@goodandready/dsh-cron 0.2.27 → 0.2.29

package/lib/cron-tool.js

@@ -0,0 +1,402 @@
+import { executeCreateTask } from './task-create.js';
+import { applyTaskPatch, describeTaskPatch } from './task-patch.js';
+import { isConfigOwned, configOwnedMessage } from './config-jobs.js';
+import { TASK_TYPES } from './runtimes.js';
+import { CHANNEL_IDS } from './channels.js';
+
+export const LEGACY_TOOL_NAMES = [
+  'cron_create_task',
+  'cron_schedule_task',
+  'cron_list_tasks',
+  'cron_pause_task',
+  'cron_resume_task',
+  'cron_delete_task',
+  'cron_get_task',
+  'cron_update_task',
+  'cron_run_task',
+];
+
+export const LEGACY_ACTION_MAP = {
+  cron_create_task: 'create',
+  create_task: 'create',
+  cron_schedule_task: 'create',
+  schedule_task: 'create',
+  schedule: 'create',
+  cron_list_tasks: 'list',
+  list_tasks: 'list',
+  cron_get_task: 'get',
+  get_task: 'get',
+  cron_update_task: 'update',
+  update_task: 'update',
+  cron_pause_task: 'pause',
+  pause_task: 'pause',
+  cron_resume_task: 'resume',
+  resume_task: 'resume',
+  cron_run_task: 'run',
+  run_task: 'run',
+  cron_delete_task: 'delete',
+  delete_task: 'delete',
+};
+
+export function rejectLegacyTool(toolName) {
+  const mapped = LEGACY_ACTION_MAP[toolName] || 'list';
+  return {
+    success: false,
+    message: `Tool "${toolName}" has been removed and consolidated into the unified "cron" tool. Please call "cron" with action: "${mapped}" instead. For simple in-chat reminders, use the built-in "schedule_create" tool.`,
+  };
+}
+
+export const cronToolParameters = {
+  action: {
+    type: 'string',
+    enum: ['create', 'list', 'get', 'update', 'pause', 'resume', 'run', 'delete'],
+    description: 'Operation to perform: "create", "list", "get", "update", "pause", "resume", "run", or "delete". For simple reminders in the current chat, use the built-in "schedule_create" tool instead.',
+    required: true,
+  },
+  id: {
+    type: 'string',
+    description: 'Task ID (required for get, update, pause, resume, run, delete)',
+  },
+  title: {
+    type: 'string',
+    description: 'Short task name (for create and update)',
+  },
+  schedule: {
+    type: 'string',
+    description: 'Schedule expression: cron ("0 9 * * *"), shorthand ("@daily", "@every 30m"), interval ("every 2h"), or one-shot ("in 30m", "at: 2026-09-05T15:00:00Z")',
+  },
+  prompt: {
+    type: 'string',
+    description: 'Prompt/instruction for the agent at run time or command to execute',
+  },
+  type: {
+    type: 'string',
+    enum: TASK_TYPES,
+    description: 'Task runtime type: llm | script | node | python | http | ssh | docker | skill | workflow',
+  },
+  status: {
+    type: 'string',
+    enum: ['all', 'active', 'paused', 'completed'],
+    description: 'Filter tasks by status (for list action)',
+  },
+  confirmCodeSwitch: {
+    type: 'boolean',
+    description: 'Explicit confirmation required when updating a task into a code-executing type (script/node/python/ssh/docker)',
+  },
+  delivery: {
+    type: 'string',
+    enum: ['current', 'isolated'],
+    description: 'Run mode: current (in current chat) or isolated (separate session)',
+  },
+  provider: {
+    type: 'string',
+    description: 'Model provider (optional)',
+  },
+  model: {
+    type: 'string',
+    description: 'Model identifier (optional)',
+  },
+  fallbackModel: {
+    type: 'string',
+    description: 'Model tried once more when the primary model fails',
+  },
+  fallbackProvider: {
+    type: 'string',
+    description: 'Provider for the fallback model (defaults to task provider)',
+  },
+  inspectOnFailure: {
+    type: 'boolean',
+    description: 'Diagnose failed runs with a model and store the diagnosis with the run',
+  },
+  silentRule: {
+    type: 'string',
+    description: 'Plain-language condition for staying silent on a successful run',
+  },
+  timezone: {
+    type: 'string',
+    description: 'IANA time zone for the schedule, e.g. "Europe/Berlin"',
+  },
+  notifyTelegram: {
+    type: 'boolean',
+    description: 'Send the run report to Telegram',
+  },
+  onlyOnFailure: {
+    type: 'boolean',
+    description: 'Send reports only for failures',
+  },
+  timeoutSeconds: {
+    type: 'number',
+    description: 'Execution time limit in seconds',
+  },
+  overlapPolicy: {
+    type: 'string',
+    enum: ['skip', 'queue', 'replace'],
+    description: 'Overlap policy: skip | queue | replace',
+  },
+  misfirePolicy: {
+    type: 'string',
+    enum: ['skip', 'runOnce', 'catchUpAll'],
