@goodandready/dsh-cron 0.2.32 → 0.2.33

package/lib/api-webhook.js

@@ -1,3 +1,4 @@
+import crypto from 'node:crypto';
 import { logger } from './logger.js';
 import { sendJson, readBody } from './http-utils.js';
 import { answerTelegramCallbackQuery, sendTelegramMessage, getDshDefaultTelegramCredentials } from './telegram.js';
@@ -5,6 +6,7 @@ import { handleTelegramCommand } from './telegram-commands.js';
 import { bestEffort } from './best-effort.js';
 
 const NOT_ALLOWED = { ok: false, error: 'Method not allowed' };
+const seenUpdateIds = new Set();
 
 export async function handleTelegramWebhook({ store, scheduler, req, res }) {
   if (req.method !== 'POST') {
@@ -19,13 +21,45 @@ export async function handleTelegramWebhook({ store, scheduler, req, res }) {
   const botToken = settings.botToken || defaults.botToken;
   const allowedChatId = String(settings.chatId || defaults.chatId || '').trim();
 
+  // Secret token verification (Issue #208)
+  const webhookSecret = settings.telegramWebhookSecret || settings.webhookSecret || settings.secretToken || process.env.TELEGRAM_WEBHOOK_SECRET;
+  if (webhookSecret) {
+    const receivedSecret = req.headers['x-telegram-bot-api-secret-token'];
+    if (!receivedSecret || typeof receivedSecret !== 'string') {
+      logger.warn('[dsh-cron] unauthorized telegram webhook: missing secret token header');
+      sendJson(res, 401, { ok: false, error: 'Unauthorized: missing secret token' });
+      return;
+    }
+    const secretBuf = Buffer.from(String(webhookSecret));
+    const receivedBuf = Buffer.from(String(receivedSecret));
+    if (secretBuf.length !== receivedBuf.length || !crypto.timingSafeEqual(secretBuf, receivedBuf)) {
+      logger.warn('[dsh-cron] unauthorized telegram webhook: invalid secret token');
+      sendJson(res, 401, { ok: false, error: 'Unauthorized: invalid secret token' });
+      return;
+    }
+  }
+
+  // Deduplicate updates by update_id (Issue #208)
+  if (body.update_id != null) {
+    if (seenUpdateIds.has(body.update_id)) {
+      sendJson(res, 200, { ok: true, duplicate: true });
+      return;
+    }
+    seenUpdateIds.add(body.update_id);
+    if (seenUpdateIds.size > 2000) {
+      const first = seenUpdateIds.values().next().value;
+      seenUpdateIds.delete(first);
+    }
+  }
+
   // 1. Text command message (#175)
   const message = body.message;
   if (message && typeof message.text === 'string' && message.text.trim().startsWith('/')) {
     const fromId = String(message.from?.id || '');
     const chatId = String(message.chat?.id || fromId);
-    if (allowedChatId && chatId !== allowedChatId && fromId !== allowedChatId) {
-      logger.warn(`[dsh-cron] unauthorized telegram command from chat ${chatId} / user ${fromId}`);
+    // Fail-closed: empty allowedChatId denies control (Issue #208)
+    if (!allowedChatId || (chatId !== allowedChatId && fromId !== allowedChatId)) {
+      logger.warn(`[dsh-cron] unauthorized telegram command from chat ${chatId} / user ${fromId} (allowedChatId: ${allowedChatId || 'NOT_CONFIGURED'})`);
       sendJson(res, 403, { ok: false, error: 'Forbidden' });
       return;
     }
@@ -52,8 +86,8 @@ export async function handleTelegramWebhook({ store, scheduler, req, res }) {
   const fromId = String(callbackQuery.from?.id || '');
   const chatId = String(callbackQuery.message?.chat?.id || fromId);
 
