-      .dsh-cron-card { background: var(--dsw-alias-bg-layer-2, #1f1f1f); border: 1px solid var(--dsw-alias-border-l1, #333); border-radius: 12px; padding: 18px 20px; margin-bottom: 16px; }
+      .dsh-cron-card { background: var(--dsw-alias-bg-layer-3, #1f1f1f); border: 1px solid var(--dsw-alias-border-l2, #333); border-radius: 12px; padding: 18px 20px; margin-bottom: 0; display: flex; flex-direction: column; gap: 14px; }
+      .dsh-cron-card-head-btn { appearance: none; width: 100%; font: inherit; color: inherit; text-align: left; cursor: pointer; background: 0 0; border: 0; border-radius: 12px; display: flex; align-items: center; gap: 12px; padding: 0; }
+      .dsh-cron-card-head-btn .dsh-cron-card-title { flex: 1; }
+      .dsh-cron-card-title { font-size: 16px; font-weight: 600; color: var(--dsw-alias-label-primary, #fff); }
+      .dsh-cron-chev { margin-left: auto; flex: none; color: var(--dsw-alias-label-tertiary, #888); transition: transform 0.16s; display: flex; align-items: center; }
+      .dsh-cron-chev-open { transform: rotate(180deg); }
+      .dsh-cron-card-body { border-top: 1px solid var(--dsw-alias-border-l2, #333); margin-top: 2px; padding-top: 14px; }
       .dsh-cron-card-head { display: flex; justify-content: space-between; align-items: center; margin-bottom: 12px; }
-      .dsh-cron-card-title { font-size: 15px; font-weight: 600; color: var(--dsw-alias-label-primary, #fff); }
-      .dsh-cron-card-desc { font-size: 13px; color: var(--dsw-alias-label-secondary, #888); margin-bottom: 16px; line-height: 1.4; }
+      .dsh-cron-card-desc { font-size: 13px; color: var(--dsw-alias-label-secondary, #888); line-height: 1.4; }
 
       .dsh-cron-modal-nav { display: flex; gap: 4px; border-bottom: 1px solid var(--dsw-alias-border-l2, #2e2e2e); margin-bottom: 18px; padding-bottom: 2px; }
       .dsh-cron-modal-tab { appearance: none; background: transparent; border: none; border-bottom: 2px solid transparent; padding: 8px 14px; font-size: 13.5px; color: var(--dsw-alias-label-tertiary, #888); cursor: pointer; font-weight: 500; transition: color 0.15s, border-color 0.15s; }
@@ -283,21 +341,21 @@ window.__ModuleLoader__.load({
       .dsh-cron-history-list { display: flex; flex-direction: column; gap: 10px; max-height: 420px; overflow-y: auto; padding-right: 4px; }
       .dsh-cron-history-item { background: var(--dsw-alias-bg-base, #161616); border: 1px solid var(--dsw-alias-border-l1, #2a2a2a); border-radius: 8px; padding: 12px 14px; font-size: 12.5px; }
       .dsh-cron-history-head { display: flex; justify-content: space-between; align-items: center; margin-bottom: 6px; }
-      .dsh-cron-history-status { font-weight: 600; font-size: 11.5px; text-transform: uppercase; padding: 2px 6px; border-radius: 4px; }
-      .dsh-cron-history-status[data-status="success"] { background: var(--dsh-cron-success-bg); color: var(--dsh-cron-success); }
-      .dsh-cron-history-status[data-status="error"], .dsh-cron-history-status[data-status="timeout"] { background: var(--dsh-cron-danger-bg); color: var(--dsh-cron-danger); }
-      .dsh-cron-history-status[data-status="skipped"], .dsh-cron-history-status[data-status="missed"] { background: var(--dsh-cron-warning-bg); color: var(--dsh-cron-warning); }
+      .dsh-cron-history-status { font-weight: 500; font-size: 11px; text-transform: uppercase; padding: 2px 8px; border-radius: 999px; border: 1px solid var(--dsw-alias-border-l2, #383838); }
+      .dsh-cron-history-status[data-status="success"] { background: var(--dsh-cron-success-bg); color: var(--dsh-cron-success); border-color: var(--dsh-cron-success); }
+      .dsh-cron-history-status[data-status="error"], .dsh-cron-history-status[data-status="timeout"] { background: var(--dsh-cron-danger-bg); color: var(--dsh-cron-danger); border-color: var(--dsh-cron-danger); }
+      .dsh-cron-history-status[data-status="skipped"], .dsh-cron-history-status[data-status="missed"] { background: var(--dsh-cron-warning-bg); color: var(--dsh-cron-warning); border-color: var(--dsh-cron-warning); }
       .dsh-cron-history-time { color: var(--dsw-alias-label-tertiary, #777); font-size: 12px; }
       .dsh-cron-history-output { background: var(--dsw-alias-bg-base, #0c0c0c); border: 1px solid var(--dsw-alias-border-l1, #222); border-radius: 6px; padding: 8px 10px; font-family: monospace; font-size: 12px; color: var(--dsw-alias-label-secondary, #bbb); max-height: 140px; overflow-y: auto; white-space: pre-wrap; word-break: break-all; margin-top: 6px; }
       .dsh-cron-history-empty { text-align: center; padding: 36px 0; color: var(--dsw-alias-label-tertiary, #666); font-size: 13.5px; }
 
