@goodandready/dsh-cron 0.2.40 → 0.2.42

package/README.md

@@ -550,7 +550,7 @@ dsh-cron:
 Notes:
 
 * Run history is capped at **50 entries per task** (fixed); each entry keeps up to 4000 characters of output.
-* Tasks run in the **server's local timezone**; cron expressions are evaluated by `croner` on the host clock.
+* Tasks run in their configured **timezone** (`task.timezone`, falling back to `settings.defaultTimezone` or server local timezone); cron expressions are evaluated by `croner` against the resolved timezone.
 * Tasks persist in the DSH data directory (`cron/tasks.json`) and survive restarts; missed one-shots are detected on startup.
 
 ---

package/lib/api-webhook.js

@@ -21,22 +21,26 @@ export async function handleTelegramWebhook({ store, scheduler, req, res }) {
   const botToken = settings.botToken || defaults.botToken;
   const allowedChatId = String(settings.chatId || defaults.chatId || '').trim();
 
-  // Secret token verification (Issue #208)
+  // Secret token verification (Issue #208) - fail-closed: secret MUST be configured
   const webhookSecret = settings.telegramWebhookSecret || settings.webhookSecret || settings.secretToken || process.env.TELEGRAM_WEBHOOK_SECRET;
-  if (webhookSecret) {
-    const receivedSecret = req.headers['x-telegram-bot-api-secret-token'];
-    if (!receivedSecret || typeof receivedSecret !== 'string') {
-      logger.warn('[dsh-cron] unauthorized telegram webhook: missing secret token header');
-      sendJson(res, 401, { ok: false, error: 'Unauthorized: missing secret token' });
-      return;
-    }
-    const secretBuf = Buffer.from(String(webhookSecret));
-    const receivedBuf = Buffer.from(String(receivedSecret));
-    if (secretBuf.length !== receivedBuf.length || !crypto.timingSafeEqual(secretBuf, receivedBuf)) {
-      logger.warn('[dsh-cron] unauthorized telegram webhook: invalid secret token');
-      sendJson(res, 401, { ok: false, error: 'Unauthorized: invalid secret token' });
-      return;
-    }
+  if (!webhookSecret) {
+    logger.warn('[dsh-cron] unauthorized telegram webhook: webhook secret is not configured (fail-closed)');
+    sendJson(res, 401, { ok: false, error: 'Unauthorized: webhook secret is not configured' });
+    return;
+  }
+  const headers = req.headers || {};
+  const receivedSecret = headers['x-telegram-bot-api-secret-token'] || headers['X-Telegram-Bot-Api-Secret-Token'];
+  if (!receivedSecret || typeof receivedSecret !== 'string') {
+    logger.warn('[dsh-cron] unauthorized telegram webhook: missing secret token header');
+    sendJson(res, 401, { ok: false, error: 'Unauthorized: missing secret token' });
+    return;
+  }
+  const secretBuf = Buffer.from(String(webhookSecret));
+  const receivedBuf = Buffer.from(String(receivedSecret));
+  if (secretBuf.length !== receivedBuf.length || !crypto.timingSafeEqual(secretBuf, receivedBuf)) {
+    logger.warn('[dsh-cron] unauthorized telegram webhook: invalid secret token');
+    sendJson(res, 401, { ok: false, error: 'Unauthorized: invalid secret token' });
+    return;
   }
 
   // Deduplicate updates by update_id (Issue #208)

package/lib/api.js

@@ -256,8 +256,8 @@ function buildTaskRecord(store, body, taskType, parsed) {
     model: body.model || undefined,
     fallbackProvider: body.fallbackProvider || undefined,
     fallbackModel: body.fallbackModel || undefined,
-    notifyTelegram: body.notifyTelegram !== undefined ? Boolean(body.notifyTelegram) : (current ? current.notifyTelegram : false),
-    onlyOnFailure: body.onlyOnFailure !== undefined ? Boolean(body.onlyOnFailure) : (current ? current.onlyOnFailure : false),
+    notifyTelegram: body.notifyTelegram !== undefined ? Boolean(body.notifyTelegram) : (current ? current.notifyTelegram : undefined),
+    onlyOnFailure: body.onlyOnFailure !== undefined ? Boolean(body.onlyOnFailure) : (current ? current.onlyOnFailure : undefined),
     timeoutSeconds: body.timeoutSeconds !== undefined ? Number(body.timeoutSeconds) : (current ? current.timeoutSeconds : 1800),
     overlapPolicy: body.overlapPolicy || (current ? current.overlapPolicy : 'skip'),
     kanbanMode: body.kanbanMode || (current ? current.kanbanMode : 'none'),

package/lib/channels.js

@@ -18,11 +18,17 @@ export const CHANNEL_IDS = ['telegram', 'kanban', 'discord', 'slack', 'ntfy', 'b
 export const isFailureStatus = (status) => status === 'error' || status === 'timeout' || status === 'missed';
 export const isFailed = (status) => isFailureStatus(status);
 
