@goodandready/dsh-cron 0.2.18 → 0.2.20

package/README.md

@@ -392,6 +392,15 @@ Developer-facing, no behaviour change. `parseScheduleExpression` was split into
 
 
 
+### 31. Quality & Preflight Hardening Pack (v0.2.19, #149, #152, #155, #156, #162)
+- **Zero Empty Catch Blocks (#156)**: Implemented `lib/best-effort.js` matching standard architecture with synchronous/asynchronous error suppression, fallback value handling, and optional context logging. Eliminated all 63 empty catch blocks across runner, scheduler, store, and UI client scripts.
+- **CI Workflows & Local Preflight Gate (#162)**: Added automated CI workflows (`.gitea/workflows/ci.yml` and `.github/workflows/ci.yml`) running test suites and enforcing a strict preflight gate (`scripts/ci-preflight.mjs`) that halts on any syntax error, empty catch, theme hardcoding, or leak attempt.
+- **Theme Token Modernization (#149)**: Replaced all remaining raw `rgba(...)` declarations in UI styles and modals with native `color-mix(in srgb, var(--token) N%, transparent)`.
+- **Plugin Manifest Declarations (#152)**: Updated `dsh.client.inject` in `package.json` to declare full package dependencies (`@deepseek-ai/dsh-client-locale`, `@deepseek-ai/dsh-client-ui-slots`).
+- **Production Export Integration (#155)**: Connected test-only exports (`findDestructiveRecipe` in `listRecipes`, `shouldNotifyTask` in `shouldSendToChannel`, and `TEMPLATE_VARIABLES` in `buildTemplateVars`) into active production pipelines.
+
+---
+
 ### 30. Updater Localization in English & Chinese (v0.2.18, #160)
 - **Settings Card Updater Localization (#160)**: Added native translations for all 10 in-app updater keys (`updater.title`, `updater.btnCheck`, `updater.checking`, `updater.btnUpdate`, `updater.updating`, `updater.desc`, `updater.current`, `updater.available`, `updater.upToDate`, `updater.success`) into English (`en`) and Chinese (`zh`) dictionaries in `lib/client-src/10-locales.js`. In accordance with DSH core plugin architecture, Russian localization is maintained externally via `dsh-russian-lang`.
 
@@ -529,7 +538,7 @@ All endpoints are served by the DSH web server under `/dsh-cron/`. Read endpoint
 
 ---
 
-## 🧪 Testing
+## 🧪 Testing & Preflight Verification
 
 Run the automated test suite covering schedule parsing, the scheduler engine, atomic storage, HTTP helpers, notifications and tool contracts:
 
@@ -537,6 +546,12 @@ Run the automated test suite covering schedule parsing, the scheduler engine, at
 npm test
 ```
 
+Run the local preflight gate to verify syntax, zero empty catch blocks, theme token compliance, package boundaries and leak protection:
+
+```bash
+node scripts/ci-preflight.mjs
+```
+
 ---
 
 ## 📄 License

package/README.ru.md

@@ -268,6 +268,15 @@ cron_create_task({
 
 
 
+### 31. Пакет ужесточения стандартов качества и CI (v0.2.19, #149, #152, #155, #156, #162)
+- **Устранение пустых catch (#156)**: Реализован модуль `lib/best-effort.js` по единому стандарту с безопасным выполнением синхронных/асинхронных операций и опциональным логированием. Все 63 пустых catch-блока в планировщике, раннере, хранилище и клиентских фрагментах устранены.
+- **Автоматический CI и локальный гейт Preflight (#162)**: Добавлены workflows непрерывной интеграции (`.gitea/workflows/ci.yml` и `.github/workflows/ci.yml`), проверяющие синтаксис, тесты и запускающие механический аудит `scripts/ci-preflight.mjs` с блокировкой любых отклонений.
+- **Модернизация токенов темы (#149)**: Оставшиеся цвета `rgba(...)` в модальных окнах и карточках переведены на современный стандарт `color-mix(in srgb, var(--токен) N%, transparent)`.
+- **Декларация зависимостей в манифесте (#152)**: В `package.json` поле `dsh.client.inject` переведено на полные имена пакетов Cordis (`@deepseek-ai/dsh-client-locale`, `@deepseek-ai/dsh-client-ui-slots`).
+- **Активация экспортов в рабочем коде (#155)**: Функции `findDestructiveRecipe`, `shouldNotifyTask` и переменные `TEMPLATE_VARIABLES` подключены в активные цепочки работы с рецептами, роутинга уведомлений и рендеринга шаблонов.
+
+---
+
 ### 30. Локализация автообновления на английский и китайский языки (v0.2.18, #160)
 - **Локализация карточки обновления (#160)**: Добавлены нативные переводы для всех 10 ключей модуля автообновления (`updater.title`, `updater.btnCheck`, `updater.checking`, `updater.btnUpdate`, `updater.updating`, `updater.desc`, `updater.current`, `updater.available`, `updater.upToDate`, `updater.success`) в словари английского (`en`) и китайского (`zh`) языков в `lib/client-src/10-locales.js`. В соответствии со стандартами ядра DSH плагин поставляется с EN и ZH словарями, а русская локализация обслуживается через системный плагин `dsh-russian-lang`.
 
@@ -526,13 +535,19 @@ bash deploy.sh verify [exact-version]
 
 ---
 
-## 🧪 Тестирование
+## 🧪 Тестирование и локальная проверка (Preflight)
+
+Запуск автоматического набора тестов (разбор расписаний, движок планировщика, атомарное хранилище, HTTP-хелперы, уведомления и контракт инструментов):
 
