@goodandready/dsh-cron 0.2.15 → 0.2.17

package/README.md

@@ -392,6 +392,20 @@ Developer-facing, no behaviour change. `parseScheduleExpression` was split into
 
 
 
+### 29. Client Modular Decomposition & Theme Standardization (v0.2.17, #149, #150)
+- **Modular Client Architecture (#150)**: Decomposed monolithic `lib/client.js` (~3950 lines) into 14 focused, single-responsibility fragments under `lib/client-src/` (none exceeding 580 lines). Integrated zero-dependency build script `scripts/build-client.mjs` wired into `package.json` (`build:client`, `pretest`). Development fragments are excluded from npm distribution via `"files": ["lib/*.js", ...]`.
+- **DSH Theme Tokens & Visual Standardization (#149)**: Replaced inline styles on task type badges (`onSuccess`, `onFailure`, `heartbeat`, `targetSession`, `preflight`) with dedicated `.dsh-cron-tag-*` CSS classes powered by semantic `--dsh-cron-*` theme variables. Modal overlay now adapts dynamically using `var(--dsw-alias-bg-mask, rgba(0, 0, 0, 0.75))`, and keyframe pulse animations use theme variables without hardcoded RGBA.
+- **Label Governance & Triage Audit (#95)**: Standardized 100% of repository issues and triage on the canonical repo-level label set.
+
+---
+
+### 28. In-App One-Click Auto-Updater & Error Resilience (v0.2.16, #147, #155, #156)
+- **Plugin Self-Updater (#147)**: Added in-app one-click self-updating module (`lib/updater.js`) with `/api/dsh-cron/update` endpoint and dedicated Settings UI card. Automatically queries npm registry, compares semver versions including pre-releases, and upgrades `@goodandready/dsh-cron` in-place through the DSH CLI without manual SSH sessions. POST updates are protected via origin validation (`rejectCrossOrigin`).
+- **Silent Failure Elimination (#156)**: Replaced silent empty catches with diagnostic logging: uncompleted import transaction rollbacks are surfaced to system logs with warning severity, dynamic core module fallback reasons are logged, and session opening failures inform the user with actionable notifications.
+- **Dead Code & Export Hygiene (#155)**: Cleaned unused legacy helpers (`CHANNEL_LABELS`, `makeInspectAsk`), stripped unnecessary exports from 16 internal modules, and wired `supportsSilentRule` directly into execution pipeline.
+
+---
+
 ## 📦 Installation
 
 Install into your DeepSeek Harness web profile:
@@ -503,6 +517,7 @@ All endpoints are served by the DSH web server under `/dsh-cron/`. Read endpoint
 | `POST` | `/dsh-cron/kanban/test` | Create a Kanban connectivity-test card |
 | `*` | `/dsh-cron/action/:id/:action` | Legacy alias for the task action routes (`run`, `toggle`, `delete`, `history`) |
 | `GET` | `/dsh-cron/metrics` | Prometheus text exposition of task and run counters — never prompts or output (#53) |
+| `GET` / `POST` | `/api/dsh-cron/update` | One-click plugin self-updater: query registry version and in-place upgrade (#147) |
 | `GET` / `POST` | `/dsh-cron/api/tasks` | External token-guarded surface: list / create-or-update (#54) |
 | `GET` / `DELETE` | `/dsh-cron/api/tasks/:id` | External token-guarded surface: read / delete (#54) |
 | `POST` | `/dsh-cron/api/tasks/:id/run` | External token-guarded surface: force a run (#54) |

package/README.ru.md

@@ -268,6 +268,20 @@ cron_create_task({
 
 
 
+### 29. Модульная декомпозиция клиента и стандартизация тем оформления (v0.2.17, #149, #150)
+- **Модульная архитектура клиентской части (#150)**: Монолитный файл `lib/client.js` (~3950 строк) декомпозирован на 14 независимых специализированных модулей в каталоге `lib/client-src/` (каждый строго <= 580 строк). Сборка `lib/client.js` выполняется легковесным скриптом `scripts/build-client.mjs` перед запуском тестов и сборки. Исходные фрагменты исключены из npm-дистрибутива через `"files": ["lib/*.js", ...]`.
+- **Семантические токены тем DSH (#149)**: Инлайн-стили тегов типа задач (`onSuccess`, `onFailure`, `heartbeat`, `targetSession`, `preflight`) переведены на выделенные CSS-классы `.dsh-cron-tag-*` на базе переменных темы `--dsh-cron-*`. Оверлей модальных окон переведен на адаптивную маску `var(--dsw-alias-bg-mask, rgba(0, 0, 0, 0.75))`, а анимация пульсации избавлена от захардкоженных значений RGBA.
+- **Аудит меток репозитория (#95)**: Подтверждена 100% консистентность использования канонического репозиторного набора меток и фильтрации задач.
+
+---
+
+### 28. Модуль самообновления в 1 клик и устойчивость к ошибкам (v0.2.16, #147, #155, #156)
+- **Самообновление плагина (#147)**: Добавлен встроенный модуль обновления (`lib/updater.js`) с маршрутом `/api/dsh-cron/update` и карточкой в настройках Web UI. Автоматически опрашивает npm registry, корректно сравнивает semver-версии (включая пререлизы) и обновляет `@goodandready/dsh-cron` на лету через CLI DSH без необходимости входа по SSH. Запросы POST защищены проверкой источника (`rejectCrossOrigin`).
+- **Устранение скрытых сбоев (#156)**: Ликвидированы пустые `catch`: незавершённые откаты транзакций импорта логируются с уровнем `warn`, причины fallback для динамических модулей ядра фиксируются в отладочном журнале, а при сбое открытия сессии пользователь получает понятное уведомление.
+- **Гигиена кода и экспортов (#155)**: Удалены устаревшие неиспользуемые сущности (`CHANNEL_LABELS`, `makeInspectAsk`), снят лишний модификатор `export` с 16 внутренних функций и констант, а метод `supportsSilentRule` напрямую подключен в боевой пайплайн проверки тихих правил.
+
+---
+
 ## 📦 Установка
 
 ```bash
@@ -500,6 +514,7 @@ bash deploy.sh verify [exact-version]
 | `POST` | `/dsh-cron/kanban/test` | Тестовая карточка в Kanban |
 | `*` | `/dsh-cron/action/:id/:action` | Legacy-алиас действий над задачей (`run`, `toggle`, `delete`, `history`) |
 | `GET` | `/dsh-cron/metrics` | Текст в формате Prometheus: счётчики задач и запусков — без промптов и вывода (#53) |
+| `GET` / `POST` | `/api/dsh-cron/update` | Самообновление плагина в 1 клик: запрос версии в реестре и обновление на лету (#147) |
 | `GET` / `POST` | `/dsh-cron/api/tasks` | Внешняя поверхность под токеном: список / создание-обновление (#54) |
 | `GET` / `DELETE` | `/dsh-cron/api/tasks/:id` | Внешняя поверхность под токеном: чтение / удаление (#54) |
 | `POST` | `/dsh-cron/api/tasks/:id/run` | Внешняя поверхность под токеном: принудительный запуск (#54) |

package/README.zh.md

@@ -391,6 +391,20 @@ bash deploy.sh verify [exact-version]
 
 
 
+### 29. 客户端模块化解耦与原生主题标准化 (v0.2.17, #149, #150)
+- **客户端模块化架构 (#150)**: 将庞大的单文件 `lib/client.js` (约 3950 行) 拆分为 `lib/client-src/` 下的 14 个高内聚模块文件 (各模块严格 <= 580 行)。集成零依赖构建脚本 `scripts/build-client.mjs` 并接入 `package.json` (`build:client`, `pretest`)，通过 `"files": ["lib/*.js", ...]` 避免开发源码冗余打包进 npm 发布包。
+- **DSH 语义化主题变量对齐 (#149)**: 将任务类型标签 (`onSuccess`, `onFailure`, `heartbeat`, `targetSession`, `preflight`) 的内联样式全部替换为基于主题变量的 `.dsh-cron-tag-*` 类；模态框遮罩层接入自适应主题遮罩变量 `var(--dsw-alias-bg-mask, rgba(0, 0, 0, 0.75))`，移除脉冲动画关键帧中的硬编码 RGBA。
+- **标签治理与工单审计 (#95)**: 审计并确认全仓库 100% 统一规范使用仓库级标签集。
+
+---
+
+### 28. 应用内一键自更新与错误容错增强 (v0.2.16, #147, #155, #156)
+- **插件自更新模块 (#147)**：新增应用内一键自更新机制 (`lib/updater.js`)、`/api/dsh-cron/update` 接口与设置面板专属卡片。自动轮询 npmjs 仓库最新版本，精准比对 Semver 版本号（含预发布版本），通过 DSH CLI 就地升级 `@goodandready/dsh-cron`，无需 SSH 终端操作。POST 请求受跨域与来源保护 (`rejectCrossOrigin`)。
+- **消除静默异常与错误追踪 (#156)**：全面消除空 `catch` 异常压制：任务导入事务回滚失败记录 `warn` 级别日志、动态核心模块降级原因记录诊断日志、会话自动唤出失败向用户呈现友好提示。
+- **死代码清理与模块导出精简 (#155)**：清理未引用的旧版实体 (`CHANNEL_LABELS`, `makeInspectAsk`)，收回 16 个内部工具函数的暴露权限，并将 `supportsSilentRule` 接入静默规则核心执行流水线。
+
+---
+
 ## 📦 安装
 
