@goodandready/dsh-cron 0.2.47 → 0.2.49

package/lib/api.js

@@ -547,7 +547,7 @@ export async function handleExternalTaskRequest({ store, scheduler, req, res, ur
   }
 
   if (req.method === 'POST') {
-    const handled = await handleItemPost({ store, scheduler, req, res, url, id, action, apiToken });
+    const handled = await handleItemPost({ store, scheduler, req, res, url, id, action });
     if (handled) return;
   }
   if (req.method === 'GET' && !action) {

package/lib/channels.js

@@ -153,14 +153,27 @@ export function buildGiteaIssuePayload({ task, runInfo, settings = {} }) {
   const failed = isFailed(runInfo.status);
   const defaultNames = failed ? ['cron', 'bug', 'alert'] : ['cron', 'auto'];
 
-  // Resolve labels to integer IDs per Gitea Swagger (array<int64>) (#224)
-  const mapping = settings.giteaLabelIds || {};
+  // Resolve labels to integer IDs per Gitea Swagger (array<int64>) (#224, #297)
+  let mapping = settings.giteaLabelIds || {};
+  if (typeof mapping === 'string' && mapping.trim().startsWith('{')) {
+    try {
+      mapping = JSON.parse(mapping);
+    } catch (_) {
+      mapping = {};
+    }
+  }
   let candidateIds = [];
 
   if (Array.isArray(task && task.giteaLabelIds)) {
     candidateIds = task.giteaLabelIds;
   } else if (Array.isArray(settings.giteaLabels)) {
     candidateIds = settings.giteaLabels;
+  } else if (typeof settings.giteaLabels === 'string' && settings.giteaLabels.trim()) {
+    candidateIds = settings.giteaLabels.split(',').map((s) => s.trim()).filter(Boolean).map((name) => {
+      const num = Number(name);
+      if (Number.isInteger(num) && num > 0) return num;
+      return typeof mapping === 'object' && mapping !== null ? mapping[name] : undefined;
+    });
   } else if (Array.isArray(settings.giteaLabelIds)) {
     candidateIds = settings.giteaLabelIds;
   } else if (Array.isArray(task && task.labels)) {

package/lib/client.js

@@ -1102,6 +1102,54 @@ window.__ModuleLoader__.load({
       return (typeof t === 'function' ? t : translate)(key, vars);
     }
 
+    /**
+     * Issue #307: universal fetch with AbortController timeout (default 15s).
+     * Connects with caller signal if supplied and fails closed on timeouts.
+     */
+    const fetchWithTimeout = async (url, options = {}, timeoutMs = 15000) => {
+      const controller = typeof AbortController !== 'undefined' ? new AbortController() : null;
+      const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : null;
+      if (options && options.signal && controller) {
+        if (options.signal.aborted) {
+          controller.abort();
+        } else {
+          options.signal.addEventListener('abort', () => controller.abort(), { once: true });
+        }
+      }
+      try {
+        const res = await fetch(url, {
+          ...options,
+          signal: controller ? controller.signal : (options ? options.signal : undefined),
+        });
+        return res;
+      } catch (err) {
+        if (err && (err.name === 'AbortError' || controller?.signal?.aborted)) {
+          const timeoutErr = new Error(`Request timed out after ${Math.round(timeoutMs / 1000)}s`);
+          timeoutErr.isTimeout = true;
+          throw timeoutErr;
+        }
+        throw err;
+      } finally {
+        if (timer) clearTimeout(timer);
+      }
+    };
+
+    /**
+     * Issue #307: universal JSON fetch helper with timeout and aborted body protection.
+     */
+    const fetchJsonWithTimeout = async (url, options = {}, timeoutMs = 15000) => {
+      const res = await fetchWithTimeout(url, options, timeoutMs);
+      let data = {};
+      try {
+        data = await res.json();
+      } catch (jsonErr) {
+        if (jsonErr && jsonErr.name === 'AbortError') {
+          throw jsonErr;
+        }
+      }
+      return { res, data };
+    };
+
     function pickDeliverySettings(source) {
       const out = {};
       for (const key of DELIVERY_SETTING_KEYS.concat(TEMPLATE_SETTING_KEYS)) {
@@ -1391,8 +1439,12 @@ window.__ModuleLoader__.load({
         const gen = ++fetchGenRef.current;
         setLoading(true);
         setFetchError(null);
+        const controller = (typeof AbortController !== 'undefined') ? new AbortController() : null;
+        const timer = controller ? setTimeout(() => controller.abort(), 15000) : null;
         try {
-          const res = await fetch('/dsh-cron/tasks?status=' + encodeURIComponent(tab) + '&query=' + encodeURIComponent(query));
+          const res = await fetch('/dsh-cron/tasks?status=' + encodeURIComponent(tab) + '&query=' + encodeURIComponent(query), {
+            signal: controller ? controller.signal : undefined,
+          });
           const data = await res.json();
           if (gen !== fetchGenRef.current) return;
           if (data && data.ok) {
@@ -1407,6 +1459,7 @@ window.__ModuleLoader__.load({
           console.error('[dsh-cron] fetch tasks error:', err);
           setFetchError(err.message || T_KEY(t, 'list.loadErrorPrefix'));
         } finally {
+          if (timer) clearTimeout(timer);
           if (gen === fetchGenRef.current) {
             setLoading(false);
           }
@@ -1414,9 +1467,11 @@ window.__ModuleLoader__.load({
       };
 