 ```bash
 npm test
 ```
 
-Набор покрывает разбор расписаний, движок планировщика, атомарное хранилище, HTTP-хелперы, уведомления и контракт инструментов.
+Локальный запуск гейта стандартов качества (синтаксис, отсутствие пустых catch, соответствие токенам тем оформления, чистота состава npm-пакета и защита от утечек):
+
+```bash
+node scripts/ci-preflight.mjs
+```
 
 ---
 

package/README.zh.md

@@ -391,6 +391,15 @@ bash deploy.sh verify [exact-version]
 
 
 
+### 31. 质量加固与 CI 预检标准包 (v0.2.19, #149, #152, #155, #156, #162)
+- **彻底消除空 catch 块 (#156)**：引入符合标准规范的 `lib/best-effort.js` 模块，全面支持同步/异步安全调用、回退返回值和可选日志记录，清除了 runner、scheduler、store 及客户端中的所有 63 处空 catch 块。
+- **CI 工作流与本地预检门禁 (#162)**：新增自动化 CI 工作流（`.gitea/workflows/ci.yml` 与 `.github/workflows/ci.yml`），集成本地预检门禁脚本 `scripts/ci-preflight.mjs`，在出现语法错误、空 catch、颜色硬编码或信息泄露时自动阻断。
+- **主题设计令牌现代化 (#149)**：将模态对话框与设置卡片中遗留的 `rgba(...)` 全部重构为原生的 `color-mix(in srgb, var(--token) N%, transparent)`。
+- **插件清单注入声明规范化 (#152)**：在 `package.json` 的 `dsh.client.inject` 中统一声明完整的 Cordis 包名（`@deepseek-ai/dsh-client-locale`、`@deepseek-ai/dsh-client-ui-slots`）。
+- **生产管线导出连接 (#155)**：将此前仅在测试中调用的导出（`findDestructiveRecipe`、`shouldNotifyTask` 和 `TEMPLATE_VARIABLES`）全面接入配方过滤、通知分发及模板生成核心逻辑。
+
+---
+
 ### 30. 自更新模块英文与中文多语言支持 (v0.2.18, #160)
 - **设置面板自更新多语言 (#160)**：在 `lib/client-src/10-locales.js` 的英文 (`en`) 与中文 (`zh`) 字典中补全了全部 10 个自更新键值 (`updater.title`, `updater.btnCheck`, `updater.checking`, `updater.btnUpdate`, `updater.updating`, `updater.desc`, `updater.current`, `updater.available`, `updater.upToDate`, `updater.success`)。遵循 DSH 插件规范，插件核心内置英文与中文，俄语多语言由 `dsh-russian-lang` 统一扩展。
 
@@ -526,13 +535,19 @@ dsh-cron:
 
 ---
 
-## 🧪 测试
+## 🧪 测试与预检门禁 (Preflight)
+
+运行全套自动化测试（调度表达式解析、调度器引擎、原子存储、HTTP 辅助函数、通知与工具契约）：
 
