@goodandready/dsh-cron 0.2.2 → 0.2.4

package/lib/runner.js

@@ -1,4 +1,9 @@
 import { estimateTokenCost } from './integrations.js';
+import {
+  EXTERNAL_RUNTIMES,
+  normalizeTaskType,
+  buildInvocation,
+} from './runtimes.js';
 
 /**
  * Runner executing scheduled tasks in DeepSeek Harness sessions.
@@ -43,35 +48,164 @@ export class SessionRunner {
     }
   }
 
-  async _run(task, signal) {
-    console.log(`[dsh-cron] executing task "${task.title}" (${task.id})`);
+  /**
+   * Resolve the working directory for a task: explicit cwd, a bound
+   * workspace id resolved through the harness, or the process cwd (#31).
+   */
+  resolveCwd(task) {
+    if (task.cwd) return String(task.cwd);
+    if (task.workspaceId && this.ctx && typeof this.ctx.get === 'function') {
+      try {
+        const workspaces = this.ctx.get('workspaces');
+        const ws = workspaces && (typeof workspaces.get === 'function'
+          ? workspaces.get(task.workspaceId)
+          : (workspaces[task.workspaceId] || null));
+        const resolved = ws && (ws.path || ws.cwd || ws.root || ws.dir);
+        if (resolved) return String(resolved);
+      } catch {}
+      return String(task.workspaceId);
+    }
+    return process.cwd();
+  }
 
