@goodandready/dsh-cron 0.2.14 → 0.2.16

package/README.md

@@ -382,6 +382,22 @@ Developer-facing, no behaviour change. `parseScheduleExpression` was split into
 
 ---
 
+### 27. Modal Dialog Viewport Bounds & Package Hygiene (v0.2.15, #153, #148, #151, #152)
+- **Viewport Height Bounding & Sticky Footer**: Modal forms (including task creation, editing, and ready recipe presets) now strictly respect viewport boundaries with `max-height: min(90vh, calc(100vh - 36px))` and smooth internal scrolling. The modal action footer (`Cancel`, `Save`, `Create`) is pinned via sticky positioning (`position: sticky`), guaranteeing that critical buttons remain immediately accessible and never clipped regardless of form complexity or display scale.
+- **Overlay Scroll Protection**: Modal overlays now provide safe viewport padding and overflow handling (`overflow-y: auto`), preventing flexbox centering clipping on small screens.
+- **Package Weight Optimization**: Removed redundant documentation duplicates from npm distribution files, trimming tarball weight by over 32 kB and unpacked size by ~102 kB.
+- **Cordis Client Inject Compliance**: Explicitly declared `locale` and `slots` dependencies in `package.json` client injection manifest (`dsh.client.inject`).
+
+---
+
+
+
+### 28. In-App One-Click Auto-Updater & Error Resilience (v0.2.16, #147, #155, #156)
+- **Plugin Self-Updater (#147)**: Added in-app one-click self-updating module (`lib/updater.js`) with `/api/dsh-cron/update` endpoint and dedicated Settings UI card. Automatically queries npm registry, compares semver versions including pre-releases, and upgrades `@goodandready/dsh-cron` in-place through the DSH CLI without manual SSH sessions. POST updates are protected via origin validation (`rejectCrossOrigin`).
+- **Silent Failure Elimination (#156)**: Replaced silent empty catches with diagnostic logging: uncompleted import transaction rollbacks are surfaced to system logs with warning severity, dynamic core module fallback reasons are logged, and session opening failures inform the user with actionable notifications.
+- **Dead Code & Export Hygiene (#155)**: Cleaned unused legacy helpers (`CHANNEL_LABELS`, `makeInspectAsk`), stripped unnecessary exports from 16 internal modules, and wired `supportsSilentRule` directly into execution pipeline.
+
+---
 
 ## 📦 Installation
 
@@ -494,6 +510,7 @@ All endpoints are served by the DSH web server under `/dsh-cron/`. Read endpoint
 | `POST` | `/dsh-cron/kanban/test` | Create a Kanban connectivity-test card |
 | `*` | `/dsh-cron/action/:id/:action` | Legacy alias for the task action routes (`run`, `toggle`, `delete`, `history`) |
 | `GET` | `/dsh-cron/metrics` | Prometheus text exposition of task and run counters — never prompts or output (#53) |
+| `GET` / `POST` | `/api/dsh-cron/update` | One-click plugin self-updater: query registry version and in-place upgrade (#147) |
 | `GET` / `POST` | `/dsh-cron/api/tasks` | External token-guarded surface: list / create-or-update (#54) |
 | `GET` / `DELETE` | `/dsh-cron/api/tasks/:id` | External token-guarded surface: read / delete (#54) |
 | `POST` | `/dsh-cron/api/tasks/:id/run` | External token-guarded surface: force a run (#54) |

