@goodandready/dsh-cron 0.2.48 → 0.2.50

package/lib/api.js

@@ -7,7 +7,7 @@
 
 import { randomUUID, createHash } from 'node:crypto';
 import { parseScheduleExpression } from './scheduler.js';
-import { normalizeTaskType, CODE_EXECUTING_TYPES } from './runtimes.js';
+import { normalizeTaskType, CODE_EXECUTING_TYPES, EXTERNAL_RUNTIMES } from './runtimes.js';
 import { CHANNEL_IDS, unknownChannelIds } from './channels.js';
 import { applyTaskPatch } from './task-patch.js';
 import { MANAGED_BY_CONFIG, configOwnedMessage } from './config-jobs.js';
@@ -265,7 +265,7 @@ function buildTaskRecord(store, body, taskType, parsed) {
     misfirePolicy: ['skip', 'runOnce', 'catchUpAll'].includes(body.misfirePolicy) ? body.misfirePolicy : (current ? (current.misfirePolicy || 'skip') : 'skip'),
     maxRetries: body.maxRetries !== undefined ? Math.max(0, Number(body.maxRetries) || 0) : (current ? (Number(current.maxRetries) || 0) : 0),
     retryBackoffMs: body.retryBackoffMs !== undefined ? Math.max(1000, Number(body.retryBackoffMs) || 30000) : (current ? (Number(current.retryBackoffMs) || 30000) : 30000),
-    permissionPreset: ['default', 'read-only', 'workspace-write', 'full'].includes(body.permissionPreset) ? body.permissionPreset : (current ? (current.permissionPreset || 'default') : 'default'),
+    permissionPreset: !EXTERNAL_RUNTIMES.includes(taskType) && ['default', 'read-only', 'workspace-write', 'full'].includes(body.permissionPreset) ? body.permissionPreset : (current && !EXTERNAL_RUNTIMES.includes(taskType) ? (current.permissionPreset || 'default') : 'default'),
     ...mergeExecutionFields(current, body, parsed),
   };
 }

package/lib/client.js

@@ -137,6 +137,7 @@ window.__ModuleLoader__.load({
         'modal.params': 'Parameters',
         'modal.history': 'Run history ({count})',
         'modal.cancel': 'Cancel',
+        'modal.confirmDiscard': 'Discard unsaved changes?',
         'modal.save': 'Save changes',
         'modal.create': 'Create task',
         'modal.close': 'Close',
@@ -492,6 +493,7 @@ window.__ModuleLoader__.load({
         'modal.params': '配置参数',
         'modal.history': '运行历史 ({count})',
         'modal.cancel': '取消',
+        'modal.confirmDiscard': '放弃未保存的内容？',
         'modal.save': '保存修改',
         'modal.create': '创建任务',
         'history.loading': '正在加载历史记录...',
@@ -1102,6 +1104,54 @@ window.__ModuleLoader__.load({
       return (typeof t === 'function' ? t : translate)(key, vars);
     }
 
+    /**
+     * Issue #307: universal fetch with AbortController timeout (default 15s).
+     * Connects with caller signal if supplied and fails closed on timeouts.
+     */
+    const fetchWithTimeout = async (url, options = {}, timeoutMs = 15000) => {
+      const controller = typeof AbortController !== 'undefined' ? new AbortController() : null;
+      const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : null;
+      if (options && options.signal && controller) {
+        if (options.signal.aborted) {
+          controller.abort();
+        } else {
+          options.signal.addEventListener('abort', () => controller.abort(), { once: true });
+        }
+      }
+      try {
+        const res = await fetch(url, {
+          ...options,
+          signal: controller ? controller.signal : (options ? options.signal : undefined),
+        });
+        return res;
+      } catch (err) {
+        if (err && (err.name === 'AbortError' || controller?.signal?.aborted)) {
+          const timeoutErr = new Error(`Request timed out after ${Math.round(timeoutMs / 1000)}s`);
+          timeoutErr.isTimeout = true;
+          throw timeoutErr;
+        }
+        throw err;
+      } finally {
+        if (timer) clearTimeout(timer);
+      }
+    };
+
+    /**
+     * Issue #307: universal JSON fetch helper with timeout and aborted body protection.
+     */
+    const fetchJsonWithTimeout = async (url, options = {}, timeoutMs = 15000) => {
+      const res = await fetchWithTimeout(url, options, timeoutMs);
+      let data = {};
+      try {
+        data = await res.json();
+      } catch (jsonErr) {
+        if (jsonErr && jsonErr.name === 'AbortError') {
+          throw jsonErr;
+        }
+      }
+      return { res, data };
+    };
+
     function pickDeliverySettings(source) {
       const out = {};
       for (const key of DELIVERY_SETTING_KEYS.concat(TEMPLATE_SETTING_KEYS)) {
@@ -1290,6 +1340,80 @@ window.__ModuleLoader__.load({
       const [formWorkflowName, setFormWorkflowName] = React.useState('');
       const [stats, setStats] = React.useState(null);
 