 ```bash
@@ -500,6 +514,7 @@ dsh-cron:
 | `POST` | `/dsh-cron/kanban/test` | 创建 Kanban 连通性测试卡片 |
 | `*` | `/dsh-cron/action/:id/:action` | 任务操作路由的兼容别名（`run`、`toggle`、`delete`、`history`） |
 | `GET` | `/dsh-cron/metrics` | Prometheus 文本格式的任务与运行计数 —— 不含提示词与输出（#53） |
+| `GET` / `POST` | `/api/dsh-cron/update` | 插件一键自更新：查询仓库最新版本并就地平滑升级 (#147) |
 | `GET` / `POST` | `/dsh-cron/api/tasks` | 令牌保护的外部接口：列表 / 创建或更新（#54） |
 | `GET` / `DELETE` | `/dsh-cron/api/tasks/:id` | 令牌保护的外部接口：读取 / 删除（#54） |
 | `POST` | `/dsh-cron/api/tasks/:id/run` | 令牌保护的外部接口：强制执行（#54） |

package/lib/api.js

@@ -343,7 +343,9 @@ function applyImportPlan({ store, scheduler, plan }) {
       try {
         if (entry.previous) store.set(entry.previous);
         else store.delete(entry.id);
-      } catch (_) {}
+      } catch (rollbackErr) {
+        console.warn(`[dsh-cron] import rollback failed for task "${entry.id}":`, rollbackErr?.message || rollbackErr);
+      }
     }
     return { imported: [], error: `Import failed and was rolled back: ${writeErr.message}` };
   }

package/lib/channels.js

@@ -13,22 +13,12 @@ import { resolveTemplateText, truncateText } from './templates.js';
 
 export const CHANNEL_IDS = ['telegram', 'kanban', 'discord', 'slack', 'ntfy', 'bark', 'pushplus', 'tts', 'gitea'];
 
-export const CHANNEL_LABELS = {
-  telegram: 'Telegram',
-  kanban: 'dsh-kanban card',
-  discord: 'Discord webhook',
-  slack: 'Slack webhook',
-  ntfy: 'ntfy push',
-  bark: 'Bark push',
-  pushplus: 'PushPlus',
-  tts: 'Voice via dsh-tts',
-  gitea: 'Gitea issue',
-};
+// CHANNEL_LABELS removed (#155) — localized via lib/client.js
 
 const isFailed = (status) => status === 'error' || status === 'timeout';
 
 /** The message text for a channel: custom template, else built-in defaults. */
-export function messageTextFor(channelId, task, runInfo, settings = {}) {
+function messageTextFor(channelId, task, runInfo, settings = {}) {
   const templates = (settings && settings.channelTemplates) || {};
   const template = templates[channelId] || settings.template || '';
   return resolveTemplateText({ template, task, runInfo });
@@ -247,7 +237,7 @@ async function postJson(http, url, headers, body, channelId, signal, timeoutMs)
  * One handler per channel. Each returns a small detail object and throws a
  * descriptive Error on failure; the router turns that into a failure entry.
  */
-export const CHANNEL_HANDLERS = {
+const CHANNEL_HANDLERS = {
   async telegram({ task, runInfo, settings, secrets, http, signal, timeoutMs }) {
     const botToken = secrets.botToken || '';
     const chatId = String(settings.chatId || '').trim();

package/lib/chat-start.js

@@ -24,7 +24,9 @@ export async function chatStartHandler(ctx, req, res, parseJsonBody, sendJson, r
       if (llmModule && typeof llmModule.createUserMessage === 'function') {
         createUserMessage = llmModule.createUserMessage;
       }
-    } catch {}
+    } catch (err) {
+      (ctx.logger || console).debug?.('[dsh-cron] @deepseek-ai/dsh-llm createUserMessage unavailable, using identity fallback:', err?.message || err);
+    }
 
     let mintSessionId = () => `cron-setup-${randomUUID()}`;
     try {
@@ -33,7 +35,9 @@ export async function chatStartHandler(ctx, req, res, parseJsonBody, sendJson, r
         const sid = mintSessionId();
         mintSessionId = () => sessionModule.SessionId(sid);
       }
-    } catch {}
+    } catch (err) {
+      (ctx.logger || console).debug?.('[dsh-cron] @deepseek-ai/dsh-session SessionId unavailable, using string fallback:', err?.message || err);
+    }
 
     const defaultSel = ctx.get('agentDefaultModel')?.currentSelection?.();
     const provider = body.provider || defaultSel?.provider;

package/lib/client.js

@@ -44,6 +44,17 @@ window.__ModuleLoader__.load({
     // Locale dictionary: English is the canonical source language (Issue #87).
     // Russian and other languages are provided at runtime by the translation
     // plugin; no per-language duplicates are stored here.
+    // Core chevron primitive when the build ships it; own SVG fallback otherwise.
+    let CoreChevron = null;
+    try {
+      const primitives = require('@deepseek-ai/dsh-client-ui-primitives');
+      CoreChevron = primitives && primitives.IconChevronDownOutline14;
+    } catch (e) {}
+    const chevronNode = () => (CoreChevron ? React.createElement(CoreChevron) : React.createElement('span', { style: { display: 'flex', alignItems: 'center' }, dangerouslySetInnerHTML: { __html: ICON_CHEVRON_DOWN } }));
+
+    // Own React error boundary (#106): the core's SlotErrorBoundary renders an
+    // empty div on crash, so a slot failure would silently vanish. Ours keeps
+    // the failure visible with a retry.
     const STRINGS = {
       en: {
         'sidebar.label': 'Scheduled tasks',
@@ -588,214 +599,6 @@ window.__ModuleLoader__.load({
     };
     const T = (key, vars) => translate(key, vars);
 
