@goodandready/dsh-cron 0.2.3 → 0.2.4

package/lib/index.js

@@ -14,12 +14,16 @@ import {
   pickPatchableFields,
   SCRIPT_CONFIRM_HEADER,
 } from './http-utils.js';
+import { TASK_TYPES, CODE_EXECUTING_TYPES, normalizeTaskType } from './runtimes.js';
+import { resolveTelegramSecrets, resolveCredentialValue } from './secrets.js';
+import { deliverRun, CHANNEL_IDS } from './channels.js';
 
 export const name = '@goodandready/dsh-cron';
-export const inject = ['tools', 'webServer', 'settings', 'llm', 'agents', 'agentDefaultModel'];
+export const inject = ['tools', 'webServer', 'settings', 'llm', 'agents', 'agentDefaultModel', 'credentials'];
 
 export const Config = z.object({
-  botToken: z.string().role('secret').default('').description('Telegram Bot API token used to deliver task reports'),
+  botToken: z.string().role('secret').default('').description('Legacy Telegram Bot API token (prefer botTokenRef with the DSH credentials service)'),
+  botTokenRef: z.string().default('').description('Name of the DSH credential that holds the Telegram bot token'),
   chatId: z.string().default('').description('Telegram chat ID that receives task reports'),
   notifyTelegram: z.boolean().default(false).description('Deliver task reports to Telegram for every task'),
   onlyOnFailure: z.boolean().default(false).description('Deliver reports only for failed runs'),
@@ -28,6 +32,30 @@ export const Config = z.object({
   maxConcurrent: z.number().default(0).description('Max parallel task runs (0 = unlimited)'),
   heartbeatUrl: z.string().default('').description('Dead man\'s snitch URL pinged on the heartbeat interval'),
   heartbeatIntervalSec: z.number().default(0).description('Heartbeat ping interval in seconds (0 = off)'),
+  // --- Delivery channels (#20-#23, #26, #28, #47) ---
+  template: z.string().default('').description('Global notification template; placeholders: {title} {status} {output} {error} {duration} {schedule} {time} {tokens} {cost}'),
+  channelTemplates: z.object({}).default({}).description('Per-channel template overrides keyed by channel id'),
+  deliveryTimeoutMs: z.number().default(15000).description('Per-channel delivery timeout in ms; a slower endpoint is recorded as a failure and does not block other channels or the next tick'),
+  discordWebhookUrl: z.string().default('').description('Discord webhook URL'),
+  slackWebhookUrl: z.string().default('').description('Slack incoming webhook URL'),
+  ntfyUrl: z.string().default('https://ntfy.sh').description('ntfy server base URL'),
+  ntfyTopic: z.string().default('').description('ntfy topic for push notifications'),
+  ntfyTokenRef: z.string().default('').description('Credential name for the ntfy access token'),
+  barkServerUrl: z.string().default('https://api.day.app').description('Bark server base URL'),
+  barkKey: z.string().default('').description('Bark device key'),
+  pushplusTokenRef: z.string().default('').description('Credential name for the PushPlus token'),
+  pushplusUrl: z.string().default('https://www.pushplus.plus/send').description('PushPlus send endpoint (override for a self-hosted proxy)'),
+  smtpHost: z.string().default('').description('SMTP host for email notifications'),
+  smtpPort: z.number().default(587).description('SMTP port'),
+  smtpSecure: z.boolean().default(false).description('Use implicit TLS for SMTP'),
+  smtpUser: z.string().default('').description('SMTP user name'),
+  smtpPasswordRef: z.string().default('').description('Credential name for the SMTP password'),
+  smtpFrom: z.string().default('').description('From address for email notifications'),
+  smtpTo: z.string().default('').description('Comma-separated recipient addresses'),
+  ttsBaseUrl: z.string().default('http://127.0.0.1:3080').description('Base URL of the harness used to reach the dsh-tts speak route'),
+  giteaBaseUrl: z.string().default('').description('Gitea base URL for alert issues'),
+  giteaRepo: z.string().default('').description('Gitea repository (owner/name) for alert issues'),
+  giteaTokenRef: z.string().default('').description('Credential name for the Gitea API token'),
 });
 