+    description: 'What to do with a run missed during downtime: skip | runOnce | catchUpAll',
+  },
+  maxRetries: {
+    type: 'number',
+    description: 'Automatic retry attempts on failure (0 = off)',
+  },
+  retryBackoffMs: {
+    type: 'number',
+    description: 'Base backoff between retries in ms, doubled per attempt',
+  },
+  permissionPreset: {
+    type: 'string',
+    enum: ['default', 'read-only', 'workspace-write', 'full'],
+    description: 'Permission preset applied to the task session',
+  },
+  kanbanMode: {
+    type: 'string',
+    enum: ['none', 'on_failure', 'always'],
+    description: 'Create a dsh-kanban card for runs: none | on_failure | always',
+  },
+  channels: {
+    type: 'array',
+    items: { type: 'string', enum: CHANNEL_IDS },
+    description: 'Notification channels for this task',
+  },
+  template: {
+    type: 'string',
+    description: 'Notification template with {title} {status} {output} {error} {duration} placeholders',
+  },
+  env: {
+    type: 'object',
+    additionalProperties: true,
+    description: 'Environment variables for external runtimes (KEY: value)',
+  },
+  cwd: {
+    type: 'string',
+    description: 'Working directory for the run',
+  },
+  workspaceId: {
+    type: 'string',
+    description: 'Workspace bound to the task',
+  },
+  worktree: {
+    type: 'boolean',
+    description: 'Run code-modifying agent tasks in an isolated git worktree',
+  },
+  keepWorktree: {
+    type: 'boolean',
+    description: 'Keep the created worktree after the run',
+  },
+  nodePath: {
+    type: 'string',
+    description: 'Node.js binary for node tasks',
+  },
+  pythonPath: {
+    type: 'string',
+    description: 'Python interpreter for python tasks',
+  },
+  httpMethod: {
+    type: 'string',
+    description: 'HTTP method for http tasks',
+  },
+  httpUrl: {
+    type: 'string',
+    description: 'URL for http tasks',
+  },
+  httpHeaders: {
+    type: 'object',
+    additionalProperties: true,
+    description: 'Headers for http tasks',
+  },
+  httpBody: {
+    type: 'string',
+    description: 'Request body for http tasks',
+  },
+  sshProfileId: {
+    type: 'string',
+    description: 'dsh-remote-workspace profile id',
+  },
+  sshTarget: {
+    type: 'string',
+    description: 'Fallback user@host when no remote-workspace profile is used',
+  },
+  sshPort: {
+    type: 'number',
+    description: 'SSH port',
+  },
+  sshKeyPath: {
+    type: 'string',
+    description: 'Private key path',
+  },
+  dockerImage: {
+    type: 'string',
+    description: 'Container image for docker tasks',
+  },
+  skillName: {
+    type: 'string',
+    description: 'DSH skill name for skill tasks',
+  },
+  workflowName: {
+    type: 'string',
+    description: 'DSH workflow name for workflow tasks',
+  },
+  costLimitUsd: {
+    type: 'number',
+    description: 'Maximum allowed total cost in USD before auto-pausing',
+  },
+  dailyCostLimitUsd: {
+    type: 'number',
+    description: 'Maximum allowed daily cost in USD before auto-pausing',
+  },
+  tokenLimit: {
+    type: 'number',
+    description: 'Maximum allowed token usage before auto-pausing',
+  },
+};
+
+export const cronToolOutput = {
+  schema: {
+    type: 'object',
+    additionalProperties: true,
+    properties: {
+      success: { type: 'boolean' },
+      message: { type: 'string' },
+      count: { type: 'number' },
+      task: { type: 'object', additionalProperties: true },
+      tasks: { type: 'array', items: { type: 'object', additionalProperties: true } },
+    },
+  },
+  render: (_args, val) => [{ type: 'text', text: val.message || (val.success ? 'Success' : 'Failed') }],
+};
+
+export async function executeCronTool(store, scheduler, args = {}) {
+  const action = args.action;
+
+  if (!action) {
+    if (args.schedule && args.prompt) {
+      return {
+        success: false,
+        message: 'Missing "action" parameter. The 9 separate cron tools have been consolidated into "cron". Did you mean action: "create"?',
+      };
+    }
+    return {
+      success: false,
+      message: 'Parameter "action" is required: "create", "list", "get", "update", "pause", "resume", "run", or "delete". Note: For simple in-chat reminders, use built-in "schedule_create".',
+    };
+  }
+
+  if (LEGACY_ACTION_MAP[action]) {
+    const suggested = LEGACY_ACTION_MAP[action];
+    return {
+      success: false,
+      message: `Action "${action}" is deprecated. The 9 separate tools have been consolidated into the unified "cron" tool. Please use action: "${suggested}".`,
+    };
