@goodandready/dsh-cron 0.2.49 → 0.2.51

package/lib/cron-tool.js

@@ -150,7 +150,27 @@ export const cronToolParameters = {
   permissionPreset: {
     type: 'string',
     enum: ['default', 'read-only', 'workspace-write', 'full'],
-    description: 'Permission preset applied to the task session',
+    description: 'Permission preset applied to the task session (only used for agent session tasks: llm, skill, workflow)',
+  },
+  validators: {
+    type: 'array',
+    description: 'Declarative post-execution validation checks (json, regex, text, exitCode, file)',
+    items: {
+      type: 'object',
+      properties: {
+        type: { type: 'string', enum: ['json', 'regex', 'text', 'exitCode', 'file'] },
+        pattern: { type: 'string' },
+        text: { type: 'string' },
+        negate: { type: 'boolean' },
+        statusKey: { type: 'string' },
+        expected: { type: 'string' },
+        path: { type: 'string' },
+        mustExist: { type: 'boolean' },
+        minBytes: { type: 'number' },
+        target: { type: 'string' },
+      },
+      additionalProperties: true,
+    },
   },
   kanbanMode: {
     type: 'string',

package/lib/index.js

@@ -165,7 +165,10 @@ export function apply(ctx, rawConfig) {
     deliver: (task, runInfo, settings) => deliverRun({
       task,
       runInfo,
-      settings,
+      settings: {
+        ...settings,
+        _webServerPort: ctx.webServer?.port || 3080,
+      },
       secrets: {
         botToken: settings.botToken || '',
         resolveSecret: (ref) => resolveCredentialValue(ctx, ref),

package/lib/scheduler-execution.js

@@ -1,3 +1,4 @@
+import { validateRunResult } from './validators.js';
 import { logger } from './logger.js';
 import { checkAndApplyBurnGuard, checkTaskBudgetLimits } from './burn-guard.js';
 import { resolveTaskForExecution } from './prompt-interpolation.js';
@@ -327,7 +328,9 @@ export async function executeTask(scheduler, taskId, options = {}) {
   const currentRun = scheduler.beginRun(task, taskId, options);
   if (currentRun === null) return null;
 
+  const preflightStart = Date.now();
   const preflight = await executePreflight(task);
+  const preflightDurationMs = Date.now() - preflightStart;
   if (!preflight.ok) {
     logger.info(`[dsh-cron] task "${task.title}" (${taskId}) skipped: ${preflight.reason}`);
     scheduler.running.delete(taskId);
@@ -337,7 +340,10 @@ export async function executeTask(scheduler, taskId, options = {}) {
 
   const start = Date.now();
   const outcome = await scheduler.executeWithFallback(task, currentRun.controller.signal, options);
-  await scheduler.completeRun(task, taskId, currentRun, outcome, start, options);
+  await scheduler.completeRun(task, taskId, currentRun, outcome, start, {
+    ...options,
+    preflightDurationMs,
+  });
   return outcome;
 }
 
@@ -429,7 +435,7 @@ export async function deliverNotifications(task, runInfo, { store, resolveSecret
         logger.warn('[dsh-cron] credential resolution failed:', secErr.message);
       }
     }
-    if (typeof deliver !== 'function') return;
+    if (typeof deliver !== 'function') return { status: 'skipped', delivered: [], failures: [] };
     const result = await deliver(task, runInfo, settings);
     if (result && Array.isArray(result.delivered) && result.delivered.length) {
       logger.info(`[dsh-cron] delivered "${task.title}" to: ${result.delivered.map((d) => d.channel).join(', ')}`);
@@ -437,8 +443,16 @@ export async function deliverNotifications(task, runInfo, { store, resolveSecret
     if (result && Array.isArray(result.failures) && result.failures.length) {
       logger.warn(`[dsh-cron] delivery failures for "${task.title}": ${result.failures.map((f) => `${f.channel}: ${f.error}`).join('; ')}`);
     }
+    const delivered = Array.isArray(result?.delivered) ? result.delivered : [];
+    const failures = Array.isArray(result?.failures) ? result.failures : [];
+    let status = 'skipped';
+    if (delivered.length > 0 && failures.length === 0) status = 'delivered';
+    else if (delivered.length > 0 && failures.length > 0) status = 'partial';
+    else if (delivered.length === 0 && failures.length > 0) status = 'failed';
+    return { status, delivered, failures };
   } catch (notifyErr) {
     logger.error('[dsh-cron] notification error:', notifyErr.message);
+    return { status: 'failed', delivered: [], failures: [{ channel: 'all', error: notifyErr.message }] };
   }
 }
 