-  if (allowedChatId && chatId !== allowedChatId && fromId !== allowedChatId) {
-    logger.warn(`[dsh-cron] unauthorized telegram callback from chat ${chatId} / user ${fromId}`);
+  if (!allowedChatId || (chatId !== allowedChatId && fromId !== allowedChatId)) {
+    logger.warn(`[dsh-cron] unauthorized telegram callback from chat ${chatId} / user ${fromId} (allowedChatId: ${allowedChatId || 'NOT_CONFIGURED'})`);
     if (botToken) {
       await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: 'Unauthorized', showAlert: true });
     }
@@ -82,6 +116,15 @@ export async function handleTelegramWebhook({ store, scheduler, req, res }) {
     return;
   }
 
+  const isConfigTask = task.source === 'config' || task.origin === 'config' || task.readOnly || task.managedBy === 'config';
+  if ((verb === 'pause' || verb === 'resume') && isConfigTask) {
+    if (botToken) {
+      await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: 'Cannot modify config-owned task', showAlert: true });
+    }
+    sendJson(res, 400, { ok: false, error: 'Cannot modify config-owned task' });
+    return;
+  }
+
   if (verb === 'run') {
     try {
       await scheduler.triggerManualRun(taskId);

package/lib/api.js

@@ -17,6 +17,7 @@ import {
   buildDuplicateTask,
   RESERVED_TASK_IDS,
   PATCHABLE_TASK_FIELDS,
+  isCodeExecutingTask,
 } from './task-transfer.js';
 import {
   handleTaskExport,
@@ -190,8 +191,8 @@ async function createOrUpdateTask({ store, scheduler, req, res, apiToken }) {
     return;
   }
   const taskType = normalizeTaskType(body.type);
-  if (CODE_EXECUTING_TYPES.includes(taskType) && req.headers[SCRIPT_CONFIRM_HEADER] !== 'script') {
-    sendJson(res, 403, { ok: false, error: `Creating ${taskType} tasks over HTTP requires the x-dsh-cron-confirm: script header` });
+  if ((CODE_EXECUTING_TYPES.includes(taskType) || isCodeExecutingTask(body)) && req.headers[SCRIPT_CONFIRM_HEADER] !== 'script') {
+    sendJson(res, 403, { ok: false, error: `Creating code-executing tasks over HTTP requires the x-dsh-cron-confirm: script header` });
     return;
   }
   const typeError = validateTaskType(taskType, body);

package/lib/client.js

@@ -1530,10 +1530,19 @@ window.__ModuleLoader__.load({
       const RESERVED_TASK_IDS = ['export', 'import'];
 
       /** Import needs the script-confirm header when the file has code tasks. */
+      const isCodeTaskForm = (x) => {
+        if (!x || typeof x !== 'object') return false;
+        if (CODE_FORM_TYPES.includes(x.type)) return true;
+        if (x.command && String(x.command).trim()) return true;
+        if (x.preflightType === 'command' || (x.preflightCommand && String(x.preflightCommand).trim())) return true;
+        if (x.selfHealingCommand && String(x.selfHealingCommand).trim()) return true;
+        return false;
+      };
+
       const importHeaders = (document_) => {
         const headers = { 'Content-Type': 'application/json' };
         const tasks = (document_ && Array.isArray(document_.tasks)) ? document_.tasks : [];
-        if (tasks.some((x) => CODE_FORM_TYPES.includes(x && x.type))) headers[SCRIPT_CONFIRM_HEADER] = 'script';
+        if (tasks.some(isCodeTaskForm)) headers[SCRIPT_CONFIRM_HEADER] = 'script';
         return headers;
       };
 
@@ -1976,7 +1985,12 @@ window.__ModuleLoader__.load({
           // Cross-origin hardening: every code-executing type needs the explicit
           // confirm header, which forged cross-site posts cannot attach (#86)
           const headers = { 'Content-Type': 'application/json' };
-          if (CODE_FORM_TYPES.includes(formType)) headers[SCRIPT_CONFIRM_HEADER] = 'script';
+          const hasCodeExec = CODE_FORM_TYPES.includes(formType) ||
+            Boolean(payload.command && payload.command.trim()) ||
+            payload.preflightType === 'command' ||
+            Boolean(payload.preflightCommand && payload.preflightCommand.trim()) ||
+            Boolean(payload.selfHealingCommand && payload.selfHealingCommand.trim());
+          if (hasCodeExec) headers[SCRIPT_CONFIRM_HEADER] = 'script';
           const res = await fetch('/dsh-cron/tasks', {
             method: 'POST',
             headers,

