@goodandready/dsh-cron 0.2.4 → 0.2.6

package/docs/plans/0.2.6-economy-block.md

@@ -0,0 +1,61 @@
+# План: блок B — экономия и меньше шума (0.2.6)
+
+Живой план блока. Обновляется по факту работы; источник истины по задачам —
+Gitea (`goodandready/dsh-cron`), milestone `0.2.6`.
+
+## Состав блока (согласован владельцем)
+
+| Issue | Задача | Сложность |
+|:--|:--|:--|
+| #45 | Каскад моделей Flash → Pro при сбое | H |
+| #44 | «Правило тишины» на базе LLM для задач с внешним выводом | M |
+| #43 | Инспектор сбоев: диагноз и предложение правки промпта | M |
+| #49 | Подстройка задачи через диалог (`cron_get_task`, `cron_update_task`) | M |
+| #48 | Хаб готовых рецептов мониторинга | M |
+| #97 | Техдолг: разбить разросшиеся обработчики (пункт 3 issue) | L |
+
+Следующий по согласованию блок C (0.2.7) — #54, #50, #53, #97(остатки), #121.
+
+## Границы и инварианты
+
+- Один блок → одна ветка `feat/0.2.6-economy-block` → один PR → один релиз 0.2.6.
+- Новых зависимостей блок не добавляет; вызовы модели идут через сервис харнесса.
+- **Все обращения к модели fail-open:** ошибка, таймаут или невалидный ответ LLM
+  не приводят к потере отчёта, зависанию запуска или ложной тишине.
+- Секреты — только credential-ссылки. Ключи и токены в рецептах и промптах не
+  хранятся.
+- Публичные экспорты `lib/index.js` не ломаются; поведение существующих
+  маршрутов не меняется.
+- Рефакторинг (#97) идёт первым коммитом блока: новые фичи ложатся в уже
+  разобранную структуру, а не наоборот.
+- `lib/client.js` остаётся single-file (требование загрузчика DSH).
+
+## Вне scope
+
+- Внешний REST API и декларативный конфиг (блок C).
+- Новые каналы доставки и изменения существующих.
+- Обновление зависимостей (`#117` — отдельная ветка).
+
+## План проверки блока
+
+- `npm test` до и после каждого пункта; базовый результат на старте — 128/128.
+- Новые тесты: каскад моделей с подставным исполнителем, вердикты правила тишины
+  (тихо/громко/ошибка/невалидный JSON), разбор диагноза инспектора, инструменты
+  подстройки, валидность всех рецептов и отсутствие деструктивных команд.
+- `bash deploy.sh check` (тесты + гейт размера + кандидат).
+- Приёмка на изолированном MiniPC: установка кандидата, проверка новых полей и
+  инструментов через API, отображение в браузере.
+- Независимое ревью PR перед merge.
+
+## Журнал
+
+- 2026-09-11 — #97 закрыт первым коммитом: `lib/api.js` (диспетчер + обработчики по областям), `http-utils` получил общие `sendJson`/`rejectCrossOrigin`/`readBody`, `runTask` → `beginRun`/`executeOnce`/`completeRun`, `_run` → диспетчер + подготовка/ход/уборка. `index.js` 1024 → 671 строк; полный набор тестов зелёный без правок ожиданий, добавлен тест на контракты item-маршрутов. **Уточнение после ревью:** утверждение «все затронутые функции ≤ 50 строк» на тот момент было неверным — `completeRun` и `buildTaskRecord` превышали ориентир и разбиты отдельным коммитом.
+- 2026-09-11 — #43 готов: `lib/failure-inspector.js` (промпт, разбор диагноза, fail-open), планировщик диагностирует сбой до записи, история хранит `diagnosis`/`suggestion`/`confidence`, в UI — чекбокс, настройка `inspectorModel`, блок диагноза в истории с кнопкой подстановки правки, переменная `{diagnosis}`. 164/164 тестов.
+- 2026-09-11 — #44 готов: `lib/llm-ask.js` (обёртка над `ctx.llm.stream` со сбором текста, таймаутом и fail-open) и `lib/silent-rule.js` (правило словами → вердикт `{notify, reason}`); планировщик решает о доставке до записи запуска, история хранит `silentSkip`/`silentReason`, в UI есть поле правила и маркер в истории, настройка `silentRuleModel`. 156/156 тестов, включая четыре сценария fail-open.
+- 2026-09-11 — #49 готов: инструменты `cron_get_task`/`cron_update_task`, общий модуль `lib/task-patch.js` (один код для HTTP PATCH и инструмента), действие «Настроить с DSH» в строке задачи, которое открывает сессию с контекстом задачи и предписанием подтверждать code-изменения. 145/145 тестов.
+- 2026-09-11 — #48 готов: каталог `lib/recipes.js` (10 рецептов в 5 категориях, только read-only команды), маршрут `GET /dsh-cron/recipes`, панель подсказок переведена на каталог, пресет рецепта заполняет форму вместе с типом и каналами; тест проверяет валидность каждого рецепта и отсутствие деструктивных команд.
+- 2026-09-11 — #45 готов: `fallbackProvider`/`fallbackModel` у задачи, ровно одна повторная попытка на fallback-модели при `error`/`timeout` (только агентские типы), сумма usage и стоимости обеих попыток, `model` и `fallback` в записи истории, переменная шаблона `{model}`, поле в UI. 134/134 тестов.
+- 2026-09-11 — блок согласован (блок B + #97 → 0.2.6), ТЗ по каждой задаче
+  записаны в Gitea, все шесть задач переведены в milestone 0.2.6.
+- 2026-09-11 — независимое ревью блока B дало FAIL и нашло: `cron_update_task` обходил подтверждение переключения в код-исполняющий тип (закрыто структурным гейтом `allowCodeSwitch`/`confirmCodeSwitch` с поведенческими тестами), помощники моделей всегда шли на модель харнесса вместо модели задачи (исправлено передачей задачи в `ask`), дедлайн вызова модели держался только на abort-сигнале (добавлена жёсткая гонка в `lib/llm-ask.js`), чёрный список деструктивных команд обходился `find -delete`, `shred`, `apt purge`, `mv /etc/...` и др. (расширен, те же пробы теперь блокируются), две функции превышали ориентир 50 строк (`completeRun`, `buildTaskRecord` — разбиты), документация отстала (DESIGN.md, index.md, AGENTS.md, RU §14 обновлены). Тестов стало 175.
+- 2026-09-11 — релиз `0.2.6`: bump 0.2.5 → 0.2.6, тег `v0.2.6`, npm publish, GitHub Release, установка точной версии в production web-профиль MiniAI и production-проверки; закрыты #43, #44, #45, #48, #49, #97.