-    // Core chevron primitive when the build ships it; own SVG fallback otherwise.
-    let CoreChevron = null;
-    try {
-      const primitives = require('@deepseek-ai/dsh-client-ui-primitives');
-      CoreChevron = primitives && primitives.IconChevronDownOutline14;
-    } catch (e) {}
-    const chevronNode = () => (CoreChevron ? React.createElement(CoreChevron) : React.createElement('span', { style: { display: 'flex', alignItems: 'center' }, dangerouslySetInnerHTML: { __html: ICON_CHEVRON_DOWN } }));
-
-    // Own React error boundary (#106): the core's SlotErrorBoundary renders an
-    // empty div on crash, so a slot failure would silently vanish. Ours keeps
-    // the failure visible with a retry.
-    function createErrorBoundary() {
-      if (!React || typeof React.Component !== 'function') {
-        return function NoopBoundary(props) { return (props && props.children) || null; };
-      }
-      return class ErrorBoundary extends React.Component {
-        constructor(props) {
-          super(props);
-          this.state = { hasError: false, error: null };
-        }
-        static getDerivedStateFromError(error) {
-          return { hasError: true, error };
-        }
-        componentDidCatch(error, errorInfo) {
-          console.error('[dsh-cron] React error:', error, errorInfo);
-        }
-        render() {
-          if (this.state.hasError) {
-            return React.createElement('div', { className: 'dsh-cron-status-banner', 'data-type': 'error', style: { margin: '12px 0' } },
-              React.createElement('div', { style: { fontWeight: 600, marginBottom: '6px' } }, '⚠️ Cron UI error:'),
-              React.createElement('div', { style: { fontSize: '12px', wordBreak: 'break-all' } }, String((this.state.error && this.state.error.message) || this.state.error)),
-              React.createElement('button', {
-                type: 'button',
-                className: 'dsh-cron-btn-secondary',
-                style: { marginTop: '10px', fontSize: '12px', padding: '4px 10px' },
-                onClick: () => this.setState({ hasError: false, error: null })
-              }, 'Retry')
-            );
-          }
-          return (this.props && this.props.children) || null;
-        }
-      };
-    }
-    const ErrorBoundary = createErrorBoundary();
-
-    const AGENT_FORM_TYPES = ['llm', 'skill', 'workflow'];
-    const CODE_FORM_TYPES = ['script', 'node', 'python', 'ssh', 'docker'];
-
-    // Delivery channels (#26) — must stay in sync with lib/channels.js.
-    const DELIVERY_CHANNELS = ['telegram', 'kanban', 'discord', 'slack', 'ntfy', 'bark', 'pushplus', 'tts', 'gitea'];
-    const CHANNEL_LABEL_KEYS = {
-      telegram: 'form.channelTelegram',
-      kanban: 'form.channelKanban',
-      discord: 'form.channelDiscord',
-      slack: 'form.channelSlack',
-      ntfy: 'form.channelNtfy',
-      bark: 'form.channelBark',
-      pushplus: 'form.channelPushplus',
-      tts: 'form.channelTts',
-      gitea: 'form.channelGitea',
-    };
-
-    // Non-secret delivery settings shown in the settings panel. Secrets are
-    // referenced by credential name only (#51) — never typed as values.
-    const DELIVERY_SETTING_FIELDS = [
-      { key: 'botTokenRef', labelKey: 'settings.botTokenRefLabel', placeholderKey: 'settings.botTokenRefPlaceholder', group: 'secrets' },
-      { key: 'ntfyTokenRef', labelKey: 'settings.ntfyTokenRefLabel', group: 'secrets' },
-      { key: 'pushplusTokenRef', labelKey: 'settings.pushplusTokenRefLabel', group: 'secrets' },
-      { key: 'giteaTokenRef', labelKey: 'settings.giteaTokenRefLabel', group: 'secrets' },
-      // The external API is the one surface where a typed secret is the point:
-      // a CI job cannot present a credential reference (#54).
-      { key: 'apiToken', labelKey: 'settings.apiTokenLabel', placeholderKey: 'settings.apiTokenPlaceholder', group: 'secrets' },
-      { key: 'discordWebhookUrl', labelKey: 'settings.discordLabel', group: 'channels' },
-      { key: 'slackWebhookUrl', labelKey: 'settings.slackLabel', group: 'channels' },
-      { key: 'ntfyUrl', labelKey: 'settings.ntfyUrlLabel', group: 'channels' },
-      { key: 'ntfyTopic', labelKey: 'settings.ntfyTopicLabel', group: 'channels' },
-      { key: 'barkServerUrl', labelKey: 'settings.barkServerLabel', group: 'channels' },
-      { key: 'barkKey', labelKey: 'settings.barkKeyLabel', group: 'channels' },
-      { key: 'pushplusUrl', labelKey: 'settings.pushplusUrlLabel', group: 'channels' },
-      { key: 'ttsBaseUrl', labelKey: 'settings.ttsBaseUrlLabel', group: 'channels' },
-      { key: 'giteaBaseUrl', labelKey: 'settings.giteaBaseUrlLabel', group: 'channels' },
-      { key: 'giteaRepo', labelKey: 'settings.giteaRepoLabel', group: 'channels' },
-      { key: 'deliveryTimeoutMs', labelKey: 'settings.deliveryTimeoutMsLabel', group: 'channels', numeric: true, defaultValue: 15000, min: 1000 },
-      { key: 'silentRuleModel', labelKey: 'settings.silentRuleModelLabel', group: 'automation' },
-      { key: 'inspectorModel', labelKey: 'settings.inspectorModelLabel', group: 'automation' },
-    ];
-    const DELIVERY_SETTING_KEYS = DELIVERY_SETTING_FIELDS.map((f) => f.key);
-    // The global template plus the per-channel override map (server model).
-    const TEMPLATE_SETTING_KEYS = ['template', 'channelTemplates'];
-
-    /** Collect every delivery key the settings endpoints may return. */
-    function pickDeliverySettings(source) {
-      const out = {};
-      for (const key of DELIVERY_SETTING_KEYS.concat(TEMPLATE_SETTING_KEYS)) {
-        if (source && source[key] !== undefined && source[key] !== null) out[key] = source[key];
-      }
-      if (out.channelTemplates && typeof out.channelTemplates === 'object') {
-        out.channelTemplates = Object.assign({}, out.channelTemplates);
-      }
-      return out;
-    }
-
-    /**
-     * Shared delivery form used by both the task panel modal and the plugin
-     * settings card, so a new channel is added in exactly one place.
-     * Sections collapse via the canonical aria-expanded head contract.
-     */
-    function renderDeliverySettings({ T, values, onChange, onChannelTemplate, sections, onToggleSection }) {
-      const val = (key) => (values[key] === undefined || values[key] === null ? '' : String(values[key]));
-      const field = (f) => React.createElement('div', { className: 'dsh-cron-form-group', key: f.key, style: { marginBottom: '10px' } },
-        React.createElement('label', null, T(f.labelKey)),
-        React.createElement('input', f.numeric ? {
-          type: 'number',
-          min: f.min !== undefined ? f.min : 1000,
-          step: 1000,
-          value: val(f.key),
-          placeholder: String(f.defaultValue !== undefined ? f.defaultValue : 15000),
-          // #115: clearing the field must send the explicit default. Deleting the
-          // key would leave the previously stored value in place (the settings
-          // scope skips absent keys), so the field would silently keep 1 ms.
-          onChange: (e) => onChange(f.key, e.target.value === ''
-            ? (f.defaultValue !== undefined ? f.defaultValue : 15000)
-            : Number(e.target.value)),
-        } : {
-          type: 'text',
-          value: val(f.key),
-          placeholder: f.placeholderKey ? T(f.placeholderKey) : '',
-          onChange: (e) => onChange(f.key, e.target.value)
-        })
-      );
-      const section = (key, titleKey, children) => {
-        const open = Boolean(sections[key]);
-        return React.createElement('div', { className: 'dsh-cron-section', key },
-          React.createElement('button', {
-            type: 'button',
-            className: 'dsh-cron-section-head',
-            'aria-expanded': open ? 'true' : 'false',
-            onClick: () => onToggleSection(key)
-          },
-            React.createElement('span', null, T(titleKey)),
-            React.createElement('span', { className: 'dsh-cron-section-chevron', 'data-open': open ? 'true' : 'false' }, '▾')
-          ),
-          open && React.createElement('div', { className: 'dsh-cron-section-body' }, children)
-        );
-      };
-
-      return [
-        section('secrets', 'settings.secretsSection', [
-          React.createElement('div', { className: 'dsh-cron-hint', key: 'hint', style: { marginBottom: '10px' } }, T('settings.secretsHint')),
-          ...DELIVERY_SETTING_FIELDS.filter((f) => f.group === 'secrets').map(field),
-        ]),
-        section('channels', 'settings.deliverySection', [
-          React.createElement('div', { className: 'dsh-cron-form-row', key: 'row' },
-            ...DELIVERY_SETTING_FIELDS.filter((f) => f.group === 'channels').map(field)
-          ),
-        ]),
-        section('automation', 'settings.automationSection', [
-          React.createElement('div', { className: 'dsh-cron-hint', key: 'hint', style: { marginBottom: '10px' } }, T('settings.automationHint')),
-          React.createElement('div', { className: 'dsh-cron-form-row', key: 'row' },
-            ...DELIVERY_SETTING_FIELDS.filter((f) => f.group === 'automation').map(field)
-          ),
-        ]),
-        section('templates', 'settings.templatesSection', [
-          React.createElement('div', { className: 'dsh-cron-form-group', key: 'global', style: { marginBottom: '10px' } },
-            React.createElement('label', null, T('settings.templateLabel')),
-            React.createElement('input', {
-              type: 'text',
-              value: val('template'),
-              onChange: (e) => onChange('template', e.target.value)
-            }),
-            React.createElement('div', { className: 'dsh-cron-hint' }, T('settings.templateHint'))
-          ),
-          React.createElement('div', { className: 'dsh-cron-form-row', key: 'perchannel' },
-            ...DELIVERY_CHANNELS.map((id) => React.createElement('div', { className: 'dsh-cron-form-group', key: id, style: { marginBottom: '10px' } },
-              React.createElement('label', null, T('settings.channelTemplateLabel', { channel: T(CHANNEL_LABEL_KEYS[id]) })),
-              React.createElement('input', {
-                type: 'text',
-                value: (values.channelTemplates && values.channelTemplates[id]) || '',
-                onChange: (e) => onChannelTemplate(id, e.target.value)
-              })
-            ))
-          ),
-        ]),
-      ];
-    }
-
-    /** Parse a KEY=VALUE textarea into the task env object (#38). */
-    function parseEnvText(text) {
-      const env = {};
-      for (const rawLine of String(text || '').split('\n')) {
-        const line = rawLine.trim();
-        if (!line || line.startsWith('#')) continue;
-        const idx = line.indexOf('=');
-        if (idx <= 0) continue;
-        const key = line.slice(0, idx).trim();
-        const value = line.slice(idx + 1).trim();
-        if (key) env[key] = value;
-      }
-      return Object.keys(env).length ? env : undefined;
-    }
-
-    function formatEnvText(env) {
-      if (!env || typeof env !== 'object') return '';
-      return Object.entries(env).map(([k, v]) => `${k}=${v}`).join('\n');
-    }
-
-    // Status colors: core semantic state tokens first (same set dsh-clinebot
-    // uses), plugin fallbacks as a single point of change (#105).
     const STYLES = `
       :root {
         --dsh-cron-success: var(--dsw-alias-state-success-primary, #10b981);
@@ -865,6 +668,12 @@ window.__ModuleLoader__.load({
       .dsh-cron-task-item:hover, .dsh-cron-task-item:focus-visible { background: var(--dsw-alias-bg-layer-4, #242424); border-color: var(--dsw-alias-label-dimmed, var(--dsw-alias-border-l1, #444)); outline: none; }
       .dsh-cron-task-prompt-preview { font-size: 12.5px; color: var(--dsw-alias-label-secondary, #888); margin-top: 5px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; max-width: 520px; line-height: 1.3; }
       .dsh-cron-type-tag { display: inline-flex; align-items: center; font-size: 11px; padding: 2px 8px; border-radius: 999px; border: 1px solid var(--dsw-alias-border-l2, #383838); text-transform: uppercase; font-weight: 500; margin-left: 8px; vertical-align: middle; }
+      .dsh-cron-tag-success { background: var(--dsh-cron-info-bg); color: var(--dsh-cron-info); border-color: var(--dsh-cron-info); }
+      .dsh-cron-tag-failure { background: var(--dsh-cron-danger-bg); color: var(--dsh-cron-danger); border-color: var(--dsh-cron-danger); }
+      .dsh-cron-tag-heartbeat { background: var(--dsh-cron-accent-bg); color: var(--dsh-cron-accent); border-color: var(--dsh-cron-accent); }
+      .dsh-cron-tag-session { background: var(--dsh-cron-info-bg); color: var(--dsh-cron-info); border-color: var(--dsh-cron-info); }
+      .dsh-cron-tag-preflight { background: var(--dsh-cron-warning-bg); color: var(--dsh-cron-warning); border-color: var(--dsh-cron-warning); }
+
       .dsh-cron-task-model-tag { display: inline-flex; align-items: center; font-size: 11px; padding: 2px 8px; border-radius: 999px; border: 1px solid var(--dsw-alias-border-l2, #383838); background: var(--dsw-alias-bg-layer-2, rgba(255,255,255,0.06)); color: var(--dsw-alias-label-secondary, #aaa); margin-left: 8px; vertical-align: middle; }
       .dsh-cron-task-actions { display: flex; gap: 8px; }
       .dsh-cron-icon-btn { appearance: none; font: inherit; background: var(--dsw-alias-bg-layer-2, transparent); border: 1px solid var(--dsw-alias-border-l2, #333); border-radius: 8px; padding: 6px 12px; font-size: 12.5px; font-weight: 500; color: var(--dsw-alias-label-primary, #aaa); cursor: pointer; display: inline-flex; align-items: center; gap: 6px; transition: all 0.15s ease; }
@@ -883,7 +692,7 @@ window.__ModuleLoader__.load({
       .dsh-cron-rec-time { font-size: 13px; color: var(--dsw-alias-label-secondary, #9ca3af); font-weight: normal; margin-left: 8px; }
       .dsh-cron-rec-desc { font-size: 13px; color: var(--dsw-alias-label-tertiary, #71717a); }
 