-/** The message text for a channel: custom template, else built-in defaults. */
-function messageTextFor(channelId, task, runInfo, settings = {}) {
+/** The message text for a channel: task template -> channel template -> global template -> built-in defaults (#233). */
+export function messageTextFor(channelId, task, runInfo, settings = {}) {
   const templates = (settings && settings.channelTemplates) || {};
-  const template = templates[channelId] || settings.template || '';
-  return resolveTemplateText({ template, task, runInfo });
+  const custom = (task && task.template) || templates[channelId] || (settings && settings.template) || '';
+  if (custom) {
+    return resolveTemplateText({ template: custom, task, runInfo });
+  }
+  if (channelId === 'telegram') {
+    return formatTaskTelegramMessage(task, runInfo);
+  }
+  return resolveTemplateText({ template: '', task, runInfo });
 }
 
 /**
@@ -56,17 +62,27 @@ export function unknownChannels(task) {
   return unknownChannelIds(task && task.channels);
 }
 
-/** Failure/only-on-failure filtering, per channel. */
+/** Failure/only-on-failure filtering, per channel (#219). Explicit task channels win over legacy flags. */
 export function shouldSendToChannel(channelId, task, runInfo, settings = {}) {
-  if (channelId === 'kanban') return shouldCreateKanbanCard(task, runInfo);
-  if (channelId === 'telegram') {
-    if (task && task.notifyTelegram === false) return false;
-    const taskForTelegram = Object.assign({}, task, { notifyTelegram: true });
-    return shouldNotifyTask(taskForTelegram, runInfo, settings);
+  const isExplicit = Array.isArray(task && task.channels) && task.channels.includes(channelId);
+  if (!isExplicit) {
+    if (channelId === 'kanban') return shouldCreateKanbanCard(task, runInfo);
+    if (channelId === 'telegram') {
+      if (task && task.notifyTelegram === false) return false;
+      const taskForTelegram = Object.assign({}, task, { notifyTelegram: true });
+      return shouldNotifyTask(taskForTelegram, runInfo, settings);
+    }
+  }
+
+  // Explicit selection (or default event filtering for all channels):
+  if (channelId === 'kanban') {
+    if (task && task.kanbanMode === 'on_failure') return isFailed(runInfo.status);
+    if (task && task.kanbanMode === 'always') return true;
   }
-  const onlyOnFail = task.onlyOnFailure !== undefined
+
+  const onlyOnFail = (task && task.onlyOnFailure !== undefined)
     ? Boolean(task.onlyOnFailure)
-    : Boolean(settings.onlyOnFailure);
+    : Boolean(settings && settings.onlyOnFailure);
   if (onlyOnFail && !isFailed(runInfo.status)) return false;
   return true;
 }
@@ -133,8 +149,34 @@ export function buildPushplusRequest({ settings = {}, text, task, token }) {
   };
 }
 
-export function buildGiteaIssuePayload({ task, runInfo }) {
+export function buildGiteaIssuePayload({ task, runInfo, settings = {} }) {
   const failed = isFailed(runInfo.status);
+  const defaultNames = failed ? ['cron', 'bug', 'alert'] : ['cron', 'auto'];
+
+  // Resolve labels to integer IDs per Gitea Swagger (array<int64>) (#224)
+  const mapping = settings.giteaLabelIds || {};
+  let candidateIds = [];
+
+  if (Array.isArray(task && task.giteaLabelIds)) {
+    candidateIds = task.giteaLabelIds;
+  } else if (Array.isArray(settings.giteaLabels)) {
+    candidateIds = settings.giteaLabels;
+  } else if (Array.isArray(settings.giteaLabelIds)) {
+    candidateIds = settings.giteaLabelIds;
+  } else if (Array.isArray(task && task.labels)) {
+    candidateIds = task.labels.map((item) => {
+      const num = Number(item);
+      if (Number.isInteger(num) && num > 0) return num;
+      return typeof mapping === 'object' && mapping !== null ? mapping[item] : undefined;
+    });
+  } else if (typeof mapping === 'object' && mapping !== null && Object.keys(mapping).length > 0) {
+    candidateIds = defaultNames.map((name) => mapping[name]);
+  }
+
+  const labelIds = candidateIds
+    .map((id) => Number(id))
+    .filter((id) => Number.isInteger(id) && id > 0);
+
   return {
     title: `${failed ? '[Cron failure]' : '[Cron run]'} ${truncateText(task.title || 'Task', 200)}`,
     body: [
@@ -145,7 +187,7 @@ export function buildGiteaIssuePayload({ task, runInfo }) {
       runInfo.error ? `\n**Error:**\n\`\`\`\n${truncateText(runInfo.error, 1000)}\n\`\`\`` : '',
       runInfo.output ? `\n**Output:**\n\`\`\`\n${truncateText(runInfo.output, 1000)}\n\`\`\`` : '',
     ].filter(Boolean).join('\n\n'),
-    labels: failed ? ['cron', 'bug', 'alert'] : ['cron', 'auto'],
+    labels: labelIds,
   };
 }
 
