@goodandready/dsh-cron 0.2.3 → 0.2.4

package/lib/runtimes.js

@@ -0,0 +1,174 @@
+/**
+ * Runtime invocation builders for non-LLM task types (#4, #5, #7, #8, #9, #38).
+ *
+ * Every builder is a pure function returning the process invocation
+ * ({ file, args, env }) or the HTTP request description, so the whole matrix
+ * is unit-testable without spawning anything.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const EXTERNAL_RUNTIMES = ['script', 'node', 'python', 'http', 'ssh', 'docker'];
+export const AGENT_RUNTIMES = ['llm', 'skill', 'workflow'];
+export const TASK_TYPES = [...AGENT_RUNTIMES, ...EXTERNAL_RUNTIMES];
+
+/** Types that execute code and therefore need the HTTP confirm header. */
+export const CODE_EXECUTING_TYPES = ['script', 'node', 'python', 'ssh', 'docker'];
+
+export function normalizeTaskType(type) {
+  return TASK_TYPES.includes(type) ? type : 'llm';
+}
+
+/**
+ * Split a leading script path from trailing CLI arguments.
+ * Quoted segments are preserved as single arguments.
+ */
+export function splitCommandLine(text) {
+  const trimmed = String(text || '').trim();
+  if (!trimmed) return { path: '', args: [] };
+  const tokens = trimmed.match(/"[^"]*"|'[^']*'|\S+/g) || [];
+  const clean = tokens.map((t) => t.replace(/^["']|["']$/g, ''));
+  return { path: clean[0] || '', args: clean.slice(1) };
+}
+
+function looksLikeScriptFile(token, extensions) {
+  if (!token) return false;
+  const ext = path.extname(token).toLowerCase();
+  if (extensions.includes(ext)) return true;
+  try {
+    return fs.existsSync(token) && fs.statSync(token).isFile();
+  } catch {
+    return false;
+  }
+}
+
+/** #5: resolve a Node.js invocation (inline code or a .js/.mjs/.cjs file). */
+export function buildNodeInvocation(task, cwd) {
+  const { path: filePath, args } = splitCommandLine(task.prompt);
+  if (looksLikeScriptFile(filePath, ['.js', '.mjs', '.cjs'])) {
+    return { file: process.execPath, args: [filePath, ...args] };
+  }
+  const code = String(task.prompt || '');
+  const isEsm = /\bimport\s|\bexport\s/.test(code);
+  const nodeArgs = isEsm ? ['--input-type=module', '-e', code] : ['-e', code];
+  return { file: task.nodePath || process.execPath, args: nodeArgs };
+}
+
+/** Find the Python interpreter, preferring a task virtualenv, then the workspace one. */
+export function detectPython(task, cwd) {
+  if (task.pythonPath) return task.pythonPath;
+  const candidates = [];
+  if (process.env.VIRTUAL_ENV) {
+    candidates.push(path.join(process.env.VIRTUAL_ENV, 'bin', 'python'));
+    candidates.push(path.join(process.env.VIRTUAL_ENV, 'Scripts', 'python.exe'));
+  }
+  const base = cwd || process.cwd();
+  candidates.push(path.join(base, '.venv', 'bin', 'python'));
+  candidates.push(path.join(base, '.venv', 'Scripts', 'python.exe'));
+  candidates.push(path.join(base, 'venv', 'bin', 'python'));
+  for (const candidate of candidates) {
+    try {
+      if (fs.existsSync(candidate)) return candidate;
+    } catch {}
+  }
+  return process.platform === 'win32' ? 'python' : 'python3';
+}
+
+/** #4: resolve a Python invocation (inline code or a .py file). */
+export function buildPythonInvocation(task, cwd) {
+  const interpreter = detectPython(task, cwd);
+  const { path: filePath, args } = splitCommandLine(task.prompt);
+  if (looksLikeScriptFile(filePath, ['.py'])) {