       const loadModels = async (providerName) => {
+        const controller = (typeof AbortController !== 'undefined') ? new AbortController() : null;
+        const timer = controller ? setTimeout(() => controller.abort(), 15000) : null;
         try {
           const url = providerName ? '/dsh-cron/models?provider=' + encodeURIComponent(providerName) : '/dsh-cron/models';
-          const res = await fetch(url);
+          const res = await fetch(url, { signal: controller ? controller.signal : undefined });
           const data = await res.json();
           if (data && data.ok) {
             if (!providerName) {
@@ -1431,6 +1486,8 @@ window.__ModuleLoader__.load({
           }
         } catch (err) {
           console.error('[dsh-cron] load models error:', err);
+        } finally {
+          if (timer) clearTimeout(timer);
         }
       };
 
@@ -1455,6 +1512,7 @@ window.__ModuleLoader__.load({
           const fetchOpts = { headers };
           if (pollController) fetchOpts.signal = pollController.signal;
 
+          const pollTimer = pollController ? setTimeout(() => { try { pollController.abort(); } catch (abortErr) { void abortErr; } }, 15000) : null;
           fetch('/dsh-cron/tasks?status=' + encodeURIComponent(tab) + '&query=' + encodeURIComponent(query), fetchOpts)
             .then(res => {
               if (isDestroyed || pollGen !== fetchGenRef.current) return null;
@@ -1478,6 +1536,7 @@ window.__ModuleLoader__.load({
               if (err && err.name === 'AbortError') return;
             })
             .finally(() => {
+              if (pollTimer) clearTimeout(pollTimer);
               if (isDestroyed) return;
               // Adaptive interval: 30s when tab is hidden, 8s when active (#134)
               const intervalMs = (typeof document !== 'undefined' && document.hidden) ? 30000 : 8000;
@@ -1515,10 +1574,17 @@ window.__ModuleLoader__.load({
       const fetchJsonWithTimeout = async (url, options = {}, timeoutMs = 15000) => {
         const controller = typeof AbortController !== 'undefined' ? new AbortController() : null;
         const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : null;
+        if (options && options.signal && controller) {
+          if (options.signal.aborted) {
+            controller.abort();
+          } else {
+            options.signal.addEventListener('abort', () => controller.abort(), { once: true });
+          }
+        }
         try {
           const res = await fetch(url, {
             ...options,
-            signal: controller ? controller.signal : options.signal,
+            signal: controller ? controller.signal : (options ? options.signal : undefined),
           });
           let data = {};
           try {
@@ -1589,8 +1655,7 @@ window.__ModuleLoader__.load({
       /** #41: duplicate a task; the server copies config, resets run state (#41). */
       const handleDryRun = async (taskId) => {
         try {
-          const res = await fetch('/dsh-cron/tasks/' + encodeURIComponent(taskId) + '/dry-run', { method: 'POST' });
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks/' + encodeURIComponent(taskId) + '/dry-run', { method: 'POST' });
           setDryRunResult(data);
         } catch (err) {
           alert('Dry run error: ' + err.message);
@@ -1603,8 +1668,7 @@ window.__ModuleLoader__.load({
         setArchiveLoading(true);
         setArchiveModalOpen(true);
         try {
-          const res = await fetch('/dsh-cron/tasks/' + encodeURIComponent(task.id) + '/archive?limit=15&offset=' + offset);
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks/' + encodeURIComponent(task.id) + '/archive?limit=15&offset=' + offset);
           if (data.ok) {
             setArchiveRuns(prev => offset === 0 ? (data.runs || []) : [...prev, ...(data.runs || [])]);
             setArchiveTotal(data.total || 0);
@@ -1618,12 +1682,11 @@ window.__ModuleLoader__.load({
 
       const handlePreviewSchedule = async (scheduleExpr) => {
         try {
-          const res = await fetch('/dsh-cron/schedule/preview', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/schedule/preview', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ schedule: scheduleExpr, timezone: formTimezone })
           });
-          const data = await res.json();
           if (data.ok && data.runs) {
             setSchedulePreviewRuns(data.runs);
           } else {
@@ -1636,8 +1699,7 @@ window.__ModuleLoader__.load({
 