@@ -248,9 +290,7 @@ const CHANNEL_HANDLERS = {
     const botToken = secrets.botToken || '';
     const chatId = String(settings.chatId || '').trim();
     if (!botToken || !chatId) throw new Error('telegram: botToken or chatId is not configured');
-    const text = settings.template
-      ? messageTextFor('telegram', task, runInfo, settings)
-      : formatTaskTelegramMessage(task, runInfo);
+    const text = messageTextFor('telegram', task, runInfo, settings);
     try {
       const replyMarkup = createTelegramTaskKeyboard(task, runInfo);
       await sendTelegramMessage({ botToken, chatId, text, replyMarkup, fetchFn: http, signal });
@@ -321,7 +361,7 @@ const CHANNEL_HANDLERS = {
     if (!base || !repo) throw new Error('gitea: giteaBaseUrl and giteaRepo are required');
     const token = settings.giteaTokenRef ? await resolveSecret(settings.giteaTokenRef) : '';
     if (!token) throw new Error(`gitea: credential "${settings.giteaTokenRef || ''}" did not resolve`);
-    const payload = buildGiteaIssuePayload({ task, runInfo });
+    const payload = buildGiteaIssuePayload({ task, runInfo, settings });
     const issue = await postJson(
       http,
       `${base}/api/v1/repos/${repo}/issues`,

package/lib/client.js

@@ -1499,11 +1499,32 @@ window.__ModuleLoader__.load({
 
       const actionInProgressRef = React.useRef(new Set());
 
+      const fetchWithTimeout = async (url, options = {}, timeoutMs = 15000) => {
+        const controller = typeof AbortController !== 'undefined' ? new AbortController() : null;
+        const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : null;
+        try {
+          const res = await fetch(url, {
+            ...options,
+            signal: controller ? controller.signal : options.signal,
+          });
+          return res;
+        } catch (err) {
+          if (err && err.name === 'AbortError') {
+            const timeoutErr = new Error(`Request timed out after ${Math.round(timeoutMs / 1000)}s`);
+            timeoutErr.isTimeout = true;
+            throw timeoutErr;
+          }
+          throw err;
+        } finally {
+          if (timer) clearTimeout(timer);
+        }
+      };
+
       const handleToggleTask = async (id) => {
         if (actionInProgressRef.current.has(id)) return;
         actionInProgressRef.current.add(id);
         try {
-          const res = await fetch('/dsh-cron/tasks/' + encodeURIComponent(id) + '/toggle', { method: 'POST' });
+          const res = await fetchWithTimeout('/dsh-cron/tasks/' + encodeURIComponent(id) + '/toggle', { method: 'POST' }, 15000);
           const data = await res.json().catch(() => ({}));
           if (!res.ok || (data && data.ok === false)) {
             const msg = (data && data.error) || `Toggle failed (HTTP ${res.status})`;
@@ -1526,7 +1547,7 @@ window.__ModuleLoader__.load({
         const prevStatus = prevTask ? prevTask.lastStatus : null;
         setTasks(prev => prev.map(t2 => t2.id === id ? { ...t2, lastStatus: 'running' } : t2));
         try {
-          const res = await fetch('/dsh-cron/tasks/' + encodeURIComponent(id) + '/run', { method: 'POST' });
+          const res = await fetchWithTimeout('/dsh-cron/tasks/' + encodeURIComponent(id) + '/run', { method: 'POST' }, 15000);
           const data = await res.json().catch(() => ({}));
           if (!res.ok || (data && data.ok === false)) {
             setTasks(prev => prev.map(t2 => t2.id === id ? { ...t2, lastStatus: prevStatus } : t2));

package/lib/index.js

@@ -1,4 +1,5 @@
 import fs from 'node:fs';
+import { bestEffort } from './best-effort.js';
 import { setLogger, logger } from './logger.js';
 import { registerPluginUpdater } from './updater.js';
 import { credentialRefStatus } from './secrets.js';
@@ -182,16 +183,67 @@ export function apply(ctx, rawConfig) {
 
   scheduler.start();
 