+    return { file: interpreter, args: [filePath, ...args] };
+  }
+  return { file: interpreter, args: ['-c', String(task.prompt || '')] };
+}
+
+/** #7: build the HTTP trigger request description. */
+export function buildHttpRequest(task) {
+  const raw = String(task.httpUrl || task.prompt || '').trim();
+  if (!raw) throw new Error('HTTP task requires a URL (httpUrl or prompt)');
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new Error(`Invalid HTTP URL: ${raw}`);
+  }
+  let headers = {};
+  if (task.httpHeaders) {
+    if (typeof task.httpHeaders === 'object') {
+      headers = { ...task.httpHeaders };
+    } else {
+      try {
+        headers = JSON.parse(String(task.httpHeaders));
+      } catch {
+        throw new Error('httpHeaders must be a JSON object');
+      }
+    }
+  }
+  const method = String(task.httpMethod || 'GET').toUpperCase();
+  const body = task.httpBody !== undefined && task.httpBody !== '' ? String(task.httpBody) : undefined;
+  return { url: url.toString(), method, headers, body };
+}
+
+/** #9: build a remote SSH invocation. */
+export function buildSshInvocation(task) {
+  const target = String(task.sshTarget || '').trim();
+  if (!target) throw new Error('SSH task requires sshTarget (user@host)');
+  const args = [];
+  if (task.sshPort) args.push('-p', String(Number(task.sshPort)));
+  if (task.sshKeyPath) args.push('-i', String(task.sshKeyPath));
+  args.push(target, String(task.prompt || 'true'));
+  return { file: 'ssh', args };
+}
+
+/** #8: build a Docker run invocation. */
+export function buildDockerInvocation(task, env) {
+  const image = String(task.dockerImage || '').trim();
+  if (!image) throw new Error('Docker task requires dockerImage');
+  const args = ['run', '--rm'];
+  for (const [key, value] of Object.entries(env || {})) {
+    if (key === 'PATH' || key === 'HOME') continue; // container owns those
+    args.push('-e', `${key}=${value}`);
+  }
+  if (task.cwd) args.push('-v', `${task.cwd}:/workspace`, '-w', '/workspace');
+  args.push(image, 'sh', '-lc', String(task.prompt || 'true'));
+  return { file: 'docker', args };
+}
+
+/** #38: merge task env vars over the base environment. */
+export function buildEnv(task, baseEnv) {
+  const env = { ...(baseEnv || process.env) };
+  if (task && task.env && typeof task.env === 'object') {
+    for (const [key, value] of Object.entries(task.env)) {
+      if (value === null || value === undefined) delete env[key];
+      else env[key] = String(value);
+    }
+  }
+  return env;
+}
+
+/**
+ * Dispatch an external (non-LLM) runtime to its invocation.
+ * Returns { file, args } plus an optional `http` descriptor for the fetch path.
+ */
+export function buildInvocation(task, cwd, baseEnv) {
+  const type = normalizeTaskType(task.type);
+  const env = buildEnv(task, baseEnv);
+  switch (type) {
+    case 'node':
+      return { type, env, ...buildNodeInvocation(task, cwd) };
+    case 'python':
+      return { type, env, ...buildPythonInvocation(task, cwd) };
+    case 'http':
+      return { type, env, http: buildHttpRequest(task) };
+    case 'ssh':
+      return { type, env, ...buildSshInvocation(task) };
+    case 'docker':
+      return { type, env, ...buildDockerInvocation(task, env) };
+    case 'script':
+    default:
+      return { type: 'script', env, file: null, args: null, shellCommand: String(task.prompt || '') };
+  }
+}