       const handleDuplicate = async (task) => {
         try {
-          const res = await fetch('/dsh-cron/tasks/' + encodeURIComponent(task.id) + '/duplicate', { method: 'POST' });
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks/' + encodeURIComponent(task.id) + '/duplicate', { method: 'POST' });
           if (!data.ok) {
             alert(T_KEY(t, 'duplicate.failed', { error: (data && data.error) || '' }));
             return;
@@ -1678,8 +1740,7 @@ window.__ModuleLoader__.load({
           const promptMsg = T_KEY(t, 'transfer.exportPrompt') || 'Choose export mode:\nOK = Sanitized (removes custom env vars & headers)\nCancel = Full raw export';
           const wantSanitized = confirm(promptMsg);
           const exportUrl = '/dsh-cron/tasks/export' + (wantSanitized ? '?sanitize=true' : '');
-          const res = await fetch(exportUrl);
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout(exportUrl);
           if (!data.ok) {
             alert(T_KEY(t, 'transfer.exportFailed', { error: (data && data.error) || '' }));
             return;
@@ -1717,12 +1778,11 @@ window.__ModuleLoader__.load({
             alert(T_KEY(t, 'transfer.badFile', { error: parseErr.message }));
             return;
           }
-          const res = await fetch('/dsh-cron/tasks/import', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks/import', {
             method: 'POST',
             headers: importHeaders(document_),
             body: JSON.stringify({ document: document_, dryRun: true, strategy: importStrategy })
           });
-          const data = await res.json();
           if (!data.ok) {
             alert(T_KEY(t, 'transfer.importFailed', { error: (data && data.error) || '' }));
             return;
@@ -1740,12 +1800,11 @@ window.__ModuleLoader__.load({
         if (!importDoc) return;
         setTransferBusy(true);
         try {
-          const res = await fetch('/dsh-cron/tasks/import', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks/import', {
             method: 'POST',
             headers: importHeaders(importDoc),
             body: JSON.stringify({ document: importDoc, strategy: importStrategy })
           });
-          const data = await res.json();
           if (!data.ok) {
             alert(T_KEY(t, 'transfer.importFailed', { error: (data && data.error) || '' }));
             return;
@@ -1777,12 +1836,11 @@ window.__ModuleLoader__.load({
           'If the change makes the task execute code (script/node/python/ssh/docker), confirm it with me explicitly before applying it.',
         ].filter(Boolean);
         try {
-          const res = await fetch('/dsh-cron/chat/start', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/chat/start', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ prompt: lines.join(String.fromCharCode(10)) })
           });
-          const data = await res.json();
           if (!data.ok || !data.sessionId) {
             alert(T_KEY(t, 'tune.startFailed', { error: (data && data.error) || '' }));
             return;
@@ -1798,7 +1856,7 @@ window.__ModuleLoader__.load({
       const handleDelete = async (id) => {
         if (!confirm(T_KEY(t, 'confirm.delete'))) return;
         try {
-          await fetch('/dsh-cron/tasks/' + encodeURIComponent(id), { method: 'DELETE' });
+          await fetchWithTimeout('/dsh-cron/tasks/' + encodeURIComponent(id), { method: 'DELETE' });
           fetchTasks();
         } catch (err) {
           console.debug('[dsh-cron] delete failed', err);
@@ -1809,8 +1867,7 @@ window.__ModuleLoader__.load({
         setTestStatus(null);
         setSettingsModalOpen(true);
         try {
-          const res = await fetch('/dsh-cron/settings');
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/settings');
           if (data && data.ok && data.settings) {
             setSettingsBotToken(data.settings.botToken || '');
             setSettingsChatId(data.settings.chatId || '');
@@ -1829,7 +1886,7 @@ window.__ModuleLoader__.load({
       const handleSaveSettings = async (e) => {
         e.preventDefault();
         try {
-          const res = await fetch('/dsh-cron/settings', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/settings', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(Object.assign({
@@ -1840,7 +1897,6 @@ window.__ModuleLoader__.load({
               kanbanBaseUrl: settingsKanbanUrl,
             }, settingsDelivery))
           });
-          const data = await res.json();
           if (data && data.ok) {
             setSettingsModalOpen(false);
           } else {
@@ -1881,7 +1937,7 @@ window.__ModuleLoader__.load({
 
       const handleTestTelegram = async () => {        setTestStatus({ loading: true, message: T_KEY(t, 'settings.sending') });
         try {
-          const res = await fetch('/dsh-cron/telegram/test', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/telegram/test', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({
@@ -1889,7 +1945,6 @@ window.__ModuleLoader__.load({
               chatId: settingsChatId
             })
           });
-          const data = await res.json();
           if (data && data.ok) {
             setTestStatus({ loading: false, success: true, message: T_KEY(t, 'settings.testOk') });
           } else {
@@ -1969,8 +2024,7 @@ window.__ModuleLoader__.load({
       const loadTaskHistory = async (taskId) => {
         setHistoryLoading(true);
         try {
-          const res = await fetch('/dsh-cron/tasks/' + encodeURIComponent(taskId) + '/history');
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks/' + encodeURIComponent(taskId) + '/history');
           if (data.ok) {
             setTaskHistory(data.history || []);
           }
@@ -2119,12 +2173,11 @@ window.__ModuleLoader__.load({
             Boolean(payload.preflightCommand && payload.preflightCommand.trim()) ||
             Boolean(payload.selfHealingCommand && payload.selfHealingCommand.trim());
           if (hasCodeExec) headers[SCRIPT_CONFIRM_HEADER] = 'script';
-          const res = await fetch('/dsh-cron/tasks', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks', {
             method: 'POST',
             headers,
             body: JSON.stringify(payload)
           });
-          const data = await res.json();
           if (!data.ok) { alert(data.error || T_KEY(t, 'settings.saveError', { error: '' })); return; }
           setManualModalOpen(false);
           fetchTasks();
@@ -2143,12 +2196,11 @@ window.__ModuleLoader__.load({
 
