@goodandready/dsh-cron 0.2.48 → 0.2.49

package/lib/client.js

@@ -1102,6 +1102,54 @@ window.__ModuleLoader__.load({
       return (typeof t === 'function' ? t : translate)(key, vars);
     }
 
+    /**
+     * Issue #307: universal fetch with AbortController timeout (default 15s).
+     * Connects with caller signal if supplied and fails closed on timeouts.
+     */
+    const fetchWithTimeout = async (url, options = {}, timeoutMs = 15000) => {
+      const controller = typeof AbortController !== 'undefined' ? new AbortController() : null;
+      const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : null;
+      if (options && options.signal && controller) {
+        if (options.signal.aborted) {
+          controller.abort();
+        } else {
+          options.signal.addEventListener('abort', () => controller.abort(), { once: true });
+        }
+      }
+      try {
+        const res = await fetch(url, {
+          ...options,
+          signal: controller ? controller.signal : (options ? options.signal : undefined),
+        });
+        return res;
+      } catch (err) {
+        if (err && (err.name === 'AbortError' || controller?.signal?.aborted)) {
+          const timeoutErr = new Error(`Request timed out after ${Math.round(timeoutMs / 1000)}s`);
+          timeoutErr.isTimeout = true;
+          throw timeoutErr;
+        }
+        throw err;
+      } finally {
+        if (timer) clearTimeout(timer);
+      }
+    };
+
+    /**
+     * Issue #307: universal JSON fetch helper with timeout and aborted body protection.
+     */
+    const fetchJsonWithTimeout = async (url, options = {}, timeoutMs = 15000) => {
+      const res = await fetchWithTimeout(url, options, timeoutMs);
+      let data = {};
+      try {
+        data = await res.json();
+      } catch (jsonErr) {
+        if (jsonErr && jsonErr.name === 'AbortError') {
+          throw jsonErr;
+        }
+      }
+      return { res, data };
+    };
+
     function pickDeliverySettings(source) {
       const out = {};
       for (const key of DELIVERY_SETTING_KEYS.concat(TEMPLATE_SETTING_KEYS)) {
@@ -1391,8 +1439,12 @@ window.__ModuleLoader__.load({
         const gen = ++fetchGenRef.current;
         setLoading(true);
         setFetchError(null);
+        const controller = (typeof AbortController !== 'undefined') ? new AbortController() : null;
+        const timer = controller ? setTimeout(() => controller.abort(), 15000) : null;
         try {
-          const res = await fetch('/dsh-cron/tasks?status=' + encodeURIComponent(tab) + '&query=' + encodeURIComponent(query));
+          const res = await fetch('/dsh-cron/tasks?status=' + encodeURIComponent(tab) + '&query=' + encodeURIComponent(query), {
+            signal: controller ? controller.signal : undefined,
+          });
           const data = await res.json();
           if (gen !== fetchGenRef.current) return;
           if (data && data.ok) {
@@ -1407,6 +1459,7 @@ window.__ModuleLoader__.load({
           console.error('[dsh-cron] fetch tasks error:', err);
           setFetchError(err.message || T_KEY(t, 'list.loadErrorPrefix'));
         } finally {
+          if (timer) clearTimeout(timer);
           if (gen === fetchGenRef.current) {
             setLoading(false);
           }
@@ -1414,9 +1467,11 @@ window.__ModuleLoader__.load({
       };
 
       const loadModels = async (providerName) => {
+        const controller = (typeof AbortController !== 'undefined') ? new AbortController() : null;
+        const timer = controller ? setTimeout(() => controller.abort(), 15000) : null;
         try {
           const url = providerName ? '/dsh-cron/models?provider=' + encodeURIComponent(providerName) : '/dsh-cron/models';
-          const res = await fetch(url);
+          const res = await fetch(url, { signal: controller ? controller.signal : undefined });
           const data = await res.json();
           if (data && data.ok) {
             if (!providerName) {
@@ -1431,6 +1486,8 @@ window.__ModuleLoader__.load({
           }
         } catch (err) {
           console.error('[dsh-cron] load models error:', err);
+        } finally {
+          if (timer) clearTimeout(timer);
         }
       };
 
@@ -1455,6 +1512,7 @@ window.__ModuleLoader__.load({
           const fetchOpts = { headers };
           if (pollController) fetchOpts.signal = pollController.signal;
 
