@goodandready/dsh-cron 0.2.27 → 0.2.28

package/README.md

@@ -517,7 +517,7 @@ Notes:
 
 ## 🔌 HTTP API Reference
 
-All endpoints are served by the DSH web server under `/dsh-cron/`. Read endpoints are open to the local UI; **mutating endpoints reject cross-origin requests** and accept bodies up to 1 MB. Creating `script`-type tasks over HTTP additionally requires the `x-dsh-cron-confirm: script` header, which forged cross-site posts cannot attach.
+All endpoints are served by the DSH web server under `/dsh-cron/`. Endpoints are protected by a hardened HTTP source guard (`isTrustedRequest`): non-loopback remote callers require token authentication (`Authorization: Bearer <token>` or `x-dsh-cron-token`), and browser requests enforce strict `Host` and `Origin` matching, reject `Origin: null`, and restrict `Sec-Fetch-Site` to `same-origin` or `none`. Heartbeat ping routes strictly require the `POST` method. Task `GET` responses automatically redact sensitive fields (`env`, `httpHeaders`, `httpBody`) as `'[REDACTED]'`, and update operations preserve existing secrets when `'[REDACTED]'` is passed. Creating `script`-type tasks over HTTP additionally requires the `x-dsh-cron-confirm: script` header, which forged cross-site posts cannot attach. Body size is capped at 1 MB.
 
 | Method | Path | Description |
 |:---|:---|:---|

package/README.ru.md

@@ -506,7 +506,7 @@ bash deploy.sh verify [exact-version]
 
 ## 🔌 HTTP API
 
-Все эндпоинты обслуживаются веб-сервером DSH под `/dsh-cron/`. Чтение открыто локальному интерфейсу; **мутирующие эндпоинты отклоняют cross-origin запросы** и принимают тела до 1 МБ. Для создания `script`-задач по HTTP дополнительно требуется заголовок `x-dsh-cron-confirm: script`, который подделанный межсайтовый запрос приложить не может.
+Все эндпоинты обслуживаются веб-сервером DSH под `/dsh-cron/`. Эндпоинты защищены строгой проверкой источника (`isTrustedRequest`): удалённые не-loopback клиенты требуют аутентификацию токеном (`Authorization: Bearer <token>` или `x-dsh-cron-token`), а браузерные запросы проходят строгую валидацию совпадения `Host` и `Origin` с блокировкой `Origin: null` и ограничением `Sec-Fetch-Site` (`same-origin` или `none`). Маршруты heartbeat-ping строго требуют метод `POST`. В ответах `GET` чувствительные данные задач (`env`, `httpHeaders`, `httpBody`) маскируются как `'[REDACTED]'`, а при обновлении задач переданные плейсхолдеры `'[REDACTED]'` сохраняют оригинальные сохранённые секреты. Для создания `script`-задач по HTTP дополнительно требуется заголовок `x-dsh-cron-confirm: script`. Максимальный размер тела запроса ограничен 1 МБ.
 
 | Метод | Путь | Описание |
 |:---|:---|:---|

package/README.zh.md

@@ -506,7 +506,7 @@ dsh-cron:
 
 ## 🔌 HTTP API 参考
 
-所有端点由 DSH Web 服务器在 `/dsh-cron/` 下提供。读端点对本地 UI 开放；**变更端点拒绝跨域请求**且请求体最大 1 MB。通过 HTTP 创建 `script` 类型任务还需要 `x-dsh-cron-confirm: script` 请求头 —— 伪造的跨站请求无法附加该头。
+所有端点由 DSH Web 服务器在 `/dsh-cron/` 下提供。所有端点均受到强化的 HTTP 来源防护（`isTrustedRequest`）：非回环远程客户端必须携带有效令牌（`Authorization: Bearer <token>` 或 `x-dsh-cron-token`），浏览器请求严格校验 `Host` 与 `Origin` 一致性并拒绝 `Origin: null`，同时限制 `Sec-Fetch-Site` 仅允许 `same-origin` 或 `none`。心跳 ping 端点严格要求 `POST` 方法。任务 `GET` 响应自动将敏感字段（`env`、`httpHeaders`、`httpBody`）掩码为 `'[REDACTED]'`，并在更新操作提交 `'[REDACTED]'` 时安全保留已有原密钥。通过 HTTP 创建 `script` 类型任务还需要 `x-dsh-cron-confirm: script` 请求头。请求体大小上限为 1 MB。
 