package/lib/runner-worktree.js

@@ -7,16 +7,20 @@ import { bestEffort } from './best-effort.js';
  */
 export function resolveCwd(task, ctx = null) {
   if (task.cwd) return String(task.cwd);
-  if (task.workspaceId && ctx && typeof ctx.get === 'function') {
-    const resolved = bestEffort('resolve-workspace-path', () => {
-      const workspaces = ctx.get('workspaces');
-      if (workspaces && typeof workspaces.get === 'function') {
-        const ws = workspaces.get(task.workspaceId);
-        return ws && ws.path ? String(ws.path) : null;
-      }
-      return null;
-    });
-    if (resolved) return resolved;
+  if (task.workspaceId) {
+    if (ctx && typeof ctx.get === 'function') {
+      const resolved = bestEffort('resolve-workspace-path', () => {
+        const workspaces = ctx.get('workspaces');
+        if (workspaces && typeof workspaces.get === 'function') {
+          const ws = workspaces.get(task.workspaceId);
+          return ws && ws.path ? String(ws.path) : null;
+        }
+        return null;
+      });
+      if (resolved) return resolved;
+    }
+    // Issue #231: fail-closed if workspaceId was specified but cannot be resolved
+    throw new Error(`Workspace "${task.workspaceId}" requested by task could not be resolved`);
   }
   return process.cwd();
 }

package/lib/runner.js

@@ -297,18 +297,15 @@ export class SessionRunner {
     };
   }
 
-  /** Working directory for the run, in an isolated worktree when requested (#29). */
+  /** Working directory for the run, in an isolated worktree when requested (#29, #231). */
   async _resolveRunContext(task) {
     const baseCwd = this.resolveCwd(task);
     let cwd = baseCwd;
     let taskWorktree = null;
     if (task.worktree) {
-      try {
-        taskWorktree = await this.createTaskWorktree(baseCwd, task);
-        cwd = taskWorktree;
-      } catch (wtErr) {
-        logger.warn('[dsh-cron] task worktree not created, running in the workspace:', wtErr.message);
-      }
+      // Issue #231: Fail-closed — if worktree creation fails, abort run and preserve base workspace
+      taskWorktree = await this.createTaskWorktree(baseCwd, task);
+      cwd = taskWorktree;
     }
     return { baseCwd, cwd, taskWorktree };
   }

package/lib/runtimes.js

@@ -123,18 +123,34 @@ export function buildSshInvocation(task) {
   return { file: 'ssh', args };
 }
 
-/** #8: build a Docker run invocation. */
-export function buildDockerInvocation(task, env) {
+export const DOCKER_HOST_ENV_ALLOWLIST = ['TZ', 'LANG', 'LC_ALL'];
+
+/** #8/#226: build Docker run invocation without leaking host process secrets into container. */
+export function buildDockerInvocation(task, explicitEnv) {
   const image = String(task.dockerImage || '').trim();
   if (!image) throw new Error('Docker task requires dockerImage');
   const args = ['run', '--rm'];
-  for (const [key, value] of Object.entries(env || {})) {
+
+  // Issue #226: isolate container environment. If explicitEnv is passed directly
+  // (e.g. test or explicit invocation), use it; otherwise use task.env only.
+  let envMap = explicitEnv;
+  if (!envMap) {
+    envMap = {};
+    if (task && task.env && typeof task.env === 'object') {
+      for (const [k, v] of Object.entries(task.env)) {
+        if (v !== null && v !== undefined) envMap[k] = String(v);
+      }
+    }
+  }
+
+  for (const [key, value] of Object.entries(envMap)) {
     if (key === 'PATH' || key === 'HOME') continue; // container owns those
+    if (value === null || value === undefined) continue;
     args.push('-e', `${key}=${value}`);
   }
   if (task.cwd) args.push('-v', `${task.cwd}:/workspace`, '-w', '/workspace');
   args.push(image, 'sh', '-lc', String(task.prompt || 'true'));
-  return { file: 'docker', args };
+  return { file: 'docker', args, env: envMap };
 }
 