+          const pollTimer = pollController ? setTimeout(() => { try { pollController.abort(); } catch (abortErr) { void abortErr; } }, 15000) : null;
           fetch('/dsh-cron/tasks?status=' + encodeURIComponent(tab) + '&query=' + encodeURIComponent(query), fetchOpts)
             .then(res => {
               if (isDestroyed || pollGen !== fetchGenRef.current) return null;
@@ -1478,6 +1536,7 @@ window.__ModuleLoader__.load({
               if (err && err.name === 'AbortError') return;
             })
             .finally(() => {
+              if (pollTimer) clearTimeout(pollTimer);
               if (isDestroyed) return;
               // Adaptive interval: 30s when tab is hidden, 8s when active (#134)
               const intervalMs = (typeof document !== 'undefined' && document.hidden) ? 30000 : 8000;
@@ -1515,10 +1574,17 @@ window.__ModuleLoader__.load({
       const fetchJsonWithTimeout = async (url, options = {}, timeoutMs = 15000) => {
         const controller = typeof AbortController !== 'undefined' ? new AbortController() : null;
         const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : null;
+        if (options && options.signal && controller) {
+          if (options.signal.aborted) {
+            controller.abort();
+          } else {
+            options.signal.addEventListener('abort', () => controller.abort(), { once: true });
+          }
+        }
         try {
           const res = await fetch(url, {
             ...options,
-            signal: controller ? controller.signal : options.signal,
+            signal: controller ? controller.signal : (options ? options.signal : undefined),
           });
           let data = {};
           try {
@@ -1589,8 +1655,7 @@ window.__ModuleLoader__.load({
       /** #41: duplicate a task; the server copies config, resets run state (#41). */
       const handleDryRun = async (taskId) => {
         try {
-          const res = await fetch('/dsh-cron/tasks/' + encodeURIComponent(taskId) + '/dry-run', { method: 'POST' });
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks/' + encodeURIComponent(taskId) + '/dry-run', { method: 'POST' });
           setDryRunResult(data);
         } catch (err) {
           alert('Dry run error: ' + err.message);
@@ -1603,8 +1668,7 @@ window.__ModuleLoader__.load({
         setArchiveLoading(true);
         setArchiveModalOpen(true);
         try {
-          const res = await fetch('/dsh-cron/tasks/' + encodeURIComponent(task.id) + '/archive?limit=15&offset=' + offset);
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks/' + encodeURIComponent(task.id) + '/archive?limit=15&offset=' + offset);
           if (data.ok) {
             setArchiveRuns(prev => offset === 0 ? (data.runs || []) : [...prev, ...(data.runs || [])]);
             setArchiveTotal(data.total || 0);
@@ -1618,12 +1682,11 @@ window.__ModuleLoader__.load({
 
       const handlePreviewSchedule = async (scheduleExpr) => {
         try {
-          const res = await fetch('/dsh-cron/schedule/preview', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/schedule/preview', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ schedule: scheduleExpr, timezone: formTimezone })
           });
-          const data = await res.json();
           if (data.ok && data.runs) {
             setSchedulePreviewRuns(data.runs);
           } else {
@@ -1636,8 +1699,7 @@ window.__ModuleLoader__.load({
 