+      const initialFormSnapshotRef = React.useRef(null);
+
+      const getFormSnapshot = () => JSON.stringify({
+        title: String(formTitle || '').trim(),
+        schedule: String(formSchedule || '').trim(),
+        type: String(formType || 'llm'),
+        prompt: String(formPrompt || '').trim(),
+        provider: String(formProvider || ''),
+        model: String(formModel || ''),
+        fallbackModel: String(formFallbackModel || ''),
+        silentRule: String(formSilentRule || ''),
+        inspectOnFailure: Boolean(formInspectOnFailure),
+        delivery: String(formDelivery || 'isolated'),
+        notifyTelegram: Boolean(formNotifyTelegram),
+        channels: Array.isArray(formChannels) ? [...formChannels].sort() : [],
+        template: String(formTemplate || '').trim(),
+        onlyOnFailure: Boolean(formOnlyOnFailure),
+        timeoutSeconds: Number(formTimeoutSeconds) || 1800,
+        overlapPolicy: String(formOverlapPolicy || 'skip'),
+        kanbanMode: String(formKanbanMode || 'none'),
+        onSuccess: String(formOnSuccess || '').trim(),
+        onFailure: String(formOnFailure || '').trim(),
+        heartbeatIntervalSeconds: Number(formHeartbeatIntervalSeconds) || 0,
+        gracePeriodSeconds: Number(formGracePeriodSeconds) || 300,
+        preflightType: String(formPreflightType || 'none'),
+        preflightTarget: String(formPreflightTarget || '').trim(),
+        priority: Number(formPriority) || 5,
+        concurrencyGroup: String(formConcurrencyGroup || 'default').trim(),
+        selfHealingCommand: String(formSelfHealingCommand || '').trim(),
+        autoDiagnose: Boolean(formAutoDiagnose),
+        timezone: String(formTimezone || '').trim(),
+        misfirePolicy: String(formMisfirePolicy || 'skip'),
+        maxRetries: Number(formMaxRetries) || 0,
+        permissionPreset: String(formPermissionPreset || 'default'),
+        agentPreset: String(formAgentPreset || '').trim(),
+        targetSessionId: String(formTargetSessionId || '').trim(),
+        targetSessionReset: String(formTargetSessionReset || 'never'),
+        env: String(formEnv || '').trim(),
+        cwd: String(formCwd || '').trim(),
+        workspaceId: String(formWorkspaceId || '').trim(),
+        worktree: Boolean(formWorktree),
+        keepWorktree: Boolean(formKeepWorktree),
+        httpMethod: String(formHttpMethod || 'GET'),
+        httpUrl: String(formHttpUrl || '').trim(),
+        httpHttpHeaders: String(formHttpHeaders || '').trim(),
+        httpBody: String(formHttpBody || '').trim(),
+        sshProfileId: String(formSshProfileId || '').trim(),
+        sshTarget: String(formSshTarget || '').trim(),
+        sshKeyPath: String(formSshKeyPath || '').trim(),
+        dockerImage: String(formDockerImage || '').trim(),
+        nodePath: String(formNodePath || '').trim(),
+        pythonPath: String(formPythonPath || '').trim(),
+        skillName: String(formSkillName || '').trim(),
+        workflowName: String(formWorkflowName || '').trim(),
+      });
+
+      const isFormDirty = () => {
+        if (!manualModalOpen) return false;
+        if (initialFormSnapshotRef.current !== null) {
+          return getFormSnapshot() !== initialFormSnapshotRef.current;
+        }
+        return Boolean(formTitle.trim() || formPrompt.trim());
+      };
+
+      const closeManualModalWithConfirm = () => {
+        if (isFormDirty()) {
+          if (!confirm(T_KEY(t, 'modal.confirmDiscard') || 'Discard unsaved changes?')) {
+            return;
+          }
+        }
+        initialFormSnapshotRef.current = null;
+        setManualModalOpen(false);
+      };
+
       // Live execution indicator (#35): a light 1s tick only while some task
       // is actually running.
       const tasksRef = React.useRef([]);
@@ -1331,7 +1455,7 @@ window.__ModuleLoader__.load({
         const onKey = (e) => {
           if (e.key === 'Escape') {
             if (dropdownOpen) { setDropdownOpen(false); return; }
-            if (manualModalOpen) { setManualModalOpen(false); return; }
+            if (manualModalOpen) { closeManualModalWithConfirm(); return; }
             if (settingsModalOpen) { setSettingsModalOpen(false); return; }
             if (dshModalOpen && !dshLoading) { setDshModalOpen(false); return; }
             if (onClose) onClose();
@@ -1391,8 +1515,12 @@ window.__ModuleLoader__.load({
         const gen = ++fetchGenRef.current;
         setLoading(true);
         setFetchError(null);
+        const controller = (typeof AbortController !== 'undefined') ? new AbortController() : null;
+        const timer = controller ? setTimeout(() => controller.abort(), 15000) : null;
         try {
-          const res = await fetch('/dsh-cron/tasks?status=' + encodeURIComponent(tab) + '&query=' + encodeURIComponent(query));
+          const res = await fetch('/dsh-cron/tasks?status=' + encodeURIComponent(tab) + '&query=' + encodeURIComponent(query), {
+            signal: controller ? controller.signal : undefined,
+          });
           const data = await res.json();
           if (gen !== fetchGenRef.current) return;
           if (data && data.ok) {
@@ -1407,6 +1535,7 @@ window.__ModuleLoader__.load({
           console.error('[dsh-cron] fetch tasks error:', err);
           setFetchError(err.message || T_KEY(t, 'list.loadErrorPrefix'));
         } finally {
+          if (timer) clearTimeout(timer);
           if (gen === fetchGenRef.current) {
             setLoading(false);
           }
@@ -1414,9 +1543,11 @@ window.__ModuleLoader__.load({
       };
 