-      .dsh-cron-modal-overlay { position: fixed; inset: 0; background: rgba(0,0,0,0.75); backdrop-filter: blur(4px); display: flex; align-items: center; justify-content: center; z-index: 1000; padding: 16px; box-sizing: border-box; overflow-y: auto; }
+      .dsh-cron-modal-overlay { position: fixed; inset: 0; background: var(--dsw-alias-bg-mask, rgba(0, 0, 0, 0.75)); backdrop-filter: blur(4px); display: flex; align-items: center; justify-content: center; z-index: 1000; padding: 16px; box-sizing: border-box; overflow-y: auto; }
       .dsh-cron-modal { background: var(--dsw-alias-bg-layer-2, #1f1f1f); border: 1px solid var(--dsw-alias-border-l2, #333); border-radius: 16px; width: 100%; max-width: 540px; max-height: min(90vh, calc(100vh - 36px)); overflow-y: auto; padding: 24px; box-shadow: 0 20px 40px rgba(0,0,0,0.6); box-sizing: border-box; }
       .dsh-cron-modal-scroll { max-width: 640px; max-height: min(90vh, calc(100vh - 36px)); overflow-y: auto; }
       .dsh-cron-modal::-webkit-scrollbar { width: 6px; }
@@ -963,7 +772,7 @@ window.__ModuleLoader__.load({
       .dsh-cron-status-banner[data-type="success"] { background: var(--dsh-cron-success-bg); border: 1px solid var(--dsh-cron-success); color: var(--dsh-cron-success); }
       .dsh-cron-status-banner[data-type="error"] { background: var(--dsh-cron-danger-bg); border: 1px solid var(--dsh-cron-danger); color: var(--dsh-cron-danger); }
       .dsh-cron-status-banner[data-type="info"] { background: var(--dsh-cron-info-bg); border: 1px solid var(--dsh-cron-info); color: var(--dsh-cron-info); }
-      @keyframes dsh-cron-pulse-ring { 0% { box-shadow: 0 0 0 0 rgba(16, 185, 129, 0.5); } 70% { box-shadow: 0 0 0 9px rgba(16, 185, 129, 0); } 100% { box-shadow: 0 0 0 0 rgba(16, 185, 129, 0); } }
+      @keyframes dsh-cron-pulse-ring { 0% { box-shadow: 0 0 0 0 var(--dsh-cron-success-bg); } 70% { box-shadow: 0 0 0 9px transparent; } 100% { box-shadow: 0 0 0 0 transparent; } }
       .dsh-cron-pulse { animation: dsh-cron-pulse-ring 1.6s infinite; border-color: var(--dsh-cron-success); color: var(--dsh-cron-success); }
 
       /* #34: sidebar job list */
@@ -1026,6 +835,107 @@ window.__ModuleLoader__.load({
       el.textContent = STYLES;
     }
 
