@goodandready/dsh-cron 0.2.4 → 0.2.5

package/lib/index.js

@@ -16,7 +16,42 @@ import {
 } from './http-utils.js';
 import { TASK_TYPES, CODE_EXECUTING_TYPES, normalizeTaskType } from './runtimes.js';
 import { resolveTelegramSecrets, resolveCredentialValue } from './secrets.js';
-import { deliverRun, CHANNEL_IDS } from './channels.js';
+import {
+  PATCHABLE_TASK_FIELDS,
+  DUPLICATE_TASK_FIELDS,
+  RESERVED_TASK_IDS,
+  EXPORT_SECRET_BEARING_FIELDS,
+  validateTaskType,
+  buildDuplicateTask,
+  buildTaskExport,
+  validateImportDocument,
+  hasCodeExecutingTask,
+  planImport,
+  TASK_EXPORT_KIND,
+  TASK_EXPORT_VERSION,
+  EXPORT_TASK_FIELDS,
+  IMPORT_STRATEGIES,
+} from './task-transfer.js';
+
+// Re-exported for backward compatibility: tests and tools import these names
+// from lib/index.js.
+export {
+  PATCHABLE_TASK_FIELDS,
+  DUPLICATE_TASK_FIELDS,
+  RESERVED_TASK_IDS,
+  EXPORT_SECRET_BEARING_FIELDS,
+  validateTaskType,
+  buildDuplicateTask,
+  buildTaskExport,
+  validateImportDocument,
+  hasCodeExecutingTask,
+  planImport,
+  TASK_EXPORT_KIND,
+  TASK_EXPORT_VERSION,
+  EXPORT_TASK_FIELDS,
+  IMPORT_STRATEGIES,
+};
+import { deliverRun, CHANNEL_IDS, resolveDeliveryTimeoutMs, MIN_DELIVERY_TIMEOUT_MS } from './channels.js';
 
 export const name = '@goodandready/dsh-cron';
 export const inject = ['tools', 'webServer', 'settings', 'llm', 'agents', 'agentDefaultModel', 'credentials'];
@@ -35,7 +70,7 @@ export const Config = z.object({
   // --- Delivery channels (#20-#23, #26, #28, #47) ---
   template: z.string().default('').description('Global notification template; placeholders: {title} {status} {output} {error} {duration} {schedule} {time} {tokens} {cost}'),
   channelTemplates: z.object({}).default({}).description('Per-channel template overrides keyed by channel id'),
-  deliveryTimeoutMs: z.number().default(15000).description('Per-channel delivery timeout in ms; a slower endpoint is recorded as a failure and does not block other channels or the next tick'),
+  deliveryTimeoutMs: z.number().min(MIN_DELIVERY_TIMEOUT_MS).default(15000).description('Per-channel delivery timeout in ms (minimum 1000); a slower endpoint is recorded as a failure and does not block other channels or the next tick'),
   discordWebhookUrl: z.string().default('').description('Discord webhook URL'),
   slackWebhookUrl: z.string().default('').description('Slack incoming webhook URL'),
   ntfyUrl: z.string().default('https://ntfy.sh').description('ntfy server base URL'),
@@ -45,88 +80,12 @@ export const Config = z.object({
   barkKey: z.string().default('').description('Bark device key'),
   pushplusTokenRef: z.string().default('').description('Credential name for the PushPlus token'),
   pushplusUrl: z.string().default('https://www.pushplus.plus/send').description('PushPlus send endpoint (override for a self-hosted proxy)'),
-  smtpHost: z.string().default('').description('SMTP host for email notifications'),
-  smtpPort: z.number().default(587).description('SMTP port'),
-  smtpSecure: z.boolean().default(false).description('Use implicit TLS for SMTP'),
-  smtpUser: z.string().default('').description('SMTP user name'),
-  smtpPasswordRef: z.string().default('').description('Credential name for the SMTP password'),
-  smtpFrom: z.string().default('').description('From address for email notifications'),
-  smtpTo: z.string().default('').description('Comma-separated recipient addresses'),
   ttsBaseUrl: z.string().default('http://127.0.0.1:3080').description('Base URL of the harness used to reach the dsh-tts speak route'),
   giteaBaseUrl: z.string().default('').description('Gitea base URL for alert issues'),
   giteaRepo: z.string().default('').description('Gitea repository (owner/name) for alert issues'),
   giteaTokenRef: z.string().default('').description('Credential name for the Gitea API token'),
 });
 