+  // Heartbeat / dead man's snitch (#16): an optional periodic GET ping so an
+  // external monitor can alert when this scheduler stops responding.
   // Heartbeat / dead man's snitch (#16): an optional periodic GET ping so an
   // external monitor can alert when this scheduler stops responding.
   let heartbeatTimer = null;
-  if (config && config.heartbeatUrl && Number(config.heartbeatIntervalSec) > 0) {
-    const intervalMs = Number(config.heartbeatIntervalSec) * 1000;
-    heartbeatTimer = setInterval(() => {
-      fetch(config.heartbeatUrl, { method: 'GET' }).catch((err) => {
-        logger.warn('[dsh-cron] heartbeat ping failed:', err.message);
-      });
-    }, intervalMs);
+  function updateHeartbeat(url, intervalSec) {
+    if (heartbeatTimer) {
+      clearInterval(heartbeatTimer);
+      heartbeatTimer = null;
+    }
+    const cleanUrl = String(url || '').trim();
+    const cleanSec = Number(intervalSec) || 0;
+    if (cleanUrl && cleanSec > 0) {
+      heartbeatTimer = setInterval(() => {
+        fetch(cleanUrl, { method: 'GET' }).catch((err) => {
+          logger.warn('[dsh-cron] heartbeat ping failed:', err.message);
+        });
+      }, cleanSec * 1000);
+      if (typeof heartbeatTimer.unref === 'function') heartbeatTimer.unref();
+    }
+  }
+  updateHeartbeat(config && config.heartbeatUrl, config && config.heartbeatIntervalSec);
+
+  // Synchronize volatile Config settings to runtime scheduler and store (#235)
+  let activeVolatileConfig = {};
+  function syncVolatileConfig(updatedConfig) {
+    try {
+      const cfg = updatedConfig || ctx.config || config || {};
+      const unwrapped = unwrapConfig(cfg);
+      activeVolatileConfig = { ...activeVolatileConfig, ...unwrapped };
+      if (typeof unwrapped.maxConcurrent === 'number') {
+        scheduler.maxConcurrent = unwrapped.maxConcurrent;
+      }
+      if (typeof unwrapped.defaultTimezone === 'string') {
+        scheduler.defaultTimezone = unwrapped.defaultTimezone;
+      }
+      if (typeof unwrapped.llmActionsEnabled === 'boolean') {
+        scheduler.llmActionsEnabled = unwrapped.llmActionsEnabled;
+      }
+      if (unwrapped.heartbeatUrl !== undefined || unwrapped.heartbeatIntervalSec !== undefined) {
+        updateHeartbeat(unwrapped.heartbeatUrl, unwrapped.heartbeatIntervalSec);
+      }
+      const current = store.getSettings();
+      const patch = {};
+      for (const k of ['maxConcurrent', 'defaultTimezone', 'heartbeatUrl', 'heartbeatIntervalSec', 'llmActionsEnabled']) {
+        if (unwrapped[k] !== undefined && unwrapped[k] !== current[k]) {
+          patch[k] = unwrapped[k];
+        }
+      }
+      if (Object.keys(patch).length > 0) {
+        store.saveSettings(patch);
+      }
+    } catch (err) {
+      logger.warn('[dsh-cron] error syncing volatile config:', err.message);
+    }
+  }
+
+  if (typeof ctx.on === 'function') {
+    ctx.on('loader/volatile-update', (updatedConfig) => {
+      syncVolatileConfig(updatedConfig);
+    });
   }
 
   ctx.effect(() => {
@@ -228,7 +280,17 @@ export function apply(ctx, rawConfig) {
     handler: async (req, res) => {
       try {
         if (req.method === 'GET') {
-          sendJson(res, 200, { ok: true, settings: { ...store.getClientSettings(), version: pkgVersion } });
+          const unwrapped = {
+            ...unwrapConfig(ctx.config || config || {}),
+            ...activeVolatileConfig,
+          };
+          const clientSettings = store.getClientSettings();
+          for (const k of ['maxConcurrent', 'defaultTimezone', 'heartbeatUrl', 'heartbeatIntervalSec', 'llmActionsEnabled']) {
+            if (unwrapped[k] !== undefined) {
+              clientSettings[k] = unwrapped[k];
+            }
+          }
+          sendJson(res, 200, { ok: true, settings: { ...clientSettings, version: pkgVersion } });
           return;
         }
         if (req.method === 'POST') {
@@ -236,12 +298,29 @@ export function apply(ctx, rawConfig) {
           const { body, error } = await readBody(req, res);
           if (error) return;
           const payload = sanitizeSettingsPayload(body);
-          store.saveSettings(payload);
           const scopeErrors = await applySettingsToScope(settingsService, payload);
+          if (scopeErrors && scopeErrors.length > 0) {
+            sendJson(res, 500, {
+              ok: false,
+              error: `Settings scope update failed: ${scopeErrors.join('; ')}`,
+              scopeErrors,
+            });
+            return;
+          }
+          store.saveSettings(payload);
+          if (payload.maxConcurrent !== undefined && Number.isFinite(Number(payload.maxConcurrent))) {
+            scheduler.maxConcurrent = Number(payload.maxConcurrent);
+          }
+          if (payload.defaultTimezone !== undefined) {
+            scheduler.defaultTimezone = String(payload.defaultTimezone || '').trim();
+          }
+          if (payload.heartbeatUrl !== undefined || payload.heartbeatIntervalSec !== undefined) {
+            const current = store.getSettings();
+            updateHeartbeat(current.heartbeatUrl, current.heartbeatIntervalSec);
+          }
           sendJson(res, 200, {
             ok: true,
             settings: { ...store.getClientSettings(), version: pkgVersion },
-            scopeErrors: (scopeErrors && scopeErrors.length > 0) ? scopeErrors : undefined
           });
           return;
         }