-      .dsh-cron-stats-bar { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px; margin-bottom: 18px; }
-      .dsh-cron-stat-card { background: var(--dsw-alias-bg-layer-3, rgba(255, 255, 255, 0.02)); border: 1px solid var(--dsw-alias-border-l1, #222); border-radius: 8px; padding: 10px 14px; }
-      .dsh-cron-stat-val { font-size: 16px; font-weight: 600; color: var(--dsw-alias-label-primary, #fff); }
-      .dsh-cron-stat-lbl { font-size: 11.5px; color: var(--dsw-alias-label-tertiary, #777); margin-top: 2px; }
-      .dsh-cron-oneshot-tag { font-size: 11px; padding: 2px 6px; border-radius: 4px; background: var(--dsh-cron-accent-bg); color: var(--dsh-cron-accent); font-weight: 500; }
-      .dsh-cron-cost-tag { font-size: 11px; padding: 2px 6px; border-radius: 4px; background: var(--dsh-cron-success-bg); color: var(--dsh-cron-success); font-weight: 500; }
-      .dsh-cron-tokens-tag { font-size: 11px; padding: 2px 6px; border-radius: 4px; background: var(--dsh-cron-info-bg); color: var(--dsh-cron-info); }
+      .dsh-cron-stats-bar { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); gap: 10px; margin-bottom: 0; }
+      .dsh-cron-stat-card { background: var(--dsw-alias-bg-layer-2, rgba(255, 255, 255, 0.02)); border: 1px solid var(--dsw-alias-border-l2, #222); border-radius: 8px; padding: 12px 14px; display: flex; flex-direction: column; gap: 4px; }
+      .dsh-cron-stat-val { font-size: 18px; font-weight: 700; color: var(--dsw-alias-label-primary, #fff); }
+      .dsh-cron-stat-lbl { font-size: 12px; color: var(--dsw-alias-label-secondary, #777); margin-top: 0; }
+      .dsh-cron-oneshot-tag { display: inline-flex; align-items: center; font-size: 11px; padding: 2px 8px; border-radius: 999px; border: 1px solid var(--dsh-cron-accent); background: var(--dsh-cron-accent-bg); color: var(--dsh-cron-accent); font-weight: 500; }
+      .dsh-cron-cost-tag { display: inline-flex; align-items: center; font-size: 11px; padding: 2px 8px; border-radius: 999px; border: 1px solid var(--dsh-cron-success); background: var(--dsh-cron-success-bg); color: var(--dsh-cron-success); font-weight: 500; }
+      .dsh-cron-tokens-tag { display: inline-flex; align-items: center; font-size: 11px; padding: 2px 8px; border-radius: 999px; border: 1px solid var(--dsh-cron-info); background: var(--dsh-cron-info-bg); color: var(--dsh-cron-info); }
       .dsh-cron-checkbox-row { display: flex; align-items: center; gap: 8px; font-size: 13px; color: var(--dsw-alias-label-secondary, #ccc); cursor: pointer; user-select: none; }
       .dsh-cron-checkbox-row input { width: 15px; height: 15px; margin: 0; cursor: pointer; accent-color: var(--dsw-alias-label-primary, #ededed); }
       .dsh-cron-hint { font-size: 12px; color: var(--dsw-alias-label-tertiary, #888); margin-top: 4px; }
@@ -930,7 +988,7 @@ window.__ModuleLoader__.load({
                       }, React.createElement('span', svgProps(ICON_EDIT))),
                       React.createElement('button', {
                         type: 'button',
-                        className: 'dsh-cron-icon-btn',
+                        className: 'dsh-cron-icon-btn dsh-cron-danger',
                         title: T_KEY(t, 'actions.delete'),
                         'aria-label': T_KEY(t, 'actions.delete'),
                         onClick: () => handleDelete(task.id)
@@ -1355,24 +1413,36 @@ window.__ModuleLoader__.load({
       const [hasDefault, setHasDefault] = React.useState(false);
       const [saved, setSaved] = React.useState(false);
       const [testInfo, setTestInfo] = React.useState(null);
+      // Collapsed by default, head is the toggle (canonical card contract, #100)
+      const [cardOpen, setCardOpen] = React.useState(false);
+
+      // Settings snapshot status (#102): never render phantom inputs before
+      // the snapshot arrives; offer a retry when it is unavailable.
+      const [loadState, setLoadState] = React.useState('loading');
+      const [reloadTick, setReloadTick] = React.useState(0);
 