package/lib/scheduler.js

@@ -1,6 +1,4 @@
 import { Cron } from 'croner';
-import { shouldNotifyTask, formatTaskTelegramMessage, sendTelegramMessage } from './telegram.js';
-import { createKanbanCard, shouldCreateKanbanCard } from './integrations.js';
 
 function pad(v) {
   return String(v).padStart(2, '0');
@@ -142,6 +140,8 @@ export class TaskScheduler {
     this.executeFn = executeFn;
     this.maxConcurrent = Number(options.maxConcurrent) > 0 ? Number(options.maxConcurrent) : 0; // 0 = unlimited (#52)
     this.defaultTimezone = options.defaultTimezone || ''; // #13
+    this.resolveSecrets = typeof options.resolveSecrets === 'function' ? options.resolveSecrets : null; // #51
+    this.deliver = typeof options.deliver === 'function' ? options.deliver : null; // #26 channel router
     this.jobs = new Map(); // taskId -> Cron instance
     this.timers = new Map(); // taskId -> setTimeout handle (for one-shot tasks)
     this.retryTimers = new Map(); // taskId -> setTimeout handle (for #18 retries)
@@ -266,9 +266,11 @@ export class TaskScheduler {
         this.store.set(task);
 
         // If target is in the past, or when delay triggers:
-        const timer = setTimeout(async () => {
+        const timer = setTimeout(() => {
           this.timers.delete(task.id);
-          await this.runTask(task.id);
+          this.runTask(task.id).catch((err) => {
+            console.error(`[dsh-cron] one-shot run of task ${task.id} failed:`, (err && err.message) || err);
+          });
         }, delay);
 
         this.timers.set(task.id, timer);
@@ -276,7 +278,11 @@ export class TaskScheduler {
       }
 
       // Handle Recurring Cron job
-      const job = new Cron(parsed.cronPattern, { protect: true, ...(timezone ? { timezone } : {}) }, async () => {
+      const job = new Cron(parsed.cronPattern, {
+        protect: true,
+        catch: (err) => console.error(`[dsh-cron] scheduled run of "${task.title}" (${task.id}) failed:`, (err && err.message) || err),
+        ...(timezone ? { timezone } : {}),
+      }, async () => {
         await this.runTask(task.id);
       });
 
@@ -388,7 +394,11 @@ export class TaskScheduler {
         costUsd,
         sessionId,
       };
-      this.store.recordRun(taskId, runInfo);
+      try {
+        this.store.recordRun(taskId, runInfo);
+      } catch (recordErr) {
+        console.error(`[dsh-cron] failed to record the run of task ${taskId}:`, recordErr.message);
+      }
 
       // Clean up running map
       const finishedRun = this.running.get(taskId);
@@ -398,58 +408,48 @@ export class TaskScheduler {
 
       const queuedCount = finishedRun?.queueCount || 0;
 
-      // 1. Telegram notification delivery
-      try {
-        const settings = typeof this.store.getSettings === 'function' ? this.store.getSettings() : {};
-        if (shouldNotifyTask(task, runInfo, settings)) {
-          const botToken = settings.botToken;
-          const chatId = settings.chatId;
-          if (botToken && chatId) {
-            const text = formatTaskTelegramMessage(task, runInfo);
-            sendTelegramMessage({ botToken, chatId, text }).catch((err) => {
-              console.error(`[dsh-cron] telegram delivery failed for task "${task.title}":`, err.message);
-            });
-          }
-        }
-      } catch (notifyErr) {
-        console.error('[dsh-cron] notification error:', notifyErr.message);
-      }
+      await this.deliverNotifications(task, runInfo);
+      this.finishRun(task, taskId, status, queuedCount);
+    }
+  }
 