 const PATCHABLE_TASK_FIELDS = [
@@ -44,15 +72,62 @@ const PATCHABLE_TASK_FIELDS = [
   'maxRetries',
   'retryBackoffMs',
   'permissionPreset',
+  'env',
+  'cwd',
+  'workspaceId',
+  'worktree',
+  'keepWorktree',
+  'httpMethod',
+  'httpUrl',
+  'httpHeaders',
+  'httpBody',
+  'sshTarget',
+  'sshPort',
+  'sshKeyPath',
+  'sshProfileId',
+  'dockerImage',
+  'pythonPath',
+  'nodePath',
+  'skillName',
+  'workflowName',
   'notifyTelegram',
   'onlyOnFailure',
   'timeoutSeconds',
   'overlapPolicy',
   'kanbanMode',
+  'channels',
+  'template',
   'status',
   'oneShot',
 ];
 
+/**
+ * Validate runtime-specific task configuration. Returns an error string or
+ * null when the payload is usable for the given type.
+ */
+export function validateTaskType(type, payload) {
+  const t = normalizeTaskType(type);
+  if (t === 'http') {
+    const raw = String((payload && (payload.httpUrl || payload.prompt)) || '').trim();
+    if (!raw) return 'HTTP tasks require a URL (httpUrl or prompt)';
+    try {
+      // eslint-disable-next-line no-new
+      new URL(raw);
+    } catch {
+      return `Invalid HTTP URL: ${raw}`;
+    }
+  }
+  if (t === 'ssh') {
+    const hasProfile = Boolean(payload && String(payload.sshProfileId || '').trim());
+    const hasTarget = Boolean(payload && String(payload.sshTarget || '').trim());
+    if (!hasProfile && !hasTarget) return 'SSH tasks require sshProfileId (remote-workspace profile) or sshTarget (user@host)';
+  }
+  if (t === 'docker' && !String((payload && payload.dockerImage) || '').trim()) {
+    return 'Docker tasks require dockerImage';
+  }
+  return null;
+}
+
 function sendJson(res, statusCode, data) {
   res.writeHead(statusCode, { 'Content-Type': 'application/json' });
   res.end(JSON.stringify(data));
@@ -75,6 +150,20 @@ async function readBody(req, res) {
   }
 }
 
+/** Settings keys synchronized between the store and the settings service. */
+export const SETTINGS_SYNC_KEYS = [
+  'botToken', 'botTokenRef', 'chatId', 'notifyTelegram', 'onlyOnFailure', 'kanbanBaseUrl',
+  'template', 'channelTemplates', 'deliveryTimeoutMs',
+  'discordWebhookUrl', 'slackWebhookUrl',
+  'ntfyUrl', 'ntfyTopic', 'ntfyTokenRef',
+  'barkServerUrl', 'barkKey',
+  'pushplusTokenRef',
+  'pushplusUrl',
+  'smtpHost', 'smtpPort', 'smtpSecure', 'smtpUser', 'smtpPasswordRef', 'smtpFrom', 'smtpTo',
+  'ttsBaseUrl',
+  'giteaBaseUrl', 'giteaRepo', 'giteaTokenRef',
+];
+
 /**
  * Apply settings writes through the registered settings scope so the core
  * snapshot stays authoritative (#102). Returns null when the settings
@@ -83,7 +172,7 @@ async function readBody(req, res) {
 export async function applySettingsToScope(settingsScope, body) {
   if (!settingsScope || typeof settingsScope.set !== 'function') return null;
   const errors = [];
-  for (const key of ['botToken', 'chatId', 'notifyTelegram', 'onlyOnFailure', 'kanbanBaseUrl']) {
+  for (const key of SETTINGS_SYNC_KEYS) {
     if (!Object.prototype.hasOwnProperty.call(body, key)) continue;
     try {
       await settingsScope.set(key, body[key]);
@@ -95,13 +184,29 @@ export async function applySettingsToScope(settingsScope, body) {
 }
 