+  }
+
+  switch (action) {
+    case 'create': {
+      if (!args.title || !args.schedule || !args.prompt) {
+        return {
+          success: false,
+          message: 'Fields "title", "schedule", and "prompt" are required to create a task.',
+        };
+      }
+      try {
+        return executeCreateTask(store, scheduler, args);
+      } catch (err) {
+        return { success: false, message: err.message };
+      }
+    }
+
+    case 'list': {
+      const tasks = store.list({ status: args.status || 'all' });
+      return {
+        success: true,
+        count: tasks.length,
+        tasks: tasks.map((t) => ({
+          id: t.id,
+          title: t.title,
+          schedule: t.scheduleText || t.schedule,
+          status: t.status,
+          nextRunAt: t.nextRunAt ? new Date(t.nextRunAt).toISOString() : null,
+          lastStatus: t.lastStatus,
+          totalTokens: t.totalTokens || 0,
+          totalCostUsd: t.totalCostUsd || 0,
+          oneShot: Boolean(t.oneShot),
+        })),
+        message: `Total tasks: ${tasks.length}`,
+      };
+    }
+
+    case 'get': {
+      if (!args.id) return { success: false, message: 'Field "id" is required for get action' };
+      const task = store.get(args.id);
+      if (!task) return { success: false, message: 'Task not found' };
+      const summary = [
+        `Task "${task.title}" (${task.id})`,
+        `type: ${task.type || 'llm'}`,
+        `schedule: ${task.scheduleText || task.schedule}`,
+        `status: ${task.status}`,
+        task.type === 'llm' || !task.type ? `model: ${task.model || '(default)'}${task.fallbackModel ? ` (fallback: ${task.fallbackModel})` : ''}` : null,
+        `channels: ${Array.isArray(task.channels) && task.channels.length ? task.channels.join(', ') : '(legacy flags)'}`,
+        `prompt: ${String(task.prompt || '').slice(0, 500)}`,
+      ].filter(Boolean).join('\n');
+      return { success: true, message: summary, task };
+    }
+
+    case 'update': {
+      if (!args.id) return { success: false, message: 'Field "id" is required for update action' };
+      const { id, confirmCodeSwitch, action: _act, ...patch } = args;
+      const result = applyTaskPatch({
+        store,
+        scheduler,
+        id,
+        body: patch,
+        allowCodeSwitch: confirmCodeSwitch === true,
+      });
+      if (!result.ok) return { success: false, message: result.error };
+      return {
+        success: true,
+        message: `Task "${result.task.title}" updated (${result.task.scheduleText || result.task.schedule}). Changed: ${describeTaskPatch(result.task, result.patch)}`,
+        task: result.task,
+      };
+    }
+
+    case 'pause': {
+      if (!args.id) return { success: false, message: 'Field "id" is required for pause action' };
+      if (isConfigOwned(store.get(args.id))) return { success: false, message: configOwnedMessage(args.id) };
+      const task = scheduler.pauseTask(args.id);
+      if (!task) return { success: false, message: 'Task not found' };
+      return { success: true, message: `Task "${task.title}" paused` };
+    }
+
+    case 'resume': {
+      if (!args.id) return { success: false, message: 'Field "id" is required for resume action' };
+      if (isConfigOwned(store.get(args.id))) return { success: false, message: configOwnedMessage(args.id) };
+      const task = scheduler.resumeTask(args.id);
+      if (!task) return { success: false, message: 'Task not found' };
+      return { success: true, message: `Task "${task.title}" resumed (${task.scheduleText})` };
+    }
+
+    case 'run': {
+      if (!args.id) return { success: false, message: 'Field "id" is required for run action' };
+      const task = store.get(args.id);
+      if (!task) return { success: false, message: 'Task not found' };
+      scheduler.triggerManualRun(args.id);
+      return { success: true, message: `Manual run started for task "${task.title}"` };
+    }
+
+    case 'delete': {
+      if (!args.id) return { success: false, message: 'Field "id" is required for delete action' };
+      if (isConfigOwned(store.get(args.id))) return { success: false, message: configOwnedMessage(args.id) };
+      scheduler.pauseTask(args.id);
+      const ok = store.delete(args.id);
+      return { success: ok, message: ok ? 'Task deleted' : 'Task not found' };
+    }
+
+    default:
+      return {
+        success: false,
+        message: `Unknown action "${action}". Allowed actions: create, list, get, update, pause, resume, run, delete.`,
+      };
+  }
+}