package/README.ru.md

@@ -258,6 +258,22 @@ cron_create_task({
 
 ---
 
+### 27. Ограничение высоты модальных окон и гигиена пакета (v0.2.15, #153, #148, #151, #152)
+- **Ограничение по высоте экрана и липкий подвал**: Модальные окна (включая создание, редактирование и готовые шаблоны-рецепты) теперь строго ограничены высотой экрана `max-height: min(90vh, calc(100vh - 36px))` с плавным внутренним скроллом. Подвал окна с кнопками («Отмена», «Сохранить», «Создать») закреплён через `position: sticky`, гарантируя постоянную доступность кнопок действий при любой длине формы и любом разрешении экрана.
+- **Защита оверлея от вылетов**: Оверлей модального окна получил безопасные отступы и свойство `overflow-y: auto`, исключая срезание контента при flexbox-центрировании на компактных дисплеях.
+- **Оптимизация размера npm-пакета**: Удалены дублирующие файлы документации из списка дистрибуции npm, снизив вес архива более чем на 32 kB, а распакованный размер — на 102 kB.
+- **Соответствие манифеста клиента Cordis**: В `package.json` явно задекларированы зависимости инжекции `locale` и `slots` в секции `dsh.client.inject`.
+
+---
+
+
+
+### 28. Модуль самообновления в 1 клик и устойчивость к ошибкам (v0.2.16, #147, #155, #156)
+- **Самообновление плагина (#147)**: Добавлен встроенный модуль обновления (`lib/updater.js`) с маршрутом `/api/dsh-cron/update` и карточкой в настройках Web UI. Автоматически опрашивает npm registry, корректно сравнивает semver-версии (включая пререлизы) и обновляет `@goodandready/dsh-cron` на лету через CLI DSH без необходимости входа по SSH. Запросы POST защищены проверкой источника (`rejectCrossOrigin`).
+- **Устранение скрытых сбоев (#156)**: Ликвидированы пустые `catch`: незавершённые откаты транзакций импорта логируются с уровнем `warn`, причины fallback для динамических модулей ядра фиксируются в отладочном журнале, а при сбое открытия сессии пользователь получает понятное уведомление.
+- **Гигиена кода и экспортов (#155)**: Удалены устаревшие неиспользуемые сущности (`CHANNEL_LABELS`, `makeInspectAsk`), снят лишний модификатор `export` с 16 внутренних функций и констант, а метод `supportsSilentRule` напрямую подключен в боевой пайплайн проверки тихих правил.
+
+---
 
 ## 📦 Установка
 
@@ -491,6 +507,7 @@ bash deploy.sh verify [exact-version]
 | `POST` | `/dsh-cron/kanban/test` | Тестовая карточка в Kanban |
 | `*` | `/dsh-cron/action/:id/:action` | Legacy-алиас действий над задачей (`run`, `toggle`, `delete`, `history`) |
 | `GET` | `/dsh-cron/metrics` | Текст в формате Prometheus: счётчики задач и запусков — без промптов и вывода (#53) |
+| `GET` / `POST` | `/api/dsh-cron/update` | Самообновление плагина в 1 клик: запрос версии в реестре и обновление на лету (#147) |
 | `GET` / `POST` | `/dsh-cron/api/tasks` | Внешняя поверхность под токеном: список / создание-обновление (#54) |
 | `GET` / `DELETE` | `/dsh-cron/api/tasks/:id` | Внешняя поверхность под токеном: чтение / удаление (#54) |
 | `POST` | `/dsh-cron/api/tasks/:id/run` | Внешняя поверхность под токеном: принудительный запуск (#54) |

package/README.zh.md

@@ -381,6 +381,22 @@ bash deploy.sh verify [exact-version]
 
