@goodandready/dsh-cron 0.2.19 → 0.2.21

package/lib/client.js

@@ -11,6 +11,9 @@ window.__ModuleLoader__.load({
     // namespace registered on the server ('dsh-cron', Issue #85).
     const PLUGIN_ID = '@goodandready/dsh-cron';
     const NS = 'dsh-cron';
+    // Plugins page row seat (DSH 0.1.6-alpha.2): key = '<package name>#<row id>'.
+    const ROW_ID = 'dsh-cron';
+    const ROW_CONFIG_KEY = PLUGIN_ID + '#' + ROW_ID;
     const PANEL = 'cron';
     const ACTIVATE_EVENT = 'dsh-panel-activate';
     const ACTIVE_ATTR = 'data-dsh-cron-active';
@@ -3529,17 +3532,24 @@ window.__ModuleLoader__.load({
         );
       }
 
-      return React.createElement('div', { className: 'dsh-cron-card' },
+      // Row seat (plugins.row.config): the host page draws title/icon/crumb and the
+      // padding, so the summary is a one-liner and the page drops our card chrome.
+      if (props && props.view === 'summary') {
+        return React.createElement('span', { className: 'dsh-cron-card-desc' }, T_KEY(t, 'settings.cardDesc'));
+      }
+      const page = !!(props && props.view === 'page');
+      return React.createElement('div', { className: page ? 'dsh-cron-page' : 'dsh-cron-card' },
         React.createElement('button', {
           type: 'button',
           className: 'dsh-cron-card-head-btn',
-          'aria-expanded': cardOpen ? 'true' : 'false',
+          style: page ? { display: 'none' } : undefined,
+          'aria-expanded': (page || cardOpen) ? 'true' : 'false',
           onClick: () => setCardOpen(!cardOpen)
         },
           React.createElement('span', { className: 'dsh-cron-card-title' }, T_KEY(t, 'settings.cardTitle')),
           React.createElement('span', { className: 'dsh-cron-chev' + (cardOpen ? ' dsh-cron-chev-open' : '') }, chevronNode())
         ),
-        cardOpen && React.createElement('div', { className: 'dsh-cron-card-body' },
+        (page || cardOpen) && React.createElement('div', { className: 'dsh-cron-card-body' },
           React.createElement('div', { className: 'dsh-cron-card-desc' }, T_KEY(t, 'settings.cardDesc')),
           React.createElement('div', { style: { display: 'flex', justifyContent: 'flex-end', marginBottom: '12px' } },
             React.createElement('button', {
@@ -4042,6 +4052,29 @@ window.__ModuleLoader__.load({
       function SettingsCardWithBoundary(props) {
         return React.createElement(ErrorBoundary, null, CronSettingsCard(props));
       }
+      // List seat (plugins.item): the seat the Plugins page renders as the plugin's own
+      // page with its configuration. The label is a static string on purpose — it is
+      // resolved while the page renders, and a locale lookup there would take the whole
+      // client batch down with it.
+      const itemOk = registerIntoMount(ctx, 'plugins.item', {
+        name: 'plugins.item',
+        id: ROW_ID,
+        order: 60,
+        label: () => 'Cron',
+        locale: NS,
+        inject: () => ({ ctx, toggle }),
+      }, SettingsCardWithBoundary);
+      if (!itemOk) {
+        console.warn('[dsh-cron] plugins.item slot unavailable — plugin page card not registered');
+      }
+      // Row seat and the legacy settings.plugin.item seat stay as fallbacks
+      // (#102: still no top-level section fallback).
+      const rowOk = registerIntoMount(ctx, 'plugins.row.config', {
+        name: 'plugins.row.config',
+        key: ROW_CONFIG_KEY,
+        locale: NS,
+        inject: () => ({ ctx, toggle }),
+      }, SettingsCardWithBoundary);
       const cardOk = registerIntoMount(ctx, 'settings.plugin.item', {
         name: 'settings.plugin.item',
         key: NS,

package/lib/index.js

@@ -69,188 +69,26 @@ import { applyConfigSync, isConfigOwned, configOwnedMessage } from './config-job
 import { createExternalApiHandler, EXTERNAL_API_PREFIX } from './external-api.js';
 export { createCronApiHandler };
 