package/lib/http-utils.js

@@ -6,6 +6,35 @@
 
 export const MAX_BODY_BYTES = 1024 * 1024;
 export const SCRIPT_CONFIRM_HEADER = 'x-dsh-cron-confirm';
+export const REDACTED_SECRET = '[REDACTED]';
+
+/**
+ * Check if an IP address is a local loopback address.
+ */
+export function isLoopbackAddress(addr) {
+  if (!addr || typeof addr !== 'string') return false;
+  return (
+    addr === '127.0.0.1' ||
+    addr === '::1' ||
+    addr === '::ffff:127.0.0.1' ||
+    addr === 'localhost'
+  );
+}
+
+/**
+ * Extract bearer authorization or custom token from request headers.
+ */
+export function extractBearerToken(req) {
+  const auth = req?.headers?.authorization;
+  if (typeof auth === 'string' && auth.startsWith('Bearer ')) {
+    return auth.slice(7).trim();
+  }
+  const custom = req?.headers?.['x-dsh-cron-token'];
+  if (typeof custom === 'string') {
+    return custom.trim();
+  }
+  return '';
+}
 
 /**
  * Parse a JSON request body with a hard byte size cap.
@@ -48,27 +77,63 @@ export function parseJsonBody(req, limit = MAX_BODY_BYTES) {
 }
 
 /**
- * Detect cross-origin (drive-by/CSRF) requests.
- * Browsers attach Origin to every non-GET request and Sec-Fetch-Site on
- * modern fetches; plain local API clients (curl, server-side calls) send
- * neither and stay allowed.
+ * Validate that an incoming request originates from a trusted local caller or
+ * an authenticated client (Issue #86).
+ *
+ * Rules:
+ * 1. Non-loopback remote callers are rejected unless authenticated with a valid token.
+ * 2. Host header must be present and non-empty.
+ * 3. Origin header (if present) cannot be null and its host must match Host.
+ * 4. Sec-Fetch-Site (if present) must be same-origin or none (cross-site/same-site rejected).
+ * 5. Mutating requests (POST, PUT, PATCH, DELETE) must provide browser proof (same-origin / matching Origin)
+ *    or an explicit capability header (confirm header, token, or update header).
  */
-export function isCrossOrigin(req) {
+export function isTrustedRequest(req, options = {}) {
+  if (!req) return false;
   const headers = req.headers || {};
+
+  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress;
+  const hasRemote = Boolean(remote && typeof remote === 'string');
+  const isLoopback = !hasRemote || isLoopbackAddress(remote);
+
+  const token = extractBearerToken(req);
+  const expectedToken = options.apiToken || process.env.DSH_AUTH_TOKEN || process.env.DSH_TOKEN;
+  const isTokenAuthenticated = Boolean(expectedToken && token && token === expectedToken);
+
+  // 1. Non-loopback remote addresses require explicit token authentication (#86)
+  if (hasRemote && !isLoopback && !isTokenAuthenticated) {
+    return false;
+  }
+
+  // 2. Validate Origin header if present: cannot be null, must match Host
   const origin = headers.origin;
+  const host = headers.host || '';
   if (origin !== undefined) {
-    if (origin === 'null') return true;
+    if (origin === 'null' || !origin) return false;
     try {
       const parsed = new URL(origin);
-      const host = headers.host || '';
-      if (parsed.host && parsed.host !== host) return true;
-    } catch (err) {
-      return true;
+      if (!parsed.host || !host || parsed.host !== host) return false;
+    } catch {
+      return false;
     }
   }
+
+  // 3. Validate Sec-Fetch-Site header if present
   const site = headers['sec-fetch-site'];
-  if (site && site !== 'same-origin' && site !== 'none') return true;
-  return false;
+  if (site !== undefined) {
+    if (site !== 'same-origin' && site !== 'none') {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+/**
+ * Backward-compatible wrapper for checking cross-origin / untrusted requests.
+ */
+export function isCrossOrigin(req, options) {
+  return !isTrustedRequest(req, options);
 }
 
 /**
@@ -91,9 +156,9 @@ export function sendJson(res, statusCode, data) {
   res.end(JSON.stringify(data));
 }
 