 /**
- * Drop values that must never re-enter the store from the client: a masked
- * secret echoed back by the settings UI would overwrite the real token.
+ * Drop values that must never re-enter the store from the client:
+ *
+ * - a masked secret echoed back by the settings UI would overwrite the real
+ *   value (bot token, SMTP password, webhook URLs, Bark key);
+ * - the raw credential keys are refused outright — the *Ref fields are the
+ *   supported way to configure them.
+ *
+ * Applied before both the settings scope and the store, because the scope is
+ * the source of truth and would otherwise persist a raw or masked value.
  */
 export function sanitizeSettingsPayload(body) {
   const payload = Object.assign({}, body);
-  if (typeof payload.botToken === 'string' && (payload.botToken.includes('••') || payload.botToken.includes('****'))) {
-    delete payload.botToken;
+  for (const key of TaskStore.MASKED_SETTING_KEYS) {
+    const val = payload[key];
+    if (typeof val === 'string' && (val.includes('••') || val.includes('****'))) {
+      delete payload[key];
+    }
+  }
+  for (const key of TaskStore.FORBIDDEN_SETTING_KEYS) {
+    if (key in payload) {
+      console.warn(`[dsh-cron] refusing raw secret "${key}" from the client — use a credential reference`);
+      delete payload[key];
+    }
   }
   return payload;
 }
@@ -150,9 +255,14 @@ export function createCronApiHandler(store, scheduler, collection) {
             sendJson(res, 400, { ok: false, error: 'Fields title, schedule and prompt are required' });
             return;
           }
-          const taskType = body.type === 'script' ? 'script' : 'llm';
-          if (taskType === 'script' && req.headers[SCRIPT_CONFIRM_HEADER] !== 'script') {
-            sendJson(res, 403, { ok: false, error: 'Creating script tasks over HTTP requires the x-dsh-cron-confirm: script header' });
+          const taskType = normalizeTaskType(body.type);
+          if (CODE_EXECUTING_TYPES.includes(taskType) && req.headers[SCRIPT_CONFIRM_HEADER] !== 'script') {
+            sendJson(res, 403, { ok: false, error: `Creating ${taskType} tasks over HTTP requires the x-dsh-cron-confirm: script header` });
+            return;
+          }
+          const typeError = validateTaskType(taskType, body);
+          if (typeError) {
+            sendJson(res, 400, { ok: false, error: typeError });
             return;
           }
           const parsed = parseScheduleExpression(body.schedule);
@@ -180,6 +290,28 @@ export function createCronApiHandler(store, scheduler, collection) {
             maxRetries: body.maxRetries !== undefined ? Math.max(0, Number(body.maxRetries) || 0) : (current ? (Number(current.maxRetries) || 0) : 0),
             retryBackoffMs: body.retryBackoffMs !== undefined ? Math.max(1000, Number(body.retryBackoffMs) || 30000) : (current ? (Number(current.retryBackoffMs) || 30000) : 30000),
             permissionPreset: ['default', 'read-only', 'workspace-write', 'full'].includes(body.permissionPreset) ? body.permissionPreset : (current ? (current.permissionPreset || 'default') : 'default'),
+            env: body.env && typeof body.env === 'object' ? body.env : (current ? current.env : undefined),
+            cwd: body.cwd !== undefined ? String(body.cwd).trim() : (current ? current.cwd : ''),
+            channels: Array.isArray(body.channels)
+              ? body.channels.filter((c) => CHANNEL_IDS.includes(c))
+              : (current ? current.channels : undefined),
+            template: body.template !== undefined ? String(body.template) : (current ? current.template : ''),
+            workspaceId: body.workspaceId !== undefined ? String(body.workspaceId).trim() : (current ? current.workspaceId : ''),
+            worktree: body.worktree !== undefined ? Boolean(body.worktree) : (current ? Boolean(current.worktree) : false),
+            keepWorktree: body.keepWorktree !== undefined ? Boolean(body.keepWorktree) : (current ? Boolean(current.keepWorktree) : false),
+            httpMethod: body.httpMethod ? String(body.httpMethod).toUpperCase() : (current ? current.httpMethod : 'GET'),
+            httpUrl: body.httpUrl !== undefined ? String(body.httpUrl).trim() : (current ? current.httpUrl : ''),
+            httpHeaders: body.httpHeaders !== undefined ? body.httpHeaders : (current ? current.httpHeaders : undefined),
+            httpBody: body.httpBody !== undefined ? String(body.httpBody) : (current ? current.httpBody : ''),
+            sshProfileId: body.sshProfileId !== undefined ? String(body.sshProfileId).trim() : (current ? current.sshProfileId : ''),
+            sshTarget: body.sshTarget !== undefined ? String(body.sshTarget).trim() : (current ? current.sshTarget : ''),