package/lib/runner-external.js

@@ -112,11 +112,29 @@ export async function runViaRemoteWorkspace(task, signal, ctx) {
 
   let profile = null;
   profile = bestEffort('get-remoteSsh-profile', () => {
+    const remoteProfilesSvc = ctx.get('remoteProfiles');
+    if (remoteProfilesSvc && typeof remoteProfilesSvc.list === 'function') {
+      const list = remoteProfilesSvc.list();
+      if (Array.isArray(list)) {
+        const found = list.find((p) => p && p.id === task.sshProfileId);
+        if (found) return found;
+      }
+    }
     const settings = ctx.get('settings');
-    if (settings && typeof settings.get === 'function') {
-      const snap = settings.get('dsh-remote-workspace');
-      const profiles = snap && Array.isArray(snap.profiles) ? snap.profiles : [];
-      return profiles.find((p) => p && p.id === task.sshProfileId) || null;
+    if (settings) {
+      if (typeof settings.describe === 'function') {
+        const desc = settings.describe();
+        const entry = Array.isArray(desc) ? desc.find((r) => r && r.ns === 'dsh-remote-workspace') : null;
+        const snap = entry ? entry.value : null;
+        const profiles = snap && Array.isArray(snap.profiles) ? snap.profiles : [];
+        const found = profiles.find((p) => p && p.id === task.sshProfileId);
+        if (found) return found;
+      }
+      if (typeof settings.get === 'function') {
+        const snap = settings.get('dsh-remote-workspace');
+        const profiles = snap && Array.isArray(snap.profiles) ? snap.profiles : [];
+        return profiles.find((p) => p && p.id === task.sshProfileId) || null;
+      }
     }
     return null;
   });

package/lib/runner.js

@@ -423,22 +423,41 @@ export class SessionRunner {
         turnEvents = handle.agent.log.slice(startSeq);
       }
 
-      // 3. Terminal turn failure check (#227)
+      // Extract usage FIRST so failed turns and budget checks have accurate token and cost accounting (#228)
+      const usage = this._extractUsage(handle, turnEvents);
+      const costUsd = estimateTokenCost(prep.model, usage);
+
+      // 3. Terminal turn failure and settlement check (#227)
+      let hasTerminalEvent = false;
       for (const ev of turnEvents) {
         if (!ev) continue;
         if (ev.type === 'turn/end' || ev.type === 'turn/error' || ev.type === 'turn/failure') {
+          hasTerminalEvent = true;
           const reason = ev.data?.reason || ev.reason;
           const reasonKind = (reason && typeof reason === 'object') ? reason.kind : reason;
-          if (['error', 'interrupted', 'failed', 'aborted'].includes(reasonKind) || ev.data?.error || ev.error) {
-            const errMsg = ev.data?.error?.message || ev.error?.message || reason?.message || (typeof reason === 'string' ? reason : 'Agent turn ended with error');
+          if (['error', 'interrupted', 'failed', 'aborted', 'blocked'].includes(reasonKind) || ev.data?.error || ev.error) {
+            const errMsg = ev.data?.error?.message || ev.error?.message || reason?.message || (typeof reason === 'string' ? reason : `Agent turn ended with status: ${reasonKind || 'error'}`);
             const err = new Error(errMsg);
             err.reason = reason;
+            err.reasonKind = reasonKind;
             err.turnFailed = true;
+            err.usage = usage;
+            err.costUsd = costUsd;
+            err.sessionId = handle.agent.session?.id || null;
             throw err;
           }
         }
       }
 
+      if (turnEvents.length > 0 && !hasTerminalEvent) {
+        const err = new Error('Agent turn ended without terminal completion event');
+        err.turnFailed = true;
+        err.usage = usage;
+        err.costUsd = costUsd;
+        err.sessionId = handle.agent.session?.id || null;
+        throw err;
+      }
+
       // 4. Extract assistant message text from turn events (#227)
       const messageTexts = [];
       const chunkTexts = [];
@@ -476,11 +495,10 @@ export class SessionRunner {
         outputText = `[dsh-cron] Agent finished turn for task "${task.title}" (${sessionNote})`;
       }
 
-      const usage = this._extractUsage(handle, turnEvents);
       return {
         output: outputText,
         usage,
-        costUsd: estimateTokenCost(prep.model, usage),
+        costUsd,
         sessionId: handle.agent.session?.id || null,
       };
     } finally {
@@ -541,27 +559,35 @@ export class SessionRunner {
           }
         }
 