       const loadModels = async (providerName) => {
+        const controller = (typeof AbortController !== 'undefined') ? new AbortController() : null;
+        const timer = controller ? setTimeout(() => controller.abort(), 15000) : null;
         try {
           const url = providerName ? '/dsh-cron/models?provider=' + encodeURIComponent(providerName) : '/dsh-cron/models';
-          const res = await fetch(url);
+          const res = await fetch(url, { signal: controller ? controller.signal : undefined });
           const data = await res.json();
           if (data && data.ok) {
             if (!providerName) {
@@ -1431,6 +1562,8 @@ window.__ModuleLoader__.load({
           }
         } catch (err) {
           console.error('[dsh-cron] load models error:', err);
+        } finally {
+          if (timer) clearTimeout(timer);
         }
       };
 
@@ -1455,6 +1588,7 @@ window.__ModuleLoader__.load({
           const fetchOpts = { headers };
           if (pollController) fetchOpts.signal = pollController.signal;
 
+          const pollTimer = pollController ? setTimeout(() => { try { pollController.abort(); } catch (abortErr) { void abortErr; } }, 15000) : null;
           fetch('/dsh-cron/tasks?status=' + encodeURIComponent(tab) + '&query=' + encodeURIComponent(query), fetchOpts)
             .then(res => {
               if (isDestroyed || pollGen !== fetchGenRef.current) return null;
@@ -1478,6 +1612,7 @@ window.__ModuleLoader__.load({
               if (err && err.name === 'AbortError') return;
             })
             .finally(() => {
+              if (pollTimer) clearTimeout(pollTimer);
               if (isDestroyed) return;
               // Adaptive interval: 30s when tab is hidden, 8s when active (#134)
               const intervalMs = (typeof document !== 'undefined' && document.hidden) ? 30000 : 8000;
@@ -1515,10 +1650,17 @@ window.__ModuleLoader__.load({
       const fetchJsonWithTimeout = async (url, options = {}, timeoutMs = 15000) => {
         const controller = typeof AbortController !== 'undefined' ? new AbortController() : null;
         const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : null;
+        if (options && options.signal && controller) {
+          if (options.signal.aborted) {
+            controller.abort();
+          } else {
+            options.signal.addEventListener('abort', () => controller.abort(), { once: true });
+          }
+        }
         try {
           const res = await fetch(url, {
             ...options,
-            signal: controller ? controller.signal : options.signal,
+            signal: controller ? controller.signal : (options ? options.signal : undefined),
           });
           let data = {};
           try {
@@ -1589,8 +1731,7 @@ window.__ModuleLoader__.load({
       /** #41: duplicate a task; the server copies config, resets run state (#41). */
       const handleDryRun = async (taskId) => {
         try {
-          const res = await fetch('/dsh-cron/tasks/' + encodeURIComponent(taskId) + '/dry-run', { method: 'POST' });
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks/' + encodeURIComponent(taskId) + '/dry-run', { method: 'POST' });
           setDryRunResult(data);
         } catch (err) {
           alert('Dry run error: ' + err.message);
@@ -1603,8 +1744,7 @@ window.__ModuleLoader__.load({
         setArchiveLoading(true);
         setArchiveModalOpen(true);
         try {
-          const res = await fetch('/dsh-cron/tasks/' + encodeURIComponent(task.id) + '/archive?limit=15&offset=' + offset);
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks/' + encodeURIComponent(task.id) + '/archive?limit=15&offset=' + offset);
           if (data.ok) {
             setArchiveRuns(prev => offset === 0 ? (data.runs || []) : [...prev, ...(data.runs || [])]);
             setArchiveTotal(data.total || 0);
@@ -1618,12 +1758,11 @@ window.__ModuleLoader__.load({
 
       const handlePreviewSchedule = async (scheduleExpr) => {
         try {
-          const res = await fetch('/dsh-cron/schedule/preview', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/schedule/preview', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ schedule: scheduleExpr, timezone: formTimezone })
           });
-          const data = await res.json();
           if (data.ok && data.runs) {
             setSchedulePreviewRuns(data.runs);
           } else {
@@ -1636,8 +1775,7 @@ window.__ModuleLoader__.load({
 
