@goodandready/dsh-cron 0.2.2 → 0.2.4

package/lib/scheduler.js

@@ -1,6 +1,4 @@
 import { Cron } from 'croner';
-import { shouldNotifyTask, formatTaskTelegramMessage, sendTelegramMessage } from './telegram.js';
-import { createKanbanCard, shouldCreateKanbanCard } from './integrations.js';
 
 function pad(v) {
   return String(v).padStart(2, '0');
@@ -99,8 +97,19 @@ export function parseScheduleExpression(input) {
     }
   }
 
-  // 4. Friendly recurring aliases (English plus accepted Russian input aliases)
+  // 4. Standard @-shorthands (#15)
   const lower = str.toLowerCase();
+  if (lower === '@hourly') return { cronPattern: '0 * * * *', humanText: 'Every hour' };
+  if (lower === '@daily' || lower === '@midnight') return { cronPattern: '0 0 * * *', humanText: 'Every day at 00:00' };
+  if (lower === '@weekly') return { cronPattern: '0 0 * * 0', humanText: 'Every week on Sunday at 00:00' };
+  if (lower === '@monthly') return { cronPattern: '0 0 1 * *', humanText: 'Every month on the 1st at 00:00' };
+  if (lower === '@yearly' || lower === '@annually') return { cronPattern: '0 0 1 1 *', humanText: 'Every year on Jan 1 at 00:00' };
+  const everyAlias = str.match(/^@every\s+(\d+)\s*(sec|seconds?|m|min|minutes?|h|hr|hours?|d|days?)$/i);
+  if (everyAlias) {
+    return parseScheduleExpression(`every ${everyAlias[1]} ${everyAlias[2]}`);
+  }
+
+  // 5. Friendly recurring aliases (English plus accepted Russian input aliases)
   if (lower === 'daily' || lower === 'каждый день') {
     return { cronPattern: '0 9 * * *', humanText: 'Every day at 09:00' };
   }
@@ -126,35 +135,77 @@ export function parseScheduleExpression(input) {
 }
 
 export class TaskScheduler {
-  constructor(store, executeFn) {
+  constructor(store, executeFn, options = {}) {
     this.store = store;
     this.executeFn = executeFn;
+    this.maxConcurrent = Number(options.maxConcurrent) > 0 ? Number(options.maxConcurrent) : 0; // 0 = unlimited (#52)
+    this.defaultTimezone = options.defaultTimezone || ''; // #13
+    this.resolveSecrets = typeof options.resolveSecrets === 'function' ? options.resolveSecrets : null; // #51
+    this.deliver = typeof options.deliver === 'function' ? options.deliver : null; // #26 channel router
     this.jobs = new Map(); // taskId -> Cron instance
     this.timers = new Map(); // taskId -> setTimeout handle (for one-shot tasks)
+    this.retryTimers = new Map(); // taskId -> setTimeout handle (for #18 retries)
     this.running = new Map(); // taskId -> { controller, startedAt, queueCount }
   }
 