-        // assistant/attempt usage (e.g. paid failed attempts or retry attempts)
-        if (ev.type === 'assistant/attempt' && ev.data?.usage) {
-          const u = ev.data.usage;
-          if (ev.data.failed || ev.data.error || ev.data.status === 'failed') {
-            failedAttempts.push({
+        // assistant/attempt usage (e.g. paid failed attempts, retries, streaming attempts) (#228)
+        if (ev.type === 'assistant/attempt') {
+          let attemptUsage = null;
+          if (ev.data?.usage) {
+            const u = ev.data.usage;
+            attemptUsage = {
               inputTokens: Number(u.inputTokens || u.promptTokens || u.uncachedInputTokens) || 0,
               outputTokens: Number(u.outputTokens || u.completionTokens) || 0,
               cacheReadTokens: Number(u.cacheReadTokens || u.cachedTokens) || 0,
-            });
-            hasEventUsage = true;
-          } else {
-            const key = `${ev.data.turn || 0}:${ev.data.step || 0}`;
-            if (!stepUsage.has(key)) {
-              stepUsage.set(key, {
-                inputTokens: Number(u.inputTokens || u.promptTokens || u.uncachedInputTokens) || 0,
-                outputTokens: Number(u.outputTokens || u.completionTokens) || 0,
-                cacheReadTokens: Number(u.cacheReadTokens || u.cachedTokens) || 0,
-              });
-              hasEventUsage = true;
+            };
+          }
+          // DSH 0.2.0-rc.2 AssistantStreamRecord: stream contains usage chunks
+          if (Array.isArray(ev.data?.stream)) {
+            for (const item of ev.data.stream) {
+              const u = item?.chunk?.usage || item?.usage;
+              if (u) {
+                if (!attemptUsage) {
+                  attemptUsage = { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0 };
+                }
+                attemptUsage.inputTokens += Number(u.inputTokens || u.promptTokens || u.uncachedInputTokens) || 0;
+                attemptUsage.outputTokens += Number(u.outputTokens || u.completionTokens) || 0;
+                attemptUsage.cacheReadTokens += Number(u.cacheReadTokens || u.cachedTokens) || 0;
+              }
             }
           }
+          if (attemptUsage) {
+            failedAttempts.push(attemptUsage);
+            hasEventUsage = true;
+          }
         }
       }
 

package/lib/runtimes.js

@@ -46,14 +46,15 @@ function looksLikeScriptFile(token, extensions) {
 
 /** #5: resolve a Node.js invocation (inline code or a .js/.mjs/.cjs file). */
 export function buildNodeInvocation(task, cwd) {
+  const nodeExecutable = task.nodePath || process.execPath;
   const { path: filePath, args } = splitCommandLine(task.prompt);
   if (looksLikeScriptFile(filePath, ['.js', '.mjs', '.cjs'])) {
-    return { file: process.execPath, args: [filePath, ...args] };
+    return { file: nodeExecutable, args: [filePath, ...args] };
   }
   const code = String(task.prompt || '');
   const isEsm = /\bimport\s|\bexport\s/.test(code);
   const nodeArgs = isEsm ? ['--input-type=module', '-e', code] : ['-e', code];
-  return { file: task.nodePath || process.execPath, args: nodeArgs };
+  return { file: nodeExecutable, args: nodeArgs };
 }
 
 /** Find the Python interpreter, preferring a task virtualenv, then the workspace one. */

package/lib/scheduler-execution.js

@@ -146,6 +146,9 @@ export async function executeOnce(scheduler, task, signal, options = {}) {
     result.error = err.message || String(err);
     const timedOut = result.error.toLowerCase().includes('timed out') || result.error.toLowerCase().includes('timeout');
     result.status = timedOut ? 'timeout' : 'error';
+    if (err.usage) result.usage = err.usage;
+    if (typeof err.costUsd === 'number') result.costUsd = err.costUsd;
+    if (err.sessionId) result.sessionId = err.sessionId;
   }
   return result;
 }
@@ -261,6 +264,48 @@ export async function executeTask(scheduler, taskId, options = {}) {
   const task = scheduler.store.get(taskId);
   if (!task) return null;
 