         setDshLoading(true);
         try {
-          const res = await fetch('/dsh-cron/chat/start', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/chat/start', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ prompt: text })
           });
-          const data = await res.json();
           if (!data.ok || !data.sessionId) {
             alert(T_KEY(t, 'dsh.startFailed', { error: data.error || '' }));
             setDshLoading(false);
@@ -3532,8 +3584,7 @@ window.__ModuleLoader__.load({
       const checkUpdates = async () => {
         setUpdateState(prev => ({ ...prev, checking: true, error: null, notice: null }));
         try {
-          const res = await fetch('/api/dsh-cron/update');
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout('/api/dsh-cron/update');
           if (data && data.currentVersion) {
             setUpdateState(prev => ({
               ...prev,
@@ -3554,11 +3605,10 @@ window.__ModuleLoader__.load({
       const runUpdate = async () => {
         setUpdateState(prev => ({ ...prev, updating: true, error: null, notice: null }));
         try {
-          const res = await fetch('/api/dsh-cron/update', {
+          const { res, data } = await fetchJsonWithTimeout('/api/dsh-cron/update', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json', 'x-dsh-plugin-update': '1' }
           });
-          const data = await res.json();
           if (data && data.updated) {
             setUpdateState(prev => ({
               ...prev,
@@ -3587,9 +3637,8 @@ window.__ModuleLoader__.load({
       React.useEffect(() => {
         let active = true;
         setLoadState('loading');
-        fetch('/dsh-cron/settings')
-          .then(r => r.json())
-          .then(data => {
+        fetchJsonWithTimeout('/dsh-cron/settings')
+          .then(({ data }) => {
             if (!active) return;
             if (data && data.ok && data.settings) {
               setToken(data.settings.botToken || '');
@@ -3615,7 +3664,7 @@ window.__ModuleLoader__.load({
       const saveSettings = async (e) => {
         if (e) e.preventDefault();
         try {
-          const res = await fetch('/dsh-cron/settings', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/settings', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(Object.assign({
@@ -3627,7 +3676,6 @@ window.__ModuleLoader__.load({
               kanbanBaseUrl: kanbanUrl
             }, delivery))
           });
-          const data = await res.json();
           if (data && data.ok) {
             setSaved(true);
             setTimeout(() => setSaved(false), 2500);
@@ -3640,12 +3688,11 @@ window.__ModuleLoader__.load({
       const testTelegram = async () => {
         setTestInfo({ loading: true, message: T_KEY(t, 'settings.sending') });
         try {
-          const res = await fetch('/dsh-cron/telegram/test', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/telegram/test', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ botToken: token, chatId })
           });
-          const data = await res.json();
           if (data && data.ok) {
             setTestInfo({ success: true, message: T_KEY(t, 'settings.testOk') });
           } else {
@@ -3659,12 +3706,11 @@ window.__ModuleLoader__.load({
       const testKanban = async () => {
         setTestInfo({ loading: true, message: T_KEY(t, 'settings.checkingKanban') });
         try {
-          const res = await fetch('/dsh-cron/kanban/test', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/kanban/test', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ kanbanBaseUrl: kanbanUrl })
           });
-          const data = await res.json();
           if (data && data.ok) {
             setTestInfo({ success: true, message: T_KEY(t, 'settings.kanbanOk') });
           } else {
@@ -3971,8 +4017,7 @@ window.__ModuleLoader__.load({
 
     async function loadSidebarJobs(state) {
       try {
-        const res = await fetch('/dsh-cron/tasks?status=active');
-        const data = await res.json();
+        const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks?status=active');
         if (data && data.ok) renderSidebarJobs(state, data.tasks || []);
       } catch (err) {
         console.debug('[dsh-cron] load sidebar jobs failed', err);

package/lib/config-jobs.js

@@ -17,6 +17,7 @@ import { parseScheduleExpression } from './scheduler.js';
 import { unknownChannelIds } from './channels.js';
 import { PATCHABLE_TASK_FIELDS, validateTaskType } from './task-transfer.js';
 import { pickPatchableFields } from './http-utils.js';
+import { logger } from './logger.js';
 