 ```bash
 npm test
 ```
 
-测试覆盖调度表达式解析、调度器引擎、原子存储、HTTP 辅助函数、通知与工具契约。
+本地执行质量预检门禁（语法检查、零空 catch 块、主题设计规范、npm 发布归档合规性及防泄漏检查）：
+
+```bash
+node scripts/ci-preflight.mjs
+```
 
 ---
 

package/lib/api-helpers.js

@@ -0,0 +1,68 @@
+import { previewSchedule } from './scheduler.js';
+import { sendJson, readBody, rejectCrossOrigin } from './http-utils.js';
+
+const NOT_ALLOWED = { ok: false, error: 'Method not allowed' };
+
+export function handleHeartbeatPing({ store, req, res, taskId }) {
+  const task = store.get(taskId);
+  if (!task) {
+    sendJson(res, 404, { ok: false, error: 'Task not found' });
+    return;
+  }
+  const result = typeof store.recordHeartbeat === 'function' ? store.recordHeartbeat(taskId) : null;
+  if (!result) {
+    sendJson(res, 500, { ok: false, error: 'Could not record heartbeat' });
+    return;
+  }
+  sendJson(res, 200, result);
+}
+
+export async function handleSchedulePreview({ req, res, url }) {
+  let schedule = '';
+  let timezone = '';
+  let count = 5;
+
+  if (req.method === 'POST') {
+    const { body, error } = await readBody(req, res);
+    if (error) return;
+    schedule = body.schedule || '';
+    timezone = body.timezone || '';
+    count = body.count || 5;
+  } else if (req.method === 'GET') {
+    schedule = url.searchParams.get('schedule') || '';
+    timezone = url.searchParams.get('timezone') || '';
+    count = parseInt(url.searchParams.get('count') || '5', 10);
+  } else {
+    sendJson(res, 405, NOT_ALLOWED);
+    return;
+  }
+
+  if (!schedule) {
+    sendJson(res, 400, { ok: false, error: 'Field "schedule" is required' });
+    return;
+  }
+
+  try {
+    const preview = previewSchedule(schedule, { timezone, count });
+    sendJson(res, 200, { ok: true, ...preview });
+  } catch (err) {
+    sendJson(res, 400, { ok: false, error: err.message });
+  }
+}
+
+export async function handleDryRunTask({ store, scheduler, req, res, id }) {
+  if (rejectCrossOrigin(req, res)) return;
+  const task = store.get(id);
+  if (!task) {
+    sendJson(res, 404, { ok: false, error: 'Task not found' });
+    return;
+  }
+
+  try {
+    const outcome = await scheduler.runTask(id, { dryRun: true });
+    sendJson(res, 200, outcome || { ok: true, status: 'completed' });
+  } catch (err) {
+    sendJson(res, 500, { ok: false, error: err.message });
+  }
+}
+

package/lib/api-import-export.js

@@ -0,0 +1,145 @@
+import { randomUUID } from 'node:crypto';
+import {
+  buildTaskExport,
+  validateImportDocument,
+  planImport,
+  hasCodeExecutingTask,
+  IMPORT_STRATEGIES,
+} from './task-transfer.js';
+import { unknownChannelIds } from './channels.js';
+import {
+  sendJson,
+  readBody,
+  SCRIPT_CONFIRM_HEADER,
+} from './http-utils.js';
+import { MANAGED_BY_CONFIG } from './config-jobs.js';
+
+export function handleTaskExport({ store, res }) {
+  const doc = buildTaskExport(store.list({ status: 'all' }));
+  sendJson(res, 200, { ok: true, document: doc, count: doc.tasks.length });
+}
+
+export async function handleTaskImport({ store, scheduler, req, res }) {
+  const { body, error } = await readBody(req, res);
+  if (error) return;
+  const strategy = IMPORT_STRATEGIES.includes(body && body.strategy) ? body.strategy : 'skip';
+  const checked = validateImportDocument(body && body.document);
+  if (!checked.ok) {
+    sendJson(res, 400, { ok: false, error: checked.error });
+    return;
+  }
+  // The import file is external input: importing code-executing tasks needs
+  // the same explicit confirmation that creating one over HTTP needs,
+  // otherwise a hand-edited file would bypass that gate (#86).
+  if (hasCodeExecutingTask(checked.tasks) && req.headers[SCRIPT_CONFIRM_HEADER] !== 'script') {
+    sendJson(res, 403, {
+      ok: false,
+      error: `Importing code-executing tasks over HTTP requires the ${SCRIPT_CONFIRM_HEADER}: script header`,
+    });
+    return;
+  }
+  // #121: an imported file may name a channel this build no longer has. The
+  // import stays tolerant by design (#42), but the loss is reported instead of