-const PATCHABLE_TASK_FIELDS = [
-  'title',
-  'schedule',
-  'scheduleText',
-  'prompt',
-  'type',
-  'delivery',
-  'provider',
-  'model',
-  'timezone',
-  'misfirePolicy',
-  'maxRetries',
-  'retryBackoffMs',
-  'permissionPreset',
-  'env',
-  'cwd',
-  'workspaceId',
-  'worktree',
-  'keepWorktree',
-  'httpMethod',
-  'httpUrl',
-  'httpHeaders',
-  'httpBody',
-  'sshTarget',
-  'sshPort',
-  'sshKeyPath',
-  'sshProfileId',
-  'dockerImage',
-  'pythonPath',
-  'nodePath',
-  'skillName',
-  'workflowName',
-  'notifyTelegram',
-  'onlyOnFailure',
-  'timeoutSeconds',
-  'overlapPolicy',
-  'kanbanMode',
-  'channels',
-  'template',
-  'status',
-  'oneShot',
-];
-
-/**
- * Validate runtime-specific task configuration. Returns an error string or
- * null when the payload is usable for the given type.
- */
-export function validateTaskType(type, payload) {
-  const t = normalizeTaskType(type);
-  if (t === 'http') {
-    const raw = String((payload && (payload.httpUrl || payload.prompt)) || '').trim();
-    if (!raw) return 'HTTP tasks require a URL (httpUrl or prompt)';
-    try {
-      // eslint-disable-next-line no-new
-      new URL(raw);
-    } catch {
-      return `Invalid HTTP URL: ${raw}`;
-    }
-  }
-  if (t === 'ssh') {
-    const hasProfile = Boolean(payload && String(payload.sshProfileId || '').trim());
-    const hasTarget = Boolean(payload && String(payload.sshTarget || '').trim());
-    if (!hasProfile && !hasTarget) return 'SSH tasks require sshProfileId (remote-workspace profile) or sshTarget (user@host)';
-  }
-  if (t === 'docker' && !String((payload && payload.dockerImage) || '').trim()) {
-    return 'Docker tasks require dockerImage';
-  }
-  return null;
-}
 
 function sendJson(res, statusCode, data) {
   res.writeHead(statusCode, { 'Content-Type': 'application/json' });
@@ -159,7 +118,6 @@ export const SETTINGS_SYNC_KEYS = [
   'barkServerUrl', 'barkKey',
   'pushplusTokenRef',
   'pushplusUrl',
-  'smtpHost', 'smtpPort', 'smtpSecure', 'smtpUser', 'smtpPasswordRef', 'smtpFrom', 'smtpTo',
   'ttsBaseUrl',
   'giteaBaseUrl', 'giteaRepo', 'giteaTokenRef',
 ];
@@ -187,7 +145,7 @@ export async function applySettingsToScope(settingsScope, body) {
  * Drop values that must never re-enter the store from the client:
  *
  * - a masked secret echoed back by the settings UI would overwrite the real
- *   value (bot token, SMTP password, webhook URLs, Bark key);
+ *   value (bot token, webhook URLs, Bark key);
  * - the raw credential keys are refused outright — the *Ref fields are the
  *   supported way to configure them.
  *
@@ -208,6 +166,18 @@ export function sanitizeSettingsPayload(body) {
       delete payload[key];
     }
   }
+  // #115: normalise the delivery deadline here, before it reaches the settings
+  // scope, so a value like 1 ms can never be persisted and then fail every
+  // delivery before the request is even sent.
+  if ('deliveryTimeoutMs' in payload) {
+    const raw = payload.deliveryTimeoutMs;
+    const n = Number(raw);
+    if (raw === '' || raw === null || !Number.isFinite(n) || n <= 0) {
+      delete payload.deliveryTimeoutMs;
+    } else {
+      payload.deliveryTimeoutMs = resolveDeliveryTimeoutMs(n);
+    }
+  }
   return payload;
 }
 