 /** Marker that makes a task owned by the config (#50). */
 export const MANAGED_BY_CONFIG = 'config';
@@ -171,7 +172,7 @@ export function planConfigSync(entries, existingTasks) {
  * Apply the plan: create, update and remove tasks, then arm or pause them.
  * Never throws for a single bad entry — that entry is reported and skipped.
  */
-export function applyConfigSync({ store, scheduler, entries, log = console }) {
+export function applyConfigSync({ store, scheduler, entries, log = logger }) {
   const plan = planConfigSync(entries, store.list({ status: 'all' }));
   for (const warning of plan.warnings) log.warn('[dsh-cron] config jobs: ' + warning);
   for (const entry of plan.skipped) log.error('[dsh-cron] config jobs: skipped: ' + entry.error);

package/lib/cron-tool.js

@@ -3,6 +3,7 @@ import { applyTaskPatch, describeTaskPatch } from './task-patch.js';
 import { isConfigOwned, configOwnedMessage } from './config-jobs.js';
 import { TASK_TYPES } from './runtimes.js';
 import { CHANNEL_IDS } from './channels.js';
+import { redactTaskSecrets } from './http-utils.js';
 
 export const LEGACY_TOOL_NAMES = [
   'cron_create_task',
@@ -394,7 +395,7 @@ export async function executeCronTool(store, scheduler, args = {}) {
         `channels: ${Array.isArray(task.channels) && task.channels.length ? task.channels.join(', ') : '(legacy flags)'}`,
         `prompt: ${String(task.prompt || '').slice(0, 500)}`,
       ].filter(Boolean).join('\n');
-      return { success: true, message: summary, task };
+      return { success: true, message: summary, task: redactTaskSecrets(task) };
     }
 
     case 'update': {
@@ -411,7 +412,7 @@ export async function executeCronTool(store, scheduler, args = {}) {
       return {
         success: true,
         message: `Task "${result.task.title}" updated (${result.task.scheduleText || result.task.schedule}). Changed: ${describeTaskPatch(result.task, result.patch)}`,
-        task: result.task,
+        task: redactTaskSecrets(result.task),
       };
     }
 

package/lib/http-utils.js

@@ -94,15 +94,17 @@ export function isTrustedRequest(req, options = {}) {
 
   const remote = req.socket?.remoteAddress || req.connection?.remoteAddress;
   const hasRemote = Boolean(remote && typeof remote === 'string');
-  const isLoopback = !hasRemote || isLoopbackAddress(remote);
+  const isLoopback = Boolean(hasRemote && isLoopbackAddress(remote));
 
   const token = extractBearerToken(req);
   const expectedToken = options.apiToken || process.env.DSH_AUTH_TOKEN || process.env.DSH_TOKEN;
   const isTokenAuthenticated = Boolean(expectedToken && token && token === expectedToken);
 
-  // 1. Non-loopback remote addresses require explicit token authentication (#86)
-  if (hasRemote && !isLoopback && !isTokenAuthenticated) {
-    return false;
+  // 1. Non-loopback socket callers (or callers with missing remoteAddress) require explicit token authentication (#86, #295)
+  if (req.socket || req.connection || hasRemote) {
+    if (!isLoopback && !isTokenAuthenticated) {
+      return false;
+    }
   }
 
   // 2. Validate Origin header if present: cannot be null, must match Host
@@ -178,7 +180,13 @@ export async function readBody(req, res) {
  */
 export function redactTaskSecrets(task) {
   if (!task || typeof task !== 'object') return task;
-  const clone = { ...task };
+  // Issue #310 / GH #5: sanitize to lossless JSON by omitting any undefined properties
+  const clone = {};
+  for (const [k, v] of Object.entries(task)) {
+    if (v !== undefined) {
+      clone[k] = v;
+    }
+  }
 
   if (clone.env && typeof clone.env === 'object') {
     const redactedEnv = {};

package/lib/index.js

@@ -117,22 +117,20 @@ export {
   LEGACY_ACTION_MAP,
 };
 const pkgUrl = new URL('../package.json', import.meta.url);
-// Helper to access configuration safely in native Cordis Context without throwing missing-inject error (#235)
-function getContextConfig(ctx, rawConfig) {
+// Helper to access configuration safely in native Cordis Context without throwing missing-inject error (#235, #288)
+export function getContextConfig(ctx, rawConfig) {
   try {
     if (ctx && ctx.fiber && ctx.fiber.config) return ctx.fiber.config;
     if (ctx && ctx.scope && ctx.scope.config) return ctx.scope.config;
     if (ctx && ctx.runtime && ctx.runtime.config) return ctx.runtime.config;
-    if (ctx && typeof ctx === 'object' && 'config' in ctx) {
-      try {
-        const c = ctx.config;
-        if (c) return c;
-      } catch (err) {
-        // Ignore missing inject error on native Cordis Context (#235)
-      }
+    // In plain/mock contexts without fiber/scope, safely attempt reading config
+    try {
+      if (ctx && ctx.config) return ctx.config;
+    } catch (_) {
+      // Ignored if ctx is a Cordis proxy throwing without inject (#235, #288)
     }
   } catch (err) {
-    // Ignore context access error and fall back to rawConfig (#235)
+    // Ignore context access error and fall back to rawConfig (#235, #288)
   }
   return rawConfig || {};
 }
@@ -199,7 +197,7 @@ export function apply(ctx, rawConfig) {
   // A broken entry is reported and skipped, never fatal.
   try {
     const configJobs = Array.isArray(config && config.jobs) ? config.jobs : [];
-    const summary = applyConfigSync({ store, scheduler, entries: configJobs });
+    const summary = applyConfigSync({ store, scheduler, entries: configJobs, log: logger });
     logger.info('[dsh-cron] config jobs synced: ' + JSON.stringify(summary));
   } catch (err) {
     logger.error('[dsh-cron] config job sync failed:', err.message);
@@ -253,7 +251,7 @@ export function apply(ctx, rawConfig) {
       }
       const current = store.getSettings();
       const patch = {};
-      for (const k of ['maxConcurrent', 'defaultTimezone', 'heartbeatUrl', 'heartbeatIntervalSec', 'llmActionsEnabled']) {
+      for (const k of SETTINGS_SYNC_KEYS) {
         if (unwrapped[k] !== undefined && unwrapped[k] !== current[k]) {
           patch[k] = unwrapped[k];
         }
@@ -295,7 +293,6 @@ export function apply(ctx, rawConfig) {
   registerRoutes(ctx, {
     store,
     scheduler,
-    getCronSettingsScope: () => settingsService,
     recommendations,
   });
 