+    function createErrorBoundary() {
+      if (!React || typeof React.Component !== 'function') {
+        return function NoopBoundary(props) { return (props && props.children) || null; };
+      }
+      return class ErrorBoundary extends React.Component {
+        constructor(props) {
+          super(props);
+          this.state = { hasError: false, error: null };
+        }
+        static getDerivedStateFromError(error) {
+          return { hasError: true, error };
+        }
+        componentDidCatch(error, errorInfo) {
+          console.error('[dsh-cron] React error:', error, errorInfo);
+        }
+        render() {
+          if (this.state.hasError) {
+            return React.createElement('div', { className: 'dsh-cron-status-banner', 'data-type': 'error', style: { margin: '12px 0' } },
+              React.createElement('div', { style: { fontWeight: 600, marginBottom: '6px' } }, '⚠️ Cron UI error:'),
+              React.createElement('div', { style: { fontSize: '12px', wordBreak: 'break-all' } }, String((this.state.error && this.state.error.message) || this.state.error)),
+              React.createElement('button', {
+                type: 'button',
+                className: 'dsh-cron-btn-secondary',
+                style: { marginTop: '10px', fontSize: '12px', padding: '4px 10px' },
+                onClick: () => this.setState({ hasError: false, error: null })
+              }, 'Retry')
+            );
+          }
+          return (this.props && this.props.children) || null;
+        }
+      };
+    }
+    const ErrorBoundary = createErrorBoundary();
+
+    const AGENT_FORM_TYPES = ['llm', 'skill', 'workflow'];
+    const CODE_FORM_TYPES = ['script', 'node', 'python', 'ssh', 'docker'];
+
+    // Delivery channels (#26) — must stay in sync with lib/channels.js.
+    const DELIVERY_CHANNELS = ['telegram', 'kanban', 'discord', 'slack', 'ntfy', 'bark', 'pushplus', 'tts', 'gitea'];
+    const CHANNEL_LABEL_KEYS = {
+      telegram: 'form.channelTelegram',
+      kanban: 'form.channelKanban',
+      discord: 'form.channelDiscord',
+      slack: 'form.channelSlack',
+      ntfy: 'form.channelNtfy',
+      bark: 'form.channelBark',
+      pushplus: 'form.channelPushplus',
+      tts: 'form.channelTts',
+      gitea: 'form.channelGitea',
+    };
+
+    // Non-secret delivery settings shown in the settings panel. Secrets are
+    // referenced by credential name only (#51) — never typed as values.
+    const DELIVERY_SETTING_FIELDS = [
+      { key: 'botTokenRef', labelKey: 'settings.botTokenRefLabel', placeholderKey: 'settings.botTokenRefPlaceholder', group: 'secrets' },
+      { key: 'ntfyTokenRef', labelKey: 'settings.ntfyTokenRefLabel', group: 'secrets' },
+      { key: 'pushplusTokenRef', labelKey: 'settings.pushplusTokenRefLabel', group: 'secrets' },
+      { key: 'giteaTokenRef', labelKey: 'settings.giteaTokenRefLabel', group: 'secrets' },
+      // The external API is the one surface where a typed secret is the point:
+      // a CI job cannot present a credential reference (#54).
+      { key: 'apiToken', labelKey: 'settings.apiTokenLabel', placeholderKey: 'settings.apiTokenPlaceholder', group: 'secrets' },
+      { key: 'discordWebhookUrl', labelKey: 'settings.discordLabel', group: 'channels' },
+      { key: 'slackWebhookUrl', labelKey: 'settings.slackLabel', group: 'channels' },
+      { key: 'ntfyUrl', labelKey: 'settings.ntfyUrlLabel', group: 'channels' },
+      { key: 'ntfyTopic', labelKey: 'settings.ntfyTopicLabel', group: 'channels' },
+      { key: 'barkServerUrl', labelKey: 'settings.barkServerLabel', group: 'channels' },
+      { key: 'barkKey', labelKey: 'settings.barkKeyLabel', group: 'channels' },
+      { key: 'pushplusUrl', labelKey: 'settings.pushplusUrlLabel', group: 'channels' },
+      { key: 'ttsBaseUrl', labelKey: 'settings.ttsBaseUrlLabel', group: 'channels' },
+      { key: 'giteaBaseUrl', labelKey: 'settings.giteaBaseUrlLabel', group: 'channels' },
+      { key: 'giteaRepo', labelKey: 'settings.giteaRepoLabel', group: 'channels' },
+      { key: 'deliveryTimeoutMs', labelKey: 'settings.deliveryTimeoutMsLabel', group: 'channels', numeric: true, defaultValue: 15000, min: 1000 },
+      { key: 'silentRuleModel', labelKey: 'settings.silentRuleModelLabel', group: 'automation' },
+      { key: 'inspectorModel', labelKey: 'settings.inspectorModelLabel', group: 'automation' },
+    ];
+    const DELIVERY_SETTING_KEYS = DELIVERY_SETTING_FIELDS.map((f) => f.key);
+    // The global template plus the per-channel override map (server model).
+    const TEMPLATE_SETTING_KEYS = ['template', 'channelTemplates'];
+
+    /** Collect every delivery key the settings endpoints may return. */
+    function parseEnvText(text) {
+      const env = {};
+      for (const rawLine of String(text || '').split('\n')) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith('#')) continue;
+        const idx = line.indexOf('=');
+        if (idx <= 0) continue;
+        const key = line.slice(0, idx).trim();
+        const value = line.slice(idx + 1).trim();
+        if (key) env[key] = value;
+      }
+      return Object.keys(env).length ? env : undefined;
+    }
+
+    function formatEnvText(env) {
+      if (!env || typeof env !== 'object') return '';
+      return Object.entries(env).map(([k, v]) => `${k}=${v}`).join('\n');
+    }
+
+    // Status colors: core semantic state tokens first (same set dsh-clinebot
+    // uses), plugin fallbacks as a single point of change (#105).
     function createToggle() {
       let open = false;
       const listeners = new Set();
@@ -1088,6 +998,7 @@ window.__ModuleLoader__.load({
           }
         }
       }
+      console.warn('[dsh-cron] could not open session in workspace:', sessionId);
       return false;
     }
 
@@ -1112,6 +1023,102 @@ window.__ModuleLoader__.load({
       return (typeof t === 'function' ? t : translate)(key, vars);
     }
 