 /** #38: merge task env vars over the base environment. */
@@ -165,8 +181,11 @@ export function buildInvocation(task, cwd, baseEnv) {
       return { type, env, http: buildHttpRequest(task) };
     case 'ssh':
       return { type, env, ...buildSshInvocation(task) };
-    case 'docker':
-      return { type, env, ...buildDockerInvocation(task, env) };
+    case 'docker': {
+      // Issue #226: do not pass full host process.env into docker run
+      const dockerInvocation = buildDockerInvocation(task, task.env);
+      return { type, env: dockerInvocation.env, file: dockerInvocation.file, args: dockerInvocation.args };
+    }
     case 'script':
     default:
       return { type: 'script', env, file: null, args: null, shellCommand: String(task.prompt || '') };

package/lib/settings.js

@@ -15,6 +15,7 @@ if (typeof z.prototype?.volatile !== 'function') {
 export const Config = z.object({
   botToken: z.string().role('secret').default('').description('Legacy Telegram Bot API token (prefer botTokenRef with the DSH credentials service)').volatile(),
   botTokenRef: z.string().default('').description('Name of the DSH credential that holds the Telegram bot token').volatile(),
+  telegramWebhookSecret: z.string().role('secret').default('').description('Secret token for validating incoming Telegram webhook requests (X-Telegram-Bot-Api-Secret-Token)').volatile(),
   chatId: z.string().default('').description('Telegram chat ID that receives task reports').volatile(),
   notifyTelegram: z.boolean().default(false).description('Deliver task reports to Telegram for every task').volatile(),
   onlyOnFailure: z.boolean().default(false).description('Deliver reports only for failed runs').volatile(),
@@ -75,7 +76,7 @@ export function unwrapConfig(cfg) {
 }
 
 export const SETTINGS_SYNC_KEYS = [
-  'botToken', 'botTokenRef', 'chatId', 'notifyTelegram', 'onlyOnFailure', 'kanbanBaseUrl',
+  'botToken', 'botTokenRef', 'telegramWebhookSecret', 'chatId', 'notifyTelegram', 'onlyOnFailure', 'kanbanBaseUrl',
   'template', 'channelTemplates', 'deliveryTimeoutMs', 'silentRuleModel', 'inspectorModel',
   'discordWebhookUrl', 'slackWebhookUrl',
   'ntfyUrl', 'ntfyTopic', 'ntfyTokenRef',

package/lib/store.js

@@ -215,7 +215,7 @@ export class TaskStore {
    * fields (botTokenRef, ntfyTokenRef, …) take precedence over them.
    */
   static get MASKED_SETTING_KEYS() {
-    return ['botToken', 'discordWebhookUrl', 'slackWebhookUrl', 'barkKey', 'apiToken'];
+    return ['botToken', 'discordWebhookUrl', 'slackWebhookUrl', 'barkKey', 'apiToken', 'telegramWebhookSecret'];
   }
 
   saveSettings(newSettings = {}) {

package/lib/task-patch.js

@@ -22,6 +22,26 @@ export function isCodeTypeSwitch(current, nextType) {
   return CODE_EXECUTING_TYPES.includes(target) && !CODE_EXECUTING_TYPES.includes(current.type);
 }
 