@@ -266,6 +236,13 @@ export function createCronApiHandler(store, scheduler, collection) {
             return;
           }
           const parsed = parseScheduleExpression(body.schedule);
+          // A client-supplied id must not shadow the collection routes under
+          // /dsh-cron/tasks, otherwise that task could never be fetched or
+          // deleted again (#42 review finding).
+          if (body.id && RESERVED_TASK_IDS.includes(String(body.id))) {
+            sendJson(res, 400, { ok: false, error: `Task id "${body.id}" is reserved` });
+            return;
+          }
           const current = body.id ? store.get(body.id) : null;
           const resolvedStatus = body.status || (current ? current.status : 'active');
 
@@ -329,6 +306,93 @@ export function createCronApiHandler(store, scheduler, collection) {
       // Item level: /dsh-cron/{tasks|action}/:id[/:action]
       if (req.method !== 'GET' && rejectCrossOrigin(req, res)) return;
 
+      // Export/import are collection operations that live under /tasks/:id/…,
+      // so they are matched before the generic id handling below.
+      if (id === 'export' && req.method === 'GET') {
+        const doc = buildTaskExport(store.list({ status: 'all' }));
+        sendJson(res, 200, { ok: true, document: doc, count: doc.tasks.length });
+        return;
+      }
+
+      if (id === 'import' && req.method === 'POST') {
+        const { body, error } = await readBody(req, res);
+        if (error) return;
+        const strategy = IMPORT_STRATEGIES.includes(body && body.strategy) ? body.strategy : 'skip';
+        const checked = validateImportDocument(body && body.document);
+        if (!checked.ok) {
+          sendJson(res, 400, { ok: false, error: checked.error });
+          return;
+        }
+        // The import file is external input: importing code-executing tasks
+        // needs the same explicit confirmation that creating one over HTTP
+        // needs, otherwise a hand-edited file would bypass that gate (#86).
+        if (hasCodeExecutingTask(checked.tasks) && req.headers[SCRIPT_CONFIRM_HEADER] !== 'script') {
+          sendJson(res, 403, {
+            ok: false,
+            error: `Importing code-executing tasks over HTTP requires the ${SCRIPT_CONFIRM_HEADER}: script header`,
+          });
+          return;
+        }
+        const existingIds = store.list({ status: 'all' }).map((x) => x.id);
+        const plan = planImport(checked.tasks, existingIds, strategy);
+        if (body && body.dryRun) {
+          sendJson(res, 200, {
+            ok: true,
+            dryRun: true,
+            strategy: plan.strategy,
+            summary: { add: plan.add.length, replace: plan.replace.length, skip: plan.skip.length },
+            codeExecuting: hasCodeExecutingTask(plan.add.concat(plan.replace)),
+          });
+          return;
+        }
+        // Every imported task is paused (the file's status is ignored) and every
+        // id that replaced an existing task is disarmed: writing "paused" to the
+        // store does not stop an already-armed croner job, so the scheduler must
+        // be told explicitly. The writes are rolled back if one of them throws,
+        // so a failed import cannot leave the store half-updated.
+        const imported = [];
+        const rollback = [];
+        const disarm = [];
+        try {
+          for (const task of plan.add) {
+            const before = store.get(task.id);
+            const created = store.set({ ...task, id: task.id || randomUUID(), status: 'paused', updatedAt: Date.now() });
+            imported.push(created);
+            rollback.push({ id: created.id, previous: before || null });
+            disarm.push(created.id);
+          }
+          for (const task of plan.replace) {
+            const before = store.get(task.id);
+            if (!before) continue;
+            const replaced = store.set({ ...task, id: task.id, status: 'paused', updatedAt: Date.now() });
+            imported.push(replaced);
+            rollback.push({ id: replaced.id, previous: before });
+            disarm.push(replaced.id);
+          }
+        } catch (writeErr) {
+          for (const entry of rollback.reverse()) {
+            try {
+              if (entry.previous) store.set(entry.previous);
+              else store.delete(entry.id);
+            } catch (_) {}
+          }
+          sendJson(res, 500, { ok: false, error: `Import failed and was rolled back: ${writeErr.message}` });
+          return;
+        }
+        // Disarm outside the write transaction: pauseTask is idempotent and a
+        // failure here must not undo a successful import.
+        for (const id of disarm) {
+          try { scheduler.pauseTask(id); } catch (err) { console.error('[dsh-cron] import: could not pause task', id + ':', err.message); }
+        }
+        sendJson(res, 200, {
+          ok: true,
+          imported: imported.length,
+          summary: { add: plan.add.length, replace: plan.replace.length, skip: plan.skip.length },
+          tasks: imported,
+        });
+        return;
+      }
+
       if (req.method === 'GET' && (action === 'history' || !action)) {
         const limit = parseInt(url.searchParams.get('limit') || '20', 10);
         sendJson(res, 200, { ok: true, history: store.getHistory(id, limit) });
@@ -345,6 +409,21 @@ export function createCronApiHandler(store, scheduler, collection) {
         return;
       }
 