       const handleDuplicate = async (task) => {
         try {
-          const res = await fetch('/dsh-cron/tasks/' + encodeURIComponent(task.id) + '/duplicate', { method: 'POST' });
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks/' + encodeURIComponent(task.id) + '/duplicate', { method: 'POST' });
           if (!data.ok) {
             alert(T_KEY(t, 'duplicate.failed', { error: (data && data.error) || '' }));
             return;
@@ -1678,8 +1816,7 @@ window.__ModuleLoader__.load({
           const promptMsg = T_KEY(t, 'transfer.exportPrompt') || 'Choose export mode:\nOK = Sanitized (removes custom env vars & headers)\nCancel = Full raw export';
           const wantSanitized = confirm(promptMsg);
           const exportUrl = '/dsh-cron/tasks/export' + (wantSanitized ? '?sanitize=true' : '');
-          const res = await fetch(exportUrl);
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout(exportUrl);
           if (!data.ok) {
             alert(T_KEY(t, 'transfer.exportFailed', { error: (data && data.error) || '' }));
             return;
@@ -1717,12 +1854,11 @@ window.__ModuleLoader__.load({
             alert(T_KEY(t, 'transfer.badFile', { error: parseErr.message }));
             return;
           }
-          const res = await fetch('/dsh-cron/tasks/import', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks/import', {
             method: 'POST',
             headers: importHeaders(document_),
             body: JSON.stringify({ document: document_, dryRun: true, strategy: importStrategy })
           });
-          const data = await res.json();
           if (!data.ok) {
             alert(T_KEY(t, 'transfer.importFailed', { error: (data && data.error) || '' }));
             return;
@@ -1740,12 +1876,11 @@ window.__ModuleLoader__.load({
         if (!importDoc) return;
         setTransferBusy(true);
         try {
-          const res = await fetch('/dsh-cron/tasks/import', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks/import', {
             method: 'POST',
             headers: importHeaders(importDoc),
             body: JSON.stringify({ document: importDoc, strategy: importStrategy })
           });
-          const data = await res.json();
           if (!data.ok) {
             alert(T_KEY(t, 'transfer.importFailed', { error: (data && data.error) || '' }));
             return;
@@ -1777,12 +1912,11 @@ window.__ModuleLoader__.load({
           'If the change makes the task execute code (script/node/python/ssh/docker), confirm it with me explicitly before applying it.',
         ].filter(Boolean);
         try {
-          const res = await fetch('/dsh-cron/chat/start', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/chat/start', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ prompt: lines.join(String.fromCharCode(10)) })
           });
-          const data = await res.json();
           if (!data.ok || !data.sessionId) {
             alert(T_KEY(t, 'tune.startFailed', { error: (data && data.error) || '' }));
             return;
@@ -1798,7 +1932,7 @@ window.__ModuleLoader__.load({
       const handleDelete = async (id) => {
         if (!confirm(T_KEY(t, 'confirm.delete'))) return;
         try {
-          await fetch('/dsh-cron/tasks/' + encodeURIComponent(id), { method: 'DELETE' });
+          await fetchWithTimeout('/dsh-cron/tasks/' + encodeURIComponent(id), { method: 'DELETE' });
           fetchTasks();
         } catch (err) {
           console.debug('[dsh-cron] delete failed', err);
@@ -1809,8 +1943,7 @@ window.__ModuleLoader__.load({
         setTestStatus(null);
         setSettingsModalOpen(true);
         try {
-          const res = await fetch('/dsh-cron/settings');
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/settings');
           if (data && data.ok && data.settings) {
             setSettingsBotToken(data.settings.botToken || '');
             setSettingsChatId(data.settings.chatId || '');
@@ -1829,7 +1962,7 @@ window.__ModuleLoader__.load({
       const handleSaveSettings = async (e) => {
         e.preventDefault();
         try {
-          const res = await fetch('/dsh-cron/settings', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/settings', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(Object.assign({
@@ -1840,7 +1973,6 @@ window.__ModuleLoader__.load({
               kanbanBaseUrl: settingsKanbanUrl,
             }, settingsDelivery))
           });
-          const data = await res.json();
           if (data && data.ok) {
             setSettingsModalOpen(false);
           } else {
@@ -1881,7 +2013,7 @@ window.__ModuleLoader__.load({
 