+/** True when a patch introduces code-executing type or shell hooks (#212). */
+export function isCodeExecutionIntroduced(current, body) {
+  if (!current || !body) return false;
+  if (body.type !== undefined && isCodeTypeSwitch(current, body.type)) return true;
+
+  const hadPreflight = Boolean(current.preflightCommand && String(current.preflightCommand).trim()) || current.preflightType === 'command';
+  const hasPreflight = Boolean(body.preflightCommand && String(body.preflightCommand).trim()) || body.preflightType === 'command';
+  if (hasPreflight && !hadPreflight) return true;
+
+  const hadSelfHealing = Boolean(current.selfHealingCommand && String(current.selfHealingCommand).trim());
+  const hasSelfHealing = Boolean(body.selfHealingCommand && String(body.selfHealingCommand).trim());
+  if (hasSelfHealing && !hadSelfHealing) return true;
+
+  const hadCommand = Boolean(current.command && String(current.command).trim());
+  const hasCommand = Boolean(body.command && String(body.command).trim());
+  if (hasCommand && !hadCommand && !CODE_EXECUTING_TYPES.includes(current.type)) return true;
+
+  return false;
+}
+
 /**
  * Normalise a patch: whitelist the fields, resolve the type, re-parse the
  * schedule so cron patterns and one-shot markers stay consistent.
@@ -85,11 +105,11 @@ export function applyTaskPatch({ store, scheduler, id, body, allowCodeSwitch = f
   if (isConfigOwned(current)) {
     return { ok: false, configOwned: true, error: configOwnedMessage(id) };
   }
-  if (isCodeTypeSwitch(current, body && body.type) && allowCodeSwitch !== true) {
+  if (isCodeExecutionIntroduced(current, body) && allowCodeSwitch !== true) {
     return {
       ok: false,
       needsConfirmation: true,
-      error: `Switching this task to ${normalizeTaskType(body.type)} makes it execute code; confirm that explicitly and retry`,
+      error: `Adding code-executing commands or switching this task to execute code requires explicit confirmation`,
     };
   }
   const built = buildTaskPatch(current, body);

package/lib/task-transfer.js

@@ -222,10 +222,21 @@ export function validateImportDocument(doc) {
   return { ok: true, tasks };
 }
 
-/** True when any task in a validated batch executes code on the host. */
-export function hasCodeExecutingTask(tasks) {
+/** True when a task executes host code or contains shell hooks (#212). */
+export function isCodeExecutingTask(task) {
+  if (!task || typeof task !== 'object') return false;
   const CODE_TYPES = ['script', 'node', 'python', 'ssh', 'docker'];
-  return (tasks || []).some((task) => CODE_TYPES.includes(normalizeTaskType(task.type)));
+  if (CODE_TYPES.includes(normalizeTaskType(task.type))) return true;
+  if (task.command && String(task.command).trim()) return true;
+  if (task.preflightType === 'command' || (task.preflightCommand && String(task.preflightCommand).trim())) return true;
+  if (task.selfHealingCommand && String(task.selfHealingCommand).trim()) return true;
+  if (task.preflightScript && String(task.preflightScript).trim()) return true;
+  return false;
+}
+
+/** True when any task in a validated batch executes code on the host (#212). */
+export function hasCodeExecutingTask(tasks) {
+  return (tasks || []).some(isCodeExecutingTask);
 }
 
 /**

package/lib/telegram-commands.js

@@ -210,6 +210,10 @@ export async function handleTelegramCommand({
         await reply(`❌ Task \`${targetId}\` not found.`);
         return { ok: false, error: 'Task not found' };
       }
+      if (task.source === 'config' || task.origin === 'config' || task.readOnly || task.managedBy === 'config') {
+        await reply(`❌ Cannot modify config-owned task *${task.title}* (\`${task.id}\`).`);
+        return { ok: false, error: 'Cannot modify config-owned task' };
+      }
       scheduler.pauseTask(task.id, 'Paused via Telegram');
       await reply(`⏸ Task *${task.title}* (\`${task.id}\`) paused.`);
       return { ok: true, command, taskId: task.id };
@@ -226,6 +230,10 @@ export async function handleTelegramCommand({
         await reply(`❌ Task \`${targetId}\` not found.`);
         return { ok: false, error: 'Task not found' };
       }
+      if (task.source === 'config' || task.origin === 'config' || task.readOnly || task.managedBy === 'config') {
+        await reply(`❌ Cannot modify config-owned task *${task.title}* (\`${task.id}\`).`);
+        return { ok: false, error: 'Cannot modify config-owned task' };
+      }
       scheduler.resumeTask(task.id);
       await reply(`▶️ Task *${task.title}* (\`${task.id}\`) resumed.`);
       return { ok: true, command, taskId: task.id };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cron",
-  "version": "0.2.32",
+  "version": "0.2.33",
   "description": "Background automation runner for DSH: isolated agent runs, script/HTTP/SSH/Docker runtimes, cost guard, notifications, heartbeats.",
   "type": "module",
   "main": "lib/index.js",