-    // 1. Direct shell / script task fallback (NO-LLM)
-    if (task.type === 'script' || task.mode === 'no-llm') {
-      const { exec } = await import('node:child_process');
-      return new Promise((resolve, reject) => {
-        const shellPath = process.platform === 'win32' ? undefined : (process.env.SHELL || '/bin/bash');
-        const child = exec(task.prompt, {
-          cwd: process.cwd(),
-          signal,
-          maxBuffer: 10 * 1024 * 1024,
-          shell: shellPath,
-          env: { ...process.env },
-        }, (err, stdout, stderr) => {
-          if (err) {
-            if (signal && signal.aborted) {
-              return reject(signal.reason || new Error('Command aborted'));
-            }
-            return reject(err);
+  /** Create an isolated git worktree for a code-modifying task (#29). */
+  async createTaskWorktree(cwd, task) {
+    const { execFile } = await import('node:child_process');
+    const path = await import('node:path');
+    const wtPath = path.join(cwd, '.dsh-cron-worktrees', `${task.id}-${Date.now()}`);
+    await new Promise((resolve, reject) => {
+      execFile('git', ['-C', cwd, 'worktree', 'add', '--detach', wtPath, 'HEAD'], { maxBuffer: 4 * 1024 * 1024 }, (err, stdout, stderr) => {
+        if (err) reject(new Error(String(stderr || err.message).trim()));
+        else resolve(stdout);
+      });
+    });
+    return wtPath;
+  }
+
+  /**
+   * Remove a task worktree; never throws (best-effort cleanup).
+   * Plain removal only — no force flags anywhere (workspace rule). A dirty
+   * worktree is left in place and reported instead of being force-deleted.
+   */
+  async removeTaskWorktree(cwd, wtPath) {
+    const { execFile } = await import('node:child_process');
+    await new Promise((resolve) => {
+      execFile('git', ['-C', cwd, 'worktree', 'remove', wtPath], { maxBuffer: 4 * 1024 * 1024 }, (err, stdout, stderr) => {
+        if (err) {
+          console.warn(`[dsh-cron] task worktree kept (not removable without force): ${wtPath} — ${String(stderr || err.message).trim()}`);
+        }
+        execFile('git', ['-C', cwd, 'worktree', 'prune'], () => resolve());
+      });
+    });
+  }
+
+  /** HTTP trigger runtime (#7). */
+  async _runHttp(task, request, signal) {
+    const res = await fetch(request.url, {
+      method: request.method,
+      headers: request.headers,
+      body: request.body,
+      signal,
+    });
+    const text = await res.text().catch(() => '');
+    const summary = `${request.method} ${request.url} -> ${res.status} ${res.statusText || ''}`.trim();
+    if (!res.ok) {
+      throw new Error(`${summary}\n${String(text).slice(0, 500)}`);
+    }
+    return {
+      output: `${summary}\n${String(text).trim().slice(0, 4000)}`.trim(),
+      usage: { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0 },
+      costUsd: 0,
+    };
+  }
+
+  /**
+   * #9 reuse-first path: when the task names a dsh-remote-workspace profile,
+   * execute through that plugin's `remoteSsh` service so host settings and
+   * credentials stay owned by it (we only reference the profile id).
+   * Returns null when the service or the profile is unavailable so the caller
+   * can fall back to a direct ssh invocation.
+   */
+  async _runViaRemoteWorkspace(task, signal) {
+    if (!task.sshProfileId || !this.ctx || typeof this.ctx.get !== 'function') return null;
+    let svc = null;
+    try {
+      svc = this.ctx.get('remoteSsh');
+    } catch {}
+    if (!svc || typeof svc.exec !== 'function') return null;
+
+    let profile = null;
+    try {
+      const settings = this.ctx.get('settings');
+      if (settings && typeof settings.get === 'function') {
+        const snap = settings.get('dsh-remote-workspace');
+        const profiles = snap && Array.isArray(snap.profiles) ? snap.profiles : [];
+        profile = profiles.find((p) => p && p.id === task.sshProfileId) || null;
+      }
+    } catch {}
+    if (!profile) {
+      throw new Error(`remote-workspace profile "${task.sshProfileId}" was not found — check dsh-remote-workspace settings, or use sshTarget instead`);
+    }
+    const res = await svc.exec(profile, String(task.prompt || 'true'), task.cwd || profile.remoteWorkspace || undefined);
+    const output = [res && res.stdout, res && res.stderr].filter((x) => x && String(x).trim()).join('\n').trim();
+    const code = res && typeof res.code === 'number' ? res.code : 0;
+    if (code !== 0) {
+      throw new Error(`Remote command exited with code ${code}\n${output}`.slice(0, 4000));
+    }
+    return {
+      output: output || 'Remote command completed with code 0',
+      usage: { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0 },
+      costUsd: 0,
+    };
+  }
+
+  /** Non-LLM runtimes: shell, Node.js, Python, HTTP, SSH, Docker (#4 #5 #7 #8 #9). */
+  async _runExternal(task, runtime, signal) {
+    if (runtime === 'ssh' && task.sshProfileId) {
+      const viaService = await this._runViaRemoteWorkspace(task, signal);
+      if (viaService) return viaService;
+      if (!task.sshTarget) {
+        throw new Error('SSH task needs either a working dsh-remote-workspace profile (sshProfileId) or an sshTarget');
+      }
+    }
+    const cwd = this.resolveCwd(task);
+    const invocation = buildInvocation({ ...task, type: runtime }, cwd);
+    if (invocation.http) return this._runHttp(task, invocation.http, signal);
+
+    const { exec, execFile } = await import('node:child_process');
+    return new Promise((resolve, reject) => {
+      const done = (err, stdout, stderr) => {
+        if (err) {
+          if (signal && signal.aborted) {
+            return reject(signal.reason || new Error('Command aborted'));
           }
-          const out = (stdout || stderr || '').trim();
-          resolve({
-            output: out || 'Script completed with code 0',
-            usage: { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0 },
-            costUsd: 0
-          });
+          const detail = String(stderr || '').trim();
+          return reject(new Error(detail ? `${err.message}\n${detail}` : err.message));
+        }
+        const out = (stdout || stderr || '').trim();
+        resolve({
+          output: out || `${runtime} task completed with code 0`,
+          usage: { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0 },
+          costUsd: 0,
         });
-      });
+      };
+      const options = { cwd, signal, maxBuffer: 10 * 1024 * 1024, env: invocation.env };
+      if (invocation.file) {
+        execFile(invocation.file, invocation.args || [], options, done);
+      } else {
+        const shellPath = process.platform === 'win32' ? undefined : (process.env.SHELL || '/bin/bash');
+        exec(invocation.shellCommand, { ...options, shell: shellPath }, done);
+      }
+    });
+  }
+
+  async _run(task, signal) {
+    console.log(`[dsh-cron] executing task "${task.title}" (${task.id})`);
+
+    // 1. Non-LLM runtimes: shell, Node.js, Python, HTTP, SSH, Docker (#4 #5 #7 #8 #9)
+    const runtime = normalizeTaskType(task.type);
+    if (EXTERNAL_RUNTIMES.includes(runtime) || task.mode === 'no-llm') {
+      return this._runExternal(task, runtime === 'llm' ? 'script' : runtime, signal);
     }
 