+      if (req.method === 'POST' && action === 'duplicate') {
+        const source = store.get(id);
+        if (!source) {
+          sendJson(res, 404, { ok: false, error: 'Task not found' });
+          return;
+        }
+        const copy = buildDuplicateTask(source, { id: randomUUID() });
+        store.set(copy);
+        // A copy starts paused: it must never fire on its own before the user
+        // reviews the schedule (a duplicated one-shot may point at a past time).
+        scheduler.pauseTask(copy.id);
+        sendJson(res, 200, { ok: true, task: copy });
+        return;
+      }
+
       if (req.method === 'POST' && action === 'pause') {
         const task = scheduler.pauseTask(id);
         if (!task) {

package/lib/store.js

@@ -129,17 +129,17 @@ export class TaskStore {
    * these channels.
    */
   static get FORBIDDEN_SETTING_KEYS() {
-    return ['smtpPassword', 'giteaToken', 'ntfyToken', 'pushplusToken', 'discordToken', 'slackToken'];
+    return ['giteaToken', 'ntfyToken', 'pushplusToken', 'discordToken', 'slackToken'];
   }
 
   /**
-   * Settings that hold a secret and are therefore masked on read: tokens,
-   * passwords, webhook URLs (the URL embeds the auth token) and the Bark key.
+   * Settings that hold a secret and are therefore masked on read: tokens and
+   * webhook URLs (the URL embeds the auth token), plus the Bark device key.
    * These are stored in the plugin settings file; the credential-reference
-   * fields (botTokenRef, smtpPasswordRef, …) take precedence over them.
+   * fields (botTokenRef, ntfyTokenRef, …) take precedence over them.
    */
   static get MASKED_SETTING_KEYS() {
-    return ['botToken', 'smtpPassword', 'discordWebhookUrl', 'slackWebhookUrl', 'barkKey'];
+    return ['botToken', 'discordWebhookUrl', 'slackWebhookUrl', 'barkKey'];
   }
 