+  // Dry-run path: read-only evaluation without mutating store, history, attempts, or triggering alerts (#229)
+  if (options.dryRun) {
+    const runs = (scheduler.store.history && scheduler.store.history.get(taskId)) || [];
+    const guard = checkTaskBudgetLimits(task, runs);
+    if (guard.exceeded) {
+      return {
+        ok: false,
+        dryRun: true,
+        status: 'error',
+        error: guard.reason,
+        preflightBlocked: true,
+      };
+    }
+    const preflight = await executePreflight(task);
+    if (!preflight.ok) {
+      return {
+        ok: false,
+        dryRun: true,
+        status: 'skipped',
+        error: `Preflight check skipped: ${preflight.reason}`,
+        preflightBlocked: true,
+      };
+    }
+    const start = Date.now();
+    const outcome = await scheduler.executeWithFallback(
+      task,
+      AbortSignal.timeout(Math.min((task.timeoutSeconds || 1800) * 1000, 30000)),
+      options
+    );
+    return {
+      ok: outcome.status !== 'error' && outcome.status !== 'timeout',
+      dryRun: true,
+      status: outcome.status,
+      output: outcome.output,
+      error: outcome.error,
+      durationMs: Date.now() - start,
+      usage: outcome.usage,
+      costUsd: outcome.costUsd,
+      model: outcome.model || task.model || '',
+    };
+  }
+
   // Pre-flight Burn Guard check (#181): prevent executing task if budget already breached
   const runs = (scheduler.store.history && scheduler.store.history.get(taskId)) || [];
   const guard = checkTaskBudgetLimits(task, runs);
@@ -277,22 +322,6 @@ export async function executeTask(scheduler, taskId, options = {}) {
     scheduler.store.set(task);
   }
 
-  if (options.dryRun) {
-    const start = Date.now();
-    const outcome = await scheduler.executeWithFallback(task, AbortSignal.timeout(Math.min((task.timeoutSeconds || 1800) * 1000, 30000)), options);
-    return {
-      ok: true,
-      dryRun: true,
-      status: outcome.status,
-      output: outcome.output,
-      error: outcome.error,
-      durationMs: Date.now() - start,
-      usage: outcome.usage,
-      costUsd: outcome.costUsd,
-      model: outcome.model || task.model || '',
-    };
-  }
-
   const currentRun = scheduler.beginRun(task, taskId, options);
   if (currentRun === null) return null;
 
@@ -377,12 +406,23 @@ export async function applyModelAssists(task, runInfo, options) {
 /**
  * Deliver a finished run to every configured channel (#26).
  */
-export async function deliverNotifications(task, runInfo, { store, resolveSecrets, deliver }) {
+export async function deliverNotifications(task, runInfo, { store, resolveSecrets, deliver, secretTimeoutMs = 5000 }) {
   try {
     let settings = typeof store?.getSettings === 'function' ? store.getSettings() : {};
     if (resolveSecrets) {
       try {
-        settings = { ...settings, ...(await resolveSecrets(settings)) };
+        let timer;
+        const deadline = new Promise((_, reject) => {
+          timer = setTimeout(() => reject(new Error(`credential resolution timed out after ${secretTimeoutMs}ms`)), secretTimeoutMs);
+          if (typeof timer.unref === 'function') timer.unref();
+        });
+        const resolved = await Promise.race([
+          Promise.resolve(resolveSecrets(settings)).finally(() => {
+            if (timer) clearTimeout(timer);
+          }),
+          deadline,
+        ]);
+        settings = { ...settings, ...(resolved || {}) };
       } catch (secErr) {
         logger.warn('[dsh-cron] credential resolution failed:', secErr.message);
       }

package/lib/settings.js

@@ -24,6 +24,7 @@ export const Config = z.object({
   maxConcurrent: z.number().default(2).description('Max parallel task runs (0 = unlimited, default 2)').volatile(),
   heartbeatUrl: z.string().default('').description('Dead man\'s snitch URL pinged on the heartbeat interval').volatile(),
   heartbeatIntervalSec: z.number().default(0).description('Heartbeat ping interval in seconds (0 = off)').volatile(),
+  llmActionsEnabled: z.boolean().default(false).description('Enable LLM actions execution').volatile(),
   // --- Delivery channels (#20-#23, #26, #28, #47) ---
   template: z.string().default('').description('Global notification template; placeholders: {title} {status} {output} {error} {duration} {schedule} {time} {tokens} {cost}').volatile(),
   channelTemplates: z.object({}).default({}).description('Per-channel template overrides keyed by channel id').volatile(),
@@ -77,6 +78,7 @@ export function unwrapConfig(cfg) {
 
 export const SETTINGS_SYNC_KEYS = [
   'botToken', 'botTokenRef', 'telegramWebhookSecret', 'chatId', 'notifyTelegram', 'onlyOnFailure', 'kanbanBaseUrl',
+  'defaultTimezone', 'maxConcurrent', 'heartbeatUrl', 'heartbeatIntervalSec', 'llmActionsEnabled',
   'template', 'channelTemplates', 'deliveryTimeoutMs', 'silentRuleModel', 'inspectorModel',
   'discordWebhookUrl', 'slackWebhookUrl',
   'ntfyUrl', 'ntfyTopic', 'ntfyTokenRef',

package/lib/store.js

@@ -39,6 +39,7 @@ export class TaskStore {
     this._saveTimer = null;
     this._savePromise = Promise.resolve();
     this._saveVersion = 0;
+    this._diskVersion = 0;
     this._lastWrittenVersion = 0;
     this.init();
   }
@@ -178,7 +179,7 @@ export class TaskStore {
     };
 
     const writeOp = async () => {
-      if (this._lastWrittenVersion >= version) {
+      if ((this._diskVersion || 0) >= version) {
         return;
       }
       const dir = path.dirname(this.filePath);
@@ -191,13 +192,31 @@ export class TaskStore {
       await fs.promises.writeFile(tmp, payload, { encoding: 'utf-8', mode: 0o600 });
       bestEffort('chmod-tmp', () => fs.chmodSync(tmp, 0o600));
 