+  isRunning(taskId) {
+    return this.running.has(taskId);
+  }
+
+  runningCount() {
+    return this.running.size;
+  }
+
+  runningSince(taskId) {
+    const run = this.running.get(taskId);
+    return run ? run.startedAt : null;
+  }
+
+  clearRetryTimer(taskId) {
+    const timer = this.retryTimers.get(taskId);
+    if (timer !== undefined) {
+      clearTimeout(timer);
+      this.retryTimers.delete(taskId);
+    }
+  }
+
   start() {
     const tasks = this.store.list();
     const now = Date.now();
     for (const task of tasks) {
-      if (task.status === 'active') {
-        // Detect missed execution if daemon was offline (threshold: > 5 minutes)
-        if (task.nextRunAt && (now - task.nextRunAt) > 5 * 60 * 1000) {
-          const missedAt = task.nextRunAt;
-          console.warn(`[dsh-cron] Task "${task.title}" (${task.id}) missed scheduled run at ${new Date(missedAt).toISOString()}`);
-          this.store.recordRun(task.id, {
-            at: missedAt,
-            status: 'missed',
-            durationMs: 0,
-            output: `Skipped: the service was offline or restarting at the scheduled time (${new Date(missedAt).toISOString()})`,
-            error: null,
-            usage: { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0 },
-            costUsd: 0,
-          });
+      if (task.status !== 'active') continue;
+      // Detect missed execution if daemon was offline (threshold: > 5 minutes)
+      const missed = task.nextRunAt && (now - task.nextRunAt) > 5 * 60 * 1000;
+      if (missed) {
+        const missedAt = task.nextRunAt;
+        const policy = task.misfirePolicy || 'skip'; // #12: skip | runOnce | catchUpAll
+        console.warn(`[dsh-cron] Task "${task.title}" (${task.id}) missed scheduled run at ${new Date(missedAt).toISOString()} (misfire: ${policy})`);
+        this.store.recordRun(task.id, {
+          at: missedAt,
+          status: 'missed',
+          durationMs: 0,
+          output: `Skipped: the service was offline or restarting at the scheduled time (${new Date(missedAt).toISOString()})`,
+          error: null,
+          usage: { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0 },
+          costUsd: 0,
+        });
+        if (policy === 'skip') {
+          // A missed one-shot has no future slot left: retire it instead of
+          // arming a timer in the past.
+          if (task.oneShot) {
+            task.status = 'completed';
+            this.store.set(task);
+            continue;
+          }
+          this.scheduleTask(task);
+          continue;
         }
+        // runOnce / catchUpAll: run late exactly once, then resume the schedule.
         this.scheduleTask(task);
+        setImmediate(() => this.runTask(task.id));
+        continue;
       }
+      this.scheduleTask(task);
     }
   }
 
@@ -173,6 +224,13 @@ export class TaskScheduler {
     }
     this.timers.clear();
 
+    for (const [id, timer] of this.retryTimers.entries()) {
+      try {
+        clearTimeout(timer);
+      } catch {}
+    }
+    this.retryTimers.clear();
+
     for (const [, run] of this.running.entries()) {
       try {
         run.controller.abort(new Error('Scheduler stopped'));
@@ -193,9 +251,11 @@ export class TaskScheduler {
     }
 
     if (task.status !== 'active') return;
+    this.clearRetryTimer(task.id);
 
     try {
       const parsed = parseScheduleExpression(task.schedule);
+      const timezone = task.timezone || this.defaultTimezone || undefined;
 
       // Handle One-shot task
       if (parsed.isOneShot) {
@@ -206,9 +266,11 @@ export class TaskScheduler {
         this.store.set(task);
 
         // If target is in the past, or when delay triggers:
-        const timer = setTimeout(async () => {
+        const timer = setTimeout(() => {
           this.timers.delete(task.id);
-          await this.runTask(task.id);
+          this.runTask(task.id).catch((err) => {
+            console.error(`[dsh-cron] one-shot run of task ${task.id} failed:`, (err && err.message) || err);
+          });
         }, delay);
 
         this.timers.set(task.id, timer);
@@ -216,7 +278,11 @@ export class TaskScheduler {
       }
 
       // Handle Recurring Cron job
-      const job = new Cron(parsed.cronPattern, { protect: true }, async () => {
+      const job = new Cron(parsed.cronPattern, {
+        protect: true,
+        catch: (err) => console.error(`[dsh-cron] scheduled run of "${task.title}" (${task.id}) failed:`, (err && err.message) || err),
+        ...(timezone ? { timezone } : {}),
+      }, async () => {
         await this.runTask(task.id);
       });
 
@@ -235,6 +301,23 @@ export class TaskScheduler {
     const task = this.store.get(taskId);
     if (!task) return;
 
+    // Global concurrency throttle (#52): a run that would exceed the limit is
+    // skipped and recorded; already-running tasks are never throttled against
+    // themselves.
+    if (!this.running.has(taskId) && this.maxConcurrent > 0 && this.running.size >= this.maxConcurrent) {
+      console.log(`[dsh-cron] Task "${task.title}" (${taskId}) skipped: concurrency limit (${this.maxConcurrent})`);
+      this.store.recordRun(taskId, {
+        at: Date.now(),
+        status: 'skipped',
+        durationMs: 0,
+        output: `Skipped: concurrency limit reached (${this.maxConcurrent} parallel runs)`,
+        error: null,
+        usage: { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0 },
+        costUsd: 0,
+      });
+      return;
+    }
+
     const overlapPolicy = task.overlapPolicy || 'skip';
 