+            sshPort: body.sshPort !== undefined ? Number(body.sshPort) || 0 : (current ? current.sshPort : 0),
+            sshKeyPath: body.sshKeyPath !== undefined ? String(body.sshKeyPath).trim() : (current ? current.sshKeyPath : ''),
+            dockerImage: body.dockerImage !== undefined ? String(body.dockerImage).trim() : (current ? current.dockerImage : ''),
+            pythonPath: body.pythonPath !== undefined ? String(body.pythonPath).trim() : (current ? current.pythonPath : ''),
+            nodePath: body.nodePath !== undefined ? String(body.nodePath).trim() : (current ? current.nodePath : ''),
+            skillName: body.skillName !== undefined ? String(body.skillName).trim() : (current ? current.skillName : ''),
+            workflowName: body.workflowName !== undefined ? String(body.workflowName).trim() : (current ? current.workflowName : ''),
             oneShot: Boolean(parsed.isOneShot || body.oneShot),
           });
           if (task.status === 'active') {
@@ -254,9 +386,19 @@ export function createCronApiHandler(store, scheduler, collection) {
         if (error) return;
         // Whitelist patchable fields so stats/timestamps stay server-owned (#90)
         const patchData = pickPatchableFields(body, PATCHABLE_TASK_FIELDS);
-        if (patchData.type === 'script' && current.type !== 'script' && req.headers[SCRIPT_CONFIRM_HEADER] !== 'script') {
-          sendJson(res, 403, { ok: false, error: 'Switching a task to the script type over HTTP requires the x-dsh-cron-confirm: script header' });
-          return;
+        if (patchData.type !== undefined) {
+          patchData.type = normalizeTaskType(patchData.type);
+          const switchingToCode = CODE_EXECUTING_TYPES.includes(patchData.type)
+            && !CODE_EXECUTING_TYPES.includes(current.type);
+          if (switchingToCode && req.headers[SCRIPT_CONFIRM_HEADER] !== 'script') {
+            sendJson(res, 403, { ok: false, error: `Switching a task to the ${patchData.type} type over HTTP requires the x-dsh-cron-confirm: script header` });
+            return;
+          }
+          const typeError = validateTaskType(patchData.type, { ...current, ...patchData });
+          if (typeError) {
+            sendJson(res, 400, { ok: false, error: typeError });
+            return;
+          }
         }
         if (patchData.schedule) {
           const parsed = parseScheduleExpression(patchData.schedule);
@@ -296,7 +438,9 @@ export function createCronApiHandler(store, scheduler, collection) {
  * alias pair (#70, #92). Exported for unit tests.
  */
 export function executeCreateTask(store, scheduler, args) {
-  const taskType = args.type === 'script' ? 'script' : 'llm';
+  const taskType = normalizeTaskType(args.type);
+  const typeError = validateTaskType(taskType, args);
+  if (typeError) throw new Error(typeError);
   const parsed = parseScheduleExpression(args.schedule);
   const task = store.set({
     title: args.title,
@@ -318,6 +462,26 @@ export function executeCreateTask(store, scheduler, args) {
     retryBackoffMs: Number(args.retryBackoffMs) > 0 ? Number(args.retryBackoffMs) : 30000,
     permissionPreset: ['default', 'read-only', 'workspace-write', 'full'].includes(args.permissionPreset) ? args.permissionPreset : 'default',
     kanbanMode: args.kanbanMode || 'none',
+    channels: Array.isArray(args.channels) ? args.channels.filter((c) => CHANNEL_IDS.includes(c)) : undefined,
+    template: args.template ? String(args.template) : '',
+    env: args.env && typeof args.env === 'object' ? args.env : undefined,
+    cwd: args.cwd ? String(args.cwd).trim() : '',
+    workspaceId: args.workspaceId ? String(args.workspaceId).trim() : '',
+    worktree: Boolean(args.worktree),
+    keepWorktree: Boolean(args.keepWorktree),
+    httpMethod: args.httpMethod ? String(args.httpMethod).toUpperCase() : 'GET',
+    httpUrl: args.httpUrl ? String(args.httpUrl).trim() : '',
+    httpHeaders: args.httpHeaders,
+    httpBody: args.httpBody !== undefined ? String(args.httpBody) : '',
+    sshProfileId: args.sshProfileId ? String(args.sshProfileId).trim() : '',
+    sshTarget: args.sshTarget ? String(args.sshTarget).trim() : '',
+    sshPort: Number(args.sshPort) || 0,
+    sshKeyPath: args.sshKeyPath ? String(args.sshKeyPath).trim() : '',
+    dockerImage: args.dockerImage ? String(args.dockerImage).trim() : '',
+    pythonPath: args.pythonPath ? String(args.pythonPath).trim() : '',
+    nodePath: args.nodePath ? String(args.nodePath).trim() : '',
+    skillName: args.skillName ? String(args.skillName).trim() : '',
+    workflowName: args.workflowName ? String(args.workflowName).trim() : '',
     oneShot: Boolean(parsed.isOneShot),
   });
   scheduler.scheduleTask(task);
@@ -328,11 +492,11 @@ export function executeCreateTask(store, scheduler, args) {
   };
 }
 