+    function pickDeliverySettings(source) {
+      const out = {};
+      for (const key of DELIVERY_SETTING_KEYS.concat(TEMPLATE_SETTING_KEYS)) {
+        if (source && source[key] !== undefined && source[key] !== null) out[key] = source[key];
+      }
+      if (out.channelTemplates && typeof out.channelTemplates === 'object') {
+        out.channelTemplates = Object.assign({}, out.channelTemplates);
+      }
+      return out;
+    }
+
+    /**
+     * Shared delivery form used by both the task panel modal and the plugin
+     * settings card, so a new channel is added in exactly one place.
+     * Sections collapse via the canonical aria-expanded head contract.
+     */
+    function renderDeliverySettings({ T, values, onChange, onChannelTemplate, sections, onToggleSection }) {
+      const val = (key) => (values[key] === undefined || values[key] === null ? '' : String(values[key]));
+      const field = (f) => React.createElement('div', { className: 'dsh-cron-form-group', key: f.key, style: { marginBottom: '10px' } },
+        React.createElement('label', null, T(f.labelKey)),
+        React.createElement('input', f.numeric ? {
+          type: 'number',
+          min: f.min !== undefined ? f.min : 1000,
+          step: 1000,
+          value: val(f.key),
+          placeholder: String(f.defaultValue !== undefined ? f.defaultValue : 15000),
+          // #115: clearing the field must send the explicit default. Deleting the
+          // key would leave the previously stored value in place (the settings
+          // scope skips absent keys), so the field would silently keep 1 ms.
+          onChange: (e) => onChange(f.key, e.target.value === ''
+            ? (f.defaultValue !== undefined ? f.defaultValue : 15000)
+            : Number(e.target.value)),
+        } : {
+          type: 'text',
+          value: val(f.key),
+          placeholder: f.placeholderKey ? T(f.placeholderKey) : '',
+          onChange: (e) => onChange(f.key, e.target.value)
+        })
+      );
+      const section = (key, titleKey, children) => {
+        const open = Boolean(sections[key]);
+        return React.createElement('div', { className: 'dsh-cron-section', key },
+          React.createElement('button', {
+            type: 'button',
+            className: 'dsh-cron-section-head',
+            'aria-expanded': open ? 'true' : 'false',
+            onClick: () => onToggleSection(key)
+          },
+            React.createElement('span', null, T(titleKey)),
+            React.createElement('span', { className: 'dsh-cron-section-chevron', 'data-open': open ? 'true' : 'false' }, '▾')
+          ),
+          open && React.createElement('div', { className: 'dsh-cron-section-body' }, children)
+        );
+      };
+
+      return [
+        section('secrets', 'settings.secretsSection', [
+          React.createElement('div', { className: 'dsh-cron-hint', key: 'hint', style: { marginBottom: '10px' } }, T('settings.secretsHint')),
+          ...DELIVERY_SETTING_FIELDS.filter((f) => f.group === 'secrets').map(field),
+        ]),
+        section('channels', 'settings.deliverySection', [
+          React.createElement('div', { className: 'dsh-cron-form-row', key: 'row' },
+            ...DELIVERY_SETTING_FIELDS.filter((f) => f.group === 'channels').map(field)
+          ),
+        ]),
+        section('automation', 'settings.automationSection', [
+          React.createElement('div', { className: 'dsh-cron-hint', key: 'hint', style: { marginBottom: '10px' } }, T('settings.automationHint')),
+          React.createElement('div', { className: 'dsh-cron-form-row', key: 'row' },
+            ...DELIVERY_SETTING_FIELDS.filter((f) => f.group === 'automation').map(field)
+          ),
+        ]),
+        section('templates', 'settings.templatesSection', [
+          React.createElement('div', { className: 'dsh-cron-form-group', key: 'global', style: { marginBottom: '10px' } },
+            React.createElement('label', null, T('settings.templateLabel')),
+            React.createElement('input', {
+              type: 'text',
+              value: val('template'),
+              onChange: (e) => onChange('template', e.target.value)
+            }),
+            React.createElement('div', { className: 'dsh-cron-hint' }, T('settings.templateHint'))
+          ),
+          React.createElement('div', { className: 'dsh-cron-form-row', key: 'perchannel' },
+            ...DELIVERY_CHANNELS.map((id) => React.createElement('div', { className: 'dsh-cron-form-group', key: id, style: { marginBottom: '10px' } },
+              React.createElement('label', null, T('settings.channelTemplateLabel', { channel: T(CHANNEL_LABEL_KEYS[id]) })),
+              React.createElement('input', {
+                type: 'text',
+                value: (values.channelTemplates && values.channelTemplates[id]) || '',
+                onChange: (e) => onChannelTemplate(id, e.target.value)
+              })
+            ))
+          ),
+        ]),
+      ];
+    }
+
+    /** Parse a KEY=VALUE textarea into the task env object (#38). */
     function CronScreen(props) {
       const { ctx, toggle, onClose } = props;
       const t = props.t || translate;
@@ -2216,11 +2223,11 @@ window.__ModuleLoader__.load({
                           title: T_KEY(t, 'list.configManagedHint')
                         }, T_KEY(t, 'list.configManaged')) : null,
                         task.lastDurationMs > 0 ? React.createElement('span', { className: 'dsh-cron-cost-tag', title: 'Last execution duration' }, task.lastDurationMs + 'ms') : null,
-                        task.onSuccess ? React.createElement('span', { className: 'dsh-cron-type-tag', title: 'On success: triggers ' + task.onSuccess, style: { background: 'rgba(56, 189, 248, 0.15)', color: '#38bdf8' } }, '➜ ' + task.onSuccess) : null,
-                        task.onFailure ? React.createElement('span', { className: 'dsh-cron-type-tag', title: 'On failure: triggers ' + task.onFailure, style: { background: 'rgba(239, 68, 68, 0.15)', color: '#ef4444' } }, '↳ ' + task.onFailure) : null,
-                        task.heartbeatIntervalSeconds > 0 ? React.createElement('span', { className: 'dsh-cron-type-tag', title: 'Heartbeat: every ' + task.heartbeatIntervalSeconds + 's', style: { background: 'rgba(168, 85, 247, 0.15)', color: '#a855f7' } }, '💓 ' + task.heartbeatIntervalSeconds + 's') : null,
-                        task.targetSessionId ? React.createElement('span', { className: 'dsh-cron-type-tag', title: 'Target session: ' + task.targetSessionId + (task.targetSessionReset && task.targetSessionReset !== 'never' ? ' (' + task.targetSessionReset + ')' : ''), style: { background: 'rgba(99, 102, 241, 0.15)', color: '#818cf8' } }, '🧵 ' + task.targetSessionId) : null,
-                        task.preflightType && task.preflightType !== 'none' ? React.createElement('span', { className: 'dsh-cron-type-tag', title: 'Preflight: ' + task.preflightType, style: { background: 'rgba(234, 179, 8, 0.15)', color: '#eab308' } }, '🛡️ ' + task.preflightType) : null,
+                        task.onSuccess ? React.createElement('span', { className: 'dsh-cron-type-tag dsh-cron-tag-success', title: 'On success: triggers ' + task.onSuccess }, '➜ ' + task.onSuccess) : null,
+                        task.onFailure ? React.createElement('span', { className: 'dsh-cron-type-tag dsh-cron-tag-failure', title: 'On failure: triggers ' + task.onFailure }, '↳ ' + task.onFailure) : null,
+                        task.heartbeatIntervalSeconds > 0 ? React.createElement('span', { className: 'dsh-cron-type-tag dsh-cron-tag-heartbeat', title: 'Heartbeat: every ' + task.heartbeatIntervalSeconds + 's' }, '💓 ' + task.heartbeatIntervalSeconds + 's') : null,
+                        task.targetSessionId ? React.createElement('span', { className: 'dsh-cron-type-tag dsh-cron-tag-session', title: 'Target session: ' + task.targetSessionId + (task.targetSessionReset && task.targetSessionReset !== 'never' ? ' (' + task.targetSessionReset + ')' : '') }, '🧵 ' + task.targetSessionId) : null,
+                        task.preflightType && task.preflightType !== 'none' ? React.createElement('span', { className: 'dsh-cron-type-tag dsh-cron-tag-preflight', title: 'Preflight: ' + task.preflightType }, '🛡️ ' + task.preflightType) : null,
                         task.totalCostUsd > 0 ? React.createElement('span', { className: 'dsh-cron-cost-tag' }, '$' + task.totalCostUsd.toFixed(4)) : null,
                         task.totalTokens > 0 ? React.createElement('span', { className: 'dsh-cron-tokens-tag' }, (task.totalTokens > 1000 ? Math.round(task.totalTokens / 1000) + 'k' : task.totalTokens) + ' tok') : null
                       ),
@@ -3316,6 +3323,65 @@ window.__ModuleLoader__.load({
       const [testInfo, setTestInfo] = React.useState(null);
       // Collapsed by default, head is the toggle (canonical card contract, #100)
       const [cardOpen, setCardOpen] = React.useState(false);
+      const [updateState, setUpdateState] = React.useState({
+        checking: false,
+        updating: false,
+        currentVersion: '0.2.17',
+        latestVersion: undefined,
+        updateAvailable: false,
+        notice: null,
+        error: null
+      });
+
+      const checkUpdates = async () => {
+        setUpdateState(prev => ({ ...prev, checking: true, error: null, notice: null }));
+        try {
+          const res = await fetch('/api/dsh-cron/update');
+          const data = await res.json();
+          if (data && data.currentVersion) {
+            setUpdateState(prev => ({
+              ...prev,
+              checking: false,
+              currentVersion: data.currentVersion,
+              latestVersion: data.latestVersion,
+              updateAvailable: Boolean(data.updateAvailable),
+              error: data.latestCheckFailed ? 'Registry check failed' : null
+            }));
+          } else {
+            setUpdateState(prev => ({ ...prev, checking: false, error: data.error || 'Check failed' }));
+          }
+        } catch (err) {
+          setUpdateState(prev => ({ ...prev, checking: false, error: err.message }));
+        }
+      };
+
+      const runUpdate = async () => {
+        setUpdateState(prev => ({ ...prev, updating: true, error: null, notice: null }));
+        try {
+          const res = await fetch('/api/dsh-cron/update', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', 'x-dsh-plugin-update': '1' }
+          });
+          const data = await res.json();
+          if (data && data.updated) {
+            setUpdateState(prev => ({
+              ...prev,
+              updating: false,
+              updateAvailable: false,
+              currentVersion: data.updatedVersion || data.latestVersion,
+              notice: T_KEY(t, 'updater.success', { version: data.updatedVersion || data.latestVersion })
+            }));
+          } else {
+            setUpdateState(prev => ({
+              ...prev,
+              updating: false,
+              error: data.error || data.message || 'Update failed'
+            }));
+          }
+        } catch (err) {
+          setUpdateState(prev => ({ ...prev, updating: false, error: err.message }));
+        }
+      };
 
       // Settings snapshot status (#102): never render phantom inputs before
       // the snapshot arrives; offer a retry when it is unavailable.
@@ -3521,6 +3587,57 @@ window.__ModuleLoader__.load({
             'data-type': testInfo.success ? 'success' : 'error',
             style: { margin: 0, padding: '8px 12px' }
           }, testInfo.message),
+          React.createElement('div', {
+            className: 'dsh-cron-form-group',
+            style: {
+              background: 'var(--dsw-alias-bg-layer-2, rgba(255,255,255,0.03))',
+              border: '1px solid var(--dsw-alias-border-l2, rgba(255,255,255,0.08))',
+              borderRadius: '8px',
+              padding: '14px',
+              marginBottom: '16px'
+            }
+          },
+            React.createElement('div', {
+              style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center', marginBottom: '8px' }
+            },
+              React.createElement('div', { style: { fontWeight: '600', fontSize: '14px' } }, `🚀 ${T_KEY(t, 'updater.title')}`),
+              React.createElement('div', { style: { display: 'flex', gap: '8px' } },
+                React.createElement('button', {
+                  type: 'button',
+                  className: 'dsh-cron-btn-secondary',
+                  style: { padding: '4px 10px', fontSize: '12px' },
+                  disabled: updateState.checking || updateState.updating,
+                  onClick: checkUpdates
+                }, updateState.checking ? T_KEY(t, 'updater.checking') : T_KEY(t, 'updater.btnCheck')),
+                updateState.updateAvailable ? React.createElement('button', {
+                  type: 'button',
+                  className: 'dsh-cron-btn-primary',
+                  style: { padding: '4px 10px', fontSize: '12px' },
+                  disabled: updateState.updating,
+                  onClick: runUpdate
+                }, updateState.updating ? T_KEY(t, 'updater.updating') : T_KEY(t, 'updater.btnUpdate', { version: updateState.latestVersion })) : null
+              )
+            ),
+            React.createElement('div', {
+              style: { fontSize: '12px', color: 'var(--dsw-alias-label-secondary, #999)', marginBottom: '8px' }
+            }, T_KEY(t, 'updater.desc')),
+            React.createElement('div', {
+              style: { display: 'flex', alignItems: 'center', gap: '12px', fontSize: '13px' }
+            },
+              React.createElement('span', { style: { color: 'var(--dsw-alias-label-secondary, #aaa)' } },
+                T_KEY(t, 'updater.current', { version: updateState.currentVersion })
+              ),
+              updateState.checking ? React.createElement('span', { className: 'dsh-cron-badge dsh-cron-badge-info' }, T_KEY(t, 'updater.checking')) :
+              updateState.updateAvailable ? React.createElement('span', { className: 'dsh-cron-badge dsh-cron-badge-warn' }, T_KEY(t, 'updater.available', { version: updateState.latestVersion })) :
+              updateState.currentVersion && !updateState.error ? React.createElement('span', { className: 'dsh-cron-badge dsh-cron-badge-ok' }, `✓ ${T_KEY(t, 'updater.upToDate')}`) : null
+            ),
+            updateState.notice ? React.createElement('div', {
+              style: { marginTop: '8px', color: 'var(--dsw-alias-success, #10b981)', fontSize: '12px' }
+            }, updateState.notice) : null,
+            updateState.error ? React.createElement('div', {
+              style: { marginTop: '8px', color: 'var(--dsw-alias-error, #ef4444)', fontSize: '12px' }
+            }, updateState.error) : null
+          ),
           React.createElement('div', { style: { display: 'flex', gap: '8px', alignItems: 'center', flexWrap: 'wrap', marginTop: '4px' } },
             React.createElement('button', {
               type: 'submit',

package/lib/failure-inspector.js

@@ -13,7 +13,7 @@
 import { askModel, parseJsonAnswer, resolveAskTarget } from './llm-ask.js';
 