package/lib/api.js

@@ -0,0 +1,399 @@
+/**
+ * REST surface of the plugin: the /dsh-cron/tasks and /dsh-cron/action route
+ * families. Extracted from index.js and split into per-scope handlers so each
+ * piece stays reviewable (#97); route contracts and response bodies are
+ * unchanged.
+ */
+
+import { randomUUID } from 'node:crypto';
+import { parseScheduleExpression } from './scheduler.js';
+import { normalizeTaskType, CODE_EXECUTING_TYPES } from './runtimes.js';
+import { CHANNEL_IDS } from './channels.js';
+import { applyTaskPatch } from './task-patch.js';
+import { sendJson, rejectCrossOrigin, readBody, pickPatchableFields, SCRIPT_CONFIRM_HEADER } from './http-utils.js';
+import {
+  validateTaskType,
+  buildDuplicateTask,
+  buildTaskExport,
+  validateImportDocument,
+  planImport,
+  hasCodeExecutingTask,
+  IMPORT_STRATEGIES,
+  RESERVED_TASK_IDS,
+  PATCHABLE_TASK_FIELDS,
+} from './task-transfer.js';
+
+const NOT_FOUND = { ok: false, error: 'Task not found' };
+const NOT_ALLOWED = { ok: false, error: 'Method not allowed' };
+
+/**
+ * Shared implementation for the /dsh-cron/tasks... and /dsh-cron/action...
+ * route families — the #66 alias is kept alive by the same code path instead
+ * of a duplicated handler.
+ *
+ * IMPORTANT: prefix routes must be registered WITHOUT a trailing slash —
+ * with one, the core degrades matching to exact-path equality and every
+ * deeper path unrouted (#96). Exported for unit tests.
+ */
+export function createCronApiHandler(store, scheduler, collection) {
+  return async function handleCronApi(req, res) {
+    try {
+      const url = new URL(req.url, 'http://127.0.0.1');
+      const parts = url.pathname.split('/').filter(Boolean);
+      const scope = parts[1]; // 'tasks' | 'action'
+      const id = parts[2];
+      const action = parts[3];
+
+      if (!id) {
+        await handleTaskCollection({ store, scheduler, collection, req, res, url, scope });
+        return;
+      }
+
+      if (req.method !== 'GET' && rejectCrossOrigin(req, res)) return;
+
+      // Export/import are collection operations that live under /tasks/:id/…,
+      // so they are matched before the generic id handling below.
+      if (id === 'export' && req.method === 'GET') {
+        handleTaskExport({ store, res });
+        return;
+      }
+      if (id === 'import' && req.method === 'POST') {
+        await handleTaskImport({ store, scheduler, req, res });
+        return;
+      }
+
+      await handleTaskItem({ store, scheduler, req, res, url, id, action });
+    } catch (err) {
+      sendJson(res, err.statusCode || 500, { ok: false, error: err.message });
+    }
+  };
+}
+
+// ------------------------------------------------------------- collection
+
+async function handleTaskCollection({ store, scheduler, collection, req, res, url, scope }) {
+  // The alias family only exists for individual tasks.
+  if (scope === 'action' || !collection) {
+    sendJson(res, 405, NOT_ALLOWED);
+    return;
+  }
+  if (req.method === 'GET') {
+    listTasks({ store, scheduler, collection, res, url });
+    return;
+  }
+  if (req.method === 'POST') {
+    await createOrUpdateTask({ store, scheduler, req, res });
+    return;
+  }
+  sendJson(res, 405, NOT_ALLOWED);
+}
+
+function listTasks({ store, scheduler, collection, res, url }) {
+  const status = url.searchParams.get('status') || 'all';
+  const query = url.searchParams.get('query') || '';
+  const list = store.list({ status, query }).map((t) => ({
+    ...t,
+    running: scheduler.isRunning(t.id),
+    runningSince: scheduler.runningSince(t.id),
+  }));
+  const stats = store.getAggregatedStats();
+  sendJson(res, 200, { ok: true, tasks: list, recommendations: collection.recommendations, stats });
+}
+
+async function createOrUpdateTask({ store, scheduler, req, res }) {
+  if (rejectCrossOrigin(req, res)) return;
+  const { body, error } = await readBody(req, res);
+  if (error) return;
+  if (!body.title || !body.schedule || !body.prompt) {
+    sendJson(res, 400, { ok: false, error: 'Fields title, schedule and prompt are required' });
+    return;
+  }
+  const taskType = normalizeTaskType(body.type);
+  if (CODE_EXECUTING_TYPES.includes(taskType) && req.headers[SCRIPT_CONFIRM_HEADER] !== 'script') {