@@ -311,7 +308,7 @@ export function apply(ctx, rawConfig) {
             ...activeVolatileConfig,
           };
           const clientSettings = store.getClientSettings();
-          for (const k of ['maxConcurrent', 'defaultTimezone', 'heartbeatUrl', 'heartbeatIntervalSec', 'llmActionsEnabled']) {
+          for (const k of SETTINGS_SYNC_KEYS) {
             if (unwrapped[k] !== undefined) {
               clientSettings[k] = unwrapped[k];
             }

package/lib/routes.js

@@ -10,7 +10,7 @@ import { sendTelegramMessage, createTelegramTaskKeyboard } from './telegram.js';
 import { createKanbanCard } from './integrations.js';
 import { sanitizeSettingsPayload, applySettingsToScope } from './settings.js';
 
-export function registerRoutes(ctx, { store, scheduler, getCronSettingsScope, recommendations }) {
+export function registerRoutes(ctx, { store, scheduler, recommendations }) {
   // handler per route family; registered WITHOUT the trailing slash (#96)
   ctx.effect(() => ctx.webServer.register({
     kind: 'prefix',

package/lib/runtimes.js

@@ -124,8 +124,6 @@ export function buildSshInvocation(task) {
   return { file: 'ssh', args };
 }
 
-export const DOCKER_HOST_ENV_ALLOWLIST = ['TZ', 'LANG', 'LC_ALL'];
-
 /** #8/#226: build Docker run invocation without leaking host process secrets into container. */
 export function buildDockerInvocation(task, explicitEnv) {
   const image = String(task.dockerImage || '').trim();

package/lib/scheduler-execution.js

@@ -40,15 +40,17 @@ export async function executePreflight(task) {
   }
 
   if (type === 'http') {
+    let timeout;
     try {
       const controller = new AbortController();
-      const timeout = setTimeout(() => controller.abort(), 5000);
+      timeout = setTimeout(() => controller.abort(), 5000);
       const res = await fetch(target, { signal: controller.signal });
-      clearTimeout(timeout);
       if (res.ok) return { ok: true };
       return { ok: false, reason: `HTTP check returned status ${res.status}` };
     } catch (err) {
       return { ok: false, reason: `HTTP check failed: ${err.message}` };
+    } finally {
+      if (timeout) clearTimeout(timeout);
     }
   }
 
@@ -595,7 +597,7 @@ export async function handleCompleteRun(scheduler, task, taskId, currentRun, out
   const guard = await checkAndApplyBurnGuard(scheduler, taskId, outcome);
   if (guard && guard.exceeded) return;
 
-  while (!scheduler.isStopped && scheduler.queue.length > 0 && (scheduler.maxConcurrent === 0 || scheduler.running.size < scheduler.maxConcurrent)) {
+  if (!scheduler.isStopped && scheduler.queue.length > 0 && (scheduler.maxConcurrent === 0 || scheduler.running.size < scheduler.maxConcurrent)) {
     let admittedIndex = -1;
     for (let i = 0; i < scheduler.queue.length; i++) {
       const candidate = scheduler.queue[i];
@@ -619,17 +621,16 @@ export async function handleCompleteRun(scheduler, task, taskId, currentRun, out
       break;
     }
 
-    if (admittedIndex === -1) break;
-
-    const nextItem = scheduler.queue.splice(admittedIndex, 1)[0];
-    setImmediate(() => {
-      if (!scheduler.isStopped) {
-        scheduler.runTask(nextItem.taskId, nextItem.options || {}).catch((runErr) => {
-          bestEffort('drain-queued-task', () => {}, scheduler.logger);
-        });
-      }
-    });
-    break;
+    if (admittedIndex !== -1) {
+      const nextItem = scheduler.queue.splice(admittedIndex, 1)[0];
+      setImmediate(() => {
+        if (!scheduler.isStopped) {
+          scheduler.runTask(nextItem.taskId, nextItem.options || {}).catch((runErr) => {
+            bestEffort('drain-queued-task', () => {}, scheduler.logger);
+          });
+        }
+      });
+    }
   }
 