       React.useEffect(() => {
         let active = true;
+        setLoadState('loading');
         fetch('/dsh-cron/settings')
           .then(r => r.json())
           .then(data => {
-            if (active && data && data.ok && data.settings) {
+            if (!active) return;
+            if (data && data.ok && data.settings) {
               setToken(data.settings.botToken || '');
               setChatId(data.settings.chatId || '');
               setNotify(Boolean(data.settings.notifyTelegram));
               setOnlyFailure(Boolean(data.settings.onlyOnFailure));
               setKanbanUrl(data.settings.kanbanBaseUrl || 'http://127.0.0.1:3000');
               setHasDefault(Boolean(data.settings.hasDefaultCredentials));
+              setLoadState('ready');
+            } else {
+              setLoadState('error');
             }
           })
-          .catch(() => {});
+          .catch(() => { if (active) setLoadState('error'); });
         return () => { active = false; };
-      }, []);
+      }, [reloadTick]);
 
       const saveSettings = async (e) => {
         if (e) e.preventDefault();
@@ -1434,19 +1504,44 @@ window.__ModuleLoader__.load({
         }
       };
 
+      if (loadState !== 'ready') {
+        return React.createElement('div', { className: 'dsh-cron-card' },
+          React.createElement('div', { className: 'dsh-cron-card-title' }, T_KEY(t, 'settings.cardTitle')),
+          React.createElement('div', {
+            className: 'dsh-cron-status-banner',
+            'data-type': loadState === 'error' ? 'error' : 'info',
+            style: { marginTop: '10px', display: 'flex', justifyContent: 'space-between', alignItems: 'center', gap: '10px' }
+          },
+            React.createElement('span', null, loadState === 'error' ? T_KEY(t, 'settings.unavailable') : T_KEY(t, 'settings.loading')),
+            loadState === 'error' && React.createElement('button', {
+              type: 'button',
+              className: 'dsh-cron-btn-secondary',
+              onClick: () => setReloadTick(x => x + 1)
+            }, T_KEY(t, 'settings.retry'))
+          )
+        );
+      }
+
       return React.createElement('div', { className: 'dsh-cron-card' },
-        React.createElement('div', { className: 'dsh-cron-card-head' },
+        React.createElement('button', {
+          type: 'button',
+          className: 'dsh-cron-card-head-btn',
+          'aria-expanded': cardOpen ? 'true' : 'false',
+          onClick: () => setCardOpen(!cardOpen)
+        },
           React.createElement('span', { className: 'dsh-cron-card-title' }, T_KEY(t, 'settings.cardTitle')),
-          React.createElement('button', {
-            type: 'button',
-            className: 'dsh-cron-btn-primary',
-            onClick: () => { if (toggle) toggle.set(true); }
-          }, T_KEY(t, 'settings.openPanel'))
-        ),
-        React.createElement('div', { className: 'dsh-cron-card-desc', style: { marginBottom: '16px' } },
-          T_KEY(t, 'settings.cardDesc')
+          React.createElement('span', { className: 'dsh-cron-chev' + (cardOpen ? ' dsh-cron-chev-open' : '') }, chevronNode())
         ),
-        React.createElement('form', { onSubmit: saveSettings, style: { display: 'flex', flexDirection: 'column', gap: '12px' } },
+        cardOpen && React.createElement('div', { className: 'dsh-cron-card-body' },
+          React.createElement('div', { className: 'dsh-cron-card-desc' }, T_KEY(t, 'settings.cardDesc')),