 ---
 
+### 27. 弹窗视口高度自适应与包体积精简 (v0.2.15, #153, #148, #151, #152)
+- **视口高度约束与粘性底部操作栏**：所有弹窗（包括任务编辑、新建及推荐模板预设）现已严格受控于视口尺寸 `max-height: min(90vh, calc(100vh - 36px))`，并内置平滑纵向滚动条。弹窗操作栏（“取消”、“保存”、“创建”）采用 `position: sticky` 底部悬浮固定，确保无论表单项多长或屏幕分辨率高低，操作按钮始终清晰可见且可随时点击。
+- **遮罩层滚动溢出保护**：弹窗遮罩层增加了安全边距与 `overflow-y: auto`，防止小屏设备在 Flex 居中时发生头部或底部截断。
+- **npm 包体积深度精简**：从 npm 分发清单中剔除了多余的重复文档副本，使 tarball 体积立减 32 kB 以上，解压后体积减少约 102 kB。
+- **Cordis 客户端注入依赖规范化**：在 `package.json` 的 `dsh.client.inject` 中完整声明了 `locale` 和 `slots` 服务依赖。
+
+---
+
+
+
+### 28. 应用内一键自更新与错误容错增强 (v0.2.16, #147, #155, #156)
+- **插件自更新模块 (#147)**：新增应用内一键自更新机制 (`lib/updater.js`)、`/api/dsh-cron/update` 接口与设置面板专属卡片。自动轮询 npmjs 仓库最新版本，精准比对 Semver 版本号（含预发布版本），通过 DSH CLI 就地升级 `@goodandready/dsh-cron`，无需 SSH 终端操作。POST 请求受跨域与来源保护 (`rejectCrossOrigin`)。
+- **消除静默异常与错误追踪 (#156)**：全面消除空 `catch` 异常压制：任务导入事务回滚失败记录 `warn` 级别日志、动态核心模块降级原因记录诊断日志、会话自动唤出失败向用户呈现友好提示。
+- **死代码清理与模块导出精简 (#155)**：清理未引用的旧版实体 (`CHANNEL_LABELS`, `makeInspectAsk`)，收回 16 个内部工具函数的暴露权限，并将 `supportsSilentRule` 接入静默规则核心执行流水线。
+
+---
 
 ## 📦 安装
 
@@ -491,6 +507,7 @@ dsh-cron:
 | `POST` | `/dsh-cron/kanban/test` | 创建 Kanban 连通性测试卡片 |
 | `*` | `/dsh-cron/action/:id/:action` | 任务操作路由的兼容别名（`run`、`toggle`、`delete`、`history`） |
 | `GET` | `/dsh-cron/metrics` | Prometheus 文本格式的任务与运行计数 —— 不含提示词与输出（#53） |
+| `GET` / `POST` | `/api/dsh-cron/update` | 插件一键自更新：查询仓库最新版本并就地平滑升级 (#147) |
 | `GET` / `POST` | `/dsh-cron/api/tasks` | 令牌保护的外部接口：列表 / 创建或更新（#54） |
 | `GET` / `DELETE` | `/dsh-cron/api/tasks/:id` | 令牌保护的外部接口：读取 / 删除（#54） |
 | `POST` | `/dsh-cron/api/tasks/:id/run` | 令牌保护的外部接口：强制执行（#54） |

package/lib/api.js

@@ -343,7 +343,9 @@ function applyImportPlan({ store, scheduler, plan }) {
       try {
         if (entry.previous) store.set(entry.previous);
         else store.delete(entry.id);
-      } catch (_) {}
+      } catch (rollbackErr) {
+        console.warn(`[dsh-cron] import rollback failed for task "${entry.id}":`, rollbackErr?.message || rollbackErr);
+      }
     }
     return { imported: [], error: `Import failed and was rolled back: ${writeErr.message}` };
   }

package/lib/channels.js

@@ -13,22 +13,12 @@ import { resolveTemplateText, truncateText } from './templates.js';
 
 export const CHANNEL_IDS = ['telegram', 'kanban', 'discord', 'slack', 'ntfy', 'bark', 'pushplus', 'tts', 'gitea'];
 
-export const CHANNEL_LABELS = {
-  telegram: 'Telegram',
-  kanban: 'dsh-kanban card',
-  discord: 'Discord webhook',
-  slack: 'Slack webhook',
-  ntfy: 'ntfy push',
-  bark: 'Bark push',
-  pushplus: 'PushPlus',
-  tts: 'Voice via dsh-tts',
-  gitea: 'Gitea issue',
-};
+// CHANNEL_LABELS removed (#155) — localized via lib/client.js
 
 const isFailed = (status) => status === 'error' || status === 'timeout';
 