-      // 2. Kanban card creation
-      try {
-        if (shouldCreateKanbanCard(task, runInfo)) {
-          const settings = typeof this.store.getSettings === 'function' ? this.store.getSettings() : {};
-          const isErr = runInfo.status === 'error' || runInfo.status === 'timeout';
-          const cardTitle = isErr ? `[Cron failure] ${task.title}` : `[Cron completed] ${task.title}`;
-          const cardBody = [
-            `**Cron task:** ${task.title} (\`${task.id}\`)`,
-            `**Schedule:** ${task.scheduleText || task.schedule}`,
-            `**Status:** ${runInfo.status}`,
-            `**Started at:** ${new Date(runInfo.at).toISOString()}`,
-            runInfo.error ? `\n**Error:**\n\`\`\`\n${runInfo.error}\n\`\`\`` : '',
-            runInfo.output ? `\n**Log / Output:**\n\`\`\`\n${runInfo.output.slice(0, 1000)}\n\`\`\`` : '',
-          ].filter(Boolean).join('\n\n');
-
-          createKanbanCard({
-            title: cardTitle,
-            body: cardBody,
-            board: 'main',
-            column: isErr ? 'backlog' : 'done',
-            labels: isErr ? ['cron', 'bug', 'alert'] : ['cron', 'auto'],
-            kanbanBaseUrl: settings.kanbanBaseUrl || 'http://127.0.0.1:3000'
-          }).then((res) => {
-            if (res.success) {
-              console.log(`[dsh-cron] created kanban card for task "${task.title}"`);
-            }
-          }).catch((kErr) => {
-            console.error('[dsh-cron] kanban card error:', kErr.message);
-          });
+  /**
+   * Deliver a finished run to every configured channel (#26).
+   * Never throws: a broken or slow channel is reported, not propagated, so the
+   * cron callback (and therefore the next tick) is never blocked by delivery.
+   */
+  async deliverNotifications(task, runInfo) {
+    try {
+      let settings = typeof this.store.getSettings === 'function' ? this.store.getSettings() : {};
+      // #51: resolve delivery credentials through the credentials service
+      // (credential reference → legacy token → gateway file → env).
+      if (this.resolveSecrets) {
+        try {
+          settings = { ...settings, ...(await this.resolveSecrets(settings)) };
+        } catch (secErr) {
+          console.warn('[dsh-cron] credential resolution failed:', secErr.message);
         }
-      } catch (kanbanErr) {
-        console.error('[dsh-cron] kanban error:', kanbanErr.message);
       }
+      if (typeof this.deliver !== 'function') return;
+      const result = await this.deliver(task, runInfo, settings);
+      if (result && Array.isArray(result.delivered) && result.delivered.length) {
+        console.log(`[dsh-cron] delivered "${task.title}" to: ${result.delivered.map((d) => d.channel).join(', ')}`);
+      }
+      if (result && Array.isArray(result.failures) && result.failures.length) {
+        console.warn(`[dsh-cron] delivery failures for "${task.title}": ${result.failures.map((f) => `${f.channel}: ${f.error}`).join('; ')}`);
+      }
+    } catch (notifyErr) {
+      console.error('[dsh-cron] notification error:', notifyErr.message);
+    }
+  }
 
-      // 3. Reschedule or mark completed for one-shot
+  /**
+   * Post-run bookkeeping: one-shot completion, next-run timestamp, retry
+   * backoff and draining a queued run. Each part is guarded so a store error
+   * cannot reject the cron callback.
+   */
+  finishRun(task, taskId, status, queuedCount) {
+    try {
       if (task.oneShot) {
         task.status = 'completed';
         task.nextRunAt = null;
@@ -462,8 +462,12 @@ export class TaskScheduler {
           this.store.set(task);
         }
       }
+    } catch (err) {
+      console.error('[dsh-cron] failed to persist the next run of task', taskId + ':', err.message);
+    }
 
-      // 4. Retry with exponential backoff on failure (#18)
+    try {
+      // Retry with exponential backoff on failure (#18)
       const failed = status === 'error' || status === 'timeout';
       const maxRetries = Number(task.maxRetries) > 0 ? Number(task.maxRetries) : 0;
       if (failed && maxRetries > 0 && (task.attempts || 0) < maxRetries && task.status !== 'paused') {
@@ -481,12 +485,14 @@ export class TaskScheduler {
         task.attempts = 0;
         this.store.set(task);
       }
+    } catch (err) {
+      console.error('[dsh-cron] retry bookkeeping failed for task', taskId + ':', err.message);
+    }
 