-export const name = '@goodandready/dsh-cron';
-export const inject = ['tools', 'webServer', 'settings', 'llm', 'agents', 'agentDefaultModel', 'credentials'];
-
-export const Config = z.object({
-  botToken: z.string().role('secret').default('').description('Legacy Telegram Bot API token (prefer botTokenRef with the DSH credentials service)'),
-  botTokenRef: z.string().default('').description('Name of the DSH credential that holds the Telegram bot token'),
-  chatId: z.string().default('').description('Telegram chat ID that receives task reports'),
-  notifyTelegram: z.boolean().default(false).description('Deliver task reports to Telegram for every task'),
-  onlyOnFailure: z.boolean().default(false).description('Deliver reports only for failed runs'),
-  kanbanBaseUrl: z.string().default('http://127.0.0.1:3000').description('Base URL of the dsh-kanban HTTP API'),
-  defaultTimezone: z.string().default('').description('Default IANA time zone for schedules (empty = server local)'),
-  maxConcurrent: z.number().default(0).description('Max parallel task runs (0 = unlimited)'),
-  heartbeatUrl: z.string().default('').description('Dead man\'s snitch URL pinged on the heartbeat interval'),
-  heartbeatIntervalSec: z.number().default(0).description('Heartbeat ping interval in seconds (0 = off)'),
-  // --- Delivery channels (#20-#23, #26, #28, #47) ---
-  template: z.string().default('').description('Global notification template; placeholders: {title} {status} {output} {error} {duration} {schedule} {time} {tokens} {cost}'),
-  channelTemplates: z.object({}).default({}).description('Per-channel template overrides keyed by channel id'),
-  silentRuleModel: z.string().default('').description('Model used to evaluate a task silent rule (empty = the task model)'),
-  inspectorModel: z.string().default('').description('Model used to diagnose failed runs (empty = the task model)'),
-  deliveryTimeoutMs: z.number().min(MIN_DELIVERY_TIMEOUT_MS).default(15000).description('Per-channel delivery timeout in ms (minimum 1000); a slower endpoint is recorded as a failure and does not block other channels or the next tick'),
-  discordWebhookUrl: z.string().default('').description('Discord webhook URL'),
-  slackWebhookUrl: z.string().default('').description('Slack incoming webhook URL'),
-  ntfyUrl: z.string().default('https://ntfy.sh').description('ntfy server base URL'),
-  ntfyTopic: z.string().default('').description('ntfy topic for push notifications'),
-  ntfyTokenRef: z.string().default('').description('Credential name for the ntfy access token'),
-  barkServerUrl: z.string().default('https://api.day.app').description('Bark server base URL'),
-  barkKey: z.string().default('').description('Bark device key'),
-  pushplusTokenRef: z.string().default('').description('Credential name for the PushPlus token'),
-  pushplusUrl: z.string().default('https://www.pushplus.plus/send').description('PushPlus send endpoint (override for a self-hosted proxy)'),
-  ttsBaseUrl: z.string().default('http://127.0.0.1:3080').description('Base URL of the harness used to reach the dsh-tts speak route'),
-  giteaBaseUrl: z.string().default('').description('Gitea base URL for alert issues'),
-  giteaRepo: z.string().default('').description('Gitea repository (owner/name) for alert issues'),
-  giteaTokenRef: z.string().default('').description('Credential name for the Gitea API token'),
-  prReviewerEnabled: z.boolean().default(false).description('Enable automated PR Reviewer scheduled agent (#33)'),
-  // --- Declarative jobs (#50, ADR-0001) ---
-  // The array is intentionally permissive: each entry is validated on its own
-  // with a precise message (see lib/config-jobs.js), so one broken entry cannot
-  // reject the whole profile config. Declared jobs are owned by the config:
-  // they are created or updated at startup, and removed when they disappear
-  // from the file. Tasks created in the UI, over the API or by an agent tool
-  // are never touched.
-  jobs: z.array(z.any()).default([]).description('Static jobs owned by the config; each entry needs id, title, schedule and (for agent types) prompt'),
-  // --- External REST API (#54, ADR-0001) ---
-  apiToken: z.string().role('secret').default('').description('Bearer token for the external /dsh-cron/api/* surface (empty = the surface answers 503)'),
-});
-
-
-export const SETTINGS_SYNC_KEYS = [
-  'botToken', 'botTokenRef', 'chatId', 'notifyTelegram', 'onlyOnFailure', 'kanbanBaseUrl',
-  'template', 'channelTemplates', 'deliveryTimeoutMs', 'silentRuleModel', 'inspectorModel',
-  'discordWebhookUrl', 'slackWebhookUrl',
-  'ntfyUrl', 'ntfyTopic', 'ntfyTokenRef',
-  'barkServerUrl', 'barkKey',
-  'pushplusTokenRef',
-  'pushplusUrl',
-  'ttsBaseUrl',
-  'giteaBaseUrl', 'giteaRepo', 'giteaTokenRef', 'prReviewerEnabled',
-  'apiToken',
-];
+import {
+  Config,
+  SETTINGS_SYNC_KEYS,
+  applySettingsToScope,
+  sanitizeSettingsPayload,
+} from './settings.js';
+import { registerRoutes } from './routes.js';
 