-const createTaskParameters = {
+export const createTaskParameters = {
   title: { type: 'string', description: 'Short task name', required: true },
   schedule: { type: 'string', description: 'Schedule: cron ("0 9 * * *"), shorthand ("@daily", "@every 30m"), interval ("every 2h") or one-shot ("in 30m", "at: 2026-09-05T15:00:00Z")', required: true },
   prompt: { type: 'string', description: 'Prompt/instruction for the agent at run time', required: true },
-  type: { type: 'string', enum: ['prompt', 'script'], description: 'Task type' },
+  type: { type: 'string', enum: TASK_TYPES, description: 'Task type: llm | script | node | python | http | ssh | docker | skill | workflow' },
   delivery: { type: 'string', enum: ['current', 'isolated'], description: 'Run mode: current (in the current chat) or isolated (separate session)' },
   provider: { type: 'string', description: 'Model provider (optional)' },
   model: { type: 'string', description: 'Model (optional)' },
@@ -346,6 +510,26 @@ const createTaskParameters = {
   retryBackoffMs: { type: 'number', description: 'Base backoff between retries in ms, doubled per attempt' },
   permissionPreset: { type: 'string', enum: ['default', 'read-only', 'workspace-write', 'full'], description: 'Permission preset applied to the task session' },
   kanbanMode: { type: 'string', enum: ['none', 'on_failure', 'always'], description: 'Create a dsh-kanban card for runs' },
+  channels: { type: 'array', items: { type: 'string', enum: CHANNEL_IDS }, description: 'Notification channels for this task; empty = legacy telegram/kanban flags' },
+  template: { type: 'string', description: 'Notification template with {title} {status} {output} {error} {duration} placeholders; empty = built-in text' },
+  env: { type: 'object', additionalProperties: true, description: 'Environment variables for external runtimes (KEY: value); do not store secrets here' },
+  cwd: { type: 'string', description: 'Working directory for the run (external runtimes and agent sessions)' },
+  workspaceId: { type: 'string', description: 'Workspace bound to the task; resolved through the harness' },
+  worktree: { type: 'boolean', description: 'Run code-modifying agent tasks in an isolated git worktree' },
+  keepWorktree: { type: 'boolean', description: 'Keep the created worktree after the run' },
+  nodePath: { type: 'string', description: 'Node.js binary for node tasks (default: the harness runtime)' },
+  pythonPath: { type: 'string', description: 'Python interpreter for python tasks (default: auto-detected venv)' },
+  httpMethod: { type: 'string', description: 'HTTP method for http tasks' },
+  httpUrl: { type: 'string', description: 'URL for http tasks' },
+  httpHeaders: { type: 'object', additionalProperties: true, description: 'Headers for http tasks' },
+  httpBody: { type: 'string', description: 'Request body for http tasks' },
+  sshProfileId: { type: 'string', description: 'dsh-remote-workspace profile id that provides host and credentials' },
+  sshTarget: { type: 'string', description: 'Fallback user@host when no remote-workspace profile is used' },
+  sshPort: { type: 'number', description: 'SSH port (with sshTarget fallback)' },
+  sshKeyPath: { type: 'string', description: 'Private key path (with sshTarget fallback)' },
+  dockerImage: { type: 'string', description: 'Container image for docker tasks' },
+  skillName: { type: 'string', description: 'DSH skill name for skill tasks' },
+  workflowName: { type: 'string', description: 'DSH workflow name for workflow tasks' },
 };
 