   saveSettings(newSettings = {}) {

package/lib/task-transfer.js

@@ -0,0 +1,226 @@
+/**
+ * Task transfer helpers: duplication, export and import (#41, #42).
+ *
+ * Pure functions over plain task objects with no I/O, so the whole
+ * configuration-transfer contract is unit-testable and the HTTP layer stays a
+ * thin adapter. Kept out of index.js both for cohesion and to keep that file
+ * from growing further (see issue #97).
+ */
+
+import { randomUUID } from 'node:crypto';
+import { normalizeTaskType } from './runtimes.js';
+import { CHANNEL_IDS } from './channels.js';
+
+/** Task fields a client may patch; the single source of truth below. */
+export const PATCHABLE_TASK_FIELDS = [
+  'title',
+  'schedule',
+  'scheduleText',
+  'prompt',
+  'type',
+  'delivery',
+  'provider',
+  'model',
+  'timezone',
+  'misfirePolicy',
+  'maxRetries',
+  'retryBackoffMs',
+  'permissionPreset',
+  'env',
+  'cwd',
+  'workspaceId',
+  'worktree',
+  'keepWorktree',
+  'httpMethod',
+  'httpUrl',
+  'httpHeaders',
+  'httpBody',
+  'sshTarget',
+  'sshPort',
+  'sshKeyPath',
+  'sshProfileId',
+  'dockerImage',
+  'pythonPath',
+  'nodePath',
+  'skillName',
+  'workflowName',
+  'notifyTelegram',
+  'onlyOnFailure',
+  'timeoutSeconds',
+  'overlapPolicy',
+  'kanbanMode',
+  'channels',
+  'template',
+  'status',
+  'oneShot',
+];
+
+/** Fields a duplicate inherits; anything else is runtime state, not config. */
+export const DUPLICATE_TASK_FIELDS = PATCHABLE_TASK_FIELDS.filter((key) => key !== 'status');
+
+/**
+ * Task ids that would shadow the collection routes under /dsh-cron/tasks.
+ * A task may not use them, otherwise it could never be fetched, paused or
+ * deleted again (#42 review finding).
+ */
+export const RESERVED_TASK_IDS = ['export', 'import'];
+
+/**
+ * Task-level fields that can carry a secret the user typed in by hand
+ * (`env` values, authorization headers). The export includes them, so the UI
+ * and docs must say so instead of promising a secret-free file.
+ */
+export const EXPORT_SECRET_BEARING_FIELDS = ['env', 'httpHeaders', 'httpBody'];
+
+/**
+ * Validate runtime-specific task configuration. Returns an error string or
+ * null when the payload is usable for the given type.
+ */
+export function validateTaskType(type, payload) {
+  const t = normalizeTaskType(type);
+  if (t === 'http') {
+    const raw = String((payload && (payload.httpUrl || payload.prompt)) || '').trim();
+    if (!raw) return 'HTTP tasks require a URL (httpUrl or prompt)';
+    try {
+      // eslint-disable-next-line no-new
+      new URL(raw);
+    } catch {
+      return `Invalid HTTP URL: ${raw}`;
+    }
+  }
+  if (t === 'ssh') {
+    const hasProfile = Boolean(payload && String(payload.sshProfileId || '').trim());
+    const hasTarget = Boolean(payload && String(payload.sshTarget || '').trim());
+    if (!hasProfile && !hasTarget) return 'SSH tasks require sshProfileId (remote-workspace profile) or sshTarget (user@host)';
+  }
+  if (t === 'docker' && !String((payload && payload.dockerImage) || '').trim()) {
+    return 'Docker tasks require dockerImage';
+  }
+  return null;
+}
+
+/**
+ * Build a paused copy of a task (#41).
+ *
+ * Configuration is copied, execution state is not: the copy starts paused with
+ * no history, no token/cost totals, no last-run info and no retry counter, so a
+ * duplicate can be reviewed before it ever runs. A duplicated one-shot keeps
+ * its original schedule string and stays inert until the user resumes it.
+ */
+export function buildDuplicateTask(source, { id } = {}) {
+  const copy = {
+    id: id || randomUUID(),
+    title: `${source.title || 'Task'} (copy)`,
+    status: 'paused',
+    createdAt: Date.now(),
+    updatedAt: Date.now(),
+  };
+  for (const key of DUPLICATE_TASK_FIELDS) {
+    if (key === 'title') continue;
+    if (source[key] !== undefined) copy[key] = Array.isArray(source[key]) ? [...source[key]] : source[key];
+  }
+  return copy;
+}
+
+// ---------------------------------------------------- export / import (#42)
+
+/** Document kind marker so a random JSON file is not mistaken for an export. */
+export const TASK_EXPORT_KIND = 'dsh-cron-tasks';
+export const TASK_EXPORT_VERSION = 1;
+
+/** Fields an exported task carries: identity + configuration, never run state. */
+export const EXPORT_TASK_FIELDS = ['id', 'title', ...DUPLICATE_TASK_FIELDS.filter((k) => k !== 'title')];
+
+/** Import strategies: add (new ids), replace (overwrite by id), skip (leave existing). */
+export const IMPORT_STRATEGIES = ['add', 'replace', 'skip'];
+
+/**
+ * Serialise tasks for transfer/backup. Run state (history, token and cost