     // 2. If ctx.agents is available, run through agent session (LLM)
@@ -121,7 +255,26 @@ export class SessionRunner {
           ]);
         };
 
-        const cwd = process.cwd();
+        const baseCwd = this.resolveCwd(task);
+        // #29: code-modifying tasks may run in an isolated git worktree.
+        let cwd = baseCwd;
+        let taskWorktree = null;
+        if (task.worktree) {
+          try {
+            taskWorktree = await this.createTaskWorktree(baseCwd, task);
+            cwd = taskWorktree;
+          } catch (wtErr) {
+            console.warn('[dsh-cron] task worktree not created, running in the workspace:', wtErr.message);
+          }
+        }
+        // #6/#10: skill- and workflow-driven tasks are agent-mediated with a
+        // shaped prompt naming the skill/workflow.
+        let agentPrompt = String(task.prompt || '');
+        if (runtime === 'skill' && task.skillName) {
+          agentPrompt = `Use the DSH skill "${task.skillName}" for this task:\n${agentPrompt}`;
+        } else if (runtime === 'workflow' && task.workflowName) {
+          agentPrompt = `Execute this through the DSH workflow "${task.workflowName}" step by step:\n${agentPrompt}`;
+        }
         let handle = null;
         try {
           handle = await this.ctx.agents.create({
@@ -130,9 +283,21 @@ export class SessionRunner {
             agentOptions: provider && model ? { provider, model } : undefined,
           });
 
+          // Per-job permission preset (#32): read-only | workspace-write | full.
+          if (task.permissionPreset && task.permissionPreset !== 'default') {
+            try {
+              const presets = this.ctx.get && this.ctx.get('permissionPresets');
+              if (presets && typeof presets.set === 'function') {
+                presets.set(handle.agent.session, task.permissionPreset);
+              }
+            } catch (ppErr) {
+              console.warn('[dsh-cron] permission preset not applied:', ppErr.message);
+            }
+          }
+
           await raceAbort(handle.agent.whenIdle());
           handle.agent.followup(createUserMessage({
-            content: [{ type: 'text', text: task.prompt }],
+            content: [{ type: 'text', text: agentPrompt }],
             source: { kind: 'plugin', plugin: 'dsh-cron', form: 'cron-execute' },
           }));
 
@@ -159,9 +324,14 @@ export class SessionRunner {
           return {
             output: `[dsh-cron] Agent finished turn for task "${task.title}" (session: ${handle.agent.session?.id || 'cron'})`,
             usage,
-            costUsd
+            costUsd,
+            sessionId: handle.agent.session?.id || null
           };
         } finally {
+          let archivedSessionId = null;
+          try {
+            archivedSessionId = (handle && handle.agent && handle.agent.session && handle.agent.session.id) || null;
+          } catch {}
           try {
             if (handle && typeof handle.dispose === 'function') {
               await handle.dispose();
@@ -171,6 +341,21 @@ export class SessionRunner {
           } catch (disposeErr) {
             console.warn('[dsh-cron] session dispose notice:', disposeErr.message);
           }
+          // Best-effort: keep ephemeral cron sessions out of the main chat
+          // list (#30). The archive call degrades silently when the core
+          // does not expose it.
+          if (archivedSessionId && this.ctx && this.ctx.get) {
+            try {
+              const sessions = this.ctx.get('sessions');
+              if (sessions && typeof sessions.archive === 'function') {
+                sessions.archive(archivedSessionId);
+              }
+            } catch {}
+          }
+          // #29: dispose the isolated worktree (kept when keepWorktree is set).
+          if (taskWorktree && !task.keepWorktree) {
+            await this.removeTaskWorktree(baseCwd, taskWorktree);
+          }
         }
       } catch (err) {
         console.error(`[dsh-cron] agent execution failed:`, err.message);