-      if (queuedCount > 0) {
-        setImmediate(() => {
-          this.runTask(taskId);
-        });
-      }
+    if (queuedCount > 0) {
+      setImmediate(() => {
+        this.runTask(taskId);
+      });
     }
   }
 

package/lib/secrets.js

@@ -0,0 +1,123 @@
+/**
+ * Credential handling for dsh-cron (#51).
+ *
+ * Settings store only the NAME of a credential (an environment-variable-style
+ * reference); the value is resolved at send time through the DSH credentials
+ * service, with an environment fallback. This mirrors the pattern already
+ * used by dsh-clinebot and dsh-agentrouter.
+ */
+
+import fs from 'node:fs';
+import { getDshSettingsPath } from './telegram.js';
+
+const REF_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const TOKEN_LIKE = /^[A-Za-z0-9:_-]{24,}$/;
+
+export function isCredentialRefName(value) {
+  return REF_PATTERN.test(String(value || '').trim());
+}
+
+/** Heuristic: a pasted secret instead of a credential name. */
+export function looksLikeSecret(value) {
+  const s = String(value || '').trim();
+  if (!s || isCredentialRefName(s)) return false;
+  return TOKEN_LIKE.test(s);
+}
+
+/**
+ * Validate a credential-reference field. Returns { ok, name } or
+ * { ok: false, error } with actionable text for the settings card.
+ */
+export function credentialRefStatus(value) {
+  const name = String(value || '').trim();
+  if (!name) return { ok: true, name: '' };
+  if (looksLikeSecret(name)) {
+    return {
+      ok: false,
+      error: 'That looks like a secret value. Store it in DSH credentials and enter only the credential name (for example CRON_TELEGRAM_BOT_TOKEN).',
+    };
+  }
+  if (!isCredentialRefName(name)) {
+    return { ok: false, error: 'Credential name must look like an environment variable name, e.g. CRON_TELEGRAM_BOT_TOKEN.' };
+  }
+  return { ok: true, name };
+}
+
+/** Resolve a credential through the harness service, then the environment. */
+export async function resolveCredentialValue(ctx, refName) {
+  const name = String(refName || '').trim();
+  if (!name) return null;
+  try {
+    const creds = (ctx && typeof ctx.get === 'function' ? ctx.get('credentials') : null)
+      || (ctx && ctx.credentials);
+    if (creds && typeof creds.resolve === 'function') {
+      // Prefer the harness ref factory; fall back to the plain name when the
+      // package is not installed (keeps tests and trimmed builds working).
+      let ref = name;
+      try {
+        const mod = await import('@deepseek-ai/dsh-credentials');
+        if (mod && typeof mod.credentialRef === 'function') ref = mod.credentialRef(name);
+      } catch {}
+      const hit = await creds.resolve(ref);
+      if (hit && hit.value) return String(hit.value);
+    }
+  } catch {
+    // credentials service unavailable — fall back to the environment
+  }
+  const fromEnv = process.env[name];
+  return fromEnv ? String(fromEnv) : null;
+}
+
+/** Read the best-effort Telegram defaults from the messenger-gateway file. */
+function readGatewayToken() {
+  try {
+    const p = getDshSettingsPath();
+    if (!fs.existsSync(p)) return null;
+    const text = fs.readFileSync(p, 'utf-8');
+    const lines = text.split('\n');
+    let inside = false;
+    for (const line of lines) {
+      if (/^[^\s#]/.test(line)) inside = line.startsWith('dsh-messenger-gateway:');
+      if (!inside) continue;
+      const hit = /^[ \t]+botToken:[ \t]*(.+?)[ \t]*$/.exec(line);
+      if (hit) return hit[1].replace(/^['"]|['"]$/g, '').trim() || null;
+    }
+  } catch {}
+  return null;
+}
+
+/**
+ * Resolve the Telegram delivery secrets for a run.
+ * Precedence: credential reference → legacy stored token → messenger-gateway
+ * settings file → environment variable.
+ */
+export async function resolveTelegramSecrets(ctx, settings = {}) {
+  const out = { botToken: '', chatId: '', tokenSource: 'none' };
+
+  const fromRef = await resolveCredentialValue(ctx, settings.botTokenRef);
+  if (fromRef) {
+    out.botToken = fromRef;
+    out.tokenSource = 'credential';
+  }
+  if (!out.botToken && settings.botToken) {
+    out.botToken = String(settings.botToken);
+    out.tokenSource = 'legacy-settings';
+  }
+  if (!out.botToken) {
+    const gateway = readGatewayToken();
+    if (gateway) {
+      out.botToken = gateway;
+      out.tokenSource = 'messenger-gateway';
+    }
+  }
+  if (!out.botToken) {
+    const fromEnv = await resolveCredentialValue(ctx, 'CRON_TELEGRAM_BOT_TOKEN');
+    if (fromEnv) {
+      out.botToken = fromEnv;
+      out.tokenSource = 'env';
+    }
+  }
+
+  out.chatId = String(settings.chatId || '').trim();
+  return out;
+}

package/lib/store.js

@@ -2,11 +2,31 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { getDshDefaultTelegramCredentials } from './telegram.js';
 