 /** The message text for a channel: custom template, else built-in defaults. */
-export function messageTextFor(channelId, task, runInfo, settings = {}) {
+function messageTextFor(channelId, task, runInfo, settings = {}) {
   const templates = (settings && settings.channelTemplates) || {};
   const template = templates[channelId] || settings.template || '';
   return resolveTemplateText({ template, task, runInfo });
@@ -247,7 +237,7 @@ async function postJson(http, url, headers, body, channelId, signal, timeoutMs)
  * One handler per channel. Each returns a small detail object and throws a
  * descriptive Error on failure; the router turns that into a failure entry.
  */
-export const CHANNEL_HANDLERS = {
+const CHANNEL_HANDLERS = {
   async telegram({ task, runInfo, settings, secrets, http, signal, timeoutMs }) {
     const botToken = secrets.botToken || '';
     const chatId = String(settings.chatId || '').trim();

package/lib/chat-start.js

@@ -24,7 +24,9 @@ export async function chatStartHandler(ctx, req, res, parseJsonBody, sendJson, r
       if (llmModule && typeof llmModule.createUserMessage === 'function') {
         createUserMessage = llmModule.createUserMessage;
       }
-    } catch {}
+    } catch (err) {
+      (ctx.logger || console).debug?.('[dsh-cron] @deepseek-ai/dsh-llm createUserMessage unavailable, using identity fallback:', err?.message || err);
+    }
 
     let mintSessionId = () => `cron-setup-${randomUUID()}`;
     try {
@@ -33,7 +35,9 @@ export async function chatStartHandler(ctx, req, res, parseJsonBody, sendJson, r
         const sid = mintSessionId();
         mintSessionId = () => sessionModule.SessionId(sid);
       }
-    } catch {}
+    } catch (err) {
+      (ctx.logger || console).debug?.('[dsh-cron] @deepseek-ai/dsh-session SessionId unavailable, using string fallback:', err?.message || err);
+    }
 
     const defaultSel = ctx.get('agentDefaultModel')?.currentSelection?.();
     const provider = body.provider || defaultSel?.provider;

package/lib/client.js

@@ -883,9 +883,13 @@ window.__ModuleLoader__.load({
       .dsh-cron-rec-time { font-size: 13px; color: var(--dsw-alias-label-secondary, #9ca3af); font-weight: normal; margin-left: 8px; }
       .dsh-cron-rec-desc { font-size: 13px; color: var(--dsw-alias-label-tertiary, #71717a); }
 