-export function rejectCrossOrigin(req, res) {
-  if (isCrossOrigin(req)) {
-    sendJson(res, 403, { ok: false, error: 'Cross-origin request rejected' });
+export function rejectCrossOrigin(req, res, options) {
+  if (!isTrustedRequest(req, options)) {
+    sendJson(res, 403, { ok: false, error: 'Forbidden: untrusted or cross-origin request' });
     return true;
   }
   return false;
@@ -108,4 +173,109 @@ export async function readBody(req, res) {
   }
 }
 
-/** Settings keys synchronized between the store and the settings service. */
+/**
+ * Redact sensitive fields (env, httpHeaders, httpBody) from task records before returning in GET responses (Issue #86).
+ */
+export function redactTaskSecrets(task) {
+  if (!task || typeof task !== 'object') return task;
+  const clone = { ...task };
+
+  if (clone.env && typeof clone.env === 'object') {
+    const redactedEnv = {};
+    for (const [k, v] of Object.entries(clone.env)) {
+      redactedEnv[k] = v ? REDACTED_SECRET : v;
+    }
+    clone.env = redactedEnv;
+  }
+
+  if (clone.httpHeaders) {
+    if (typeof clone.httpHeaders === 'object' && clone.httpHeaders !== null) {
+      const redactedHeaders = {};
+      for (const [k, v] of Object.entries(clone.httpHeaders)) {
+        redactedHeaders[k] = v ? REDACTED_SECRET : v;
+      }
+      clone.httpHeaders = redactedHeaders;
+    } else if (typeof clone.httpHeaders === 'string') {
+      try {
+        const parsed = JSON.parse(clone.httpHeaders);
+        if (parsed && typeof parsed === 'object') {
+          const redactedHeaders = {};
+          for (const [k, v] of Object.entries(parsed)) {
+            redactedHeaders[k] = v ? REDACTED_SECRET : v;
+          }
+          clone.httpHeaders = JSON.stringify(redactedHeaders);
+        } else {
+          clone.httpHeaders = REDACTED_SECRET;
+        }
+      } catch {
+        clone.httpHeaders = REDACTED_SECRET;
+      }
+    }
+  }
+
+  if (clone.httpBody) {
+    clone.httpBody = REDACTED_SECRET;
+  }
+
+  return clone;
+}
+
+/**
+ * Restore redacted secret fields from the existing record when updating a task (Issue #86).
+ */
+export function restoreTaskSecrets(incoming, current) {
+  if (!incoming || typeof incoming !== 'object' || !current || typeof current !== 'object') {
+    return incoming;
+  }
+  const restored = { ...incoming };
+
+  // Restore env values
+  if (restored.env && typeof restored.env === 'object' && current.env && typeof current.env === 'object') {
+    const mergedEnv = { ...restored.env };
+    for (const [k, v] of Object.entries(mergedEnv)) {
+      if (v === REDACTED_SECRET && current.env[k] !== undefined) {
+        mergedEnv[k] = current.env[k];
+      }
+    }
+    restored.env = mergedEnv;
+  }
+
+  // Restore httpHeaders values
+  if (restored.httpHeaders && current.httpHeaders) {
+    if (typeof restored.httpHeaders === 'object' && typeof current.httpHeaders === 'object') {
+      const mergedHeaders = { ...restored.httpHeaders };
+      for (const [k, v] of Object.entries(mergedHeaders)) {
+        if (v === REDACTED_SECRET && current.httpHeaders[k] !== undefined) {
+          mergedHeaders[k] = current.httpHeaders[k];
+        }
+      }
+      restored.httpHeaders = mergedHeaders;
+    } else if (typeof restored.httpHeaders === 'string') {
+      try {
+        const parsedRestored = JSON.parse(restored.httpHeaders);
+        const parsedCurrent = typeof current.httpHeaders === 'object'
+          ? current.httpHeaders
+          : JSON.parse(current.httpHeaders);
+        if (parsedRestored && typeof parsedRestored === 'object' && parsedCurrent && typeof parsedCurrent === 'object') {
+          for (const [k, v] of Object.entries(parsedRestored)) {
+            if (v === REDACTED_SECRET && parsedCurrent[k] !== undefined) {
+              parsedRestored[k] = parsedCurrent[k];
+            }
+          }
+          restored.httpHeaders = JSON.stringify(parsedRestored);
+        }
+      } catch {
+        if (restored.httpHeaders === REDACTED_SECRET) {
+          restored.httpHeaders = current.httpHeaders;
+        }
+      }
+    }
+  }
+
+  // Restore httpBody value
+  if (restored.httpBody === REDACTED_SECRET && current.httpBody !== undefined) {
+    restored.httpBody = current.httpBody;
+  }
+
+  return restored;
+}