+/**
+ * Where plugin data lives.
+ *
+ * DSH_DATA_DIR wins when the harness sets it. Otherwise the profile home
+ * (DSH_HOME) is authoritative: falling back to ~/.dsh would make an isolated
+ * profile — a test contour, a second profile — write its tasks into another
+ * home's data directory, which is how the MiniPC test cycle leaked a task into
+ * the non-test profile.
+ */
 export function getDefaultStorePath() {
-  const base = process.env.DSH_DATA_DIR || path.join(process.env.HOME || '.', '.dsh', 'data');
+  const base = process.env.DSH_DATA_DIR
+    || (process.env.DSH_HOME
+      ? path.join(process.env.DSH_HOME, 'data')
+      : path.join(process.env.HOME || '.', '.dsh', 'data'));
   return path.join(base, 'cron', 'tasks.json');
 }
 
+/** Mask a secret for transport to the browser, keeping a readable hint. */
+function maskSecretValue(value) {
+  const s = String(value == null ? '' : value);
+  if (!s) return '';
+  if (s.length <= 8) return '••••••••';
+  return s.slice(0, 4) + '••••••••' + s.slice(-3);
+}
+
 export class TaskStore {
   constructor(filePath) {
     this.filePath = filePath || getDefaultStorePath();
@@ -70,14 +90,15 @@ export class TaskStore {
 
   getSettings() {
     const defaults = getDshDefaultTelegramCredentials();
-    return {
-      botToken: this.settings.botToken !== undefined ? this.settings.botToken : (defaults.botToken || ''),
-      chatId: this.settings.chatId !== undefined ? this.settings.chatId : (defaults.chatId || ''),
-      notifyTelegram: Boolean(this.settings.notifyTelegram),
-      onlyOnFailure: Boolean(this.settings.onlyOnFailure),
-      hasDefaultCredentials: Boolean(defaults.botToken && defaults.chatId),
-      kanbanBaseUrl: this.settings.kanbanBaseUrl || 'http://127.0.0.1:3000',
-    };
+    const base = { ...this.settings };
+    base.botToken = base.botToken !== undefined ? base.botToken : (defaults.botToken || '');
+    base.botTokenRef = base.botTokenRef || '';
+    base.chatId = base.chatId !== undefined ? base.chatId : (defaults.chatId || '');
+    base.notifyTelegram = Boolean(base.notifyTelegram);
+    base.onlyOnFailure = Boolean(base.onlyOnFailure);
+    base.kanbanBaseUrl = base.kanbanBaseUrl || 'http://127.0.0.1:3000';
+    base.hasDefaultCredentials = Boolean(defaults.botToken && defaults.chatId);
+    return base;
   }
 