   // 1. Structured LLM Actions (#137)

package/lib/scheduler.js

@@ -140,15 +140,17 @@ function parseIntervalExpression(str) {
     if (num >= 60) {
       if (num % 60 === 0) {
         const hours = num / 60;
-        if (hours >= 24 && hours % 24 === 0) {
-          const days = hours / 24;
-          if (days > 31) {
-            throw new Error(`Invalid interval: minute interval "${num}m" (${days} days) exceeds 31 days`);
+        if (hours >= 24) {
+          if (hours % 24 === 0) {
+            const days = hours / 24;
+            if (days > 31) {
+              throw new Error(`Invalid interval: minute interval "${num}m" (${days} days) exceeds 31 days`);
+            }
+            pattern = `0 0 */${days} * *`;
+            humanText = `Every ${days} days`;
+          } else {
+            throw new Error(`Invalid interval: minute interval "${num}m" (${hours} hours) cannot be expressed as a cron step`);
           }
-          pattern = `0 0 */${days} * *`;
-          humanText = `Every ${days} days`;
-        } else if (hours > 23) {
-          throw new Error(`Invalid interval: minute interval "${num}m" (${hours} hours) cannot be expressed as a cron step`);
         } else {
           pattern = `0 */${hours} * * *`;
           humanText = `Every ${hours} hours`;

package/lib/settings.js

@@ -44,6 +44,8 @@ export const Config = z.object({
   giteaBaseUrl: z.string().default('').description('Gitea base URL for alert issues').volatile(),
   giteaRepo: z.string().default('').description('Gitea repository (owner/name) for alert issues').volatile(),
   giteaTokenRef: z.string().default('').description('Credential name for the Gitea API token').volatile(),
+  giteaLabels: z.any().default([]).description('Gitea label names or IDs for alert issues').volatile(),
+  giteaLabelIds: z.any().default({}).description('Mapping of label name to integer ID for Gitea issues').volatile(),
   prReviewerEnabled: z.boolean().default(false).description('Enable automated PR Reviewer scheduled agent (#33)').volatile(),
   // --- Declarative jobs (#50, ADR-0001) ---
   jobs: z.array(z.any()).default([]).description('Static jobs owned by the config; each entry needs id, title, schedule and (for agent types) prompt'),
@@ -79,7 +81,7 @@ export const SETTINGS_SYNC_KEYS = [
   'pushplusTokenRef',
   'pushplusUrl',
   'ttsBaseUrl',
-  'giteaBaseUrl', 'giteaRepo', 'giteaTokenRef', 'prReviewerEnabled',
+  'giteaBaseUrl', 'giteaRepo', 'giteaTokenRef', 'giteaLabels', 'giteaLabelIds', 'prReviewerEnabled',
   'apiToken',
 ];
 

package/lib/store.js

@@ -555,8 +555,8 @@ export class TaskStore {
       type: task.type !== undefined ? task.type : (prev.type || 'llm'),
       status: task.status !== undefined ? task.status : (prev.status || 'active'),
       delivery: task.delivery !== undefined ? task.delivery : (prev.delivery || 'isolated'),
-      provider: task.provider !== undefined ? task.provider : prev.provider,
-      model: task.model !== undefined ? task.model : prev.model,
+      provider: task.provider !== undefined ? task.provider : (prev.provider || null),
+      model: task.model !== undefined ? task.model : (prev.model || null),
       notifyTelegram: task.notifyTelegram !== undefined
         ? (task.notifyTelegram === null || task.notifyTelegram === 'inherit' ? undefined : Boolean(task.notifyTelegram))
         : prev.notifyTelegram,
@@ -591,6 +591,12 @@ export class TaskStore {
       lastDurationMs: task.lastDurationMs !== undefined ? task.lastDurationMs : (prev.lastDurationMs || 0),
       nextRunAt: task.nextRunAt !== undefined ? task.nextRunAt : (prev.nextRunAt || null),
     };
+    // Issue #310 / GH #5: strip any undefined properties to guarantee lossless JSON
+    for (const key of Object.keys(record)) {
+      if (record[key] === undefined) {
+        delete record[key];
+      }
+    }
     this.tasks.set(id, record);
     try {
       this.save();

package/lib/task-create.js

@@ -2,13 +2,14 @@ import { normalizeTaskType } from './runtimes.js';
 import { validateTaskType } from './task-transfer.js';
 import { parseScheduleExpression } from './scheduler.js';
 import { CHANNEL_IDS } from './channels.js';
+import { redactTaskSecrets } from './http-utils.js';
 