-      .dsh-cron-modal-overlay { position: fixed; inset: 0; background: rgba(0,0,0,0.7); backdrop-filter: blur(4px); display: flex; align-items: center; justify-content: center; z-index: 1000; }
-      .dsh-cron-modal { background: var(--dsw-alias-bg-layer-2, #1f1f1f); border: 1px solid var(--dsw-alias-border-l2, #333); border-radius: 16px; width: 100%; max-width: 540px; padding: 24px; box-shadow: 0 20px 40px rgba(0,0,0,0.6); box-sizing: border-box; }
-      .dsh-cron-modal-scroll { max-width: 620px; max-height: 88vh; overflow-y: auto; }
+      .dsh-cron-modal-overlay { position: fixed; inset: 0; background: rgba(0,0,0,0.75); backdrop-filter: blur(4px); display: flex; align-items: center; justify-content: center; z-index: 1000; padding: 16px; box-sizing: border-box; overflow-y: auto; }
+      .dsh-cron-modal { background: var(--dsw-alias-bg-layer-2, #1f1f1f); border: 1px solid var(--dsw-alias-border-l2, #333); border-radius: 16px; width: 100%; max-width: 540px; max-height: min(90vh, calc(100vh - 36px)); overflow-y: auto; padding: 24px; box-shadow: 0 20px 40px rgba(0,0,0,0.6); box-sizing: border-box; }
+      .dsh-cron-modal-scroll { max-width: 640px; max-height: min(90vh, calc(100vh - 36px)); overflow-y: auto; }
+      .dsh-cron-modal::-webkit-scrollbar { width: 6px; }
+      .dsh-cron-modal::-webkit-scrollbar-track { background: transparent; }
+      .dsh-cron-modal::-webkit-scrollbar-thumb { background: var(--dsw-alias-border-l2, #383838); border-radius: 3px; }
+      .dsh-cron-modal::-webkit-scrollbar-thumb:hover { background: var(--dsw-alias-label-tertiary, #555); }
       .dsh-cron-section-head { display: flex; align-items: center; justify-content: space-between; width: 100%; background: none; border: none; padding: 0; margin-bottom: 10px; font: inherit; font-weight: 500; font-size: 12.5px; color: var(--dsw-alias-label-secondary, #aaa); cursor: pointer; }
       .dsh-cron-section-head:hover { color: var(--dsw-alias-label-primary, #eee); }
       .dsh-cron-section-chevron { transition: transform 0.15s ease; display: inline-block; }
@@ -899,7 +903,7 @@ window.__ModuleLoader__.load({
       .dsh-cron-form-group select { cursor: pointer; }
       .dsh-cron-form-group textarea { min-height: 80px; resize: vertical; }
       .dsh-cron-form-row { display: grid; grid-template-columns: 1fr 1fr; gap: 12px; }
-      .dsh-cron-modal-foot { display: flex; justify-content: flex-end; align-items: center; gap: 10px; margin-top: 20px; }
+      .dsh-cron-modal-foot { display: flex; justify-content: flex-end; align-items: center; gap: 10px; margin-top: 20px; position: sticky; bottom: -24px; background: var(--dsw-alias-bg-layer-2, #1f1f1f); border-top: 1px solid var(--dsw-alias-border-l2, #2e2e2e); padding-top: 14px; padding-bottom: 4px; margin-left: -24px; margin-right: -24px; padding-left: 24px; padding-right: 24px; z-index: 10; }
       .dsh-cron-btn-primary { background: var(--dsw-alias-label-primary, #ededed); color: var(--dsw-alias-bg-layer-3, #111); border: 1px solid transparent; border-radius: 8px; padding: 7px 14px; font-size: 13px; font-weight: 500; cursor: pointer; display: inline-flex; align-items: center; gap: 6px; }
       .dsh-cron-btn-primary:hover:not(:disabled) { opacity: 0.88; }
       .dsh-cron-btn-primary:disabled { opacity: 0.5; cursor: not-allowed; }
@@ -984,6 +988,7 @@ window.__ModuleLoader__.load({
         .dsh-cron-channel-grid { grid-template-columns: 1fr; }
         .dsh-cron-filter-panel { grid-template-columns: 1fr; }
         .dsh-cron-modal { padding: 16px; border-radius: 12px; }
+        .dsh-cron-modal-foot { bottom: -16px; margin-left: -16px; margin-right: -16px; padding-left: 16px; padding-right: 16px; }
         .dsh-cron-modal-scroll { max-height: 92vh; }
         .dsh-cron-task-item { flex-wrap: wrap; gap: 10px; }
         .dsh-cron-task-actions { margin-left: auto; }
@@ -1083,6 +1088,7 @@ window.__ModuleLoader__.load({
           }
         }
       }
+      console.warn('[dsh-cron] could not open session in workspace:', sessionId);
       return false;
     }
 