       const handleDuplicate = async (task) => {
         try {
-          const res = await fetch('/dsh-cron/tasks/' + encodeURIComponent(task.id) + '/duplicate', { method: 'POST' });
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks/' + encodeURIComponent(task.id) + '/duplicate', { method: 'POST' });
           if (!data.ok) {
             alert(T_KEY(t, 'duplicate.failed', { error: (data && data.error) || '' }));
             return;
@@ -1678,8 +1740,7 @@ window.__ModuleLoader__.load({
           const promptMsg = T_KEY(t, 'transfer.exportPrompt') || 'Choose export mode:\nOK = Sanitized (removes custom env vars & headers)\nCancel = Full raw export';
           const wantSanitized = confirm(promptMsg);
           const exportUrl = '/dsh-cron/tasks/export' + (wantSanitized ? '?sanitize=true' : '');
-          const res = await fetch(exportUrl);
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout(exportUrl);
           if (!data.ok) {
             alert(T_KEY(t, 'transfer.exportFailed', { error: (data && data.error) || '' }));
             return;
@@ -1717,12 +1778,11 @@ window.__ModuleLoader__.load({
             alert(T_KEY(t, 'transfer.badFile', { error: parseErr.message }));
             return;
           }
-          const res = await fetch('/dsh-cron/tasks/import', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks/import', {
             method: 'POST',
             headers: importHeaders(document_),
             body: JSON.stringify({ document: document_, dryRun: true, strategy: importStrategy })
           });
-          const data = await res.json();
           if (!data.ok) {
             alert(T_KEY(t, 'transfer.importFailed', { error: (data && data.error) || '' }));
             return;
@@ -1740,12 +1800,11 @@ window.__ModuleLoader__.load({
         if (!importDoc) return;
         setTransferBusy(true);
         try {
-          const res = await fetch('/dsh-cron/tasks/import', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks/import', {
             method: 'POST',
             headers: importHeaders(importDoc),
             body: JSON.stringify({ document: importDoc, strategy: importStrategy })
           });
-          const data = await res.json();
           if (!data.ok) {
             alert(T_KEY(t, 'transfer.importFailed', { error: (data && data.error) || '' }));
             return;
@@ -1777,12 +1836,11 @@ window.__ModuleLoader__.load({
           'If the change makes the task execute code (script/node/python/ssh/docker), confirm it with me explicitly before applying it.',
         ].filter(Boolean);
         try {
-          const res = await fetch('/dsh-cron/chat/start', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/chat/start', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ prompt: lines.join(String.fromCharCode(10)) })
           });
-          const data = await res.json();
           if (!data.ok || !data.sessionId) {
             alert(T_KEY(t, 'tune.startFailed', { error: (data && data.error) || '' }));
             return;
@@ -1798,7 +1856,7 @@ window.__ModuleLoader__.load({
       const handleDelete = async (id) => {
         if (!confirm(T_KEY(t, 'confirm.delete'))) return;
         try {
-          await fetch('/dsh-cron/tasks/' + encodeURIComponent(id), { method: 'DELETE' });
+          await fetchWithTimeout('/dsh-cron/tasks/' + encodeURIComponent(id), { method: 'DELETE' });
           fetchTasks();
         } catch (err) {
           console.debug('[dsh-cron] delete failed', err);
@@ -1809,8 +1867,7 @@ window.__ModuleLoader__.load({
         setTestStatus(null);
         setSettingsModalOpen(true);
         try {
-          const res = await fetch('/dsh-cron/settings');
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/settings');
           if (data && data.ok && data.settings) {
             setSettingsBotToken(data.settings.botToken || '');
             setSettingsChatId(data.settings.chatId || '');
@@ -1829,7 +1886,7 @@ window.__ModuleLoader__.load({
       const handleSaveSettings = async (e) => {
         e.preventDefault();
         try {
-          const res = await fetch('/dsh-cron/settings', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/settings', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(Object.assign({
@@ -1840,7 +1897,6 @@ window.__ModuleLoader__.load({
               kanbanBaseUrl: settingsKanbanUrl,
             }, settingsDelivery))
           });
-          const data = await res.json();
           if (data && data.ok) {
             setSettingsModalOpen(false);
           } else {
@@ -1881,7 +1937,7 @@ window.__ModuleLoader__.load({
 
       const handleTestTelegram = async () => {        setTestStatus({ loading: true, message: T_KEY(t, 'settings.sending') });
         try {
-          const res = await fetch('/dsh-cron/telegram/test', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/telegram/test', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({
@@ -1889,7 +1945,6 @@ window.__ModuleLoader__.load({
               chatId: settingsChatId
             })
           });
-          const data = await res.json();
           if (data && data.ok) {
             setTestStatus({ loading: false, success: true, message: T_KEY(t, 'settings.testOk') });
           } else {
@@ -1969,8 +2024,7 @@ window.__ModuleLoader__.load({
       const loadTaskHistory = async (taskId) => {
         setHistoryLoading(true);
         try {
-          const res = await fetch('/dsh-cron/tasks/' + encodeURIComponent(taskId) + '/history');
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks/' + encodeURIComponent(taskId) + '/history');
           if (data.ok) {
             setTaskHistory(data.history || []);
           }
@@ -2119,12 +2173,11 @@ window.__ModuleLoader__.load({
             Boolean(payload.preflightCommand && payload.preflightCommand.trim()) ||
             Boolean(payload.selfHealingCommand && payload.selfHealingCommand.trim());
           if (hasCodeExec) headers[SCRIPT_CONFIRM_HEADER] = 'script';
-          const res = await fetch('/dsh-cron/tasks', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks', {
             method: 'POST',
             headers,
             body: JSON.stringify(payload)
           });
-          const data = await res.json();
           if (!data.ok) { alert(data.error || T_KEY(t, 'settings.saveError', { error: '' })); return; }
           setManualModalOpen(false);
           fetchTasks();
@@ -2143,12 +2196,11 @@ window.__ModuleLoader__.load({
 