@@ -522,13 +536,41 @@ export function finishRun(scheduler, taskSnapshot, taskId, status, queuedCount,
 /**
  * Handle complete run lifecycle: metrics, self-healing, diagnosis, silent rule, storage, delivery, chaining.
  */
+function computeStoppedReason(status, valRes, error) {
+  if (status === 'validation_failed') return `Validation failed: ${valRes?.error || 'Check failed'}`;
+  if (status === 'validator_error') return `Validator configuration error: ${valRes?.error || 'Check failed'}`;
+  if (status === 'timeout') return 'Execution timed out';
+  if (status === 'error') return error ? `Execution error: ${error}` : 'Execution error';
+  if (status === 'success') return 'Completed successfully';
+  if (status === 'skipped') return error || 'Run skipped';
+  return null;
+}
+
 export async function handleCompleteRun(scheduler, task, taskId, currentRun, outcome, start, options = {}) {
+  // Post-execution declarative validation (#316)
+  let valRes = { ok: true, skipped: true };
+  let valDurationMs = 0;
+  if (outcome.status === 'success' && Array.isArray(task.validators) && task.validators.length > 0) {
+    const vStart = Date.now();
+    valRes = validateRunResult(task, outcome, { cwd: task.cwd });
+    valDurationMs = Date.now() - vStart;
+    if (!valRes.ok) {
+      outcome.status = valRes.status === 'error' ? 'validator_error' : 'validation_failed';
+      outcome.error = valRes.error || 'Validation failed';
+    }
+  }
+
   const isSuccess = outcome.status === 'success';
-  const isFailure = outcome.status === 'error' || outcome.status === 'timeout';
+  const isFailure = outcome.status === 'error' || outcome.status === 'timeout' || outcome.status === 'validation_failed' || outcome.status === 'validator_error';
+  const executionMs = Date.now() - start;
+  const queueWaitMs = (currentRun && currentRun.startedAt && currentRun.queuedAt) ? (currentRun.startedAt - currentRun.queuedAt) : 0;
+  const preflightMs = options.preflightDurationMs || 0;
+
   const runInfo = {
+    runId: currentRun?.id || ('run_' + Math.random().toString(36).slice(2, 9) + '_' + Date.now()),
     at: start,
     status: outcome.status,
-    durationMs: Date.now() - start,
+    durationMs: executionMs,
     output: outcome.output,
     error: outcome.error,
     usage: outcome.usage,
@@ -536,6 +578,7 @@ export async function handleCompleteRun(scheduler, task, taskId, currentRun, out
     sessionId: outcome.sessionId,
     model: outcome.model || task.model || '',
     fallback: Boolean(outcome.fallback),
+    validation: valRes.skipped ? null : valRes,
   };
 
   if (isFailure && task.selfHealingCommand) {
@@ -573,6 +616,58 @@ export async function handleCompleteRun(scheduler, task, taskId, currentRun, out
 
   const silent = await scheduler.applyModelAssists(task, runInfo);
 