     // Check overlap with currently running task
@@ -278,6 +361,7 @@ export class TaskScheduler {
     let error = null;
     let usage = { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0 };
     let costUsd = 0;
+    let sessionId = null;
 
     try {
       if (typeof this.executeFn === 'function') {
@@ -286,6 +370,7 @@ export class TaskScheduler {
           output = res.output || '';
           usage = res.usage || usage;
           costUsd = res.costUsd || 0;
+          sessionId = res.sessionId || null;
         } else {
           output = String(res || '');
         }
@@ -307,8 +392,13 @@ export class TaskScheduler {
         error,
         usage,
         costUsd,
+        sessionId,
       };
-      this.store.recordRun(taskId, runInfo);
+      try {
+        this.store.recordRun(taskId, runInfo);
+      } catch (recordErr) {
+        console.error(`[dsh-cron] failed to record the run of task ${taskId}:`, recordErr.message);
+      }
 
       // Clean up running map
       const finishedRun = this.running.get(taskId);
@@ -318,58 +408,48 @@ export class TaskScheduler {
 
       const queuedCount = finishedRun?.queueCount || 0;
 
-      // 1. Telegram notification delivery
-      try {
-        const settings = typeof this.store.getSettings === 'function' ? this.store.getSettings() : {};
-        if (shouldNotifyTask(task, runInfo, settings)) {
-          const botToken = settings.botToken;
-          const chatId = settings.chatId;
-          if (botToken && chatId) {
-            const text = formatTaskTelegramMessage(task, runInfo);
-            sendTelegramMessage({ botToken, chatId, text }).catch((err) => {
-              console.error(`[dsh-cron] telegram delivery failed for task "${task.title}":`, err.message);
-            });
-          }
-        }
-      } catch (notifyErr) {
-        console.error('[dsh-cron] notification error:', notifyErr.message);
-      }
+      await this.deliverNotifications(task, runInfo);
+      this.finishRun(task, taskId, status, queuedCount);
+    }
+  }
 
-      // 2. Kanban card creation
-      try {
-        if (shouldCreateKanbanCard(task, runInfo)) {
-          const settings = typeof this.store.getSettings === 'function' ? this.store.getSettings() : {};
-          const isErr = runInfo.status === 'error' || runInfo.status === 'timeout';
-          const cardTitle = isErr ? `[Cron failure] ${task.title}` : `[Cron completed] ${task.title}`;
-          const cardBody = [
-            `**Cron task:** ${task.title} (\`${task.id}\`)`,
-            `**Schedule:** ${task.scheduleText || task.schedule}`,
-            `**Status:** ${runInfo.status}`,
-            `**Started at:** ${new Date(runInfo.at).toISOString()}`,
-            runInfo.error ? `\n**Error:**\n\`\`\`\n${runInfo.error}\n\`\`\`` : '',
-            runInfo.output ? `\n**Log / Output:**\n\`\`\`\n${runInfo.output.slice(0, 1000)}\n\`\`\`` : '',
-          ].filter(Boolean).join('\n\n');
-
-          createKanbanCard({
-            title: cardTitle,
-            body: cardBody,
-            board: 'main',
-            column: isErr ? 'backlog' : 'done',
-            labels: isErr ? ['cron', 'bug', 'alert'] : ['cron', 'auto'],
-            kanbanBaseUrl: settings.kanbanBaseUrl || 'http://127.0.0.1:3000'
-          }).then((res) => {
-            if (res.success) {
-              console.log(`[dsh-cron] created kanban card for task "${task.title}"`);
-            }
-          }).catch((kErr) => {
-            console.error('[dsh-cron] kanban card error:', kErr.message);
-          });
+  /**
+   * Deliver a finished run to every configured channel (#26).
+   * Never throws: a broken or slow channel is reported, not propagated, so the
+   * cron callback (and therefore the next tick) is never blocked by delivery.
+   */
+  async deliverNotifications(task, runInfo) {
+    try {
+      let settings = typeof this.store.getSettings === 'function' ? this.store.getSettings() : {};
+      // #51: resolve delivery credentials through the credentials service
+      // (credential reference → legacy token → gateway file → env).
+      if (this.resolveSecrets) {
+        try {
+          settings = { ...settings, ...(await this.resolveSecrets(settings)) };
+        } catch (secErr) {
+          console.warn('[dsh-cron] credential resolution failed:', secErr.message);
         }
-      } catch (kanbanErr) {
-        console.error('[dsh-cron] kanban error:', kanbanErr.message);
       }
+      if (typeof this.deliver !== 'function') return;
+      const result = await this.deliver(task, runInfo, settings);
+      if (result && Array.isArray(result.delivered) && result.delivered.length) {
+        console.log(`[dsh-cron] delivered "${task.title}" to: ${result.delivered.map((d) => d.channel).join(', ')}`);
+      }
+      if (result && Array.isArray(result.failures) && result.failures.length) {
+        console.warn(`[dsh-cron] delivery failures for "${task.title}": ${result.failures.map((f) => `${f.channel}: ${f.error}`).join('; ')}`);
+      }
+    } catch (notifyErr) {
+      console.error('[dsh-cron] notification error:', notifyErr.message);
+    }
+  }
 