         setDshLoading(true);
         try {
-          const res = await fetch('/dsh-cron/chat/start', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/chat/start', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ prompt: text })
           });
-          const data = await res.json();
           if (!data.ok || !data.sessionId) {
             alert(T_KEY(t, 'dsh.startFailed', { error: data.error || '' }));
             setDshLoading(false);
@@ -3532,8 +3584,7 @@ window.__ModuleLoader__.load({
       const checkUpdates = async () => {
         setUpdateState(prev => ({ ...prev, checking: true, error: null, notice: null }));
         try {
-          const res = await fetch('/api/dsh-cron/update');
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout('/api/dsh-cron/update');
           if (data && data.currentVersion) {
             setUpdateState(prev => ({
               ...prev,
@@ -3554,11 +3605,10 @@ window.__ModuleLoader__.load({
       const runUpdate = async () => {
         setUpdateState(prev => ({ ...prev, updating: true, error: null, notice: null }));
         try {
-          const res = await fetch('/api/dsh-cron/update', {
+          const { res, data } = await fetchJsonWithTimeout('/api/dsh-cron/update', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json', 'x-dsh-plugin-update': '1' }
           });
-          const data = await res.json();
           if (data && data.updated) {
             setUpdateState(prev => ({
               ...prev,
@@ -3587,9 +3637,8 @@ window.__ModuleLoader__.load({
       React.useEffect(() => {
         let active = true;
         setLoadState('loading');
-        fetch('/dsh-cron/settings')
-          .then(r => r.json())
-          .then(data => {
+        fetchJsonWithTimeout('/dsh-cron/settings')
+          .then(({ data }) => {
             if (!active) return;
             if (data && data.ok && data.settings) {
               setToken(data.settings.botToken || '');
@@ -3615,7 +3664,7 @@ window.__ModuleLoader__.load({
       const saveSettings = async (e) => {
         if (e) e.preventDefault();
         try {
-          const res = await fetch('/dsh-cron/settings', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/settings', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(Object.assign({
@@ -3627,7 +3676,6 @@ window.__ModuleLoader__.load({
               kanbanBaseUrl: kanbanUrl
             }, delivery))
           });
-          const data = await res.json();
           if (data && data.ok) {
             setSaved(true);
             setTimeout(() => setSaved(false), 2500);
@@ -3640,12 +3688,11 @@ window.__ModuleLoader__.load({
       const testTelegram = async () => {
         setTestInfo({ loading: true, message: T_KEY(t, 'settings.sending') });
         try {
-          const res = await fetch('/dsh-cron/telegram/test', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/telegram/test', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ botToken: token, chatId })
           });
-          const data = await res.json();
           if (data && data.ok) {
             setTestInfo({ success: true, message: T_KEY(t, 'settings.testOk') });
           } else {
@@ -3659,12 +3706,11 @@ window.__ModuleLoader__.load({
       const testKanban = async () => {
         setTestInfo({ loading: true, message: T_KEY(t, 'settings.checkingKanban') });
         try {
-          const res = await fetch('/dsh-cron/kanban/test', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/kanban/test', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ kanbanBaseUrl: kanbanUrl })
           });
-          const data = await res.json();
           if (data && data.ok) {
             setTestInfo({ success: true, message: T_KEY(t, 'settings.kanbanOk') });
           } else {
@@ -3971,8 +4017,7 @@ window.__ModuleLoader__.load({
 
     async function loadSidebarJobs(state) {
       try {
-        const res = await fetch('/dsh-cron/tasks?status=active');
-        const data = await res.json();
+        const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks?status=active');
         if (data && data.ok) renderSidebarJobs(state, data.tasks || []);
       } catch (err) {
         console.debug('[dsh-cron] load sidebar jobs failed', err);

package/lib/http-utils.js

@@ -180,7 +180,13 @@ export async function readBody(req, res) {
  */
 export function redactTaskSecrets(task) {
   if (!task || typeof task !== 'object') return task;
-  const clone = { ...task };
+  // Issue #310 / GH #5: sanitize to lossless JSON by omitting any undefined properties
+  const clone = {};
+  for (const [k, v] of Object.entries(task)) {
+    if (v !== undefined) {
+      clone[k] = v;
+    }
+  }
 
   if (clone.env && typeof clone.env === 'object') {
     const redactedEnv = {};

package/lib/runtimes.js

@@ -124,8 +124,6 @@ export function buildSshInvocation(task) {
   return { file: 'ssh', args };
 }
 