 | 方法 | 路径 | 说明 |
 |:---|:---|:---|

package/lib/api-helpers.js

@@ -4,6 +4,13 @@ import { sendJson, readBody, rejectCrossOrigin } from './http-utils.js';
 const NOT_ALLOWED = { ok: false, error: 'Method not allowed' };
 
 export function handleHeartbeatPing({ store, req, res, taskId }) {
+  if (req.method !== 'POST') {
+    sendJson(res, 405, NOT_ALLOWED);
+    return;
+  }
+  const apiToken = store?.getSettings?.()?.apiToken;
+  if (rejectCrossOrigin(req, res, { apiToken })) return;
+
   const task = store.get(taskId);
   if (!task) {
     sendJson(res, 404, { ok: false, error: 'Task not found' });
@@ -17,7 +24,10 @@ export function handleHeartbeatPing({ store, req, res, taskId }) {
   sendJson(res, 200, result);
 }
 
-export async function handleSchedulePreview({ req, res, url }) {
+export async function handleSchedulePreview({ req, res, url, store }) {
+  const apiToken = store?.getSettings?.()?.apiToken;
+  if (rejectCrossOrigin(req, res, { apiToken })) return;
+
   let schedule = '';
   let timezone = '';
   let count = 5;
@@ -51,7 +61,8 @@ export async function handleSchedulePreview({ req, res, url }) {
 }
 
 export async function handleDryRunTask({ store, scheduler, req, res, id }) {
-  if (rejectCrossOrigin(req, res)) return;
+  const apiToken = store?.getSettings?.()?.apiToken;
+  if (rejectCrossOrigin(req, res, { apiToken })) return;
   const task = store.get(id);
   if (!task) {
     sendJson(res, 404, { ok: false, error: 'Task not found' });
@@ -65,4 +76,3 @@ export async function handleDryRunTask({ store, scheduler, req, res, id }) {
     sendJson(res, 500, { ok: false, error: err.message });
   }
 }
-

package/lib/api.js

@@ -11,7 +11,7 @@ import { normalizeTaskType, CODE_EXECUTING_TYPES } from './runtimes.js';
 import { CHANNEL_IDS, unknownChannelIds } from './channels.js';
 import { applyTaskPatch } from './task-patch.js';
 import { MANAGED_BY_CONFIG, configOwnedMessage } from './config-jobs.js';
-import { sendJson, rejectCrossOrigin, readBody, pickPatchableFields, SCRIPT_CONFIRM_HEADER } from './http-utils.js';
+import { sendJson, rejectCrossOrigin, readBody, pickPatchableFields, SCRIPT_CONFIRM_HEADER, redactTaskSecrets, restoreTaskSecrets } from './http-utils.js';
 import {
   validateTaskType,
   buildDuplicateTask,
@@ -64,9 +64,10 @@ function refuseConfigOwned(res, id) {
 export function createCronApiHandler(store, scheduler, collection) {
   return async function handleCronApi(req, res) {
     try {
+      const apiToken = store?.getSettings?.()?.apiToken;
       const url = new URL(req.url, 'http://127.0.0.1');
       const parts = url.pathname.split('/').filter(Boolean);
-      const scope = parts[1]; // 'tasks' | 'action'
+      const scope = parts[1]; // 'tasks' | 'action' | 'heartbeat-ping'
       const id = parts[2];
       const action = parts[3];
 
@@ -75,22 +76,22 @@ export function createCronApiHandler(store, scheduler, collection) {
         return;
       }
 