-/**
- * Apply settings writes through the registered settings scope so the core
- * snapshot stays authoritative (#102). Returns null when the settings
- * service is unavailable (headless profiles fall back to store-only writes).
- */
-export async function applySettingsToScope(settingsScope, body) {
-  if (!settingsScope || typeof settingsScope.set !== 'function') return null;
-  const errors = [];
-  for (const key of SETTINGS_SYNC_KEYS) {
-    if (!Object.prototype.hasOwnProperty.call(body, key)) continue;
-    try {
-      await settingsScope.set(key, body[key]);
-    } catch (e) {
-      errors.push(key + ': ' + ((e && e.message) || e));
-    }
-  }
-  return errors;
-}
+export {
+  Config,
+  SETTINGS_SYNC_KEYS,
+  applySettingsToScope,
+  sanitizeSettingsPayload,
+};
 
-/**
- * Drop values that must never re-enter the store from the client:
- *
- * - a masked secret echoed back by the settings UI would overwrite the real
- *   value (bot token, webhook URLs, Bark key);
- * - the raw credential keys are refused outright — the *Ref fields are the
- *   supported way to configure them.
- *
- * Applied before both the settings scope and the store, because the scope is
- * the source of truth and would otherwise persist a raw or masked value.
- */
-export function sanitizeSettingsPayload(body) {
-  const payload = Object.assign({}, body);
-  for (const key of TaskStore.MASKED_SETTING_KEYS) {
-    const val = payload[key];
-    if (typeof val === 'string' && (val.includes('••') || val.includes('****'))) {
-      delete payload[key];
-    }
-  }
-  for (const key of ['botTokenRef', 'barkKeyRef', 'giteaTokenRef']) {
-    if (key in payload && typeof payload[key] === 'string' && payload[key].trim()) {
-      const refCheck = credentialRefStatus(payload[key]);
-      if (!refCheck.ok) {
-        console.warn(`[dsh-cron] invalid credential reference in "${key}": ${refCheck.error}`);
-        delete payload[key];
-      }
-    }
-  }
-  for (const key of TaskStore.FORBIDDEN_SETTING_KEYS) {
-    if (key in payload) {
-      console.warn(`[dsh-cron] refusing raw secret "${key}" from the client — use a credential reference`);
-      delete payload[key];
-    }
-  }
-  // #115: normalise the delivery deadline here, before it reaches the settings
-  // scope, so a value like 1 ms can never be persisted and then fail every
-  // delivery before the request is even sent.
-  if ('deliveryTimeoutMs' in payload) {
-    const raw = payload.deliveryTimeoutMs;
-    const n = Number(raw);
-    if (raw === '' || raw === null || !Number.isFinite(n) || n <= 0) {
-      delete payload.deliveryTimeoutMs;
-    } else {
-      payload.deliveryTimeoutMs = resolveDeliveryTimeoutMs(n);
-    }
-  }
-  return payload;
-}
+export const name = '@goodandready/dsh-cron';
+export const inject = ['tools', 'webServer', 'settings', 'llm', 'agents', 'agentDefaultModel', 'credentials'];
 