+  let deliveryResult = { status: 'skipped', delivered: [], failures: [] };
+  let delivStart = Date.now();
+  if (!silent.skipped) {
+    deliveryResult = (await scheduler.deliverNotifications(task, runInfo)) || deliveryResult;
+  }
+  const delivDurationMs = Date.now() - delivStart;
+
+  const stages = [
+    {
+      name: 'queue',
+      status: 'success',
+      durationMs: queueWaitMs,
+    },
+    {
+      name: 'preflight',
+      status: 'success',
+      durationMs: preflightMs,
+      error: null,
+    },
+    {
+      name: 'execution',
+      status: (outcome.status === 'error' || outcome.status === 'timeout') ? 'failed' : 'success',
+      durationMs: executionMs,
+      error: (outcome.status === 'error' || outcome.status === 'timeout') ? (outcome.error || null) : null,
+    },
+    {
+      name: 'validation',
+      status: valRes.skipped ? 'skipped' : (valRes.ok ? 'success' : 'failed'),
+      durationMs: valDurationMs,
+      error: valRes.ok ? null : (valRes.error || null),
+    },
+    {
+      name: 'delivery',
+      status: deliveryResult?.status || 'skipped',
+      durationMs: delivDurationMs,
+      error: (deliveryResult?.failures && deliveryResult.failures.length > 0)
+        ? deliveryResult.failures.map(f => `${f.channel}: ${f.error}`).join('; ')
+        : null,
+      delivered: deliveryResult?.delivered || [],
+      failures: deliveryResult?.failures || [],
+    },
+  ];
+
+  runInfo.stages = stages;
+  runInfo.delivery = deliveryResult;
+  runInfo.cost = {
+    amount: Number(outcome.costUsd) || 0,
+    currency: 'USD',
+    kind: (Number(outcome.costUsd) > 0) ? 'exact' : ((task.type === 'llm' || task.type === 'skill' || task.type === 'workflow') ? 'unknown' : 'exact'),
+  };
+  runInfo.stoppedReason = computeStoppedReason(outcome.status, valRes, outcome.error);
+
   try {
     scheduler.store.recordRun(taskId, runInfo);
   } catch (recordErr) {
@@ -585,7 +680,6 @@ export async function handleCompleteRun(scheduler, task, taskId, currentRun, out
   const queuedRuns = isCurrentRun ? (finishedRun?.queuedRuns || []) : [];
   const queuedCount = isCurrentRun ? (finishedRun?.queueCount || 0) : 0;
 
-  if (!silent.skipped) await scheduler.deliverNotifications(task, runInfo);
   scheduler.finishRun(task, taskId, outcome.status, queuedCount, {
     isCurrentRun,
     runId: currentRun?.id,

package/lib/scheduler.js

@@ -548,7 +548,9 @@ export class TaskScheduler {
 
   recordSkipped(taskId, reason) {
     this.countRun('skipped');
+    const runId = 'run_' + Math.random().toString(36).slice(2, 9) + '_' + Date.now();
     this.store.recordRun(taskId, {
+      runId,
       at: Date.now(),
       status: 'skipped',
       durationMs: 0,
@@ -556,6 +558,16 @@ export class TaskScheduler {
       error: null,
       usage: { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0 },
       costUsd: 0,
+      stoppedReason: reason,
+      stages: [
+        { name: 'queue', status: 'skipped', durationMs: 0 },
+        { name: 'preflight', status: 'skipped', durationMs: 0, error: reason },
+        { name: 'execution', status: 'skipped', durationMs: 0 },
+        { name: 'validation', status: 'skipped', durationMs: 0 },
+        { name: 'delivery', status: 'skipped', durationMs: 0 },
+      ],
+      cost: { amount: 0, currency: 'USD', kind: 'exact' },
+      delivery: { status: 'skipped', delivered: [], failures: [] },
     });
   }
 

package/lib/settings.js

@@ -40,7 +40,7 @@ export const Config = z.object({
   barkKey: z.string().default('').description('Bark device key').volatile(),
   pushplusTokenRef: z.string().default('').description('Credential name for the PushPlus token').volatile(),
   pushplusUrl: z.string().default('https://www.pushplus.plus/send').description('PushPlus send endpoint (override for a self-hosted proxy)').volatile(),
-  ttsBaseUrl: z.string().default('http://127.0.0.1:3080').description('Base URL of the harness used to reach the dsh-tts speak route').volatile(),
+  ttsBaseUrl: z.string().default('').description('Base URL of the harness used to reach the dsh-tts speak route (empty = auto-resolved from webServer port or http://127.0.0.1:3080)').volatile(),
   giteaBaseUrl: z.string().default('').description('Gitea base URL for alert issues').volatile(),
   giteaRepo: z.string().default('').description('Gitea repository (owner/name) for alert issues').volatile(),
   giteaTokenRef: z.string().default('').description('Credential name for the Gitea API token').volatile(),