 const createTaskOutput = {
@@ -367,6 +551,16 @@ export function apply(ctx, config) {
   const scheduler = new TaskScheduler(store, (task, opts) => runner.execute(task, opts), {
     maxConcurrent: config && config.maxConcurrent,
     defaultTimezone: config && config.defaultTimezone,
+    resolveSecrets: (settings) => resolveTelegramSecrets(ctx, settings),
+    deliver: (task, runInfo, settings) => deliverRun({
+      task,
+      runInfo,
+      settings,
+      secrets: {
+        botToken: settings.botToken || '',
+        resolveSecret: (ref) => resolveCredentialValue(ctx, ref),
+      },
+    }),
   });
 
   // Register settings in the Harness settings service (#71, #102): the scope

package/lib/integrations.js

@@ -49,7 +49,8 @@ export async function createKanbanCard({
   column = 'backlog',
   labels = ['cron', 'alert'],
   fetchFn = globalThis.fetch,
-  kanbanBaseUrl = 'http://127.0.0.1:3000'
+  kanbanBaseUrl = 'http://127.0.0.1:3000',
+  signal
 }) {
   try {
     const url = `${kanbanBaseUrl.replace(/\/$/, '')}/dsh-kanban/task`;
@@ -58,6 +59,7 @@ export async function createKanbanCard({
       headers: {
         'Content-Type': 'application/json',
       },
+      signal,
       body: JSON.stringify({
         title,
         body,

package/lib/runner.js

@@ -1,4 +1,9 @@
 import { estimateTokenCost } from './integrations.js';
+import {
+  EXTERNAL_RUNTIMES,
+  normalizeTaskType,
+  buildInvocation,
+} from './runtimes.js';
 
 /**
  * Runner executing scheduled tasks in DeepSeek Harness sessions.
@@ -43,35 +48,164 @@ export class SessionRunner {
     }
   }
 
-  async _run(task, signal) {
-    console.log(`[dsh-cron] executing task "${task.title}" (${task.id})`);
+  /**
+   * Resolve the working directory for a task: explicit cwd, a bound
+   * workspace id resolved through the harness, or the process cwd (#31).
+   */
+  resolveCwd(task) {
+    if (task.cwd) return String(task.cwd);
+    if (task.workspaceId && this.ctx && typeof this.ctx.get === 'function') {
+      try {
+        const workspaces = this.ctx.get('workspaces');
+        const ws = workspaces && (typeof workspaces.get === 'function'
+          ? workspaces.get(task.workspaceId)
+          : (workspaces[task.workspaceId] || null));
+        const resolved = ws && (ws.path || ws.cwd || ws.root || ws.dir);
+        if (resolved) return String(resolved);
+      } catch {}
+      return String(task.workspaceId);
+    }
+    return process.cwd();
+  }
 