-export function executeCreateTask(store, scheduler, args) {
-  const taskType = normalizeTaskType(args.type);
-  const typeError = validateTaskType(taskType, args);
-  if (typeError) throw new Error(typeError);
-  const parsed = parseScheduleExpression(args.schedule);
-  const task = store.set({
-    title: args.title,
-    schedule: parsed.cronPattern || args.schedule,
-    scheduleText: parsed.humanText,
-    prompt: args.prompt,
-    type: taskType,
-    delivery: args.delivery || 'isolated',
-    status: 'active',
-    provider: args.provider,
-    model: args.model,
-    notifyTelegram: Boolean(args.notifyTelegram),
-    onlyOnFailure: Boolean(args.onlyOnFailure),
-    timeoutSeconds: Number(args.timeoutSeconds) || 1800,
-    overlapPolicy: args.overlapPolicy || 'skip',
-    timezone: args.timezone ? String(args.timezone).trim() : '',
-    misfirePolicy: ['skip', 'runOnce', 'catchUpAll'].includes(args.misfirePolicy) ? args.misfirePolicy : 'skip',
-    maxRetries: Number(args.maxRetries) > 0 ? Number(args.maxRetries) : 0,
-    retryBackoffMs: Number(args.retryBackoffMs) > 0 ? Number(args.retryBackoffMs) : 30000,
-    permissionPreset: ['default', 'read-only', 'workspace-write', 'full'].includes(args.permissionPreset) ? args.permissionPreset : 'default',
-    kanbanMode: args.kanbanMode || 'none',
-    channels: Array.isArray(args.channels) ? args.channels.filter((c) => CHANNEL_IDS.includes(c)) : undefined,
-    template: args.template ? String(args.template) : '',
-    env: args.env && typeof args.env === 'object' ? args.env : undefined,
-    cwd: args.cwd ? String(args.cwd).trim() : '',
-    workspaceId: args.workspaceId ? String(args.workspaceId).trim() : '',
-    worktree: Boolean(args.worktree),
-    keepWorktree: Boolean(args.keepWorktree),
-    httpMethod: args.httpMethod ? String(args.httpMethod).toUpperCase() : 'GET',
-    httpUrl: args.httpUrl ? String(args.httpUrl).trim() : '',
-    httpHeaders: args.httpHeaders,
-    httpBody: args.httpBody !== undefined ? String(args.httpBody) : '',
-    sshProfileId: args.sshProfileId ? String(args.sshProfileId).trim() : '',
-    sshTarget: args.sshTarget ? String(args.sshTarget).trim() : '',
-    sshPort: Number(args.sshPort) || 0,
-    sshKeyPath: args.sshKeyPath ? String(args.sshKeyPath).trim() : '',
-    dockerImage: args.dockerImage ? String(args.dockerImage).trim() : '',
-    pythonPath: args.pythonPath ? String(args.pythonPath).trim() : '',
-    nodePath: args.nodePath ? String(args.nodePath).trim() : '',
-    skillName: args.skillName ? String(args.skillName).trim() : '',
-    workflowName: args.workflowName ? String(args.workflowName).trim() : '',
-    oneShot: Boolean(parsed.isOneShot),
-  });
-  scheduler.scheduleTask(task);
-  return {
-    success: true,
-    message: `Task "${task.title}" scheduled successfully (${task.scheduleText})`,
-    task
-  };
-}
+import { executeCreateTask } from './task-create.js';
+export { executeCreateTask };
 
 export const createTaskParameters = {
   title: { type: 'string', description: 'Short task name', required: true },
@@ -397,79 +235,15 @@ export function apply(ctx, config) {
   }), 'dsh-cron: /api/dsh-cron/update');
 