+  // being invisible.
+  const rawTasks = Array.isArray(body.document && body.document.tasks) ? body.document.tasks : [];
+  const droppedChannels = [];
+  for (const item of rawTasks) {
+    for (const id of unknownChannelIds(item.channels)) {
+      if (!droppedChannels.includes(id)) droppedChannels.push(id);
+    }
+  }
+  if (droppedChannels.length) {
+    console.warn('[dsh-cron] import: unknown channel ids were dropped: ' + droppedChannels.join(', '));
+  }
+  const existingIds = store.list({ status: 'all' }).map((x) => x.id);
+  const plan = planImport(checked.tasks, existingIds, strategy);
+  // Replacing a task the config owns would be undone at the next start, and
+  // the id could then hold two different tasks (#50).
+  const configConflicts = plan.replace
+    .map((item) => item.id)
+    .filter((taskId) => {
+      const stored = store.get(taskId);
+      return stored && stored.managedBy === MANAGED_BY_CONFIG;
+    });
+  if (configConflicts.length) {
+    sendJson(res, 409, {
+      ok: false,
+      error: 'These tasks are declared in the profile config and cannot be replaced by an import: ' + configConflicts.join(', '),
+    });
+    return;
+  }
+  const summary = { add: plan.add.length, replace: plan.replace.length, skip: plan.skip.length };
+  if (body && body.dryRun) {
+    sendJson(res, 200, {
+      ok: true,
+      dryRun: true,
+      strategy: plan.strategy,
+      summary,
+      codeExecuting: hasCodeExecutingTask(plan.add.concat(plan.replace)),
+      unknownChannels: droppedChannels,
+    });
+    return;
+  }
+  const applied = applyImportPlan({ store, scheduler, plan });
+  if (applied.error) {
+    sendJson(res, 500, { ok: false, error: applied.error });
+    return;
+  }
+  sendJson(res, 200, {
+    ok: true,
+    imported: applied.imported.length,
+    summary,
+    unknownChannels: droppedChannels,
+    tasks: applied.imported,
+  });
+}
+
+/**
+ * Write an import plan. Every imported task is paused (the file's status is
+ * ignored) and every touched id is disarmed explicitly, because writing
+ * "paused" does not stop an already-armed croner job. A failed write rolls the
+ * store back so a partial import cannot survive.
+ */
+export function applyImportPlan({ store, scheduler, plan }) {
+  const imported = [];
+  const rollback = [];
+  const disarm = [];
+  try {
+    for (const task of plan.add) {
+      const before = store.get(task.id);
+      const created = store.set({ ...task, id: task.id || randomUUID(), status: 'paused', updatedAt: Date.now() });
+      imported.push(created);
+      rollback.push({ id: created.id, previous: before || null });
+      disarm.push(created.id);
+    }
+    for (const task of plan.replace) {
+      const before = store.get(task.id);
+      if (!before) continue;
+      const replaced = store.set({ ...task, id: task.id, status: 'paused', updatedAt: Date.now() });
+      imported.push(replaced);
+      rollback.push({ id: replaced.id, previous: before });
+      disarm.push(replaced.id);
+    }
+  } catch (writeErr) {
+    for (const entry of rollback.reverse()) {
+      try {
+        if (entry.previous) store.set(entry.previous);
+        else store.delete(entry.id);
+      } catch (rollbackErr) {
+        console.warn(`[dsh-cron] import rollback failed for task "${entry.id}":`, rollbackErr?.message || rollbackErr);
+      }
+    }
+    return { imported: [], error: `Import failed and was rolled back: ${writeErr.message}` };
+  }
+  // Disarm outside the write transaction: pauseTask is idempotent and a
+  // failure here must not undo a successful import.
+  for (const id of disarm) {
+    try {
+      scheduler.pauseTask(id);
+    } catch (err) {
+      console.error('[dsh-cron] import: could not pause task', id + ':', err.message);
+    }
+  }
+  return { imported };
+}
+

package/lib/api-webhook.js

@@ -0,0 +1,115 @@
+import { sendJson, readBody } from './http-utils.js';
+import { answerTelegramCallbackQuery, sendTelegramMessage, getDshDefaultTelegramCredentials } from './telegram.js';