-    // 1. Direct shell / script task fallback (NO-LLM)
-    if (task.type === 'script' || task.mode === 'no-llm') {
-      const { exec } = await import('node:child_process');
-      return new Promise((resolve, reject) => {
-        const shellPath = process.platform === 'win32' ? undefined : (process.env.SHELL || '/bin/bash');
-        const child = exec(task.prompt, {
-          cwd: process.cwd(),
-          signal,
-          maxBuffer: 10 * 1024 * 1024,
-          shell: shellPath,
-          env: { ...process.env },
-        }, (err, stdout, stderr) => {
-          if (err) {
-            if (signal && signal.aborted) {
-              return reject(signal.reason || new Error('Command aborted'));
-            }
-            return reject(err);
+  /** Create an isolated git worktree for a code-modifying task (#29). */
+  async createTaskWorktree(cwd, task) {
+    const { execFile } = await import('node:child_process');
+    const path = await import('node:path');
+    const wtPath = path.join(cwd, '.dsh-cron-worktrees', `${task.id}-${Date.now()}`);
+    await new Promise((resolve, reject) => {
+      execFile('git', ['-C', cwd, 'worktree', 'add', '--detach', wtPath, 'HEAD'], { maxBuffer: 4 * 1024 * 1024 }, (err, stdout, stderr) => {
+        if (err) reject(new Error(String(stderr || err.message).trim()));
+        else resolve(stdout);
+      });
+    });
+    return wtPath;
+  }
+
+  /**
+   * Remove a task worktree; never throws (best-effort cleanup).
+   * Plain removal only — no force flags anywhere (workspace rule). A dirty
+   * worktree is left in place and reported instead of being force-deleted.
+   */
+  async removeTaskWorktree(cwd, wtPath) {
+    const { execFile } = await import('node:child_process');
+    await new Promise((resolve) => {
+      execFile('git', ['-C', cwd, 'worktree', 'remove', wtPath], { maxBuffer: 4 * 1024 * 1024 }, (err, stdout, stderr) => {
+        if (err) {
+          console.warn(`[dsh-cron] task worktree kept (not removable without force): ${wtPath} — ${String(stderr || err.message).trim()}`);
+        }
+        execFile('git', ['-C', cwd, 'worktree', 'prune'], () => resolve());
+      });
+    });
+  }
+
+  /** HTTP trigger runtime (#7). */
+  async _runHttp(task, request, signal) {
+    const res = await fetch(request.url, {
+      method: request.method,
+      headers: request.headers,
+      body: request.body,
+      signal,
+    });
+    const text = await res.text().catch(() => '');
+    const summary = `${request.method} ${request.url} -> ${res.status} ${res.statusText || ''}`.trim();
+    if (!res.ok) {
+      throw new Error(`${summary}\n${String(text).slice(0, 500)}`);
+    }
+    return {
+      output: `${summary}\n${String(text).trim().slice(0, 4000)}`.trim(),
+      usage: { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0 },
+      costUsd: 0,
+    };
+  }
+
+  /**
+   * #9 reuse-first path: when the task names a dsh-remote-workspace profile,
+   * execute through that plugin's `remoteSsh` service so host settings and
+   * credentials stay owned by it (we only reference the profile id).
+   * Returns null when the service or the profile is unavailable so the caller
+   * can fall back to a direct ssh invocation.
+   */
+  async _runViaRemoteWorkspace(task, signal) {
+    if (!task.sshProfileId || !this.ctx || typeof this.ctx.get !== 'function') return null;
+    let svc = null;
+    try {
+      svc = this.ctx.get('remoteSsh');
+    } catch {}
+    if (!svc || typeof svc.exec !== 'function') return null;
+
+    let profile = null;
+    try {
+      const settings = this.ctx.get('settings');
+      if (settings && typeof settings.get === 'function') {
+        const snap = settings.get('dsh-remote-workspace');
+        const profiles = snap && Array.isArray(snap.profiles) ? snap.profiles : [];
+        profile = profiles.find((p) => p && p.id === task.sshProfileId) || null;
+      }
+    } catch {}
+    if (!profile) {
+      throw new Error(`remote-workspace profile "${task.sshProfileId}" was not found — check dsh-remote-workspace settings, or use sshTarget instead`);
+    }
+    const res = await svc.exec(profile, String(task.prompt || 'true'), task.cwd || profile.remoteWorkspace || undefined);
+    const output = [res && res.stdout, res && res.stderr].filter((x) => x && String(x).trim()).join('\n').trim();
+    const code = res && typeof res.code === 'number' ? res.code : 0;
+    if (code !== 0) {
+      throw new Error(`Remote command exited with code ${code}\n${output}`.slice(0, 4000));
+    }
+    return {
+      output: output || 'Remote command completed with code 0',
+      usage: { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0 },
+      costUsd: 0,
+    };
+  }
+
+  /** Non-LLM runtimes: shell, Node.js, Python, HTTP, SSH, Docker (#4 #5 #7 #8 #9). */
+  async _runExternal(task, runtime, signal) {
+    if (runtime === 'ssh' && task.sshProfileId) {
+      const viaService = await this._runViaRemoteWorkspace(task, signal);
+      if (viaService) return viaService;
+      if (!task.sshTarget) {
+        throw new Error('SSH task needs either a working dsh-remote-workspace profile (sshProfileId) or an sshTarget');
+      }
+    }
+    const cwd = this.resolveCwd(task);
+    const invocation = buildInvocation({ ...task, type: runtime }, cwd);
+    if (invocation.http) return this._runHttp(task, invocation.http, signal);
+
+    const { exec, execFile } = await import('node:child_process');
+    return new Promise((resolve, reject) => {
+      const done = (err, stdout, stderr) => {
+        if (err) {
+          if (signal && signal.aborted) {
+            return reject(signal.reason || new Error('Command aborted'));
           }
-          const out = (stdout || stderr || '').trim();
-          resolve({
-            output: out || 'Script completed with code 0',
-            usage: { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0 },
-            costUsd: 0
-          });
+          const detail = String(stderr || '').trim();
+          return reject(new Error(detail ? `${err.message}\n${detail}` : err.message));
+        }
+        const out = (stdout || stderr || '').trim();
+        resolve({
+          output: out || `${runtime} task completed with code 0`,
+          usage: { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0 },
+          costUsd: 0,
         });
-      });
+      };
+      const options = { cwd, signal, maxBuffer: 10 * 1024 * 1024, env: invocation.env };
+      if (invocation.file) {
+        execFile(invocation.file, invocation.args || [], options, done);
+      } else {
+        const shellPath = process.platform === 'win32' ? undefined : (process.env.SHELL || '/bin/bash');
+        exec(invocation.shellCommand, { ...options, shell: shellPath }, done);
+      }
+    });
+  }
+
+  async _run(task, signal) {
+    console.log(`[dsh-cron] executing task "${task.title}" (${task.id})`);
+
+    // 1. Non-LLM runtimes: shell, Node.js, Python, HTTP, SSH, Docker (#4 #5 #7 #8 #9)
+    const runtime = normalizeTaskType(task.type);
+    if (EXTERNAL_RUNTIMES.includes(runtime) || task.mode === 'no-llm') {
+      return this._runExternal(task, runtime === 'llm' ? 'script' : runtime, signal);
     }
 