-      if (scope === 'heartbeat' && id) {
+      if ((scope === 'heartbeat' || scope === 'heartbeat-ping') && id) {
         handleHeartbeatPing({ store, req, res, taskId: id });
         return;
       }
 
       if (scope === 'schedule' && id === 'preview') {
-        await handleSchedulePreview({ req, res, url });
+        await handleSchedulePreview({ req, res, url, store });
         return;
       }
 
       if (!id) {
-        await handleTaskCollection({ store, scheduler, collection, req, res, url, scope });
+        await handleTaskCollection({ store, scheduler, collection, req, res, url, scope, apiToken });
         return;
       }
 
-      if (req.method !== 'GET' && rejectCrossOrigin(req, res)) return;
+      if (rejectCrossOrigin(req, res, { apiToken })) return;
 
       // Export/import are collection operations that live under /tasks/:id/…,
       // so they are matched before the generic id handling below.
@@ -103,7 +104,7 @@ export function createCronApiHandler(store, scheduler, collection) {
         return;
       }
 
-      await handleTaskItem({ store, scheduler, req, res, url, id, action });
+      await handleTaskItem({ store, scheduler, req, res, url, id, action, apiToken });
     } catch (err) {
       sendJson(res, err.statusCode || 500, { ok: false, error: err.message });
     }
@@ -112,18 +113,19 @@ export function createCronApiHandler(store, scheduler, collection) {
 
 // ------------------------------------------------------------- collection
 
-async function handleTaskCollection({ store, scheduler, collection, req, res, url, scope }) {
+async function handleTaskCollection({ store, scheduler, collection, req, res, url, scope, apiToken }) {
   // The alias family only exists for individual tasks.
   if (scope === 'action' || !collection) {
     sendJson(res, 405, NOT_ALLOWED);
     return;
   }
   if (req.method === 'GET') {
+    if (rejectCrossOrigin(req, res, { apiToken })) return;
     listTasks({ store, scheduler, collection, req, res, url });
     return;
   }
   if (req.method === 'POST') {
-    await createOrUpdateTask({ store, scheduler, req, res });
+    await createOrUpdateTask({ store, scheduler, req, res, apiToken });
     return;
   }
   sendJson(res, 405, NOT_ALLOWED);
@@ -133,7 +135,7 @@ function listTasks({ store, scheduler, collection, req, res, url }) {
   const status = url.searchParams.get('status') || 'all';
   const query = url.searchParams.get('query') || '';
   const list = store.list({ status, query }).map((t) => ({
-    ...t,
+    ...redactTaskSecrets(t),
     running: scheduler.isRunning(t.id),
     runningSince: scheduler.runningSince(t.id),
   }));
@@ -160,10 +162,12 @@ function listTasks({ store, scheduler, collection, req, res, url }) {
   sendJson(res, 200, payload);
 }
 
-async function createOrUpdateTask({ store, scheduler, req, res }) {
-  if (rejectCrossOrigin(req, res)) return;
-  const { body, error } = await readBody(req, res);
+async function createOrUpdateTask({ store, scheduler, req, res, apiToken }) {
+  if (rejectCrossOrigin(req, res, { apiToken })) return;
+  const { body: rawBody, error } = await readBody(req, res);
   if (error) return;
+  const existing = rawBody.id ? store.get(rawBody.id) : null;
+  const body = existing ? restoreTaskSecrets(rawBody, existing) : rawBody;
   if (!body.title || !body.schedule || !body.prompt) {
     sendJson(res, 400, { ok: false, error: 'Fields title, schedule and prompt are required' });
     return;
@@ -211,7 +215,7 @@ async function createOrUpdateTask({ store, scheduler, req, res }) {
   } else {
     scheduler.pauseTask(task.id);
   }
-  sendJson(res, 200, { ok: true, task });
+  sendJson(res, 200, { ok: true, task: redactTaskSecrets(task) });
 }
 
 /** Merge a create/update payload onto the stored task, if any. */
@@ -249,8 +253,8 @@ function buildTaskRecord(store, body, taskType, parsed) {
 
 // ------------------------------------------------------------ single task
 
-async function handleTaskItem({ store, scheduler, req, res, url, id, action }) {
-  if ((req.method === 'GET' || req.method === 'POST') && action === 'heartbeat') {
+async function handleTaskItem({ store, scheduler, req, res, url, id, action, apiToken }) {
+  if (action === 'heartbeat') {
     handleHeartbeatPing({ store, req, res, taskId: id });
     return;
   }
@@ -260,25 +264,44 @@ async function handleTaskItem({ store, scheduler, req, res, url, id, action }) {
     return;
   }
 