package/lib/runtimes.js

@@ -0,0 +1,174 @@
+/**
+ * Runtime invocation builders for non-LLM task types (#4, #5, #7, #8, #9, #38).
+ *
+ * Every builder is a pure function returning the process invocation
+ * ({ file, args, env }) or the HTTP request description, so the whole matrix
+ * is unit-testable without spawning anything.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const EXTERNAL_RUNTIMES = ['script', 'node', 'python', 'http', 'ssh', 'docker'];
+export const AGENT_RUNTIMES = ['llm', 'skill', 'workflow'];
+export const TASK_TYPES = [...AGENT_RUNTIMES, ...EXTERNAL_RUNTIMES];
+
+/** Types that execute code and therefore need the HTTP confirm header. */
+export const CODE_EXECUTING_TYPES = ['script', 'node', 'python', 'ssh', 'docker'];
+
+export function normalizeTaskType(type) {
+  return TASK_TYPES.includes(type) ? type : 'llm';
+}
+
+/**
+ * Split a leading script path from trailing CLI arguments.
+ * Quoted segments are preserved as single arguments.
+ */
+export function splitCommandLine(text) {
+  const trimmed = String(text || '').trim();
+  if (!trimmed) return { path: '', args: [] };
+  const tokens = trimmed.match(/"[^"]*"|'[^']*'|\S+/g) || [];
+  const clean = tokens.map((t) => t.replace(/^["']|["']$/g, ''));
+  return { path: clean[0] || '', args: clean.slice(1) };
+}
+
+function looksLikeScriptFile(token, extensions) {
+  if (!token) return false;
+  const ext = path.extname(token).toLowerCase();
+  if (extensions.includes(ext)) return true;
+  try {
+    return fs.existsSync(token) && fs.statSync(token).isFile();
+  } catch {
+    return false;
+  }
+}
+
+/** #5: resolve a Node.js invocation (inline code or a .js/.mjs/.cjs file). */
+export function buildNodeInvocation(task, cwd) {
+  const { path: filePath, args } = splitCommandLine(task.prompt);
+  if (looksLikeScriptFile(filePath, ['.js', '.mjs', '.cjs'])) {
+    return { file: process.execPath, args: [filePath, ...args] };
+  }
+  const code = String(task.prompt || '');
+  const isEsm = /\bimport\s|\bexport\s/.test(code);
+  const nodeArgs = isEsm ? ['--input-type=module', '-e', code] : ['-e', code];
+  return { file: task.nodePath || process.execPath, args: nodeArgs };
+}
+
+/** Find the Python interpreter, preferring a task virtualenv, then the workspace one. */
+export function detectPython(task, cwd) {
+  if (task.pythonPath) return task.pythonPath;
+  const candidates = [];
+  if (process.env.VIRTUAL_ENV) {
+    candidates.push(path.join(process.env.VIRTUAL_ENV, 'bin', 'python'));
+    candidates.push(path.join(process.env.VIRTUAL_ENV, 'Scripts', 'python.exe'));
+  }
+  const base = cwd || process.cwd();
+  candidates.push(path.join(base, '.venv', 'bin', 'python'));
+  candidates.push(path.join(base, '.venv', 'Scripts', 'python.exe'));
+  candidates.push(path.join(base, 'venv', 'bin', 'python'));
+  for (const candidate of candidates) {
+    try {
+      if (fs.existsSync(candidate)) return candidate;
+    } catch {}
+  }
+  return process.platform === 'win32' ? 'python' : 'python3';
+}
+
+/** #4: resolve a Python invocation (inline code or a .py file). */
+export function buildPythonInvocation(task, cwd) {
+  const interpreter = detectPython(task, cwd);
+  const { path: filePath, args } = splitCommandLine(task.prompt);
+  if (looksLikeScriptFile(filePath, ['.py'])) {
+    return { file: interpreter, args: [filePath, ...args] };