+    sendJson(res, 403, { ok: false, error: `Creating ${taskType} tasks over HTTP requires the x-dsh-cron-confirm: script header` });
+    return;
+  }
+  const typeError = validateTaskType(taskType, body);
+  if (typeError) {
+    sendJson(res, 400, { ok: false, error: typeError });
+    return;
+  }
+  const parsed = parseScheduleExpression(body.schedule);
+  // A client-supplied id must not shadow the collection routes under
+  // /dsh-cron/tasks, otherwise that task could never be fetched or deleted
+  // again (#42 review finding).
+  if (body.id && RESERVED_TASK_IDS.includes(String(body.id))) {
+    sendJson(res, 400, { ok: false, error: `Task id "${body.id}" is reserved` });
+    return;
+  }
+  const task = store.set(buildTaskRecord(store, body, taskType, parsed));
+  if (task.status === 'active') {
+    scheduler.scheduleTask(task);
+  } else {
+    scheduler.pauseTask(task.id);
+  }
+  sendJson(res, 200, { ok: true, task });
+}
+
+/** Merge a create/update payload onto the stored task, if any. */
+function buildTaskRecord(store, body, taskType, parsed) {
+  const current = body.id ? store.get(body.id) : null;
+  const resolvedStatus = body.status || (current ? current.status : 'active');
+  return {
+    id: body.id,
+    title: body.title,
+    schedule: parsed.cronPattern || body.schedule,
+    scheduleText: body.scheduleText || parsed.humanText,
+    prompt: body.prompt,
+    type: taskType,
+    delivery: body.delivery || 'current',
+    status: resolvedStatus,
+    provider: body.provider || undefined,
+    model: body.model || undefined,
+    fallbackProvider: body.fallbackProvider || undefined,
+    fallbackModel: body.fallbackModel || undefined,
+    notifyTelegram: body.notifyTelegram !== undefined ? Boolean(body.notifyTelegram) : (current ? current.notifyTelegram : false),
+    onlyOnFailure: body.onlyOnFailure !== undefined ? Boolean(body.onlyOnFailure) : (current ? current.onlyOnFailure : false),
+    timeoutSeconds: body.timeoutSeconds !== undefined ? Number(body.timeoutSeconds) : (current ? current.timeoutSeconds : 1800),
+    overlapPolicy: body.overlapPolicy || (current ? current.overlapPolicy : 'skip'),
+    kanbanMode: body.kanbanMode || (current ? current.kanbanMode : 'none'),
+    timezone: body.timezone !== undefined ? String(body.timezone).trim() : (current ? current.timezone : ''),
+    misfirePolicy: ['skip', 'runOnce', 'catchUpAll'].includes(body.misfirePolicy) ? body.misfirePolicy : (current ? (current.misfirePolicy || 'skip') : 'skip'),
+    maxRetries: body.maxRetries !== undefined ? Math.max(0, Number(body.maxRetries) || 0) : (current ? (Number(current.maxRetries) || 0) : 0),
+    retryBackoffMs: body.retryBackoffMs !== undefined ? Math.max(1000, Number(body.retryBackoffMs) || 30000) : (current ? (Number(current.retryBackoffMs) || 30000) : 30000),
+    permissionPreset: ['default', 'read-only', 'workspace-write', 'full'].includes(body.permissionPreset) ? body.permissionPreset : (current ? (current.permissionPreset || 'default') : 'default'),
+    ...mergeExecutionFields(current, body, parsed),
+  };
+}
+
+// --------------------------------------------------------- export / import
+
+function handleTaskExport({ store, res }) {
+  const doc = buildTaskExport(store.list({ status: 'all' }));
+  sendJson(res, 200, { ok: true, document: doc, count: doc.tasks.length });
+}
+
+async function handleTaskImport({ store, scheduler, req, res }) {
+  const { body, error } = await readBody(req, res);
+  if (error) return;
+  const strategy = IMPORT_STRATEGIES.includes(body && body.strategy) ? body.strategy : 'skip';
+  const checked = validateImportDocument(body && body.document);
+  if (!checked.ok) {
+    sendJson(res, 400, { ok: false, error: checked.error });
+    return;
+  }
+  // The import file is external input: importing code-executing tasks needs
+  // the same explicit confirmation that creating one over HTTP needs,
+  // otherwise a hand-edited file would bypass that gate (#86).
+  if (hasCodeExecutingTask(checked.tasks) && req.headers[SCRIPT_CONFIRM_HEADER] !== 'script') {
+    sendJson(res, 403, {
+      ok: false,
+      error: `Importing code-executing tasks over HTTP requires the ${SCRIPT_CONFIRM_HEADER}: script header`,
+    });
+    return;
+  }
+  const existingIds = store.list({ status: 'all' }).map((x) => x.id);
+  const plan = planImport(checked.tasks, existingIds, strategy);