package/lib/store.js

@@ -689,7 +689,7 @@ export class TaskStore {
     const prevRuns = this.history.get(id) || [];
     const runs = [
       {
-        id: 'run_' + Math.random().toString(36).slice(2, 9),
+        id: runInfo.runId || runInfo.id || ('run_' + Math.random().toString(36).slice(2, 9)),
         at: task.lastRunAt,
         status: task.lastStatus,
         durationMs: task.lastDurationMs,
@@ -697,6 +697,15 @@ export class TaskStore {
         error: runInfo.error ? String(runInfo.error).slice(0, 1000) : null,
         usage,
         costUsd,
+        stages: Array.isArray(runInfo.stages) ? runInfo.stages : null,
+        stoppedReason: runInfo.stoppedReason || null,
+        cost: runInfo.cost || {
+          amount: costUsd,
+          currency: 'USD',
+          kind: costUsd > 0 ? 'exact' : ((task.type === 'llm' || task.type === 'skill' || task.type === 'workflow') ? 'unknown' : 'exact')
+        },
+        delivery: runInfo.delivery || null,
+        validation: runInfo.validation || null,
         sessionId: runInfo.sessionId || null,
         // #45: which model produced the run, and whether it only finished thanks
         // to the configured fallback.

package/lib/task-create.js

@@ -1,4 +1,5 @@
-import { normalizeTaskType } from './runtimes.js';
+import { sanitizeValidators } from './validators.js';
+import { normalizeTaskType, EXTERNAL_RUNTIMES } from './runtimes.js';
 import { validateTaskType } from './task-transfer.js';
 import { parseScheduleExpression } from './scheduler.js';
 import { CHANNEL_IDS } from './channels.js';
@@ -44,7 +45,7 @@ export function executeCreateTask(store, scheduler, args) {
     misfirePolicy: ['skip', 'runOnce', 'catchUpAll'].includes(args.misfirePolicy) ? args.misfirePolicy : 'skip',
     maxRetries: Number(args.maxRetries) > 0 ? Number(args.maxRetries) : 0,
     retryBackoffMs: Number(args.retryBackoffMs) > 0 ? Number(args.retryBackoffMs) : 30000,
-    permissionPreset: ['default', 'read-only', 'workspace-write', 'full'].includes(args.permissionPreset) ? args.permissionPreset : 'default',
+    permissionPreset: !EXTERNAL_RUNTIMES.includes(taskType) && ['default', 'read-only', 'workspace-write', 'full'].includes(args.permissionPreset) ? args.permissionPreset : 'default',
     kanbanMode: args.kanbanMode || 'none',
     channels: Array.isArray(args.channels) ? args.channels.filter((c) => CHANNEL_IDS.includes(c)) : undefined,
     template: args.template ? String(args.template) : '',
@@ -72,6 +73,7 @@ export function executeCreateTask(store, scheduler, args) {
     costLimitUsd: Number(args.costLimitUsd) > 0 ? Number(args.costLimitUsd) : undefined,
     dailyCostLimitUsd: Number(args.dailyCostLimitUsd) > 0 ? Number(args.dailyCostLimitUsd) : undefined,
     tokenLimit: Number(args.tokenLimit) > 0 ? Number(args.tokenLimit) : undefined,
+    validators: Array.isArray(args.validators) ? sanitizeValidators(args.validators) : undefined,
   };
   // Issue #310 / GH #5: strip any undefined properties before store.set()
   for (const k of Object.keys(taskData)) {