@@ -2320,7 +2326,7 @@ window.__ModuleLoader__.load({
         // 1. Manual creation / Edit modal
         manualModalOpen && React.createElement('div', { className: 'dsh-cron-modal-overlay', onClick: () => setManualModalOpen(false) },
           React.createElement('div', {
-            className: 'dsh-cron-modal',
+            className: 'dsh-cron-modal dsh-cron-modal-scroll',
             style: { maxWidth: '640px' },
             role: 'dialog',
             'aria-modal': 'true',
@@ -3311,6 +3317,65 @@ window.__ModuleLoader__.load({
       const [testInfo, setTestInfo] = React.useState(null);
       // Collapsed by default, head is the toggle (canonical card contract, #100)
       const [cardOpen, setCardOpen] = React.useState(false);
+      const [updateState, setUpdateState] = React.useState({
+        checking: false,
+        updating: false,
+        currentVersion: '0.2.16',
+        latestVersion: undefined,
+        updateAvailable: false,
+        notice: null,
+        error: null
+      });
+
+      const checkUpdates = async () => {
+        setUpdateState(prev => ({ ...prev, checking: true, error: null, notice: null }));
+        try {
+          const res = await fetch('/api/dsh-cron/update');
+          const data = await res.json();
+          if (data && data.currentVersion) {
+            setUpdateState(prev => ({
+              ...prev,
+              checking: false,
+              currentVersion: data.currentVersion,
+              latestVersion: data.latestVersion,
+              updateAvailable: Boolean(data.updateAvailable),
+              error: data.latestCheckFailed ? 'Registry check failed' : null
+            }));
+          } else {
+            setUpdateState(prev => ({ ...prev, checking: false, error: data.error || 'Check failed' }));
+          }
+        } catch (err) {
+          setUpdateState(prev => ({ ...prev, checking: false, error: err.message }));
+        }
+      };
+
+      const runUpdate = async () => {
+        setUpdateState(prev => ({ ...prev, updating: true, error: null, notice: null }));
+        try {
+          const res = await fetch('/api/dsh-cron/update', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', 'x-dsh-plugin-update': '1' }
+          });
+          const data = await res.json();
+          if (data && data.updated) {
+            setUpdateState(prev => ({
+              ...prev,
+              updating: false,
+              updateAvailable: false,
+              currentVersion: data.updatedVersion || data.latestVersion,
+              notice: T_KEY(t, 'updater.success', { version: data.updatedVersion || data.latestVersion })
+            }));
+          } else {
+            setUpdateState(prev => ({
+              ...prev,
+              updating: false,
+              error: data.error || data.message || 'Update failed'
+            }));
+          }
+        } catch (err) {
+          setUpdateState(prev => ({ ...prev, updating: false, error: err.message }));
+        }
+      };
 
       // Settings snapshot status (#102): never render phantom inputs before
       // the snapshot arrives; offer a retry when it is unavailable.
@@ -3516,6 +3581,57 @@ window.__ModuleLoader__.load({
             'data-type': testInfo.success ? 'success' : 'error',
             style: { margin: 0, padding: '8px 12px' }
           }, testInfo.message),
+          React.createElement('div', {
+            className: 'dsh-cron-form-group',
+            style: {
+              background: 'var(--dsw-alias-bg-layer-2, rgba(255,255,255,0.03))',
+              border: '1px solid var(--dsw-alias-border-l2, rgba(255,255,255,0.08))',
+              borderRadius: '8px',
+              padding: '14px',
+              marginBottom: '16px'
+            }
+          },
+            React.createElement('div', {
+              style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center', marginBottom: '8px' }
+            },
+              React.createElement('div', { style: { fontWeight: '600', fontSize: '14px' } }, `🚀 ${T_KEY(t, 'updater.title')}`),
+              React.createElement('div', { style: { display: 'flex', gap: '8px' } },
+                React.createElement('button', {
+                  type: 'button',
+                  className: 'dsh-cron-btn-secondary',
+                  style: { padding: '4px 10px', fontSize: '12px' },
+                  disabled: updateState.checking || updateState.updating,
+                  onClick: checkUpdates
+                }, updateState.checking ? T_KEY(t, 'updater.checking') : T_KEY(t, 'updater.btnCheck')),
+                updateState.updateAvailable ? React.createElement('button', {
+                  type: 'button',
+                  className: 'dsh-cron-btn-primary',
+                  style: { padding: '4px 10px', fontSize: '12px' },
+                  disabled: updateState.updating,
+                  onClick: runUpdate
+                }, updateState.updating ? T_KEY(t, 'updater.updating') : T_KEY(t, 'updater.btnUpdate', { version: updateState.latestVersion })) : null
+              )
+            ),
+            React.createElement('div', {
+              style: { fontSize: '12px', color: 'var(--dsw-alias-label-secondary, #999)', marginBottom: '8px' }
+            }, T_KEY(t, 'updater.desc')),
+            React.createElement('div', {
+              style: { display: 'flex', alignItems: 'center', gap: '12px', fontSize: '13px' }
+            },
+              React.createElement('span', { style: { color: 'var(--dsw-alias-label-secondary, #aaa)' } },
+                T_KEY(t, 'updater.current', { version: updateState.currentVersion })
+              ),
+              updateState.checking ? React.createElement('span', { className: 'dsh-cron-badge dsh-cron-badge-info' }, T_KEY(t, 'updater.checking')) :
+              updateState.updateAvailable ? React.createElement('span', { className: 'dsh-cron-badge dsh-cron-badge-warn' }, T_KEY(t, 'updater.available', { version: updateState.latestVersion })) :
+              updateState.currentVersion && !updateState.error ? React.createElement('span', { className: 'dsh-cron-badge dsh-cron-badge-ok' }, `✓ ${T_KEY(t, 'updater.upToDate')}`) : null
+            ),
+            updateState.notice ? React.createElement('div', {
+              style: { marginTop: '8px', color: 'var(--dsw-alias-success, #10b981)', fontSize: '12px' }
+            }, updateState.notice) : null,
+            updateState.error ? React.createElement('div', {
+              style: { marginTop: '8px', color: 'var(--dsw-alias-error, #ef4444)', fontSize: '12px' }
+            }, updateState.error) : null
+          ),
           React.createElement('div', { style: { display: 'flex', gap: '8px', alignItems: 'center', flexWrap: 'wrap', marginTop: '4px' } },
             React.createElement('button', {
               type: 'submit',