+  const summary = { add: plan.add.length, replace: plan.replace.length, skip: plan.skip.length };
+  if (body && body.dryRun) {
+    sendJson(res, 200, {
+      ok: true,
+      dryRun: true,
+      strategy: plan.strategy,
+      summary,
+      codeExecuting: hasCodeExecutingTask(plan.add.concat(plan.replace)),
+    });
+    return;
+  }
+  const applied = applyImportPlan({ store, scheduler, plan });
+  if (applied.error) {
+    sendJson(res, 500, { ok: false, error: applied.error });
+    return;
+  }
+  sendJson(res, 200, { ok: true, imported: applied.imported.length, summary, tasks: applied.imported });
+}
+
+/**
+ * Write an import plan. Every imported task is paused (the file's status is
+ * ignored) and every touched id is disarmed explicitly, because writing
+ * "paused" does not stop an already-armed croner job. A failed write rolls the
+ * store back so a partial import cannot survive.
+ */
+function applyImportPlan({ store, scheduler, plan }) {
+  const imported = [];
+  const rollback = [];
+  const disarm = [];
+  try {
+    for (const task of plan.add) {
+      const before = store.get(task.id);
+      const created = store.set({ ...task, id: task.id || randomUUID(), status: 'paused', updatedAt: Date.now() });
+      imported.push(created);
+      rollback.push({ id: created.id, previous: before || null });
+      disarm.push(created.id);
+    }
+    for (const task of plan.replace) {
+      const before = store.get(task.id);
+      if (!before) continue;
+      const replaced = store.set({ ...task, id: task.id, status: 'paused', updatedAt: Date.now() });
+      imported.push(replaced);
+      rollback.push({ id: replaced.id, previous: before });
+      disarm.push(replaced.id);
+    }
+  } catch (writeErr) {
+    for (const entry of rollback.reverse()) {
+      try {
+        if (entry.previous) store.set(entry.previous);
+        else store.delete(entry.id);
+      } catch (_) {}
+    }
+    return { imported: [], error: `Import failed and was rolled back: ${writeErr.message}` };
+  }
+  // Disarm outside the write transaction: pauseTask is idempotent and a
+  // failure here must not undo a successful import.
+  for (const id of disarm) {
+    try {
+      scheduler.pauseTask(id);
+    } catch (err) {
+      console.error('[dsh-cron] import: could not pause task', id + ':', err.message);
+    }
+  }
+  return { imported };
+}
+
+// ------------------------------------------------------------ single task
+
+async function handleTaskItem({ store, scheduler, req, res, url, id, action }) {
+  if (req.method === 'GET' && (action === 'history' || !action)) {
+    const limit = parseInt(url.searchParams.get('limit') || '20', 10);
+    sendJson(res, 200, { ok: true, history: store.getHistory(id, limit) });
+    return;
+  }
+  if (req.method === 'POST') {
+    const handled = await handleItemPost({ store, scheduler, req, res, url, id, action });
+    if (handled) return;
+  }
+  if (req.method === 'PATCH') {
+    await patchTask({ store, scheduler, req, res, id });
+    return;
+  }
+  if (req.method === 'DELETE' || (req.method === 'POST' && action === 'delete')) {
+    deleteTask({ store, scheduler, res, id });
+    return;
+  }
+  sendJson(res, 405, NOT_ALLOWED);
+}
+
+/** Task actions that are plain POSTs. Returns true when one matched. */
+async function handleItemPost({ store, scheduler, req, res, url, id, action }) {
+  if (action === 'run') {
+    if (!store.get(id)) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    await scheduler.triggerManualRun(id);
+    sendJson(res, 200, { ok: true, task: store.get(id) });
+    return true;
+  }
+  if (action === 'duplicate') {
+    const source = store.get(id);
+    if (!source) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    const copy = buildDuplicateTask(source, { id: randomUUID() });
+    store.set(copy);
+    // A copy starts paused: it must never fire on its own before the user
+    // reviews the schedule (a duplicated one-shot may point at a past time).
+    scheduler.pauseTask(copy.id);
+    sendJson(res, 200, { ok: true, task: copy });
+    return true;
+  }
+  if (action === 'pause' || action === 'resume') {
+    const task = action === 'pause' ? scheduler.pauseTask(id) : scheduler.resumeTask(id);