-      // 3. Reschedule or mark completed for one-shot
+  /**
+   * Post-run bookkeeping: one-shot completion, next-run timestamp, retry
+   * backoff and draining a queued run. Each part is guarded so a store error
+   * cannot reject the cron callback.
+   */
+  finishRun(task, taskId, status, queuedCount) {
+    try {
       if (task.oneShot) {
         task.status = 'completed';
         task.nextRunAt = null;
@@ -382,12 +462,37 @@ export class TaskScheduler {
           this.store.set(task);
         }
       }
+    } catch (err) {
+      console.error('[dsh-cron] failed to persist the next run of task', taskId + ':', err.message);
+    }
 
-      if (queuedCount > 0) {
-        setImmediate(() => {
+    try {
+      // Retry with exponential backoff on failure (#18)
+      const failed = status === 'error' || status === 'timeout';
+      const maxRetries = Number(task.maxRetries) > 0 ? Number(task.maxRetries) : 0;
+      if (failed && maxRetries > 0 && (task.attempts || 0) < maxRetries && task.status !== 'paused') {
+        task.attempts = (task.attempts || 0) + 1;
+        const backoffMs = (Number(task.retryBackoffMs) > 0 ? Number(task.retryBackoffMs) : 30000) * Math.pow(2, task.attempts - 1);
+        const attempt = task.attempts;
+        this.store.set(task);
+        this.clearRetryTimer(taskId);
+        this.retryTimers.set(taskId, setTimeout(() => {
+          this.retryTimers.delete(taskId);
           this.runTask(taskId);
-        });
+        }, backoffMs));
+        console.log(`[dsh-cron] retry ${attempt}/${maxRetries} for task "${task.title}" in ${backoffMs}ms`);
+      } else if (!failed && task.attempts) {
+        task.attempts = 0;
+        this.store.set(task);
       }
+    } catch (err) {
+      console.error('[dsh-cron] retry bookkeeping failed for task', taskId + ':', err.message);
+    }
+
+    if (queuedCount > 0) {
+      setImmediate(() => {
+        this.runTask(taskId);
+      });
     }
   }
 
@@ -396,6 +501,7 @@ export class TaskScheduler {
     if (!task) return null;
     task.status = 'paused';
     task.nextRunAt = null;
+    this.clearRetryTimer(taskId);
     if (this.jobs.has(taskId)) {
       this.jobs.get(taskId).stop();
       this.jobs.delete(taskId);