 /** Agent-mediated tasks have a prompt worth revising. */
-export const INSPECTABLE_TASK_TYPES = ['llm', 'skill', 'workflow'];
+const INSPECTABLE_TASK_TYPES = ['llm', 'skill', 'workflow'];
 
 export function supportsInspection(task) {
   const type = String((task && task.type) || 'llm');
@@ -98,10 +98,4 @@ export async function inspectFailure({ task, runInfo, ask, preferredModel, timeo
   }
 }
 
-/** Ask helper bound to a context, used by the scheduler. */
-export function makeInspectAsk(ctx) {
-  return async ({ prompt, system, preferredModel, maxTokens, timeoutMs, task }) => {
-    const target = resolveAskTarget(ctx, task || {}, preferredModel);
-    return askModel(ctx, { ...target, prompt, system, maxTokens, timeoutMs });
-  };
-}
+// makeInspectAsk removed (#155) — scheduler uses makeAsk(ctx) from lib/llm-ask.js

package/lib/index.js

@@ -1,3 +1,5 @@
+import { registerPluginUpdater } from './updater.js';
+import { credentialRefStatus } from './secrets.js';
 import { TaskStore } from './store.js';
 import { TaskScheduler, parseScheduleExpression } from './scheduler.js';
 import { SessionRunner } from './runner.js';
@@ -165,6 +167,15 @@ export function sanitizeSettingsPayload(body) {
       delete payload[key];
     }
   }
+  for (const key of ['botTokenRef', 'barkKeyRef', 'giteaTokenRef']) {
+    if (key in payload && typeof payload[key] === 'string' && payload[key].trim()) {
+      const refCheck = credentialRefStatus(payload[key]);
+      if (!refCheck.ok) {
+        console.warn(`[dsh-cron] invalid credential reference in "${key}": ${refCheck.error}`);
+        delete payload[key];
+      }
+    }
+  }
   for (const key of TaskStore.FORBIDDEN_SETTING_KEYS) {
     if (key in payload) {
       console.warn(`[dsh-cron] refusing raw secret "${key}" from the client — use a credential reference`);
@@ -378,6 +389,13 @@ export function apply(ctx, config) {
   // #48: the recipe hub is the single source of the panel's suggestions.
   const recommendations = recipeRecommendations();
 
+  // Auto-updater route (#147)
+  ctx.effect(() => registerPluginUpdater(ctx, {
+    endpoint: '/api/dsh-cron/update',
+    packageName: '@goodandready/dsh-cron',
+    manifestUrl: new URL('../package.json', import.meta.url),
+  }), 'dsh-cron: /api/dsh-cron/update');
+
   // 1. REST API — collection (list/create) + item actions in one prefix
   // handler per route family; registered WITHOUT the trailing slash (#96)
   ctx.effect(() => ctx.webServer.register({

package/lib/recipes.js

@@ -34,7 +34,7 @@ export const RECIPE_CATEGORIES = [
  * packages, users and permissions, scheduling and the network edge, power state
  * and writes outside the working tree.
  */
-export const DESTRUCTIVE_PATTERNS = [
+const DESTRUCTIVE_PATTERNS = [
   /\brm\b/i,
   /\bunlink\b/i,
   /\bshred\b/i,

package/lib/runtimes.js

@@ -10,7 +10,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 
 export const EXTERNAL_RUNTIMES = ['script', 'node', 'python', 'http', 'ssh', 'docker'];
-export const AGENT_RUNTIMES = ['llm', 'skill', 'workflow'];
+const AGENT_RUNTIMES = ['llm', 'skill', 'workflow'];
 export const TASK_TYPES = [...AGENT_RUNTIMES, ...EXTERNAL_RUNTIMES];
 
 /** Types that execute code and therefore need the HTTP confirm header. */
@@ -56,7 +56,7 @@ export function buildNodeInvocation(task, cwd) {
 }
 
 /** Find the Python interpreter, preferring a task virtualenv, then the workspace one. */
-export function detectPython(task, cwd) {
+function detectPython(task, cwd) {
   if (task.pythonPath) return task.pythonPath;
   const candidates = [];
   if (process.env.VIRTUAL_ENV) {

package/lib/scheduler.js

@@ -6,10 +6,10 @@ import { applySilentRule } from './silent-rule.js';
 import { inspectFailure } from './failure-inspector.js';
 
 /** Task types that talk to a model and can therefore use a fallback model. */
-export const AGENT_TASK_TYPES = ['llm', 'skill', 'workflow'];
+const AGENT_TASK_TYPES = ['llm', 'skill', 'workflow'];
 
 /** Sum two usage records, so a fallback attempt is not lost in accounting. */
-export function addUsage(a, b) {
+function addUsage(a, b) {
   return {
     inputTokens: (a?.inputTokens || 0) + (b?.inputTokens || 0),
     outputTokens: (a?.outputTokens || 0) + (b?.outputTokens || 0),

package/lib/silent-rule.js

@@ -15,7 +15,7 @@
 import { askModel, parseJsonAnswer, resolveAskTarget } from './llm-ask.js';
 
 /** Task types whose runs produce output a rule can judge. */
-export const SILENT_RULE_TASK_TYPES = ['script', 'node', 'python', 'http'];
+const SILENT_RULE_TASK_TYPES = ['script', 'node', 'python', 'http'];
 
 export function supportsSilentRule(task) {
   return SILENT_RULE_TASK_TYPES.includes(String(task && task.type ? task.type : 'script'));
@@ -64,6 +64,9 @@ export async function applySilentRule({ task, runInfo, ask, preferredModel, time
   if (!task || !task.silentRule || String(task.silentRule).trim() === '') {
     return { skipped: false, reason: '' };
   }
+  if (!supportsSilentRule(task)) {
+    return { skipped: false, reason: '', note: 'task type does not support silent rule' };
+  }
   if ((runInfo && runInfo.status) !== 'success') {
     return { skipped: false, reason: '', note: 'the rule only judges successful runs' };
   }

package/lib/telegram.js

@@ -79,7 +79,7 @@ export function getDshDefaultTelegramCredentials() {
 /**
  * Escape markdown special characters for Telegram legacy markdown.
  */
-export function escapeMarkdown(str) {
+function escapeMarkdown(str) {
   if (!str) return '';
   return String(str).replace(/[_*[\]()~`>#+\-=|{}.!]/g, '\\$&');
 }