+    if (!task) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    sendJson(res, 200, { ok: true, task });
+    return true;
+  }
+  if (action === 'toggle' || (!action && url.searchParams.get('action') === 'toggle')) {
+    if (!store.get(id)) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    const task = scheduler.toggleTask(id);
+    sendJson(res, 200, { ok: true, task });
+    return true;
+  }
+  return false;
+}
+
+async function patchTask({ store, scheduler, req, res, id }) {
+  const current = store.get(id);
+  if (!current) {
+    sendJson(res, 404, NOT_FOUND);
+    return;
+  }
+  const { body, error } = await readBody(req, res);
+  if (error) return;
+  const result = applyTaskPatch({
+    store,
+    scheduler,
+    id,
+    body,
+    allowCodeSwitch: req.headers[SCRIPT_CONFIRM_HEADER] === 'script',
+  });
+  if (!result.ok) {
+    const status = result.notFound ? 404 : (result.needsConfirmation ? 403 : 400);
+    const error = result.needsConfirmation
+      ? `Switching a task to the ${normalizeTaskType(body.type)} type over HTTP requires the ${SCRIPT_CONFIRM_HEADER}: script header`
+      : result.error;
+    sendJson(res, status, { ok: false, error });
+    return;
+  }
+  sendJson(res, 200, { ok: true, task: result.task });
+}
+
+function deleteTask({ store, scheduler, res, id }) {
+  const current = store.get(id);
+  if (current) {
+    scheduler.pauseTask(id);
+    store.delete(id);
+  }
+  sendJson(res, 200, { ok: true });
+}
+
+/**
+ * Runtime and execution settings of a task, merged onto the stored one. Split
+ * out of buildTaskRecord so both stay readable.
+ */
+function mergeExecutionFields(current, body, parsed) {
+  return {
+    env: body.env && typeof body.env === 'object' ? body.env : (current ? current.env : undefined),
+    cwd: body.cwd !== undefined ? String(body.cwd).trim() : (current ? current.cwd : ''),
+    channels: Array.isArray(body.channels)
+      ? body.channels.filter((c) => CHANNEL_IDS.includes(c))
+      : (current ? current.channels : undefined),
+    template: body.template !== undefined ? String(body.template) : (current ? current.template : ''),
+    silentRule: body.silentRule !== undefined ? String(body.silentRule) : (current ? current.silentRule : ''),
+    inspectOnFailure: body.inspectOnFailure !== undefined ? Boolean(body.inspectOnFailure) : (current ? Boolean(current.inspectOnFailure) : false),
+    workspaceId: body.workspaceId !== undefined ? String(body.workspaceId).trim() : (current ? current.workspaceId : ''),
+    worktree: body.worktree !== undefined ? Boolean(body.worktree) : (current ? Boolean(current.worktree) : false),
+    keepWorktree: body.keepWorktree !== undefined ? Boolean(body.keepWorktree) : (current ? Boolean(current.keepWorktree) : false),
+    httpMethod: body.httpMethod ? String(body.httpMethod).toUpperCase() : (current ? current.httpMethod : 'GET'),
+    httpUrl: body.httpUrl !== undefined ? String(body.httpUrl).trim() : (current ? current.httpUrl : ''),
+    httpHeaders: body.httpHeaders !== undefined ? body.httpHeaders : (current ? current.httpHeaders : undefined),
+    httpBody: body.httpBody !== undefined ? String(body.httpBody) : (current ? current.httpBody : ''),
+    sshProfileId: body.sshProfileId !== undefined ? String(body.sshProfileId).trim() : (current ? current.sshProfileId : ''),
+    sshTarget: body.sshTarget !== undefined ? String(body.sshTarget).trim() : (current ? current.sshTarget : ''),
+    sshPort: body.sshPort !== undefined ? Number(body.sshPort) || 0 : (current ? current.sshPort : 0),
+    sshKeyPath: body.sshKeyPath !== undefined ? String(body.sshKeyPath).trim() : (current ? current.sshKeyPath : ''),
+    dockerImage: body.dockerImage !== undefined ? String(body.dockerImage).trim() : (current ? current.dockerImage : ''),
+    pythonPath: body.pythonPath !== undefined ? String(body.pythonPath).trim() : (current ? current.pythonPath : ''),
+    nodePath: body.nodePath !== undefined ? String(body.nodePath).trim() : (current ? current.nodePath : ''),
+    skillName: body.skillName !== undefined ? String(body.skillName).trim() : (current ? current.skillName : ''),
+    workflowName: body.workflowName !== undefined ? String(body.workflowName).trim() : (current ? current.workflowName : ''),
+    oneShot: Boolean((parsed && parsed.isOneShot) || (body && body.oneShot)),
+  };
+}