   // 1. REST API — collection (list/create) + item actions in one prefix
-  // handler per route family; registered WITHOUT the trailing slash (#96)
-  ctx.effect(() => ctx.webServer.register({
-    kind: 'prefix',
-    path: '/dsh-cron/tasks',
-    handler: createCronApiHandler(store, scheduler, { recommendations })
-  }), 'dsh-cron: /tasks[...]');
-
-  // Alias route /dsh-cron/action/:id/:action for backward compatibility (#66)
-  ctx.effect(() => ctx.webServer.register({
-    kind: 'prefix',
-    path: '/dsh-cron/action',
-    handler: createCronApiHandler(store, scheduler, null)
-  }), 'dsh-cron: /action/:id/:action');
-
-  ctx.effect(() => ctx.webServer.register({
-    kind: 'prefix',
-    path: '/dsh-cron/telegram',
-    handler: createCronApiHandler(store, scheduler, null)
-  }), 'dsh-cron: /telegram[...]');
-
-  ctx.effect(() => ctx.webServer.register({
-    kind: 'prefix',
-    path: '/dsh-cron/heartbeat-ping',
-    handler: createCronApiHandler(store, scheduler, null)
-  }), 'dsh-cron: /heartbeat-ping[...]');
-
-  ctx.effect(() => ctx.webServer.register({
-    kind: 'prefix',
-    path: '/dsh-cron/schedule',
-    handler: createCronApiHandler(store, scheduler, null)
-  }), 'dsh-cron: /schedule[...]');
-
-  // GET /dsh-cron/metrics (#53) — Prometheus text exposition
-  ctx.effect(() => ctx.webServer.register({
-    kind: 'exact',
-    path: '/dsh-cron/metrics',
-    handler: createMetricsHandler({ store, scheduler })
-  }), 'dsh-cron: /metrics');
-
-  // External REST API under /dsh-cron/api/* (#54, ADR-0001): the only surface
-  // guarded by a bearer token, so CI and host automation can drive the
-  // scheduler without a browser session. The token is read per request, so a
-  // settings change applies without a restart.
-  ctx.effect(() => ctx.webServer.register({
-    kind: 'prefix',
-    path: EXTERNAL_API_PREFIX,
-    handler: createExternalApiHandler({
-      store,
-      scheduler,
-      getToken: () => store.getSettings().apiToken || ''
-    })
-  }), 'dsh-cron: /api[...]');
-
-  // GET /dsh-cron/models
-  ctx.effect(() => ctx.webServer.register({
-    kind: 'exact',
-    path: '/dsh-cron/models',
-    handler: async (req, res) => {
-      await getModelsHandler(ctx, req, res, sendJson);
-    }
-  }), 'dsh-cron: /models');
-
-  // POST /dsh-cron/chat/start
-  ctx.effect(() => ctx.webServer.register({
-    kind: 'exact',
-    path: '/dsh-cron/chat/start',
-    handler: async (req, res) => {
-      if (req.method === 'POST' && rejectCrossOrigin(req, res)) return;
-      await chatStartHandler(ctx, req, res, parseJsonBody, sendJson, randomUUID);
-    }
-  }), 'dsh-cron: /chat/start');
+  // 1. Web server routes (extracted to ./routes.js)
+  registerRoutes(ctx, {
+    store,
+    scheduler,
+    getCronSettingsScope: () => cronSettingsScope,
+    recommendations,
+  });
 
-  // GET & POST /dsh-cron/settings
+  // GET & POST /dsh-cron/settings (#102)
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: '/dsh-cron/settings',
@@ -483,8 +257,6 @@ export function apply(ctx, config) {
           if (rejectCrossOrigin(req, res)) return;
           const { body, error } = await readBody(req, res);
           if (error) return;
-          // Masked secrets echoed back by the client must never overwrite the
-          // stored token (store.saveSettings guards this too, #86-era).
           const payload = sanitizeSettingsPayload(body);
           const scopeErrors = await applySettingsToScope(cronSettingsScope, payload);
           if (scopeErrors === null) {
@@ -500,114 +272,6 @@ export function apply(ctx, config) {
     }
   }), 'dsh-cron: /settings');
 