package/lib/failure-inspector.js

@@ -13,7 +13,7 @@
 import { askModel, parseJsonAnswer, resolveAskTarget } from './llm-ask.js';
 
 /** Agent-mediated tasks have a prompt worth revising. */
-export const INSPECTABLE_TASK_TYPES = ['llm', 'skill', 'workflow'];
+const INSPECTABLE_TASK_TYPES = ['llm', 'skill', 'workflow'];
 
 export function supportsInspection(task) {
   const type = String((task && task.type) || 'llm');
@@ -98,10 +98,4 @@ export async function inspectFailure({ task, runInfo, ask, preferredModel, timeo
   }
 }
 
-/** Ask helper bound to a context, used by the scheduler. */
-export function makeInspectAsk(ctx) {
-  return async ({ prompt, system, preferredModel, maxTokens, timeoutMs, task }) => {
-    const target = resolveAskTarget(ctx, task || {}, preferredModel);
-    return askModel(ctx, { ...target, prompt, system, maxTokens, timeoutMs });
-  };
-}
+// makeInspectAsk removed (#155) — scheduler uses makeAsk(ctx) from lib/llm-ask.js

package/lib/index.js

@@ -1,3 +1,5 @@
+import { registerPluginUpdater } from './updater.js';
+import { credentialRefStatus } from './secrets.js';
 import { TaskStore } from './store.js';
 import { TaskScheduler, parseScheduleExpression } from './scheduler.js';
 import { SessionRunner } from './runner.js';
@@ -165,6 +167,15 @@ export function sanitizeSettingsPayload(body) {
       delete payload[key];
     }
   }
+  for (const key of ['botTokenRef', 'barkKeyRef', 'giteaTokenRef']) {
+    if (key in payload && typeof payload[key] === 'string' && payload[key].trim()) {
+      const refCheck = credentialRefStatus(payload[key]);
+      if (!refCheck.ok) {
+        console.warn(`[dsh-cron] invalid credential reference in "${key}": ${refCheck.error}`);
+        delete payload[key];
+      }
+    }
+  }
   for (const key of TaskStore.FORBIDDEN_SETTING_KEYS) {
     if (key in payload) {
       console.warn(`[dsh-cron] refusing raw secret "${key}" from the client — use a credential reference`);
@@ -378,6 +389,13 @@ export function apply(ctx, config) {
   // #48: the recipe hub is the single source of the panel's suggestions.
   const recommendations = recipeRecommendations();
 