package/lib/channels.js

@@ -1,5 +1,5 @@
 /**
- * Delivery channels and router (#26, #20, #21, #22, #23, #47, #28).
+ * Delivery channels and router (#26, #20, #21, #22, #47, #28).
  *
  * Every adapter is split into a pure payload/request builder (unit-testable
  * without network) and a thin send step using an injected fetch. The router
@@ -11,7 +11,7 @@ import { formatTaskTelegramMessage, sendTelegramMessage } from './telegram.js';
 import { createKanbanCard, shouldCreateKanbanCard } from './integrations.js';
 import { resolveTemplateText, truncateText } from './templates.js';
 
-export const CHANNEL_IDS = ['telegram', 'kanban', 'discord', 'slack', 'ntfy', 'bark', 'pushplus', 'email', 'tts', 'gitea'];
+export const CHANNEL_IDS = ['telegram', 'kanban', 'discord', 'slack', 'ntfy', 'bark', 'pushplus', 'tts', 'gitea'];
 
 export const CHANNEL_LABELS = {
   telegram: 'Telegram',
@@ -21,7 +21,6 @@ export const CHANNEL_LABELS = {
   ntfy: 'ntfy push',
   bark: 'Bark push',
   pushplus: 'PushPlus',
-  email: 'Email (SMTP)',
   tts: 'Voice via dsh-tts',
   gitea: 'Gitea issue',
 };
@@ -51,6 +50,17 @@ export function resolveChannels(task, settings = {}) {
   return out;
 }
 
+/**
+ * Channel ids a task still references that no longer exist (for example the
+ * removed `email` channel). They are filtered out of routing, so they must be
+ * reported explicitly — a silently dropped notification is worse than a
+ * visible failure.
+ */
+export function unknownChannels(task) {
+  if (!Array.isArray(task.channels)) return [];
+  return task.channels.filter((id) => !CHANNEL_IDS.includes(id));
+}
+
 /** Failure/only-on-failure filtering, per channel. */
 export function shouldSendToChannel(channelId, task, runInfo, settings = {}) {
   if (channelId === 'kanban') return shouldCreateKanbanCard(task, runInfo);
@@ -139,42 +149,32 @@ export function buildGiteaIssuePayload({ task, runInfo }) {
   };
 }
 