package/lib/updater.js

@@ -0,0 +1,237 @@
+import { spawn } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { basename, dirname, isAbsolute, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { rejectCrossOrigin } from './http-utils.js';
+
+const UPDATE_TIMEOUT_MS = 10 * 60_000;
+const VERSION_CACHE_MS = 5 * 60_000;
+let latestCache = null;
+
+function validProfileName(value) {
+  return typeof value === 'string' && value !== '' && value !== '.' && value !== '..'
+    && !value.includes('/') && !value.includes('\\') && !/[\0-\x1f\x7f]/.test(value);
+}
+
+function profileNameFromArgv(argv) {
+  for (let index = 2; index < argv.length; index += 1) {
+    if (argv[index] === '--profile' || argv[index] === '-p') return argv[index + 1];
+    if (argv[index]?.startsWith('--profile=')) return argv[index].slice('--profile='.length);
+  }
+  return argv[2] === 'web' ? 'web' : undefined;
+}
+
+function findDshCliEntry() {
+  const value = process.argv[1];
+  if (value === undefined || value === '') return undefined;
+  const entry = value.startsWith('file:') ? fileURLToPath(value) : resolve(process.cwd(), value);
+  if (!existsSync(entry)) return undefined;
+  for (let directory = dirname(entry); ; directory = dirname(directory)) {
+    const manifestPath = resolve(directory, 'package.json');
+    if (existsSync(manifestPath)) {
+      try {
+        const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+        const bin = typeof manifest.bin === 'string'
+          ? manifest.bin
+          : typeof manifest.bin === 'object' && manifest.bin !== null
+            ? manifest.bin.dsh
+            : undefined;
+        if (manifest.name === '@deepseek-ai/dsh' && typeof bin === 'string'
+          && !isAbsolute(bin) && resolve(directory, bin) === resolve(entry)) return entry;
+      } catch {
+        // Continue searching parent directories
+      }
+    }
+    const parent = dirname(directory);
+    if (parent === directory) return undefined;
+  }
+}
+
+export function runtime() {
+  const profileDir = resolve(process.env.DSH_PROFILE_DIR
+    ?? resolve(homedir(), '.dsh', 'profiles', 'web'));
+  const selected = profileNameFromArgv(process.argv);
+  const profileName = validProfileName(selected)
+    ? selected
+    : validProfileName(basename(profileDir)) ? basename(profileDir) : 'web';
+  const cliEntry = findDshCliEntry();
+  return cliEntry === undefined ? { profileName, profileDir } : { profileName, profileDir, cliEntry };
+}
+
+export function parseSemver(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(String(value || '').trim());
+  if (match === null) return undefined;
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    prerelease: match[4]?.split('.') ?? [],
+  };
+}
+
+function comparePrerelease(left, right) {
+  if (left.length === 0 || right.length === 0) return left.length === right.length ? 0 : left.length === 0 ? 1 : -1;
+  const length = Math.max(left.length, right.length);
+  for (let index = 0; index < length; index += 1) {
+    const a = left[index];
+    const b = right[index];
+    if (a === undefined || b === undefined) return a === b ? 0 : a === undefined ? -1 : 1;
+    if (a === b) continue;
+    const aNumeric = /^\d+$/.test(a);
+    const bNumeric = /^\d+$/.test(b);
+    if (aNumeric && bNumeric) {
+      const aNumber = BigInt(a);
+      const bNumber = BigInt(b);
+      if (aNumber !== bNumber) return aNumber > bNumber ? 1 : -1;
+      continue;
+    }
+    if (aNumeric !== bNumeric) return aNumeric ? -1 : 1;
+    return a > b ? 1 : -1;
+  }
+  return 0;
+}
+
+export function isNewerVersion(currentValue, candidateValue) {
+  const current = parseSemver(currentValue);
+  const candidate = parseSemver(candidateValue);
+  if (current === undefined || candidate === undefined) return false;
+  for (let index = 0; index < 3; index += 1) {
+    if (candidate.core[index] !== current.core[index]) return candidate.core[index] > current.core[index];
+  }
+  return comparePrerelease(candidate.prerelease, current.prerelease) > 0;
+}
+
+export async function latestVersion(packageName, registry = 'https://registry.npmjs.org') {
+  if (latestCache?.packageName === packageName && latestCache.registry === registry && Date.now() < latestCache.expiresAt) {
+    return latestCache.version;
+  }
+  try {
+    const cleanReg = registry.replace(/\/$/, '');
+    const response = await fetch(`${cleanReg}/${encodeURIComponent(packageName)}/latest`, {
+      signal: AbortSignal.timeout(8000),
+      headers: { accept: 'application/json' },
+    });
+    if (!response.ok) return undefined;
+    const value = await response.json();
+    if (typeof value.version !== 'string' || value.version === '') return undefined;
+    latestCache = { packageName, registry, version: value.version, expiresAt: Date.now() + VERSION_CACHE_MS };
+    return value.version;
+  } catch {
+    return undefined;
+  }
+}
+
+export async function currentVersion(manifestUrl) {
+  const raw = await readFile(manifestUrl, 'utf8');
+  const value = JSON.parse(raw);
+  if (typeof value.version !== 'string' || value.version === '') throw new Error('Cannot read current plugin version.');
+  return value.version;
+}
+
+export async function getUpdateStatus(options, target = runtime()) {
+  const current = await currentVersion(options.manifestUrl);
+  const latest = await latestVersion(options.packageName, options.registry ?? 'https://registry.npmjs.org');
+  return {
+    packageName: options.packageName,
+    currentVersion: current,
+    ...(latest === undefined ? {} : { latestVersion: latest }),
+    latestCheckFailed: latest === undefined,
+    updateAvailable: latest !== undefined && isNewerVersion(current, latest),
+    profileName: target.profileName,
+    canAutoUpdate: target.cliEntry !== undefined,
+  };
+}
+
+export async function installExact(target, packageSpec, options = {}) {
+  if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.');
+  return new Promise((resolvePromise, reject) => {
+    // IMPORTANT: As required by #147, do NOT add minimumReleaseAge bypass
+    const args = [
+      target.cliEntry, 'plugin', '--profile', target.profileName, 'add',
+      packageSpec,
+      `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
+    ];
+    const child = spawn(process.execPath, args, {
+      cwd: target.profileDir,
+      windowsHide: true,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, NO_COLOR: '1' },
+    });
+    let detail = '';
+    child.stdout?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4000); });
+    child.stderr?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4000); });
+    const timer = setTimeout(() => {
+      child.kill();
+      reject(new Error('Update timed out; use the normal DSH update flow.'));
+    }, UPDATE_TIMEOUT_MS);
+    child.once('error', error => { clearTimeout(timer); reject(error); });
+    child.once('exit', code => {
+      clearTimeout(timer);
+      if (code === 0) resolvePromise();
+      else reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`));
+    });
+  });
+}
+
+export function registerPluginUpdater(ctx, options) {
+  let installing = false;
+  return ctx.webServer.register({
+    kind: 'exact',
+    path: options.endpoint || '/api/dsh-cron/update',
+    handler: async (req, res) => {
+      try {
+        const target = runtime();
+        if (req.method === 'GET' || req.method === 'HEAD') {
+          const payload = await getUpdateStatus(options, target);
+          res.writeHead(200, {
+            'content-type': 'application/json; charset=utf-8',
+            'cache-control': 'no-store',
+          });
+          res.end(req.method === 'HEAD' ? undefined : JSON.stringify(payload));
+          return;
+        }
+        if (req.method !== 'POST') {
+          res.writeHead(405, { allow: 'GET, HEAD, POST' });
+          res.end();
+          return;
+        }
+        if (rejectCrossOrigin(req, res)) {
+          return;
+        }
+        if (installing) {
+          res.writeHead(409, { 'content-type': 'application/json; charset=utf-8' });
+          res.end(JSON.stringify({ ok: false, error: 'This plugin is already updating.' }));
+          return;
+        }
+        installing = true;
+        try {
+          const before = await getUpdateStatus(options, target);
+          if (before.latestVersion === undefined) {
+            res.writeHead(503, { 'content-type': 'application/json; charset=utf-8' });
+            res.end(JSON.stringify({ ok: false, error: 'The latest version is temporarily unavailable.' }));
+            return;
+          }
+          if (!before.updateAvailable) {
+            res.writeHead(200, { 'content-type': 'application/json; charset=utf-8' });
+            res.end(JSON.stringify({ ...before, updated: false, message: 'Already up to date.' }));
+            return;
+          }
+          await installExact(target, `${options.packageName}@${before.latestVersion}`, options);
+          res.writeHead(200, { 'content-type': 'application/json; charset=utf-8' });
+          res.end(JSON.stringify({
+            ...before,
+            updated: true,
+            updatedVersion: before.latestVersion,
+            restartRequired: true,
+          }));
+        } finally {
+          installing = false;
+        }
+      } catch (error) {
+        (ctx.logger || console).warn?.(`[dsh-cron] plugin updater failed: ${String(error)}`);
+        res.writeHead(503, { 'content-type': 'application/json; charset=utf-8' });
+        res.end(JSON.stringify({ ok: false, error: 'Plugin update failed; see server logs.' }));
+      }
+    },
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cron",
-  "version": "0.2.15",
+  "version": "0.2.17",
   "description": "Scheduled cron tasks, background automation and agent execution for DeepSeek Harness.",
   "type": "module",
   "main": "lib/index.js",
@@ -11,13 +11,15 @@
     "./package.json": "./package.json"
   },
   "files": [
-    "lib/",
+    "lib/*.js",
     "cordis.patch.yml",
     "README.md",
     "LICENSE"
   ],
   "scripts": {
-    "test": "node --test test/*.test.mjs"
+    "test": "node --test test/*.test.mjs",
+    "build:client": "node scripts/build-client.mjs",
+    "pretest": "node scripts/build-client.mjs"
   },
   "keywords": [
     "dsh",