       const handleTestTelegram = async () => {        setTestStatus({ loading: true, message: T_KEY(t, 'settings.sending') });
         try {
-          const res = await fetch('/dsh-cron/telegram/test', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/telegram/test', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({
@@ -1889,7 +2021,6 @@ window.__ModuleLoader__.load({
               chatId: settingsChatId
             })
           });
-          const data = await res.json();
           if (data && data.ok) {
             setTestStatus({ loading: false, success: true, message: T_KEY(t, 'settings.testOk') });
           } else {
@@ -1963,14 +2094,66 @@ window.__ModuleLoader__.load({
           setFormModel(defaultModelInfo?.model || '');
           if (defaultModelInfo?.provider) loadModels(defaultModelInfo.provider);
         }
+        initialFormSnapshotRef.current = JSON.stringify({
+          title: String((preset && preset.title) || '').trim(),
+          schedule: String((preset && preset.schedule) || (preset ? '' : '0 9 * * 1-5')).trim(),
+          type: String((preset && preset.type) || 'llm'),
+          prompt: String((preset && preset.prompt) || '').trim(),
+          provider: String(defaultModelInfo?.provider || ''),
+          model: String(defaultModelInfo?.model || ''),
+          fallbackModel: String((preset && preset.fallbackModel) || '').trim(),
+          silentRule: String((preset && preset.silentRule) || '').trim(),
+          inspectOnFailure: Boolean(preset && preset.inspectOnFailure),
+          delivery: 'isolated',
+          notifyTelegram: false,
+          channels: Array.isArray(preset && preset.channels) ? [...preset.channels].filter((c) => DELIVERY_CHANNELS.includes(c)).sort() : [],
+          template: '',
+          onlyOnFailure: Boolean(preset && preset.onlyOnFailure),
+          timeoutSeconds: 1800,
+          overlapPolicy: 'skip',
+          kanbanMode: 'none',
+          onSuccess: '',
+          onFailure: '',
+          heartbeatIntervalSeconds: 0,
+          gracePeriodSeconds: 300,
+          preflightType: 'none',
+          preflightTarget: '',
+          priority: 5,
+          concurrencyGroup: 'default',
+          selfHealingCommand: '',
+          autoDiagnose: false,
+          timezone: '',
+          misfirePolicy: 'skip',
+          maxRetries: 0,
+          permissionPreset: 'default',
+          agentPreset: '',
+          targetSessionId: '',
+          targetSessionReset: 'never',
+          env: '',
+          cwd: '',
+          workspaceId: '',
+          worktree: false,
+          keepWorktree: false,
+          httpMethod: 'GET',
+          httpUrl: '',
+          httpHttpHeaders: '',
+          httpBody: '',
+          sshProfileId: '',
+          sshTarget: '',
+          sshKeyPath: '',
+          dockerImage: '',
+          nodePath: '',
+          pythonPath: '',
+          skillName: '',
+          workflowName: '',
+        });
         setManualModalOpen(true);
       };
 
       const loadTaskHistory = async (taskId) => {
         setHistoryLoading(true);
         try {
-          const res = await fetch('/dsh-cron/tasks/' + encodeURIComponent(taskId) + '/history');
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks/' + encodeURIComponent(taskId) + '/history');
           if (data.ok) {
             setTaskHistory(data.history || []);
           }
@@ -2077,7 +2260,7 @@ window.__ModuleLoader__.load({
             timezone: formTimezone.trim(),
             misfirePolicy: formMisfirePolicy,
             maxRetries: Number(formMaxRetries) || 0,
-            permissionPreset: formPermissionPreset,
+            permissionPreset: isAgentType ? formPermissionPreset : 'default',
             agentPreset: formAgentPreset.trim() || undefined,
             targetSessionId: formTargetSessionId.trim() || undefined,
             targetSessionReset: formTargetSessionReset || 'never',
@@ -2119,13 +2302,13 @@ window.__ModuleLoader__.load({
             Boolean(payload.preflightCommand && payload.preflightCommand.trim()) ||
             Boolean(payload.selfHealingCommand && payload.selfHealingCommand.trim());
           if (hasCodeExec) headers[SCRIPT_CONFIRM_HEADER] = 'script';
-          const res = await fetch('/dsh-cron/tasks', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks', {
             method: 'POST',
             headers,
             body: JSON.stringify(payload)
           });
-          const data = await res.json();
           if (!data.ok) { alert(data.error || T_KEY(t, 'settings.saveError', { error: '' })); return; }
+          initialFormSnapshotRef.current = null;
           setManualModalOpen(false);
           fetchTasks();
         } catch (err) { alert(err.message); }
@@ -2143,12 +2326,11 @@ window.__ModuleLoader__.load({
 
         setDshLoading(true);
         try {
-          const res = await fetch('/dsh-cron/chat/start', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/chat/start', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ prompt: text })
           });
-          const data = await res.json();
           if (!data.ok || !data.sessionId) {
             alert(T_KEY(t, 'dsh.startFailed', { error: data.error || '' }));
             setDshLoading(false);
@@ -2511,7 +2693,12 @@ window.__ModuleLoader__.load({
         ),
 