+  // Auto-updater route (#147)
+  ctx.effect(() => registerPluginUpdater(ctx, {
+    endpoint: '/api/dsh-cron/update',
+    packageName: '@goodandready/dsh-cron',
+    manifestUrl: new URL('../package.json', import.meta.url),
+  }), 'dsh-cron: /api/dsh-cron/update');
+
   // 1. REST API — collection (list/create) + item actions in one prefix
   // handler per route family; registered WITHOUT the trailing slash (#96)
   ctx.effect(() => ctx.webServer.register({

package/lib/recipes.js

@@ -34,7 +34,7 @@ export const RECIPE_CATEGORIES = [
  * packages, users and permissions, scheduling and the network edge, power state
  * and writes outside the working tree.
  */
-export const DESTRUCTIVE_PATTERNS = [
+const DESTRUCTIVE_PATTERNS = [
   /\brm\b/i,
   /\bunlink\b/i,
   /\bshred\b/i,

package/lib/runtimes.js

@@ -10,7 +10,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 
 export const EXTERNAL_RUNTIMES = ['script', 'node', 'python', 'http', 'ssh', 'docker'];
-export const AGENT_RUNTIMES = ['llm', 'skill', 'workflow'];
+const AGENT_RUNTIMES = ['llm', 'skill', 'workflow'];
 export const TASK_TYPES = [...AGENT_RUNTIMES, ...EXTERNAL_RUNTIMES];
 
 /** Types that execute code and therefore need the HTTP confirm header. */
@@ -56,7 +56,7 @@ export function buildNodeInvocation(task, cwd) {
 }
 
 /** Find the Python interpreter, preferring a task virtualenv, then the workspace one. */
-export function detectPython(task, cwd) {
+function detectPython(task, cwd) {
   if (task.pythonPath) return task.pythonPath;
   const candidates = [];
   if (process.env.VIRTUAL_ENV) {

package/lib/scheduler.js

@@ -6,10 +6,10 @@ import { applySilentRule } from './silent-rule.js';
 import { inspectFailure } from './failure-inspector.js';
 
 /** Task types that talk to a model and can therefore use a fallback model. */
-export const AGENT_TASK_TYPES = ['llm', 'skill', 'workflow'];
+const AGENT_TASK_TYPES = ['llm', 'skill', 'workflow'];
 
 /** Sum two usage records, so a fallback attempt is not lost in accounting. */
-export function addUsage(a, b) {
+function addUsage(a, b) {
   return {
     inputTokens: (a?.inputTokens || 0) + (b?.inputTokens || 0),
     outputTokens: (a?.outputTokens || 0) + (b?.outputTokens || 0),

package/lib/silent-rule.js

@@ -15,7 +15,7 @@
 import { askModel, parseJsonAnswer, resolveAskTarget } from './llm-ask.js';
 
 /** Task types whose runs produce output a rule can judge. */
-export const SILENT_RULE_TASK_TYPES = ['script', 'node', 'python', 'http'];
+const SILENT_RULE_TASK_TYPES = ['script', 'node', 'python', 'http'];
 
 export function supportsSilentRule(task) {
   return SILENT_RULE_TASK_TYPES.includes(String(task && task.type ? task.type : 'script'));
@@ -64,6 +64,9 @@ export async function applySilentRule({ task, runInfo, ask, preferredModel, time
   if (!task || !task.silentRule || String(task.silentRule).trim() === '') {
     return { skipped: false, reason: '' };
   }
+  if (!supportsSilentRule(task)) {
+    return { skipped: false, reason: '', note: 'task type does not support silent rule' };
+  }
   if ((runInfo && runInfo.status) !== 'success') {
     return { skipped: false, reason: '', note: 'the rule only judges successful runs' };
   }

package/lib/telegram.js

@@ -79,7 +79,7 @@ export function getDshDefaultTelegramCredentials() {
 /**
  * Escape markdown special characters for Telegram legacy markdown.
  */
-export function escapeMarkdown(str) {
+function escapeMarkdown(str) {
   if (!str) return '';
   return String(str).replace(/[_*[\]()~`>#+\-=|{}.!]/g, '\\$&');
 }