-  if (req.method === 'GET' && action === 'archive') {
-    const limit = parseInt(url.searchParams.get('limit') || '50', 10);
-    const offset = parseInt(url.searchParams.get('offset') || '0', 10);
-    const search = url.searchParams.get('search') || '';
-    const result = typeof store.getArchivedRuns === 'function'
-      ? store.getArchivedRuns(id, { limit, offset, search })
-      : { runs: [], total: 0 };
-    sendJson(res, 200, { ok: true, taskId: id, ...result });
-    return;
-  }
-  if (req.method === 'GET' && action === 'stats') {
-    const stats = typeof store.getTaskStats === 'function' ? store.getTaskStats(id) : null;
-    sendJson(res, 200, { ok: true, taskId: id, stats });
-    return;
-  }
-  if (req.method === 'GET' && (action === 'history' || !action)) {
-    const limit = parseInt(url.searchParams.get('limit') || '20', 10);
-    sendJson(res, 200, { ok: true, history: store.getHistory(id, limit) });
-    return;
+  if (req.method === 'GET') {
+    if (rejectCrossOrigin(req, res, { apiToken })) return;
+    if (action === 'archive') {
+      const limit = parseInt(url.searchParams.get('limit') || '50', 10);
+      const offset = parseInt(url.searchParams.get('offset') || '0', 10);
+      const search = url.searchParams.get('search') || '';
+      const result = typeof store.getArchivedRuns === 'function'
+        ? store.getArchivedRuns(id, { limit, offset, search })
+        : { runs: [], total: 0 };
+      sendJson(res, 200, { ok: true, taskId: id, ...result });
+      return;
+    }
+    if (action === 'stats') {
+      const stats = typeof store.getTaskStats === 'function' ? store.getTaskStats(id) : null;
+      sendJson(res, 200, { ok: true, taskId: id, stats });
+      return;
+    }
+    if (action === 'history') {
+      const limit = parseInt(url.searchParams.get('limit') || '20', 10);
+      sendJson(res, 200, { ok: true, history: store.getHistory(id, limit) });
+      return;
+    }
+    if (!action) {
+      const task = store.get(id);
+      if (!task) {
+        sendJson(res, 404, NOT_FOUND);
+        return;
+      }
+      sendJson(res, 200, {
+        ok: true,
+        task: {
+          ...redactTaskSecrets(task),
+          running: scheduler.isRunning(task.id),
+          runningSince: scheduler.runningSince(task.id),
+        },
+      });
+      return;
+    }
   }
   if (req.method === 'POST') {
     const handled = await handleItemPost({ store, scheduler, req, res, url, id, action });
@@ -303,7 +326,7 @@ async function handleItemPost({ store, scheduler, req, res, url, id, action }) {
       return true;
     }
     await scheduler.triggerManualRun(id);
-    sendJson(res, 200, { ok: true, task: store.get(id) });
+    sendJson(res, 200, { ok: true, task: redactTaskSecrets(store.get(id)) });
     return true;
   }
   if (action === 'duplicate') {
@@ -317,7 +340,7 @@ async function handleItemPost({ store, scheduler, req, res, url, id, action }) {
     // A copy starts paused: it must never fire on its own before the user
     // reviews the schedule (a duplicated one-shot may point at a past time).
     scheduler.pauseTask(copy.id);
-    sendJson(res, 200, { ok: true, task: copy });
+    sendJson(res, 200, { ok: true, task: redactTaskSecrets(copy) });
     return true;
   }
   if (action === 'pause' || action === 'resume') {
@@ -330,7 +353,7 @@ async function handleItemPost({ store, scheduler, req, res, url, id, action }) {
       sendJson(res, 404, NOT_FOUND);
       return true;
     }
-    sendJson(res, 200, { ok: true, task });
+    sendJson(res, 200, { ok: true, task: redactTaskSecrets(task) });
     return true;
   }
   if (action === 'toggle' || (!action && url.searchParams.get('action') === 'toggle')) {
@@ -344,7 +367,7 @@ async function handleItemPost({ store, scheduler, req, res, url, id, action }) {
       return true;
     }
     const task = scheduler.toggleTask(id);
-    sendJson(res, 200, { ok: true, task });
+    sendJson(res, 200, { ok: true, task: redactTaskSecrets(task) });
     return true;
   }
   return false;
@@ -381,7 +404,7 @@ async function patchTask({ store, scheduler, req, res, id }) {
     });
     return;
   }
-  sendJson(res, 200, { ok: true, task: result.task });
+  sendJson(res, 200, { ok: true, task: redactTaskSecrets(result.task) });
 }
 