         // 1. Manual creation / Edit modal
-        manualModalOpen && React.createElement('div', { className: 'dsh-cron-modal-overlay', onClick: () => setManualModalOpen(false) },
+        manualModalOpen && React.createElement('div', {
+          className: 'dsh-cron-modal-overlay',
+          onClick: (e) => {
+            if (e.target === e.currentTarget) closeManualModalWithConfirm();
+          }
+        },
           React.createElement('div', {
             className: 'dsh-cron-modal dsh-cron-modal-scroll',
             style: { maxWidth: '640px' },
@@ -2614,7 +2801,7 @@ window.__ModuleLoader__.load({
                 React.createElement('button', {
                   type: 'button',
                   className: 'dsh-cron-btn-primary',
-                  onClick: () => setManualModalOpen(false)
+                  onClick: closeManualModalWithConfirm
                 }, T_KEY(t, 'modal.close'))
               )
             ) :
@@ -2728,7 +2915,32 @@ window.__ModuleLoader__.load({
                   )
                 )
               ),
-              React.createElement('div', { className: 'dsh-cron-form-row' },
+              AGENT_FORM_TYPES.includes(formType) ? (
+                React.createElement('div', { className: 'dsh-cron-form-row' },
+                  React.createElement('div', { className: 'dsh-cron-form-group' },
+                    React.createElement('label', null, T_KEY(t, 'form.retriesLabel')),
+                    React.createElement('input', {
+                      type: 'number',
+                      min: 0,
+                      value: formMaxRetries,
+                      placeholder: '0',
+                      onChange: (e) => setFormMaxRetries(e.target.value)
+                    })
+                  ),
+                  React.createElement('div', { className: 'dsh-cron-form-group' },
+                    React.createElement('label', null, T_KEY(t, 'form.permissionLabel')),
+                    React.createElement('select', {
+                      value: formPermissionPreset,
+                      onChange: (e) => setFormPermissionPreset(e.target.value)
+                    },
+                      React.createElement('option', { value: 'default' }, T_KEY(t, 'form.permissionDefault')),
+                      React.createElement('option', { value: 'read-only' }, T_KEY(t, 'form.permissionReadonly')),
+                      React.createElement('option', { value: 'workspace-write' }, T_KEY(t, 'form.permissionWrite')),
+                      React.createElement('option', { value: 'full' }, T_KEY(t, 'form.permissionFull'))
+                    )
+                  )
+                )
+              ) : (
                 React.createElement('div', { className: 'dsh-cron-form-group' },
                   React.createElement('label', null, T_KEY(t, 'form.retriesLabel')),
                   React.createElement('input', {
@@ -2738,18 +2950,6 @@ window.__ModuleLoader__.load({
                     placeholder: '0',
                     onChange: (e) => setFormMaxRetries(e.target.value)
                   })
-                ),
-                React.createElement('div', { className: 'dsh-cron-form-group' },
-                  React.createElement('label', null, T_KEY(t, 'form.permissionLabel')),
-                  React.createElement('select', {
-                    value: formPermissionPreset,
-                    onChange: (e) => setFormPermissionPreset(e.target.value)
-                  },
-                    React.createElement('option', { value: 'default' }, T_KEY(t, 'form.permissionDefault')),
-                    React.createElement('option', { value: 'read-only' }, T_KEY(t, 'form.permissionReadonly')),
-                    React.createElement('option', { value: 'workspace-write' }, T_KEY(t, 'form.permissionWrite')),
-                    React.createElement('option', { value: 'full' }, T_KEY(t, 'form.permissionFull'))
-                  )
                 )
               ),
               React.createElement('div', { className: 'dsh-cron-form-group' },
@@ -3197,7 +3397,7 @@ window.__ModuleLoader__.load({
                   React.createElement('button', {
                     type: 'button',
                     className: 'dsh-cron-btn-secondary',
-                    onClick: () => setManualModalOpen(false)
+                    onClick: closeManualModalWithConfirm
                   }, T_KEY(t, 'modal.cancel')),
                   React.createElement('button', {
                     type: 'submit',
@@ -3532,8 +3732,7 @@ window.__ModuleLoader__.load({
       const checkUpdates = async () => {
         setUpdateState(prev => ({ ...prev, checking: true, error: null, notice: null }));
         try {
-          const res = await fetch('/api/dsh-cron/update');
-          const data = await res.json();
+          const { res, data } = await fetchJsonWithTimeout('/api/dsh-cron/update');
           if (data && data.currentVersion) {
             setUpdateState(prev => ({
               ...prev,
@@ -3554,11 +3753,10 @@ window.__ModuleLoader__.load({
       const runUpdate = async () => {
         setUpdateState(prev => ({ ...prev, updating: true, error: null, notice: null }));
         try {
-          const res = await fetch('/api/dsh-cron/update', {
+          const { res, data } = await fetchJsonWithTimeout('/api/dsh-cron/update', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json', 'x-dsh-plugin-update': '1' }
           });
-          const data = await res.json();
           if (data && data.updated) {
             setUpdateState(prev => ({
               ...prev,
@@ -3587,9 +3785,8 @@ window.__ModuleLoader__.load({
       React.useEffect(() => {
         let active = true;
         setLoadState('loading');
-        fetch('/dsh-cron/settings')
-          .then(r => r.json())
-          .then(data => {
+        fetchJsonWithTimeout('/dsh-cron/settings')
+          .then(({ data }) => {
             if (!active) return;
             if (data && data.ok && data.settings) {
               setToken(data.settings.botToken || '');
@@ -3615,7 +3812,7 @@ window.__ModuleLoader__.load({
       const saveSettings = async (e) => {
         if (e) e.preventDefault();
         try {
-          const res = await fetch('/dsh-cron/settings', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/settings', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(Object.assign({
@@ -3627,7 +3824,6 @@ window.__ModuleLoader__.load({
               kanbanBaseUrl: kanbanUrl
             }, delivery))
           });
-          const data = await res.json();
           if (data && data.ok) {
             setSaved(true);
             setTimeout(() => setSaved(false), 2500);
@@ -3640,12 +3836,11 @@ window.__ModuleLoader__.load({
       const testTelegram = async () => {
         setTestInfo({ loading: true, message: T_KEY(t, 'settings.sending') });
         try {
-          const res = await fetch('/dsh-cron/telegram/test', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/telegram/test', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ botToken: token, chatId })
           });
-          const data = await res.json();
           if (data && data.ok) {
             setTestInfo({ success: true, message: T_KEY(t, 'settings.testOk') });
           } else {
@@ -3659,12 +3854,11 @@ window.__ModuleLoader__.load({
       const testKanban = async () => {
         setTestInfo({ loading: true, message: T_KEY(t, 'settings.checkingKanban') });
         try {
-          const res = await fetch('/dsh-cron/kanban/test', {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/kanban/test', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ kanbanBaseUrl: kanbanUrl })
           });
-          const data = await res.json();
           if (data && data.ok) {
             setTestInfo({ success: true, message: T_KEY(t, 'settings.kanbanOk') });
           } else {
@@ -3971,8 +4165,7 @@ window.__ModuleLoader__.load({
 