+          React.createElement('div', { style: { display: 'flex', justifyContent: 'flex-end', marginBottom: '12px' } },
+            React.createElement('button', {
+              type: 'button',
+              className: 'dsh-cron-btn-primary',
+              onClick: () => { if (toggle) toggle.set(true); }
+            }, T_KEY(t, 'settings.openPanel'))
+          ),
+          React.createElement('form', { onSubmit: saveSettings, style: { display: 'flex', flexDirection: 'column', gap: '12px' } },
           React.createElement('div', { className: 'dsh-cron-form-group', style: { marginBottom: 0 } },
             React.createElement('label', null, T_KEY(t, 'settings.tokenLabel')),
             React.createElement('input', {
@@ -1516,7 +1611,8 @@ window.__ModuleLoader__.load({
             }, T_KEY(t, 'settings.testKanban'))
           )
         )
-      );
+      )
+    );
     }
 
     function nativeButton() {
@@ -1613,7 +1709,7 @@ window.__ModuleLoader__.load({
         column.appendChild(container);
         if (ReactDOM && typeof ReactDOM.createRoot === 'function') {
           root = ReactDOM.createRoot(container);
-          root.render(React.createElement(CronScreen, { ctx, toggle, onClose: () => toggle.set(false), t: translate }));
+          root.render(React.createElement(ErrorBoundary, null, React.createElement(CronScreen, { ctx, toggle, onClose: () => toggle.set(false), t: translate })));
         } else if (ReactDOM && typeof ReactDOM.render === 'function') {
           ReactDOM.render(React.createElement(CronScreen, { ctx, toggle, onClose: () => toggle.set(false), t: translate }), container);
         }
@@ -1696,23 +1792,20 @@ window.__ModuleLoader__.load({
 
       const toggle = createToggle();
 
+      // The settings card lives ONLY in the plugins settings tab (#102): no
+      // top-level section fallback — the flat sidebar list is a shared core
+      // resource, and the card slot is proven on current builds (#85).
+      function SettingsCardWithBoundary(props) {
+        return React.createElement(ErrorBoundary, null, CronSettingsCard(props));
+      }
       const cardOk = registerIntoMount(ctx, 'settings.plugin.item', {
         name: 'settings.plugin.item',
         key: NS,
         locale: NS,
         inject: () => ({ ctx, toggle }),
-      }, CronSettingsCard);
+      }, SettingsCardWithBoundary);
       if (!cardOk) {
-        // Fallback for builds without the settings.plugin.item mount: a
-        // dedicated section so the settings are never lost (#85).
-        registerIntoMount(ctx, 'settings.section', {
-          name: 'settings.section',
-          id: PLUGIN_ID,
-          order: 34,
-          locale: NS,
-          label: () => translate('settings.sectionLabel'),
-          inject: () => ({ ctx, toggle }),
-        }, CronSettingsCard);
+        console.warn('[dsh-cron] settings.plugin.item slot unavailable — settings card not registered');
       }
 
       const chipOk = registerIntoMount(ctx, 'conversation.session.header.utilities', {
@@ -1722,7 +1815,7 @@ window.__ModuleLoader__.load({
         locale: NS,
         inject: () => ({ ctx, toggle }),
       }, CronChip);
-      const cardSlot = cardOk ? 'settings.plugin.item' : 'settings.section';
+      const cardSlot = cardOk ? 'settings.plugin.item' : undefined;
       const chipSlot = chipOk ? 'conversation.session.header.utilities' : undefined;
 
       function CronChip(props) {

package/lib/http-utils.js

@@ -8,12 +8,15 @@ export const MAX_BODY_BYTES = 1024 * 1024;
 export const SCRIPT_CONFIRM_HEADER = 'x-dsh-cron-confirm';
 