-export const DOCKER_HOST_ENV_ALLOWLIST = ['TZ', 'LANG', 'LC_ALL'];
-
 /** #8/#226: build Docker run invocation without leaking host process secrets into container. */
 export function buildDockerInvocation(task, explicitEnv) {
   const image = String(task.dockerImage || '').trim();

package/lib/store.js

@@ -555,8 +555,8 @@ export class TaskStore {
       type: task.type !== undefined ? task.type : (prev.type || 'llm'),
       status: task.status !== undefined ? task.status : (prev.status || 'active'),
       delivery: task.delivery !== undefined ? task.delivery : (prev.delivery || 'isolated'),
-      provider: task.provider !== undefined ? task.provider : prev.provider,
-      model: task.model !== undefined ? task.model : prev.model,
+      provider: task.provider !== undefined ? task.provider : (prev.provider || null),
+      model: task.model !== undefined ? task.model : (prev.model || null),
       notifyTelegram: task.notifyTelegram !== undefined
         ? (task.notifyTelegram === null || task.notifyTelegram === 'inherit' ? undefined : Boolean(task.notifyTelegram))
         : prev.notifyTelegram,
@@ -591,6 +591,12 @@ export class TaskStore {
       lastDurationMs: task.lastDurationMs !== undefined ? task.lastDurationMs : (prev.lastDurationMs || 0),
       nextRunAt: task.nextRunAt !== undefined ? task.nextRunAt : (prev.nextRunAt || null),
     };
+    // Issue #310 / GH #5: strip any undefined properties to guarantee lossless JSON
+    for (const key of Object.keys(record)) {
+      if (record[key] === undefined) {
+        delete record[key];
+      }
+    }
     this.tasks.set(id, record);
     try {
       this.save();

package/lib/task-create.js

@@ -9,7 +9,7 @@ export function executeCreateTask(store, scheduler, args) {
   const typeError = validateTaskType(taskType, args);
   if (typeError) throw new Error(typeError);
   const parsed = parseScheduleExpression(args.schedule);
-  const task = store.set({
+  const taskData = {
     title: args.title,
     schedule: parsed.cronPattern || args.schedule,
     scheduleText: parsed.humanText,
@@ -72,7 +72,14 @@ export function executeCreateTask(store, scheduler, args) {
     costLimitUsd: Number(args.costLimitUsd) > 0 ? Number(args.costLimitUsd) : undefined,
     dailyCostLimitUsd: Number(args.dailyCostLimitUsd) > 0 ? Number(args.dailyCostLimitUsd) : undefined,
     tokenLimit: Number(args.tokenLimit) > 0 ? Number(args.tokenLimit) : undefined,
-  });
+  };
+  // Issue #310 / GH #5: strip any undefined properties before store.set()
+  for (const k of Object.keys(taskData)) {
+    if (taskData[k] === undefined) {
+      delete taskData[k];
+    }
+  }
+  const task = store.set(taskData);
   scheduler.scheduleTask(task);
   return {
     success: true,

package/lib/task-patch.js

@@ -80,7 +80,7 @@ export function buildTaskPatch(current, body) {
       patch.oneShot = Boolean(parsed.isOneShot || (body && body.oneShot));
       if (scheduleChanged) {
         patch.nextRunAt = parsed.isOneShot ? parsed.targetTimestamp : (parsed.nextRun || null);
-        patch.targetTimestamp = parsed.isOneShot ? parsed.targetTimestamp : undefined;
+        patch.targetTimestamp = parsed.isOneShot ? parsed.targetTimestamp : null;
       }
     } catch (err) {
       return { ok: false, error: err.message };
@@ -95,6 +95,12 @@ export function buildTaskPatch(current, body) {
   if (patch.tokenLimit !== undefined) {
     patch.tokenLimit = patch.tokenLimit === null ? null : (Number(patch.tokenLimit) > 0 ? Number(patch.tokenLimit) : null);
   }
+  // Issue #310 / GH #5: strip undefined properties from patch
+  for (const k of Object.keys(patch)) {
+    if (patch[k] === undefined) {
+      delete patch[k];
+    }
+  }
   return { ok: true, patch };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cron",
-  "version": "0.2.48",
+  "version": "0.2.49",
   "description": "Background automation runner for DSH: isolated agent runs, script/HTTP/SSH/Docker runtimes, cost guard, notifications, heartbeats.",
   "type": "module",
   "main": "lib/index.js",