 function deleteTask({ store, scheduler, res, id }) {
@@ -464,7 +487,7 @@ export async function handleExternalTaskRequest({ store, scheduler, req, res, ur
     if (req.method === 'GET') {
       const list = store
         .list({ status: url.searchParams.get('status') || 'all', query: url.searchParams.get('query') || '' })
-        .map((task) => ({ ...task, running: scheduler.isRunning(task.id) }));
+        .map((task) => ({ ...redactTaskSecrets(task), running: scheduler.isRunning(task.id) }));
       sendJson(res, 200, { ok: true, tasks: list });
       return;
     }
@@ -486,7 +509,7 @@ export async function handleExternalTaskRequest({ store, scheduler, req, res, ur
       sendJson(res, 404, NOT_FOUND);
       return;
     }
-    sendJson(res, 200, { ok: true, task: { ...task, running: scheduler.isRunning(id) } });
+    sendJson(res, 200, { ok: true, task: { ...redactTaskSecrets(task), running: scheduler.isRunning(id) } });
     return;
   }
   if (req.method === 'DELETE' && !action) {

package/lib/http-utils.js

@@ -6,6 +6,35 @@
 
 export const MAX_BODY_BYTES = 1024 * 1024;
 export const SCRIPT_CONFIRM_HEADER = 'x-dsh-cron-confirm';
+export const REDACTED_SECRET = '[REDACTED]';
+
+/**
+ * Check if an IP address is a local loopback address.
+ */
+export function isLoopbackAddress(addr) {
+  if (!addr || typeof addr !== 'string') return false;
+  return (
+    addr === '127.0.0.1' ||
+    addr === '::1' ||
+    addr === '::ffff:127.0.0.1' ||
+    addr === 'localhost'
+  );
+}
+
+/**
+ * Extract bearer authorization or custom token from request headers.
+ */
+export function extractBearerToken(req) {
+  const auth = req?.headers?.authorization;
+  if (typeof auth === 'string' && auth.startsWith('Bearer ')) {
+    return auth.slice(7).trim();
+  }
+  const custom = req?.headers?.['x-dsh-cron-token'];
+  if (typeof custom === 'string') {
+    return custom.trim();
+  }
+  return '';
+}
 
 /**
  * Parse a JSON request body with a hard byte size cap.
@@ -48,27 +77,63 @@ export function parseJsonBody(req, limit = MAX_BODY_BYTES) {
 }
 