 /**
- * Parse a JSON request body with a hard size cap.
+ * Parse a JSON request body with a hard byte size cap.
+ * Chunks are accumulated as Buffers so multi-byte UTF-8 characters split
+ * across chunk boundaries decode correctly (#106, #97 follow-up).
  * Rejects with err.statusCode = 413 when the body exceeds the limit.
  */
 export function parseJsonBody(req, limit = MAX_BODY_BYTES) {
   return new Promise((resolve, reject) => {
-    let data = '';
+    const chunks = [];
+    let bytes = 0;
     let settled = false;
     const fail = (err) => {
       if (settled) return;
@@ -22,17 +25,20 @@ export function parseJsonBody(req, limit = MAX_BODY_BYTES) {
     };
     req.on('data', (chunk) => {
       if (settled) return;
-      data += chunk;
-      if (data.length > limit) {
+      const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      bytes += buf.length;
+      if (bytes > limit) {
         fail(Object.assign(new Error('Request body exceeds the allowed size'), { statusCode: 413 }));
         req.destroy();
+        return;
       }
+      chunks.push(buf);
     });
     req.on('end', () => {
       if (settled) return;
       settled = true;
       try {
-        resolve(data ? JSON.parse(data) : {});
+        resolve(chunks.length ? JSON.parse(Buffer.concat(chunks).toString('utf8')) : {});
       } catch (err) {
         reject(err);
       }

package/lib/index.js

@@ -66,6 +66,37 @@ async function readBody(req, res) {
   }
 }
 
+/**
+ * Apply settings writes through the registered settings scope so the core
+ * snapshot stays authoritative (#102). Returns null when the settings
+ * service is unavailable (headless profiles fall back to store-only writes).
+ */
+export async function applySettingsToScope(settingsScope, body) {
+  if (!settingsScope || typeof settingsScope.set !== 'function') return null;
+  const errors = [];
+  for (const key of ['botToken', 'chatId', 'notifyTelegram', 'onlyOnFailure', 'kanbanBaseUrl']) {
+    if (!Object.prototype.hasOwnProperty.call(body, key)) continue;
+    try {
+      await settingsScope.set(key, body[key]);
+    } catch (e) {
+      errors.push(key + ': ' + ((e && e.message) || e));
+    }
+  }
+  return errors;
+}
+
+/**
+ * Drop values that must never re-enter the store from the client: a masked
+ * secret echoed back by the settings UI would overwrite the real token.
+ */
+export function sanitizeSettingsPayload(body) {
+  const payload = Object.assign({}, body);
+  if (typeof payload.botToken === 'string' && (payload.botToken.includes('••') || payload.botToken.includes('****'))) {
+    delete payload.botToken;
+  }
+  return payload;
+}
+
 /**
  * Shared implementation for the /dsh-cron/tasks... and /dsh-cron/action...
  * route families — the #66 alias is kept alive by the same code path instead
@@ -73,9 +104,9 @@ async function readBody(req, res) {
  *
  * IMPORTANT: prefix routes must be registered WITHOUT a trailing slash —
  * with one, the core degrades matching to exact-path equality and every
- * deeper path unrouted (#96).
+ * deeper path unrouted (#96). Exported for unit tests.
  */
-function createCronApiHandler(store, scheduler, collection) {
+export function createCronApiHandler(store, scheduler, collection) {
   return async function handleCronApi(req, res) {
     try {
       const url = new URL(req.url, 'http://127.0.0.1');
@@ -155,6 +186,10 @@ function createCronApiHandler(store, scheduler, collection) {
       }
 
       if (req.method === 'POST' && action === 'run') {
+        if (!store.get(id)) {
+          sendJson(res, 404, { ok: false, error: 'Task not found' });
+          return;
+        }
         await scheduler.triggerManualRun(id);
         sendJson(res, 200, { ok: true, task: store.get(id) });
         return;
@@ -240,9 +275,9 @@ function createCronApiHandler(store, scheduler, collection) {
 