     async function loadSidebarJobs(state) {
       try {
-        const res = await fetch('/dsh-cron/tasks?status=active');
-        const data = await res.json();
+        const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks?status=active');
         if (data && data.ok) renderSidebarJobs(state, data.tasks || []);
       } catch (err) {
         console.debug('[dsh-cron] load sidebar jobs failed', err);

package/lib/cron-tool.js

@@ -150,7 +150,7 @@ export const cronToolParameters = {
   permissionPreset: {
     type: 'string',
     enum: ['default', 'read-only', 'workspace-write', 'full'],
-    description: 'Permission preset applied to the task session',
+    description: 'Permission preset applied to the task session (only used for agent session tasks: llm, skill, workflow)',
   },
   kanbanMode: {
     type: 'string',

package/lib/http-utils.js

@@ -180,7 +180,13 @@ export async function readBody(req, res) {
  */
 export function redactTaskSecrets(task) {
   if (!task || typeof task !== 'object') return task;
-  const clone = { ...task };
+  // Issue #310 / GH #5: sanitize to lossless JSON by omitting any undefined properties
+  const clone = {};
+  for (const [k, v] of Object.entries(task)) {
+    if (v !== undefined) {
+      clone[k] = v;
+    }
+  }
 
   if (clone.env && typeof clone.env === 'object') {
     const redactedEnv = {};

package/lib/runtimes.js

@@ -124,8 +124,6 @@ export function buildSshInvocation(task) {
   return { file: 'ssh', args };
 }
 
-export const DOCKER_HOST_ENV_ALLOWLIST = ['TZ', 'LANG', 'LC_ALL'];
-
 /** #8/#226: build Docker run invocation without leaking host process secrets into container. */
 export function buildDockerInvocation(task, explicitEnv) {
   const image = String(task.dockerImage || '').trim();

package/lib/store.js

@@ -555,8 +555,8 @@ export class TaskStore {
       type: task.type !== undefined ? task.type : (prev.type || 'llm'),
       status: task.status !== undefined ? task.status : (prev.status || 'active'),
       delivery: task.delivery !== undefined ? task.delivery : (prev.delivery || 'isolated'),
-      provider: task.provider !== undefined ? task.provider : prev.provider,
-      model: task.model !== undefined ? task.model : prev.model,
+      provider: task.provider !== undefined ? task.provider : (prev.provider || null),
+      model: task.model !== undefined ? task.model : (prev.model || null),
       notifyTelegram: task.notifyTelegram !== undefined
         ? (task.notifyTelegram === null || task.notifyTelegram === 'inherit' ? undefined : Boolean(task.notifyTelegram))
         : prev.notifyTelegram,
@@ -591,6 +591,12 @@ export class TaskStore {
       lastDurationMs: task.lastDurationMs !== undefined ? task.lastDurationMs : (prev.lastDurationMs || 0),
       nextRunAt: task.nextRunAt !== undefined ? task.nextRunAt : (prev.nextRunAt || null),
     };
+    // Issue #310 / GH #5: strip any undefined properties to guarantee lossless JSON
+    for (const key of Object.keys(record)) {
+      if (record[key] === undefined) {
+        delete record[key];
+      }
+    }
     this.tasks.set(id, record);
     try {
       this.save();