-export function buildEmailMessage({ settings = {}, text, task, runInfo, password, timeoutMs }) {
-  const to = String(settings.smtpTo || '').trim();
-  if (!to) throw new Error('smtpTo is not configured');
-  const from = String(settings.smtpFrom || settings.smtpUser || '').trim();
-  const failed = isFailed(runInfo.status);
-  const bound = Number(timeoutMs) > 0 ? Number(timeoutMs) : DEFAULT_DELIVERY_TIMEOUT_MS;
-  return {
-    from: from || undefined,
-    to,
-    subject: `${failed ? '❌' : '✅'} ${task.title || 'DSH Cron'} — ${runInfo.status}`,
-    text: truncateText(text, 10000),
-    transport: {
-      host: settings.smtpHost || '',
-      port: Number(settings.smtpPort) || 587,
-      secure: Boolean(settings.smtpSecure),
-      auth: settings.smtpUser ? { user: settings.smtpUser, pass: password || '' } : undefined,
-      // Nodemailer has no AbortSignal support: without these a stalled SMTP
-      // server would hold the run (defaults are 2–10 minutes).
-      connectionTimeout: bound,
-      greetingTimeout: bound,
-      socketTimeout: bound,
-    },
-  };
-}
-
 // ------------------------------------------------------------------ sender
 
 export const DEFAULT_DELIVERY_TIMEOUT_MS = 15000;
 
+/**
+ * Lower bound for a per-channel deadline (#115). A stored value of a few
+ * milliseconds would fail every delivery before the request could even be sent,
+ * which looks like "delivery is broken" rather than a misconfiguration, so the
+ * router clamps instead of trusting the setting blindly.
+ */
+export const MIN_DELIVERY_TIMEOUT_MS = 1000;
+
+/** Normalise a configured delivery timeout: finite, >= MIN, else the default. */
+export function resolveDeliveryTimeoutMs(value) {
+  const n = Number(value);
+  if (!Number.isFinite(n) || n <= 0) return DEFAULT_DELIVERY_TIMEOUT_MS;
+  return Math.max(MIN_DELIVERY_TIMEOUT_MS, Math.round(n));
+}
+
 /**
  * Bound every outbound request. Without this a single unresponsive endpoint
  * blocks the remaining channels and, because the run is awaited inside the
  * croner callback with protect enabled, silently skips subsequent ticks.
  */
 function deliverySignal(timeoutMs) {
-  const ms = Number(timeoutMs) > 0 ? Number(timeoutMs) : DEFAULT_DELIVERY_TIMEOUT_MS;
+  const ms = resolveDeliveryTimeoutMs(timeoutMs);
   if (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') {
     return AbortSignal.timeout(ms);
   }
@@ -189,13 +189,12 @@ function isAbort(err) {
 }
 
 /**
- * Hard deadline around one channel's whole work. Signal-based aborts only
- * help where the callee supports AbortSignal (fetch), while credential
- * resolution, SMTP and any injected transport ignore it — this is the backstop
- * that keeps every channel bounded regardless of implementation.
+ * Hard deadline around one channel's whole work. Signal-based aborts only help
+ * where the callee supports AbortSignal (fetch), while credential resolution
+ * ignores it — this is the backstop that keeps every channel bounded.
  */
 function withDeadline(promise, timeoutMs, channelId) {
-  const ms = Number(timeoutMs) > 0 ? Number(timeoutMs) : DEFAULT_DELIVERY_TIMEOUT_MS;
+  const ms = resolveDeliveryTimeoutMs(timeoutMs);
   return new Promise((resolve, reject) => {
     const timer = setTimeout(() => {
       reject(new Error(`${channelId}: timed out after ${ms} ms`));
@@ -308,23 +307,6 @@ export const CHANNEL_HANDLERS = {
     return sendHttp(http, req, 'pushplus', signal, timeoutMs);
   },
 