 export function executeCreateTask(store, scheduler, args) {
   const taskType = normalizeTaskType(args.type);
   const typeError = validateTaskType(taskType, args);
   if (typeError) throw new Error(typeError);
   const parsed = parseScheduleExpression(args.schedule);
-  const task = store.set({
+  const taskData = {
     title: args.title,
     schedule: parsed.cronPattern || args.schedule,
     scheduleText: parsed.humanText,
@@ -71,12 +72,19 @@ export function executeCreateTask(store, scheduler, args) {
     costLimitUsd: Number(args.costLimitUsd) > 0 ? Number(args.costLimitUsd) : undefined,
     dailyCostLimitUsd: Number(args.dailyCostLimitUsd) > 0 ? Number(args.dailyCostLimitUsd) : undefined,
     tokenLimit: Number(args.tokenLimit) > 0 ? Number(args.tokenLimit) : undefined,
-  });
+  };
+  // Issue #310 / GH #5: strip any undefined properties before store.set()
+  for (const k of Object.keys(taskData)) {
+    if (taskData[k] === undefined) {
+      delete taskData[k];
+    }
+  }
+  const task = store.set(taskData);
   scheduler.scheduleTask(task);
   return {
     success: true,
     message: `Task "${task.title}" scheduled successfully (${task.scheduleText})`,
-    task
+    task: redactTaskSecrets(task),
   };
 }
 

package/lib/task-patch.js

@@ -22,23 +22,27 @@ export function isCodeTypeSwitch(current, nextType) {
   return CODE_EXECUTING_TYPES.includes(target) && !CODE_EXECUTING_TYPES.includes(current.type);
 }
 
-/** True when a patch introduces code-executing type or shell hooks (#212). */
+/** True when a patch introduces code-executing type or shell hooks (#212, #296). */
 export function isCodeExecutionIntroduced(current, body) {
   if (!current || !body) return false;
   if (body.type !== undefined && isCodeTypeSwitch(current, body.type)) return true;
 
-  const hadPreflight = Boolean(current.preflightCommand && String(current.preflightCommand).trim()) || current.preflightType === 'command' || current.preflightType === 'shell';
-  const hasPreflight = Boolean(body.preflightCommand && String(body.preflightCommand).trim()) || body.preflightType === 'command' || body.preflightType === 'shell';
+  const isShellPreflight = (t) => t === 'command' || t === 'shell';
+  const currentPreflightType = current.preflightType || 'none';
+  const nextPreflightType = body.preflightType !== undefined ? body.preflightType : currentPreflightType;
+
+  const currentPreflightTarget = current.preflightTarget || current.preflightCommand || '';
+  const bodyPreflightTarget = body.preflightTarget !== undefined ? body.preflightTarget : (body.preflightCommand !== undefined ? body.preflightCommand : '');
+  const nextPreflightTarget = (body.preflightTarget !== undefined || body.preflightCommand !== undefined) ? bodyPreflightTarget : currentPreflightTarget;
+
+  const hadPreflight = isShellPreflight(currentPreflightType) && Boolean(String(currentPreflightTarget).trim());
+  const hasPreflight = isShellPreflight(nextPreflightType) && Boolean(String(nextPreflightTarget).trim());
   if (hasPreflight && !hadPreflight) return true;
 
   const hadSelfHealing = Boolean(current.selfHealingCommand && String(current.selfHealingCommand).trim());
   const hasSelfHealing = Boolean(body.selfHealingCommand && String(body.selfHealingCommand).trim());
   if (hasSelfHealing && !hadSelfHealing) return true;
 
-  const hadCommand = Boolean(current.command && String(current.command).trim());
-  const hasCommand = Boolean(body.command && String(body.command).trim());
-  if (hasCommand && !hadCommand && !CODE_EXECUTING_TYPES.includes(current.type)) return true;
-
   return false;
 }
 
@@ -76,7 +80,7 @@ export function buildTaskPatch(current, body) {
       patch.oneShot = Boolean(parsed.isOneShot || (body && body.oneShot));
       if (scheduleChanged) {
         patch.nextRunAt = parsed.isOneShot ? parsed.targetTimestamp : (parsed.nextRun || null);
-        patch.targetTimestamp = parsed.isOneShot ? parsed.targetTimestamp : undefined;
+        patch.targetTimestamp = parsed.isOneShot ? parsed.targetTimestamp : null;
       }
     } catch (err) {
       return { ok: false, error: err.message };
@@ -91,6 +95,12 @@ export function buildTaskPatch(current, body) {
   if (patch.tokenLimit !== undefined) {
     patch.tokenLimit = patch.tokenLimit === null ? null : (Number(patch.tokenLimit) > 0 ? Number(patch.tokenLimit) : null);
   }
+  // Issue #310 / GH #5: strip undefined properties from patch
+  for (const k of Object.keys(patch)) {
+    if (patch[k] === undefined) {
+      delete patch[k];
+    }
+  }
   return { ok: true, patch };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cron",
-  "version": "0.2.47",
+  "version": "0.2.49",
   "description": "Background automation runner for DSH: isolated agent runs, script/HTTP/SSH/Docker runtimes, cost guard, notifications, heartbeats.",
   "type": "module",
   "main": "lib/index.js",