-  // GET /dsh-cron/recipes (#48): the built-in recipe catalog.
-  ctx.effect(() => ctx.webServer.register({
-    kind: 'exact',
-    path: '/dsh-cron/recipes',
-    handler: async (req, res) => {
-      try {
-        if (req.method !== 'GET') {
-          sendJson(res, 405, { ok: false, error: 'Method not allowed' });
-          return;
-        }
-        const categories = recipesByCategory();
-        const recipes = categories.reduce((acc, category) => acc.concat(category.recipes), []);
-        sendJson(res, 200, { ok: true, categories, recipes });
-      } catch (err) {
-        sendJson(res, err.statusCode || 500, { ok: false, error: err.message });
-      }
-    }
-  }), 'dsh-cron: /recipes');
-
-  // GET /dsh-cron/heartbeat (#16): liveness probe for external monitors.
-  ctx.effect(() => ctx.webServer.register({
-    kind: 'exact',
-    path: '/dsh-cron/heartbeat',
-    handler: async (req, res) => {
-      try {
-        const tasks = store.list({ status: 'active' });
-        const lastRuns = tasks.map((t) => t.lastRunAt || 0);
-        sendJson(res, 200, {
-          ok: true,
-          activeTasks: tasks.length,
-          running: scheduler.runningCount(),
-          lastRunAt: lastRuns.length ? Math.max(...lastRuns) : null,
-          serverTime: Date.now(),
-        });
-      } catch (err) {
-        sendJson(res, 500, { ok: false, error: err.message });
-      }
-    }
-  }), 'dsh-cron: /heartbeat');
-
-  // POST /dsh-cron/telegram/test
-  ctx.effect(() => ctx.webServer.register({
-    kind: 'exact',
-    path: '/dsh-cron/telegram/test',
-    handler: async (req, res) => {
-      try {
-        if (req.method !== 'POST') {
-          sendJson(res, 405, { ok: false, error: 'Method not allowed' });
-          return;
-        }
-        if (rejectCrossOrigin(req, res)) return;
-        const { body, error } = await readBody(req, res);
-        if (error) return;
-        const settings = store.getSettings();
-        const botToken = body.botToken || settings.botToken;
-        const chatId = body.chatId || settings.chatId;
-
-        if (!botToken || !chatId) {
-          sendJson(res, 400, { ok: false, error: 'botToken or chatId is not configured' });
-          return;
-        }
-
-        const text = `🔔 *dsh-cron test notification*\n\nConnection between DSH Cron and Telegram is working! Checked at: \`${new Date().toISOString()}\``;
-        const replyMarkup = createTelegramTaskKeyboard(task, runInfo);
-        await sendTelegramMessage({ botToken, chatId, text, replyMarkup });
-        sendJson(res, 200, { ok: true, message: 'Test message sent successfully' });
-      } catch (err) {
-        sendJson(res, 500, { ok: false, error: err.message });
-      }
-    }
-  }), 'dsh-cron: /telegram/test');
-
-  // POST /dsh-cron/kanban/test
-  ctx.effect(() => ctx.webServer.register({
-    kind: 'exact',
-    path: '/dsh-cron/kanban/test',
-    handler: async (req, res) => {
-      try {
-        if (req.method !== 'POST') {
-          sendJson(res, 405, { ok: false, error: 'Method not allowed' });
-          return;
-        }
-        if (rejectCrossOrigin(req, res)) return;
-        const { body, error } = await readBody(req, res);
-        if (error) return;
-        const settings = store.getSettings();
-        const kanbanBaseUrl = body.kanbanBaseUrl || settings.kanbanBaseUrl || 'http://127.0.0.1:3000';
-
-        const result = await createKanbanCard({
-          title: '[Test] dsh-cron -> Kanban connectivity check',
-          body: `Test card created automatically by the \`dsh-cron\` module at ${new Date().toISOString()}.`,
-          board: 'main',
-          column: 'backlog',
-          labels: ['cron', 'test'],
-          kanbanBaseUrl
-        });
-
-        if (result.success) {
-          sendJson(res, 200, { ok: true, task: result.task });
-        } else {
-          sendJson(res, 500, { ok: false, error: result.error });
-        }
-      } catch (err) {
-        sendJson(res, 500, { ok: false, error: err.message });
-      }
-    }
-  }), 'dsh-cron: /kanban/test');
-
   // 2. Tools
   ctx.tools.register(defineTool({
     name: 'cron_create_task',