package/lib/task-patch.js

@@ -1,3 +1,4 @@
+import { sanitizeValidators } from './validators.js';
 /**
  * Partial task updates, shared by the HTTP PATCH route and the cron tool (action: 'update')
  * tool (#49).
@@ -9,7 +10,7 @@
  */
 
 import { parseScheduleExpression } from './scheduler.js';
-import { normalizeTaskType, CODE_EXECUTING_TYPES } from './runtimes.js';
+import { normalizeTaskType, CODE_EXECUTING_TYPES, EXTERNAL_RUNTIMES } from './runtimes.js';
 import { PATCHABLE_TASK_FIELDS, validateTaskType } from './task-transfer.js';
 import { pickPatchableFields, restoreTaskSecrets } from './http-utils.js';
 import { unknownChannelIds } from './channels.js';
@@ -86,6 +87,9 @@ export function buildTaskPatch(current, body) {
       return { ok: false, error: err.message };
     }
   }
+  if (patch.validators !== undefined) {
+    patch.validators = Array.isArray(patch.validators) ? sanitizeValidators(patch.validators) : [];
+  }
   if (patch.costLimitUsd !== undefined) {
     patch.costLimitUsd = patch.costLimitUsd === null ? null : (Number(patch.costLimitUsd) > 0 ? Number(patch.costLimitUsd) : null);
   }
@@ -95,6 +99,10 @@ export function buildTaskPatch(current, body) {
   if (patch.tokenLimit !== undefined) {
     patch.tokenLimit = patch.tokenLimit === null ? null : (Number(patch.tokenLimit) > 0 ? Number(patch.tokenLimit) : null);
   }
+  const effectiveType = patch.type !== undefined ? normalizeTaskType(patch.type) : current.type;
+  if (EXTERNAL_RUNTIMES.includes(effectiveType) && patch.permissionPreset !== undefined) {
+    patch.permissionPreset = 'default';
+  }
   // Issue #310 / GH #5: strip undefined properties from patch
   for (const k of Object.keys(patch)) {
     if (patch[k] === undefined) {

package/lib/task-transfer.js

@@ -74,6 +74,7 @@ export const PATCHABLE_TASK_FIELDS = [
   'dailyCostLimitUsd',
   'tokenLimit',
   'pausedReason',
+  'validators',
 ];
 
 /** Fields a duplicate inherits; anything else is runtime state, not config. */

package/lib/telegram.js

@@ -210,7 +210,7 @@ export function shouldNotifyTask(task, runInfo, globalSettings = {}) {
   const isEnabled = task.notifyTelegram ?? globalSettings.notifyTelegram ?? false;
   if (!isEnabled) return false;
 
-  const failed = runInfo.status === 'error' || runInfo.status === 'timeout' || runInfo.status === 'missed';
+  const failed = runInfo.status === 'error' || runInfo.status === 'timeout' || runInfo.status === 'missed' || runInfo.status === 'validation_failed' || runInfo.status === 'validator_error';
   const onlyOnFail = task.onlyOnFailure ?? globalSettings.onlyOnFailure ?? false;
   if (onlyOnFail && !failed) {
     return false;