package/lib/secrets.js

@@ -0,0 +1,123 @@
+/**
+ * Credential handling for dsh-cron (#51).
+ *
+ * Settings store only the NAME of a credential (an environment-variable-style
+ * reference); the value is resolved at send time through the DSH credentials
+ * service, with an environment fallback. This mirrors the pattern already
+ * used by dsh-clinebot and dsh-agentrouter.
+ */
+
+import fs from 'node:fs';
+import { getDshSettingsPath } from './telegram.js';
+
+const REF_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const TOKEN_LIKE = /^[A-Za-z0-9:_-]{24,}$/;
+
+export function isCredentialRefName(value) {
+  return REF_PATTERN.test(String(value || '').trim());
+}
+
+/** Heuristic: a pasted secret instead of a credential name. */
+export function looksLikeSecret(value) {
+  const s = String(value || '').trim();
+  if (!s || isCredentialRefName(s)) return false;
+  return TOKEN_LIKE.test(s);
+}
+
+/**
+ * Validate a credential-reference field. Returns { ok, name } or
+ * { ok: false, error } with actionable text for the settings card.
+ */
+export function credentialRefStatus(value) {
+  const name = String(value || '').trim();
+  if (!name) return { ok: true, name: '' };
+  if (looksLikeSecret(name)) {
+    return {
+      ok: false,
+      error: 'That looks like a secret value. Store it in DSH credentials and enter only the credential name (for example CRON_TELEGRAM_BOT_TOKEN).',
+    };
+  }
+  if (!isCredentialRefName(name)) {
+    return { ok: false, error: 'Credential name must look like an environment variable name, e.g. CRON_TELEGRAM_BOT_TOKEN.' };
+  }
+  return { ok: true, name };
+}
+
+/** Resolve a credential through the harness service, then the environment. */
+export async function resolveCredentialValue(ctx, refName) {
+  const name = String(refName || '').trim();
+  if (!name) return null;
+  try {
+    const creds = (ctx && typeof ctx.get === 'function' ? ctx.get('credentials') : null)
+      || (ctx && ctx.credentials);
+    if (creds && typeof creds.resolve === 'function') {
+      // Prefer the harness ref factory; fall back to the plain name when the
+      // package is not installed (keeps tests and trimmed builds working).
+      let ref = name;
+      try {
+        const mod = await import('@deepseek-ai/dsh-credentials');
+        if (mod && typeof mod.credentialRef === 'function') ref = mod.credentialRef(name);
+      } catch {}
+      const hit = await creds.resolve(ref);
+      if (hit && hit.value) return String(hit.value);
+    }
+  } catch {
+    // credentials service unavailable — fall back to the environment
+  }
+  const fromEnv = process.env[name];
+  return fromEnv ? String(fromEnv) : null;
+}
+
+/** Read the best-effort Telegram defaults from the messenger-gateway file. */
+function readGatewayToken() {
+  try {
+    const p = getDshSettingsPath();
+    if (!fs.existsSync(p)) return null;
+    const text = fs.readFileSync(p, 'utf-8');
+    const lines = text.split('\n');
+    let inside = false;
+    for (const line of lines) {
+      if (/^[^\s#]/.test(line)) inside = line.startsWith('dsh-messenger-gateway:');
+      if (!inside) continue;
+      const hit = /^[ \t]+botToken:[ \t]*(.+?)[ \t]*$/.exec(line);
+      if (hit) return hit[1].replace(/^['"]|['"]$/g, '').trim() || null;
+    }
+  } catch {}
+  return null;
+}
+
+/**
+ * Resolve the Telegram delivery secrets for a run.
+ * Precedence: credential reference → legacy stored token → messenger-gateway
+ * settings file → environment variable.
+ */
+export async function resolveTelegramSecrets(ctx, settings = {}) {
+  const out = { botToken: '', chatId: '', tokenSource: 'none' };
+
+  const fromRef = await resolveCredentialValue(ctx, settings.botTokenRef);
+  if (fromRef) {
+    out.botToken = fromRef;
+    out.tokenSource = 'credential';
+  }
+  if (!out.botToken && settings.botToken) {
+    out.botToken = String(settings.botToken);
+    out.tokenSource = 'legacy-settings';
+  }
+  if (!out.botToken) {
+    const gateway = readGatewayToken();
+    if (gateway) {
+      out.botToken = gateway;
+      out.tokenSource = 'messenger-gateway';
+    }
+  }
+  if (!out.botToken) {
+    const fromEnv = await resolveCredentialValue(ctx, 'CRON_TELEGRAM_BOT_TOKEN');
+    if (fromEnv) {
+      out.botToken = fromEnv;
+      out.tokenSource = 'env';
+    }
+  }
+
+  out.chatId = String(settings.chatId || '').trim();
+  return out;
+}

package/lib/store.js

@@ -2,11 +2,31 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { getDshDefaultTelegramCredentials } from './telegram.js';
 