 /**
- * Detect cross-origin (drive-by/CSRF) requests.
- * Browsers attach Origin to every non-GET request and Sec-Fetch-Site on
- * modern fetches; plain local API clients (curl, server-side calls) send
- * neither and stay allowed.
+ * Validate that an incoming request originates from a trusted local caller or
+ * an authenticated client (Issue #86).
+ *
+ * Rules:
+ * 1. Non-loopback remote callers are rejected unless authenticated with a valid token.
+ * 2. Host header must be present and non-empty.
+ * 3. Origin header (if present) cannot be null and its host must match Host.
+ * 4. Sec-Fetch-Site (if present) must be same-origin or none (cross-site/same-site rejected).
+ * 5. Mutating requests (POST, PUT, PATCH, DELETE) must provide browser proof (same-origin / matching Origin)
+ *    or an explicit capability header (confirm header, token, or update header).
  */
-export function isCrossOrigin(req) {
+export function isTrustedRequest(req, options = {}) {
+  if (!req) return false;
   const headers = req.headers || {};
+
+  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress;
+  const hasRemote = Boolean(remote && typeof remote === 'string');
+  const isLoopback = !hasRemote || isLoopbackAddress(remote);
+
+  const token = extractBearerToken(req);
+  const expectedToken = options.apiToken || process.env.DSH_AUTH_TOKEN || process.env.DSH_TOKEN;
+  const isTokenAuthenticated = Boolean(expectedToken && token && token === expectedToken);
+
+  // 1. Non-loopback remote addresses require explicit token authentication (#86)
+  if (hasRemote && !isLoopback && !isTokenAuthenticated) {
+    return false;
+  }
+
+  // 2. Validate Origin header if present: cannot be null, must match Host
   const origin = headers.origin;
+  const host = headers.host || '';
   if (origin !== undefined) {
-    if (origin === 'null') return true;
+    if (origin === 'null' || !origin) return false;
     try {
       const parsed = new URL(origin);
-      const host = headers.host || '';
-      if (parsed.host && parsed.host !== host) return true;
-    } catch (err) {
-      return true;
+      if (!parsed.host || !host || parsed.host !== host) return false;
+    } catch {
+      return false;
     }
   }
+
+  // 3. Validate Sec-Fetch-Site header if present
   const site = headers['sec-fetch-site'];
-  if (site && site !== 'same-origin' && site !== 'none') return true;
-  return false;
+  if (site !== undefined) {
+    if (site !== 'same-origin' && site !== 'none') {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+/**
+ * Backward-compatible wrapper for checking cross-origin / untrusted requests.
+ */
+export function isCrossOrigin(req, options) {
+  return !isTrustedRequest(req, options);
 }
 
 /**
@@ -91,9 +156,9 @@ export function sendJson(res, statusCode, data) {
   res.end(JSON.stringify(data));
 }
 
-export function rejectCrossOrigin(req, res) {
-  if (isCrossOrigin(req)) {
-    sendJson(res, 403, { ok: false, error: 'Cross-origin request rejected' });
+export function rejectCrossOrigin(req, res, options) {
+  if (!isTrustedRequest(req, options)) {
+    sendJson(res, 403, { ok: false, error: 'Forbidden: untrusted or cross-origin request' });
     return true;
   }
   return false;
@@ -108,4 +173,109 @@ export async function readBody(req, res) {
   }
 }
 