     // 2. If ctx.agents is available, run through agent session (LLM)
@@ -121,7 +255,26 @@ export class SessionRunner {
           ]);
         };
 
-        const cwd = process.cwd();
+        const baseCwd = this.resolveCwd(task);
+        // #29: code-modifying tasks may run in an isolated git worktree.
+        let cwd = baseCwd;
+        let taskWorktree = null;
+        if (task.worktree) {
+          try {
+            taskWorktree = await this.createTaskWorktree(baseCwd, task);
+            cwd = taskWorktree;
+          } catch (wtErr) {
+            console.warn('[dsh-cron] task worktree not created, running in the workspace:', wtErr.message);
+          }
+        }
+        // #6/#10: skill- and workflow-driven tasks are agent-mediated with a
+        // shaped prompt naming the skill/workflow.
+        let agentPrompt = String(task.prompt || '');
+        if (runtime === 'skill' && task.skillName) {
+          agentPrompt = `Use the DSH skill "${task.skillName}" for this task:\n${agentPrompt}`;
+        } else if (runtime === 'workflow' && task.workflowName) {
+          agentPrompt = `Execute this through the DSH workflow "${task.workflowName}" step by step:\n${agentPrompt}`;
+        }
         let handle = null;
         try {
           handle = await this.ctx.agents.create({
@@ -144,7 +297,7 @@ export class SessionRunner {
 
           await raceAbort(handle.agent.whenIdle());
           handle.agent.followup(createUserMessage({
-            content: [{ type: 'text', text: task.prompt }],
+            content: [{ type: 'text', text: agentPrompt }],
             source: { kind: 'plugin', plugin: 'dsh-cron', form: 'cron-execute' },
           }));
 
@@ -199,6 +352,10 @@ export class SessionRunner {
               }
             } catch {}
           }
+          // #29: dispose the isolated worktree (kept when keepWorktree is set).
+          if (taskWorktree && !task.keepWorktree) {
+            await this.removeTaskWorktree(baseCwd, taskWorktree);
+          }
         }
       } catch (err) {
         console.error(`[dsh-cron] agent execution failed:`, err.message);