+/**
+ * Where plugin data lives.
+ *
+ * DSH_DATA_DIR wins when the harness sets it. Otherwise the profile home
+ * (DSH_HOME) is authoritative: falling back to ~/.dsh would make an isolated
+ * profile — a test contour, a second profile — write its tasks into another
+ * home's data directory, which is how the MiniPC test cycle leaked a task into
+ * the non-test profile.
+ */
 export function getDefaultStorePath() {
-  const base = process.env.DSH_DATA_DIR || path.join(process.env.HOME || '.', '.dsh', 'data');
+  const base = process.env.DSH_DATA_DIR
+    || (process.env.DSH_HOME
+      ? path.join(process.env.DSH_HOME, 'data')
+      : path.join(process.env.HOME || '.', '.dsh', 'data'));
   return path.join(base, 'cron', 'tasks.json');
 }
 
+/** Mask a secret for transport to the browser, keeping a readable hint. */
+function maskSecretValue(value) {
+  const s = String(value == null ? '' : value);
+  if (!s) return '';
+  if (s.length <= 8) return '••••••••';
+  return s.slice(0, 4) + '••••••••' + s.slice(-3);
+}
+
 export class TaskStore {
   constructor(filePath) {
     this.filePath = filePath || getDefaultStorePath();
@@ -70,14 +90,15 @@ export class TaskStore {
 
   getSettings() {
     const defaults = getDshDefaultTelegramCredentials();
-    return {
-      botToken: this.settings.botToken !== undefined ? this.settings.botToken : (defaults.botToken || ''),
-      chatId: this.settings.chatId !== undefined ? this.settings.chatId : (defaults.chatId || ''),
-      notifyTelegram: Boolean(this.settings.notifyTelegram),
-      onlyOnFailure: Boolean(this.settings.onlyOnFailure),
-      hasDefaultCredentials: Boolean(defaults.botToken && defaults.chatId),
-      kanbanBaseUrl: this.settings.kanbanBaseUrl || 'http://127.0.0.1:3000',
-    };
+    const base = { ...this.settings };
+    base.botToken = base.botToken !== undefined ? base.botToken : (defaults.botToken || '');
+    base.botTokenRef = base.botTokenRef || '';
+    base.chatId = base.chatId !== undefined ? base.chatId : (defaults.chatId || '');
+    base.notifyTelegram = Boolean(base.notifyTelegram);
+    base.onlyOnFailure = Boolean(base.onlyOnFailure);
+    base.kanbanBaseUrl = base.kanbanBaseUrl || 'http://127.0.0.1:3000';
+    base.hasDefaultCredentials = Boolean(defaults.botToken && defaults.chatId);
+    return base;
   }
 
   getClientSettings() {
@@ -85,38 +106,87 @@ export class TaskStore {
     const isCustom = Boolean(this.settings.botToken);
     const hasToken = Boolean(raw.botToken);
     const masked = hasToken ? (raw.botToken.length > 8 ? raw.botToken.slice(0, 4) + '••••••••' + raw.botToken.slice(-3) : '••••••••') : '';
-    return {
+    const { botToken, ...rest } = raw;
+    const out = {
+      ...rest,
       botToken: masked,
       botTokenMasked: masked,
       hasBotToken: hasToken,
       hasCustomBotToken: isCustom,
-      chatId: raw.chatId,
-      notifyTelegram: raw.notifyTelegram,
-      onlyOnFailure: raw.onlyOnFailure,
-      hasDefaultCredentials: raw.hasDefaultCredentials,
-      kanbanBaseUrl: raw.kanbanBaseUrl,
     };
+    // Webhook URLs and the Bark device key carry an embedded secret, so they
+    // are never sent to the browser in clear text either.
+    for (const key of TaskStore.MASKED_SETTING_KEYS) {
+      if (key === 'botToken') continue;
+      out[key] = maskSecretValue(raw[key]);
+    }
+    return out;
+  }
+
+  /**
+   * Raw secret values that must not be stored in plugin settings; the
+   * corresponding *Ref credential names are the supported way to configure
+   * these channels.
+   */
+  static get FORBIDDEN_SETTING_KEYS() {
+    return ['smtpPassword', 'giteaToken', 'ntfyToken', 'pushplusToken', 'discordToken', 'slackToken'];
+  }
+
+  /**
+   * Settings that hold a secret and are therefore masked on read: tokens,
+   * passwords, webhook URLs (the URL embeds the auth token) and the Bark key.
+   * These are stored in the plugin settings file; the credential-reference
+   * fields (botTokenRef, smtpPasswordRef, …) take precedence over them.
+   */
+  static get MASKED_SETTING_KEYS() {
+    return ['botToken', 'smtpPassword', 'discordWebhookUrl', 'slackWebhookUrl', 'barkKey'];
   }
 