+ * totals, last-run info) is deliberately excluded — the file is a
+ * configuration artefact. Channels reference credentials by name, but task-level
+ * `env` and headers can contain hand-typed secrets, so the caller must not
+ * claim the file is secret-free.
+ */
+export function buildTaskExport(tasks, { now = Date.now() } = {}) {
+  const list = Array.isArray(tasks) ? tasks : [];
+  return {
+    kind: TASK_EXPORT_KIND,
+    version: TASK_EXPORT_VERSION,
+    exportedAt: new Date(now).toISOString(),
+    tasks: list.map((task) => {
+      const out = {};
+      for (const key of EXPORT_TASK_FIELDS) {
+        if (task[key] === undefined || key === 'status') continue;
+        out[key] = Array.isArray(task[key]) ? [...task[key]] : task[key];
+      }
+      return out;
+    }),
+  };
+}
+
+/**
+ * Validate an import document and return sanitised tasks.
+ *
+ * An import file is external input, so it is treated as untrusted: only
+ * whitelisted configuration fields survive, the file's `status` is ignored
+ * (imported tasks always start paused, matching the documented behaviour), and
+ * a document that would shadow a collection route id is refused. A malformed
+ * file is rejected as a whole so nothing is written.
+ */
+export function validateImportDocument(doc) {
+  if (!doc || typeof doc !== 'object') return { ok: false, error: 'Import file is not a JSON object' };
+  if (doc.kind !== TASK_EXPORT_KIND) return { ok: false, error: `Not a ${TASK_EXPORT_KIND} export (missing kind marker)` };
+  if (Number(doc.version) > TASK_EXPORT_VERSION) {
+    return { ok: false, error: `Export version ${doc.version} is newer than this plugin understands (${TASK_EXPORT_VERSION})` };
+  }
+  if (!Array.isArray(doc.tasks)) return { ok: false, error: 'Export has no tasks array' };
+  const tasks = [];
+  for (const [index, raw] of doc.tasks.entries()) {
+    if (!raw || typeof raw !== 'object') return { ok: false, error: `Task #${index + 1} is not an object` };
+    if (!raw.title || !String(raw.title).trim()) return { ok: false, error: `Task #${index + 1} has no title` };
+    if (!raw.schedule || !String(raw.schedule).trim()) return { ok: false, error: `Task #${index + 1} has no schedule` };
+    if (!raw.prompt || !String(raw.prompt).trim()) return { ok: false, error: `Task #${index + 1} has no prompt` };
+    const id = raw.id === undefined ? undefined : String(raw.id);
+    if (id && RESERVED_TASK_IDS.includes(id)) {
+      return { ok: false, error: `Task #${index + 1} uses the reserved id "${id}" which would shadow a task route` };
+    }
+    const type = normalizeTaskType(raw.type);
+    const typeError = validateTaskType(type, raw);
+    if (typeError) return { ok: false, error: `Task #${index + 1} ("${raw.title}"): ${typeError}` };
+    const channels = Array.isArray(raw.channels) ? raw.channels.filter((c) => CHANNEL_IDS.includes(c)) : undefined;
+    // Whitelist: drop anything the file tried to smuggle in (counters, history
+    // pointers, unknown keys) and never inherit the file's status.
+    const clean = { status: 'paused', type };
+    for (const key of DUPLICATE_TASK_FIELDS) {
+      if (raw[key] !== undefined) clean[key] = Array.isArray(raw[key]) ? [...raw[key]] : raw[key];
+    }
+    if (id) clean.id = id;
+    if (channels) clean.channels = channels;
+    tasks.push(clean);
+  }
+  return { ok: true, tasks };
+}
+
+/** True when any task in a validated batch executes code on the host. */
+export function hasCodeExecutingTask(tasks) {
+  const CODE_TYPES = ['script', 'node', 'python', 'ssh', 'docker'];
+  return (tasks || []).some((task) => CODE_TYPES.includes(normalizeTaskType(task.type)));
+}
+
+/**
+ * Decide what an import would do, without touching anything. Existing ids are
+ * compared against tasks already in the store.
+ */
+export function planImport(tasks, existingIds, strategy = 'skip') {
+  const mode = IMPORT_STRATEGIES.includes(strategy) ? strategy : 'skip';
+  const existing = new Set(existingIds || []);
+  const plan = { strategy: mode, add: [], replace: [], skip: [] };
+  for (const task of tasks || []) {
+    const hasId = Boolean(task.id) && existing.has(task.id);
+    if (!hasId) plan.add.push(task);
+    else if (mode === 'replace') plan.replace.push(task);
+    else if (mode === 'skip') plan.skip.push(task);
+    else plan.add.push({ ...task, id: undefined });
+  }
+  return plan;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cron",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Scheduled cron tasks, background automation and agent execution for DeepSeek Harness.",
   "type": "module",
   "main": "lib/index.js",