 /**
  * Single implementation behind the cron_create_task / cron_schedule_task
- * alias pair (#70, #92).
+ * alias pair (#70, #92). Exported for unit tests.
  */
-function executeCreateTask(store, scheduler, args) {
+export function executeCreateTask(store, scheduler, args) {
   const taskType = args.type === 'script' ? 'script' : 'llm';
   const parsed = parseScheduleExpression(args.schedule);
   const task = store.set({
@@ -303,19 +338,26 @@ export function apply(ctx, config) {
   const runner = new SessionRunner(ctx);
   const scheduler = new TaskScheduler(store, (task, opts) => runner.execute(task, opts));
 
-  // Register settings in Harness settings service with Config schema and initial state from store (#71)
+  // Register settings in the Harness settings service (#71, #102): the scope
+  // is the source of truth for the core, scope.watch mirrors values into the
+  // plugin store, and REST writes go through scope.set so nothing bypasses
+  // the settings service.
+  let cronSettingsScope = null;
   ctx.inject(['settings'], (sctx) => {
     try {
-      const scope = sctx.settings?.register?.('dsh-cron', Config, {
+      cronSettingsScope = sctx.settings.register('dsh-cron', Config, {
         base: store.getSettings()
       });
-      if (scope && typeof scope.watch === 'function') {
-        scope.watch((updated) => {
+      if (cronSettingsScope && typeof cronSettingsScope.watch === 'function') {
+        cronSettingsScope.watch((updated) => {
           if (updated && typeof updated === 'object') {
             store.saveSettings(updated);
           }
         });
       }
+      sctx.effect(() => () => {
+        cronSettingsScope = null;
+      });
     } catch (e) {
       console.warn('[dsh-cron] settings registration warning:', e.message);
     }
@@ -407,8 +449,14 @@ export function apply(ctx, config) {
           if (rejectCrossOrigin(req, res)) return;
           const { body, error } = await readBody(req, res);
           if (error) return;
-          store.saveSettings(body);
-          sendJson(res, 200, { ok: true, settings: store.getClientSettings() });
+          // Masked secrets echoed back by the client must never overwrite the
+          // stored token (store.saveSettings guards this too, #86-era).
+          const payload = sanitizeSettingsPayload(body);
+          const scopeErrors = await applySettingsToScope(cronSettingsScope, payload);
+          if (scopeErrors === null) {
+            store.saveSettings(payload);
+          }
+          sendJson(res, 200, { ok: true, settings: store.getClientSettings(), scopeErrors: scopeErrors || undefined });
           return;
         }
         sendJson(res, 405, { ok: false, error: 'Method not allowed' });

package/lib/scheduler.js

@@ -434,40 +434,7 @@ export class TaskScheduler {
     }
   }
 
-  removeTask(taskId) {
-    if (this.jobs.has(taskId)) {
-      this.jobs.get(taskId).stop();
-      this.jobs.delete(taskId);
-    }
-    if (this.timers.has(taskId)) {
-      clearTimeout(this.timers.get(taskId));
-      this.timers.delete(taskId);
-    }
-    const running = this.running.get(taskId);
-    if (running) {
-      try {
-        running.controller.abort(new Error('Task deleted'));
-      } catch {}
-      this.running.delete(taskId);
-    }
-    return this.store.delete(taskId);
-  }
-
   triggerManualRun(taskId) {
     return this.runTask(taskId);
   }
-
-  getNextRun(schedule) {
-    try {
-      const parsed = parseScheduleExpression(schedule);
-      if (parsed.isOneShot) {
-        return parsed.targetTimestamp;
-      }
-      const tempJob = new Cron(parsed.cronPattern);
-      const next = tempJob.nextRun();
-      return next ? next.getTime() : null;
-    } catch {
-      return null;
-    }
-  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cron",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Scheduled cron tasks, background automation and agent execution for DeepSeek Harness.",
   "type": "module",
   "main": "lib/index.js",