+  }
+  return { file: interpreter, args: ['-c', String(task.prompt || '')] };
+}
+
+/** #7: build the HTTP trigger request description. */
+export function buildHttpRequest(task) {
+  const raw = String(task.httpUrl || task.prompt || '').trim();
+  if (!raw) throw new Error('HTTP task requires a URL (httpUrl or prompt)');
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new Error(`Invalid HTTP URL: ${raw}`);
+  }
+  let headers = {};
+  if (task.httpHeaders) {
+    if (typeof task.httpHeaders === 'object') {
+      headers = { ...task.httpHeaders };
+    } else {
+      try {
+        headers = JSON.parse(String(task.httpHeaders));
+      } catch {
+        throw new Error('httpHeaders must be a JSON object');
+      }
+    }
+  }
+  const method = String(task.httpMethod || 'GET').toUpperCase();
+  const body = task.httpBody !== undefined && task.httpBody !== '' ? String(task.httpBody) : undefined;
+  return { url: url.toString(), method, headers, body };
+}
+
+/** #9: build a remote SSH invocation. */
+export function buildSshInvocation(task) {
+  const target = String(task.sshTarget || '').trim();
+  if (!target) throw new Error('SSH task requires sshTarget (user@host)');
+  const args = [];
+  if (task.sshPort) args.push('-p', String(Number(task.sshPort)));
+  if (task.sshKeyPath) args.push('-i', String(task.sshKeyPath));
+  args.push(target, String(task.prompt || 'true'));
+  return { file: 'ssh', args };
+}
+
+/** #8: build a Docker run invocation. */
+export function buildDockerInvocation(task, env) {
+  const image = String(task.dockerImage || '').trim();
+  if (!image) throw new Error('Docker task requires dockerImage');
+  const args = ['run', '--rm'];
+  for (const [key, value] of Object.entries(env || {})) {
+    if (key === 'PATH' || key === 'HOME') continue; // container owns those
+    args.push('-e', `${key}=${value}`);
+  }
+  if (task.cwd) args.push('-v', `${task.cwd}:/workspace`, '-w', '/workspace');
+  args.push(image, 'sh', '-lc', String(task.prompt || 'true'));
+  return { file: 'docker', args };
+}
+
+/** #38: merge task env vars over the base environment. */
+export function buildEnv(task, baseEnv) {
+  const env = { ...(baseEnv || process.env) };
+  if (task && task.env && typeof task.env === 'object') {
+    for (const [key, value] of Object.entries(task.env)) {
+      if (value === null || value === undefined) delete env[key];
+      else env[key] = String(value);
+    }
+  }
+  return env;
+}
+
+/**
+ * Dispatch an external (non-LLM) runtime to its invocation.
+ * Returns { file, args } plus an optional `http` descriptor for the fetch path.
+ */
+export function buildInvocation(task, cwd, baseEnv) {
+  const type = normalizeTaskType(task.type);
+  const env = buildEnv(task, baseEnv);
+  switch (type) {
+    case 'node':
+      return { type, env, ...buildNodeInvocation(task, cwd) };
+    case 'python':
+      return { type, env, ...buildPythonInvocation(task, cwd) };
+    case 'http':
+      return { type, env, http: buildHttpRequest(task) };
+    case 'ssh':
+      return { type, env, ...buildSshInvocation(task) };
+    case 'docker':
+      return { type, env, ...buildDockerInvocation(task, env) };
+    case 'script':
+    default:
+      return { type: 'script', env, file: null, args: null, shellCommand: String(task.prompt || '') };
+  }
+}