package/lib/task-create.js

@@ -1,4 +1,4 @@
-import { normalizeTaskType } from './runtimes.js';
+import { normalizeTaskType, EXTERNAL_RUNTIMES } from './runtimes.js';
 import { validateTaskType } from './task-transfer.js';
 import { parseScheduleExpression } from './scheduler.js';
 import { CHANNEL_IDS } from './channels.js';
@@ -9,7 +9,7 @@ export function executeCreateTask(store, scheduler, args) {
   const typeError = validateTaskType(taskType, args);
   if (typeError) throw new Error(typeError);
   const parsed = parseScheduleExpression(args.schedule);
-  const task = store.set({
+  const taskData = {
     title: args.title,
     schedule: parsed.cronPattern || args.schedule,
     scheduleText: parsed.humanText,
@@ -44,7 +44,7 @@ export function executeCreateTask(store, scheduler, args) {
     misfirePolicy: ['skip', 'runOnce', 'catchUpAll'].includes(args.misfirePolicy) ? args.misfirePolicy : 'skip',
     maxRetries: Number(args.maxRetries) > 0 ? Number(args.maxRetries) : 0,
     retryBackoffMs: Number(args.retryBackoffMs) > 0 ? Number(args.retryBackoffMs) : 30000,
-    permissionPreset: ['default', 'read-only', 'workspace-write', 'full'].includes(args.permissionPreset) ? args.permissionPreset : 'default',
+    permissionPreset: !EXTERNAL_RUNTIMES.includes(taskType) && ['default', 'read-only', 'workspace-write', 'full'].includes(args.permissionPreset) ? args.permissionPreset : 'default',
     kanbanMode: args.kanbanMode || 'none',
     channels: Array.isArray(args.channels) ? args.channels.filter((c) => CHANNEL_IDS.includes(c)) : undefined,
     template: args.template ? String(args.template) : '',
@@ -72,7 +72,14 @@ export function executeCreateTask(store, scheduler, args) {
     costLimitUsd: Number(args.costLimitUsd) > 0 ? Number(args.costLimitUsd) : undefined,
     dailyCostLimitUsd: Number(args.dailyCostLimitUsd) > 0 ? Number(args.dailyCostLimitUsd) : undefined,
     tokenLimit: Number(args.tokenLimit) > 0 ? Number(args.tokenLimit) : undefined,
-  });
+  };
+  // Issue #310 / GH #5: strip any undefined properties before store.set()
+  for (const k of Object.keys(taskData)) {
+    if (taskData[k] === undefined) {
+      delete taskData[k];
+    }
+  }
+  const task = store.set(taskData);
   scheduler.scheduleTask(task);
   return {
     success: true,

package/lib/task-patch.js

@@ -9,7 +9,7 @@
  */
 
 import { parseScheduleExpression } from './scheduler.js';
-import { normalizeTaskType, CODE_EXECUTING_TYPES } from './runtimes.js';
+import { normalizeTaskType, CODE_EXECUTING_TYPES, EXTERNAL_RUNTIMES } from './runtimes.js';
 import { PATCHABLE_TASK_FIELDS, validateTaskType } from './task-transfer.js';
 import { pickPatchableFields, restoreTaskSecrets } from './http-utils.js';
 import { unknownChannelIds } from './channels.js';
@@ -80,7 +80,7 @@ export function buildTaskPatch(current, body) {
       patch.oneShot = Boolean(parsed.isOneShot || (body && body.oneShot));
       if (scheduleChanged) {
         patch.nextRunAt = parsed.isOneShot ? parsed.targetTimestamp : (parsed.nextRun || null);
-        patch.targetTimestamp = parsed.isOneShot ? parsed.targetTimestamp : undefined;
+        patch.targetTimestamp = parsed.isOneShot ? parsed.targetTimestamp : null;
       }
     } catch (err) {
       return { ok: false, error: err.message };
@@ -95,6 +95,16 @@ export function buildTaskPatch(current, body) {
   if (patch.tokenLimit !== undefined) {
     patch.tokenLimit = patch.tokenLimit === null ? null : (Number(patch.tokenLimit) > 0 ? Number(patch.tokenLimit) : null);
   }
+  const effectiveType = patch.type !== undefined ? normalizeTaskType(patch.type) : current.type;
+  if (EXTERNAL_RUNTIMES.includes(effectiveType) && patch.permissionPreset !== undefined) {
+    patch.permissionPreset = 'default';
+  }
+  // Issue #310 / GH #5: strip undefined properties from patch
+  for (const k of Object.keys(patch)) {
+    if (patch[k] === undefined) {
+      delete patch[k];
+    }
+  }
   return { ok: true, patch };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cron",
-  "version": "0.2.48",
+  "version": "0.2.50",
   "description": "Background automation runner for DSH: isolated agent runs, script/HTTP/SSH/Docker runtimes, cost guard, notifications, heartbeats.",
   "type": "module",
   "main": "lib/index.js",