   saveSettings(newSettings = {}) {
+    const patch = { ...newSettings };
+
+    for (const key of TaskStore.FORBIDDEN_SETTING_KEYS) {
+      if (key in patch) {
+        console.warn(`[dsh-cron] refusing to store raw secret "${key}" in settings — use a credential reference instead`);
+        delete patch[key];
+      }
+    }
+
     let botTokenToSave = this.settings.botToken || '';
-    if (newSettings.botToken !== undefined) {
-      const val = String(newSettings.botToken).trim();
+    if (patch.botToken !== undefined) {
+      const val = String(patch.botToken).trim();
       // If client sends masked token or empty string while custom token existed, don't overwrite with dots
       if (val && !val.includes('••') && !val.includes('****')) {
         botTokenToSave = val;
       } else if (val === '') {
         botTokenToSave = '';
       }
+      delete patch.botToken;
+    }
+
+    // A masked value echoed back by the UI must never overwrite the real one.
+    for (const key of TaskStore.MASKED_SETTING_KEYS) {
+      if (key === 'botToken') continue;
+      const val = patch[key];
+      if (typeof val === 'string' && (val.includes('••') || val.includes('****'))) {
+        delete patch[key];
+      }
+    }
+
+    for (const [key, value] of Object.entries(patch)) {
+      if (value === undefined) delete patch[key];
+      else if (typeof value === 'string') patch[key] = value.trim();
     }
 
     this.settings = {
       ...this.settings,
+      ...patch,
       botToken: botTokenToSave,
-      chatId: newSettings.chatId !== undefined ? String(newSettings.chatId).trim() : (this.settings.chatId || ''),
-      notifyTelegram: newSettings.notifyTelegram !== undefined ? Boolean(newSettings.notifyTelegram) : Boolean(this.settings.notifyTelegram),
-      onlyOnFailure: newSettings.onlyOnFailure !== undefined ? Boolean(newSettings.onlyOnFailure) : Boolean(this.settings.onlyOnFailure),
-      kanbanBaseUrl: newSettings.kanbanBaseUrl !== undefined ? String(newSettings.kanbanBaseUrl).trim() : (this.settings.kanbanBaseUrl || 'http://127.0.0.1:3000'),
+      kanbanBaseUrl: patch.kanbanBaseUrl !== undefined
+        ? (patch.kanbanBaseUrl || 'http://127.0.0.1:3000')
+        : (this.settings.kanbanBaseUrl || 'http://127.0.0.1:3000'),
+      notifyTelegram: patch.notifyTelegram !== undefined ? Boolean(patch.notifyTelegram) : Boolean(this.settings.notifyTelegram),
+      onlyOnFailure: patch.onlyOnFailure !== undefined ? Boolean(patch.onlyOnFailure) : Boolean(this.settings.onlyOnFailure),
     };
     this.save();
     return this.getSettings();
@@ -212,6 +282,7 @@ export class TaskStore {
       error: runInfo.error ? String(runInfo.error).slice(0, 1000) : null,
       usage,
       costUsd,
+      sessionId: runInfo.sessionId || null,
     });
     if (runs.length > 50) runs.length = 50;
     this.history.set(id, runs);