   getClientSettings() {
@@ -85,38 +106,87 @@ export class TaskStore {
     const isCustom = Boolean(this.settings.botToken);
     const hasToken = Boolean(raw.botToken);
     const masked = hasToken ? (raw.botToken.length > 8 ? raw.botToken.slice(0, 4) + '••••••••' + raw.botToken.slice(-3) : '••••••••') : '';
-    return {
+    const { botToken, ...rest } = raw;
+    const out = {
+      ...rest,
       botToken: masked,
       botTokenMasked: masked,
       hasBotToken: hasToken,
       hasCustomBotToken: isCustom,
-      chatId: raw.chatId,
-      notifyTelegram: raw.notifyTelegram,
-      onlyOnFailure: raw.onlyOnFailure,
-      hasDefaultCredentials: raw.hasDefaultCredentials,
-      kanbanBaseUrl: raw.kanbanBaseUrl,
     };
+    // Webhook URLs and the Bark device key carry an embedded secret, so they
+    // are never sent to the browser in clear text either.
+    for (const key of TaskStore.MASKED_SETTING_KEYS) {
+      if (key === 'botToken') continue;
+      out[key] = maskSecretValue(raw[key]);
+    }
+    return out;
+  }
+
+  /**
+   * Raw secret values that must not be stored in plugin settings; the
+   * corresponding *Ref credential names are the supported way to configure
+   * these channels.
+   */
+  static get FORBIDDEN_SETTING_KEYS() {
+    return ['smtpPassword', 'giteaToken', 'ntfyToken', 'pushplusToken', 'discordToken', 'slackToken'];
+  }
+
+  /**
+   * Settings that hold a secret and are therefore masked on read: tokens,
+   * passwords, webhook URLs (the URL embeds the auth token) and the Bark key.
+   * These are stored in the plugin settings file; the credential-reference
+   * fields (botTokenRef, smtpPasswordRef, …) take precedence over them.
+   */
+  static get MASKED_SETTING_KEYS() {
+    return ['botToken', 'smtpPassword', 'discordWebhookUrl', 'slackWebhookUrl', 'barkKey'];
   }
 
   saveSettings(newSettings = {}) {
+    const patch = { ...newSettings };
+
+    for (const key of TaskStore.FORBIDDEN_SETTING_KEYS) {
+      if (key in patch) {
+        console.warn(`[dsh-cron] refusing to store raw secret "${key}" in settings — use a credential reference instead`);
+        delete patch[key];
+      }
+    }
+
     let botTokenToSave = this.settings.botToken || '';
-    if (newSettings.botToken !== undefined) {
-      const val = String(newSettings.botToken).trim();
+    if (patch.botToken !== undefined) {
+      const val = String(patch.botToken).trim();
       // If client sends masked token or empty string while custom token existed, don't overwrite with dots
       if (val && !val.includes('••') && !val.includes('****')) {
         botTokenToSave = val;
       } else if (val === '') {
         botTokenToSave = '';
       }
+      delete patch.botToken;
+    }
+
+    // A masked value echoed back by the UI must never overwrite the real one.
+    for (const key of TaskStore.MASKED_SETTING_KEYS) {
+      if (key === 'botToken') continue;
+      const val = patch[key];
+      if (typeof val === 'string' && (val.includes('••') || val.includes('****'))) {
+        delete patch[key];
+      }
+    }
+
+    for (const [key, value] of Object.entries(patch)) {
+      if (value === undefined) delete patch[key];
+      else if (typeof value === 'string') patch[key] = value.trim();
     }
 
     this.settings = {
       ...this.settings,
+      ...patch,
       botToken: botTokenToSave,
-      chatId: newSettings.chatId !== undefined ? String(newSettings.chatId).trim() : (this.settings.chatId || ''),
-      notifyTelegram: newSettings.notifyTelegram !== undefined ? Boolean(newSettings.notifyTelegram) : Boolean(this.settings.notifyTelegram),
-      onlyOnFailure: newSettings.onlyOnFailure !== undefined ? Boolean(newSettings.onlyOnFailure) : Boolean(this.settings.onlyOnFailure),
-      kanbanBaseUrl: newSettings.kanbanBaseUrl !== undefined ? String(newSettings.kanbanBaseUrl).trim() : (this.settings.kanbanBaseUrl || 'http://127.0.0.1:3000'),
+      kanbanBaseUrl: patch.kanbanBaseUrl !== undefined
+        ? (patch.kanbanBaseUrl || 'http://127.0.0.1:3000')
+        : (this.settings.kanbanBaseUrl || 'http://127.0.0.1:3000'),
+      notifyTelegram: patch.notifyTelegram !== undefined ? Boolean(patch.notifyTelegram) : Boolean(this.settings.notifyTelegram),
+      onlyOnFailure: patch.onlyOnFailure !== undefined ? Boolean(patch.onlyOnFailure) : Boolean(this.settings.onlyOnFailure),
     };
     this.save();
     return this.getSettings();