-      if (this._lastWrittenVersion >= version) {
+      if ((this._diskVersion || 0) >= version || this._saveVersion > version) {
         await fs.promises.unlink(tmp).catch(() => {});
         return;
       }
 
       await fs.promises.rename(tmp, this.filePath);
       bestEffort('chmod-store', () => fs.chmodSync(this.filePath, 0o600));
+
+      // Monotonic versioning & sync save interleaving repair (#244)
+      if ((this._diskVersion || 0) > version) {
+        const syncData = {
+          version: 1,
+          updatedAt: new Date().toISOString(),
+          tasks: Array.from(this.tasks.values()),
+          history: Object.fromEntries(this.history.entries()),
+          settings: this.settings || {},
+        };
+        const randRep = Math.random().toString(36).slice(2, 8);
+        const tmpRep = `${this.filePath}.tmp.${process.pid}_${Date.now()}_${randRep}`;
+        fs.writeFileSync(tmpRep, JSON.stringify(syncData, null, 2), { encoding: 'utf-8', mode: 0o600 });
+        fs.renameSync(tmpRep, this.filePath);
+        return;
+      }
+
+      this._diskVersion = version;
       this._lastWrittenVersion = version;
 
       const now = Date.now();
@@ -243,7 +262,8 @@ export class TaskStore {
       bestEffort('chmod-tmp', () => fs.chmodSync(tmp, 0o600));
       fs.renameSync(tmp, this.filePath);
       bestEffort('chmod-store', () => fs.chmodSync(this.filePath, 0o600));
-      this._lastWrittenVersion = version;
+      this._diskVersion = Math.max(this._diskVersion || 0, version);
+      this._lastWrittenVersion = this._diskVersion;
 
       // Throttled backup (.bak): avoid expensive copyFileSync on every micro-save
       const now = Date.now();
@@ -411,8 +431,12 @@ export class TaskStore {
       delivery: task.delivery !== undefined ? task.delivery : (prev.delivery || 'isolated'),
       provider: task.provider !== undefined ? task.provider : prev.provider,
       model: task.model !== undefined ? task.model : prev.model,
-      notifyTelegram: task.notifyTelegram !== undefined ? Boolean(task.notifyTelegram) : (prev.notifyTelegram || false),
-      onlyOnFailure: task.onlyOnFailure !== undefined ? Boolean(task.onlyOnFailure) : (prev.onlyOnFailure || false),
+      notifyTelegram: task.notifyTelegram !== undefined
+        ? (task.notifyTelegram === null || task.notifyTelegram === 'inherit' ? undefined : Boolean(task.notifyTelegram))
+        : prev.notifyTelegram,
+      onlyOnFailure: task.onlyOnFailure !== undefined
+        ? (task.onlyOnFailure === null || task.onlyOnFailure === 'inherit' ? undefined : Boolean(task.onlyOnFailure))
+        : prev.onlyOnFailure,
       timeoutSeconds: task.timeoutSeconds !== undefined ? Number(task.timeoutSeconds) : (prev.timeoutSeconds || 1800),
       overlapPolicy: task.overlapPolicy !== undefined ? String(task.overlapPolicy) : (prev.overlapPolicy || 'skip'),
       kanbanMode: task.kanbanMode !== undefined ? String(task.kanbanMode) : (prev.kanbanMode || 'none'), // 'none' | 'on_failure' | 'always'

package/lib/task-create.js

@@ -35,8 +35,8 @@ export function executeCreateTask(store, scheduler, args) {
     priority: Number(args.priority) || 5,
     selfHealingCommand: args.selfHealingCommand ? String(args.selfHealingCommand).trim() : '',
     autoDiagnose: Boolean(args.autoDiagnose),
-    notifyTelegram: Boolean(args.notifyTelegram),
-    onlyOnFailure: Boolean(args.onlyOnFailure),
+    notifyTelegram: args.notifyTelegram !== undefined ? Boolean(args.notifyTelegram) : undefined,
+    onlyOnFailure: args.onlyOnFailure !== undefined ? Boolean(args.onlyOnFailure) : undefined,
     timeoutSeconds: Number(args.timeoutSeconds) || 1800,
     overlapPolicy: args.overlapPolicy || 'skip',
     timezone: args.timezone ? String(args.timezone).trim() : '',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cron",
-  "version": "0.2.40",
+  "version": "0.2.42",
   "description": "Background automation runner for DSH: isolated agent runs, script/HTTP/SSH/Docker runtimes, cost guard, notifications, heartbeats.",
   "type": "module",
   "main": "lib/index.js",