-/** Settings keys synchronized between the store and the settings service. */
+/**
+ * Redact sensitive fields (env, httpHeaders, httpBody) from task records before returning in GET responses (Issue #86).
+ */
+export function redactTaskSecrets(task) {
+  if (!task || typeof task !== 'object') return task;
+  const clone = { ...task };
+
+  if (clone.env && typeof clone.env === 'object') {
+    const redactedEnv = {};
+    for (const [k, v] of Object.entries(clone.env)) {
+      redactedEnv[k] = v ? REDACTED_SECRET : v;
+    }
+    clone.env = redactedEnv;
+  }
+
+  if (clone.httpHeaders) {
+    if (typeof clone.httpHeaders === 'object' && clone.httpHeaders !== null) {
+      const redactedHeaders = {};
+      for (const [k, v] of Object.entries(clone.httpHeaders)) {
+        redactedHeaders[k] = v ? REDACTED_SECRET : v;
+      }
+      clone.httpHeaders = redactedHeaders;
+    } else if (typeof clone.httpHeaders === 'string') {
+      try {
+        const parsed = JSON.parse(clone.httpHeaders);
+        if (parsed && typeof parsed === 'object') {
+          const redactedHeaders = {};
+          for (const [k, v] of Object.entries(parsed)) {
+            redactedHeaders[k] = v ? REDACTED_SECRET : v;
+          }
+          clone.httpHeaders = JSON.stringify(redactedHeaders);
+        } else {
+          clone.httpHeaders = REDACTED_SECRET;
+        }
+      } catch {
+        clone.httpHeaders = REDACTED_SECRET;
+      }
+    }
+  }
+
+  if (clone.httpBody) {
+    clone.httpBody = REDACTED_SECRET;
+  }
+
+  return clone;
+}
+
+/**
+ * Restore redacted secret fields from the existing record when updating a task (Issue #86).
+ */
+export function restoreTaskSecrets(incoming, current) {
+  if (!incoming || typeof incoming !== 'object' || !current || typeof current !== 'object') {
+    return incoming;
+  }
+  const restored = { ...incoming };
+
+  // Restore env values
+  if (restored.env && typeof restored.env === 'object' && current.env && typeof current.env === 'object') {
+    const mergedEnv = { ...restored.env };
+    for (const [k, v] of Object.entries(mergedEnv)) {
+      if (v === REDACTED_SECRET && current.env[k] !== undefined) {
+        mergedEnv[k] = current.env[k];
+      }
+    }
+    restored.env = mergedEnv;
+  }
+
+  // Restore httpHeaders values
+  if (restored.httpHeaders && current.httpHeaders) {
+    if (typeof restored.httpHeaders === 'object' && typeof current.httpHeaders === 'object') {
+      const mergedHeaders = { ...restored.httpHeaders };
+      for (const [k, v] of Object.entries(mergedHeaders)) {
+        if (v === REDACTED_SECRET && current.httpHeaders[k] !== undefined) {
+          mergedHeaders[k] = current.httpHeaders[k];
+        }
+      }
+      restored.httpHeaders = mergedHeaders;
+    } else if (typeof restored.httpHeaders === 'string') {
+      try {
+        const parsedRestored = JSON.parse(restored.httpHeaders);
+        const parsedCurrent = typeof current.httpHeaders === 'object'
+          ? current.httpHeaders
+          : JSON.parse(current.httpHeaders);
+        if (parsedRestored && typeof parsedRestored === 'object' && parsedCurrent && typeof parsedCurrent === 'object') {
+          for (const [k, v] of Object.entries(parsedRestored)) {
+            if (v === REDACTED_SECRET && parsedCurrent[k] !== undefined) {
+              parsedRestored[k] = parsedCurrent[k];
+            }
+          }
+          restored.httpHeaders = JSON.stringify(parsedRestored);
+        }
+      } catch {
+        if (restored.httpHeaders === REDACTED_SECRET) {
+          restored.httpHeaders = current.httpHeaders;
+        }
+      }
+    }
+  }
+
+  // Restore httpBody value
+  if (restored.httpBody === REDACTED_SECRET && current.httpBody !== undefined) {
+    restored.httpBody = current.httpBody;
+  }
+
+  return restored;
+}

package/lib/task-patch.js

@@ -11,7 +11,7 @@
 import { parseScheduleExpression } from './scheduler.js';
 import { normalizeTaskType, CODE_EXECUTING_TYPES } from './runtimes.js';
 import { PATCHABLE_TASK_FIELDS, validateTaskType } from './task-transfer.js';
-import { pickPatchableFields } from './http-utils.js';
+import { pickPatchableFields, restoreTaskSecrets } from './http-utils.js';
 import { unknownChannelIds } from './channels.js';
 import { isConfigOwned, configOwnedMessage } from './config-jobs.js';
 
@@ -28,7 +28,8 @@ export function isCodeTypeSwitch(current, nextType) {
  * Returns `{ ok: false, error }` when the merged task would be invalid.
  */
 export function buildTaskPatch(current, body) {
-  const patch = pickPatchableFields(body || {}, PATCHABLE_TASK_FIELDS);
+  const mergedBody = current ? restoreTaskSecrets(body || {}, current) : (body || {});
+  const patch = pickPatchableFields(mergedBody, PATCHABLE_TASK_FIELDS);
   if (patch.type !== undefined) {
     patch.type = normalizeTaskType(patch.type);
     const typeError = validateTaskType(patch.type, { ...current, ...patch });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cron",
-  "version": "0.2.27",
+  "version": "0.2.28",
   "description": "Scheduled cron tasks, background automation and agent execution for DeepSeek Harness.",
   "type": "module",
   "main": "lib/index.js",