+
+const NOT_ALLOWED = { ok: false, error: 'Method not allowed' };
+
+export async function handleTelegramWebhook({ store, scheduler, req, res }) {
+  if (req.method !== 'POST') {
+    sendJson(res, 405, NOT_ALLOWED);
+    return;
+  }
+  const { body, error } = await readBody(req, res);
+  if (error || !body) return;
+
+  const callbackQuery = body.callback_query;
+  if (!callbackQuery) {
+    sendJson(res, 200, { ok: true });
+    return;
+  }
+
+  const queryId = callbackQuery.id;
+  const data = String(callbackQuery.data || '');
+  const fromId = String(callbackQuery.from?.id || '');
+  const chatId = String(callbackQuery.message?.chat?.id || fromId);
+
+  const settings = typeof store.getSettings === 'function' ? store.getSettings() : {};
+  const defaults = getDshDefaultTelegramCredentials();
+  const botToken = settings.botToken || defaults.botToken;
+  const allowedChatId = String(settings.chatId || defaults.chatId || '').trim();
+
+  if (allowedChatId && chatId !== allowedChatId && fromId !== allowedChatId) {
+    console.warn(`[dsh-cron] unauthorized telegram callback from chat ${chatId} / user ${fromId}`);
+    if (botToken) {
+      await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: 'Unauthorized', showAlert: true });
+    }
+    sendJson(res, 403, { ok: false, error: 'Forbidden' });
+    return;
+  }
+
+  const parts = data.split(':');
+  if (parts[0] !== 'cron' || parts.length < 3) {
+    if (botToken) {
+      await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: 'Unknown action' });
+    }
+    sendJson(res, 200, { ok: true, ignored: true });
+    return;
+  }
+
+  const verb = parts[1];
+  const taskId = parts.slice(2).join(':');
+  const task = store.get(taskId);
+
+  if (!task) {
+    if (botToken) {
+      await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: 'Task not found', showAlert: true });
+    }
+    sendJson(res, 200, { ok: false, error: 'Task not found' });
+    return;
+  }
+
+  if (verb === 'run') {
+    try {
+      await scheduler.triggerManualRun(taskId);
+      if (botToken) {
+        await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: `🚀 Run triggered: ${task.title}` });
+      }
+    } catch (runErr) {
+      if (botToken) {
+        await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: `Run error: ${runErr.message}`, showAlert: true });
+      }
+    }
+  } else if (verb === 'pause') {
+    const isPaused = task.status === 'paused';
+    const newStatus = isPaused ? 'active' : 'paused';
+    if (typeof store.update === 'function') {
+      store.update(taskId, { status: newStatus });
+    } else {
+      store.set({ ...task, status: newStatus });
+    }
+    if (isPaused) {
+      scheduler.resume(taskId);
+      if (botToken) {
+        await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: `▶️ Resumed: ${task.title}` });
+      }
+    } else {
+      scheduler.pause(taskId);
+      if (botToken) {
+        await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: `⏸ Paused: ${task.title}` });
+      }
+    }
+  } else if (verb === 'log') {
+    const history = store.getHistory(taskId, 1);
+    const lastRun = history && history[0];
+    if (!lastRun) {
+      if (botToken) {
+        await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: `No runs recorded for ${task.title}`, showAlert: true });
+      }
+    } else {
+      const summary = `[${task.title}] Last run: ${lastRun.status} (${lastRun.durationMs}ms)\n${lastRun.output || lastRun.error || 'Empty output'}`;
+      if (botToken) {
+        await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: summary.slice(0, 190) });
+        if (summary.length > 190 && chatId) {
+          await sendTelegramMessage({
+            botToken,
+            chatId,
+            text: `*Full Output for ${task.title}:*\n\`\`\`\n${summary.slice(0, 3000)}\n\`\`\``,
+            parseMode: 'Markdown',
+          }).catch(() => {});
+        }
+      }
+    }
+  }
+
+  sendJson(res, 200, { ok: true, verb, taskId });
+}
+