-  async email({ task, runInfo, settings, deps, resolveSecret, timeoutMs }) {
-    const password = settings.smtpPasswordRef ? await resolveSecret(settings.smtpPasswordRef) : (settings.smtpPassword || '');
-    const message = buildEmailMessage({ settings, text: messageTextFor('email', task, runInfo, settings), task, runInfo, password, timeoutMs });
-    let createTransport = deps.createTransport;
-    if (!createTransport) {
-      try {
-        const mod = await import('nodemailer');
-        createTransport = (mod.default || mod).createTransport;
-      } catch {
-        throw new Error('email: nodemailer is not installed in the harness (install it or use another channel)');
-      }
-    }
-    const transport = createTransport(message.transport);
-    await transport.sendMail({ from: message.from, to: message.to, subject: message.subject, text: message.text });
-    return { to: message.to };
-  },
-
   async tts({ task, runInfo, settings, http, signal, timeoutMs }) {
     const base = String(settings.ttsBaseUrl || 'http://127.0.0.1:3080').replace(/\/+$/, '');
     const payload = { text: truncateText(messageTextFor('tts', task, runInfo, settings), 600) };
@@ -354,22 +336,21 @@ export const CHANNEL_HANDLERS = {
 
 /**
  * Deliver one run to one channel.
- * `resolveSecret(ref)` resolves credential references; `deps.createTransport`
- * is an injectable nodemailer-compatible factory for tests.
+ * `resolveSecret(ref)` resolves credential references; `fetchFn` is injectable
+ * so every channel is testable without network access.
  */
-export async function sendToChannel({ channelId, task, runInfo, settings = {}, secrets = {}, fetchFn, deps = {}, timeoutMs = DEFAULT_DELIVERY_TIMEOUT_MS }) {
+export async function sendToChannel({ channelId, task, runInfo, settings = {}, secrets = {}, fetchFn, timeoutMs = DEFAULT_DELIVERY_TIMEOUT_MS }) {
   const handler = CHANNEL_HANDLERS[channelId];
   if (!handler) throw new Error(`unknown channel: ${channelId}`);
   const resolveSecret = typeof secrets.resolveSecret === 'function' ? secrets.resolveSecret : async () => null;
   const http = fetchFn || globalThis.fetch;
-  const effectiveTimeout = Number(timeoutMs) > 0 ? Number(timeoutMs) : DEFAULT_DELIVERY_TIMEOUT_MS;
+  const effectiveTimeout = resolveDeliveryTimeoutMs(timeoutMs);
   const work = handler({
     task,
     runInfo,
     settings,
     secrets,
     http,
-    deps,
     resolveSecret,
     signal: deliverySignal(effectiveTimeout),
     timeoutMs: effectiveTimeout,
@@ -386,10 +367,8 @@ export async function sendToChannel({ channelId, task, runInfo, settings = {}, s
  * hold the cron callback open. Never throws: per-channel failures are returned
  * in `failures`.
  */
-export async function deliverRun({ task, runInfo, settings = {}, secrets = {}, fetchFn, deps = {} }) {
-  const timeoutMs = Number(settings.deliveryTimeoutMs) > 0
-    ? Number(settings.deliveryTimeoutMs)
-    : DEFAULT_DELIVERY_TIMEOUT_MS;
+export async function deliverRun({ task, runInfo, settings = {}, secrets = {}, fetchFn }) {
+  const timeoutMs = resolveDeliveryTimeoutMs(settings.deliveryTimeoutMs);
 
   let channels = [];
   try {
@@ -403,7 +382,7 @@ export async function deliverRun({ task, runInfo, settings = {}, secrets = {}, f
       if (!shouldSendToChannel(channelId, task, runInfo, settings)) {
         return { channel: channelId, skipped: true };
       }
-      const detail = await sendToChannel({ channelId, task, runInfo, settings, secrets, fetchFn, deps, timeoutMs });
+      const detail = await sendToChannel({ channelId, task, runInfo, settings, secrets, fetchFn, timeoutMs });
       return { channel: channelId, detail: detail || null };
     } catch (err) {
       return { channel: channelId, error: (err && err.message) || String(err) };
@@ -413,6 +392,17 @@ export async function deliverRun({ task, runInfo, settings = {}, secrets = {}, f
   const delivered = [];
   const skipped = [];
   const failures = [];
+  // Report ids that no longer exist before the per-channel results, so a task
+  // still carrying a removed channel fails loudly instead of silently.
+  let removed = [];
+  try {
+    removed = unknownChannels(task);
+  } catch {
+    removed = [];
+  }
+  for (const channelId of removed) {
+    failures.push({ channel: channelId, error: `unknown channel: ${channelId}` });
+  }
   for (const outcome of outcomes) {
     if (outcome.skipped) skipped.push(outcome.channel);
     else if (outcome.error) failures.push({ channel: outcome.channel, error: outcome.error });