package/lib/validators.js

@@ -0,0 +1,192 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const VALIDATOR_TYPES = ['json', 'regex', 'text', 'exitCode', 'file'];
+
+/**
+ * Validates run output/result against declarative task validators.
+ * Pure and deterministic: never uses eval or dynamic code execution (#316).
+ *
+ * @param {object} task Task record (may have task.validators)
+ * @param {object} runInfo Run result ({ output, stdout, stderr, exitCode, error, status })
+ * @param {object} [options] Context options ({ cwd, workspaceDir })
+ * @returns {{ ok: boolean, status: 'passed' | 'failed' | 'error' | 'skipped', error?: string, details: Array<{ type: string, passed: boolean, message: string }> }}
+ */
+export function validateRunResult(task, runInfo, options = {}) {
+  const validators = Array.isArray(task?.validators) ? task.validators : [];
+  if (validators.length === 0) {
+    return { ok: true, status: 'skipped', details: [] };
+  }
+
+  const details = [];
+  const baseDir = options.workspaceDir || options.cwd || task?.cwd || process.cwd();
+
+  for (let i = 0; i < validators.length; i++) {
+    const v = validators[i];
+    if (!v || typeof v !== 'object') continue;
+    const type = String(v.type || '').trim().toLowerCase();
+
+    try {
+      if (type === 'exitCode') {
+        const expected = Number(v.expected !== undefined ? v.expected : 0);
+        const actual = Number(runInfo.exitCode !== undefined ? runInfo.exitCode : 0);
+        const passed = actual === expected;
+        const message = passed
+          ? `Exit code matches expected (${expected})`
+          : `Expected exit code ${expected}, got ${actual}`;
+        details.push({ type: 'exitCode', passed, message });
+        if (!passed) {
+          return { ok: false, status: 'failed', error: message, details };
+        }
+      } else if (type === 'json') {
+        const text = String(runInfo.output || runInfo.stdout || '').trim();
+        let parsed = null;
+        try {
+          parsed = JSON.parse(text);
+        } catch (jsonErr) {
+          const message = `Output is not valid JSON: ${jsonErr.message}`;
+          details.push({ type: 'json', passed: false, message });
+          return { ok: false, status: 'failed', error: message, details };
+        }
+
+        if (v.statusKey) {
+          const val = parsed[v.statusKey];
+          const expected = v.expected;
+          const passed = expected !== undefined ? String(val) === String(expected) : Boolean(val);
+          const message = passed
+            ? `JSON field "${v.statusKey}" matches expected (${String(expected)})`
+            : `JSON field "${v.statusKey}" value (${JSON.stringify(val)}) does not match expected (${JSON.stringify(expected)})`;
+          details.push({ type: 'json', passed, message });
+          if (!passed) {
+            return { ok: false, status: 'failed', error: message, details };
+          }
+        }
+
+        if (v.path) {
+          const parts = String(v.path).split('.');
+          let cur = parsed;
+          let found = true;
+          for (const p of parts) {
+            if (cur && typeof cur === 'object' && p in cur) {
+              cur = cur[p];
+            } else {
+              found = false;
+              break;
+            }
+          }
+          if (v.mustExist && !found) {
+            const message = `JSON path "${v.path}" not found in output`;
+            details.push({ type: 'json', passed: false, message });
+            return { ok: false, status: 'failed', error: message, details };
+          }
+          if (v.minCount !== undefined && Array.isArray(cur) && cur.length < Number(v.minCount)) {
+            const message = `JSON path "${v.path}" array length (${cur.length}) is less than minCount (${v.minCount})`;
+            details.push({ type: 'json', passed: false, message });
+            return { ok: false, status: 'failed', error: message, details };
+          }
+        }
+
+        details.push({ type: 'json', passed: true, message: 'Valid JSON output' });
+      } else if (type === 'text') {
+        const targetStr = getTargetText(runInfo, v.target);
+        const sub = String(v.text || '');
+        const contains = targetStr.includes(sub);
+        const passed = v.negate ? !contains : contains;
+        const message = passed
+          ? `Text check passed for "${sub}"`
+          : (v.negate ? `Output unexpectedly contains forbidden text "${sub}"` : `Output does not contain required text "${sub}"`);
+        details.push({ type: 'text', passed, message });
+        if (!passed) {
+          return { ok: false, status: 'failed', error: message, details };
+        }
+      } else if (type === 'regex') {
+        const targetStr = getTargetText(runInfo, v.target);
+        const pattern = String(v.pattern || '');
+        let reg;
+        try {
+          reg = new RegExp(pattern, v.flags || 'i');
+        } catch (regErr) {
+          const message = `Invalid regex pattern "${pattern}": ${regErr.message}`;
+          details.push({ type: 'regex', passed: false, message });
+          return { ok: false, status: 'error', error: message, details };
+        }
+        const matches = reg.test(targetStr);
+        const passed = v.negate ? !matches : matches;
+        const message = passed
+          ? `Regex match passed for /${pattern}/`
+          : (v.negate ? `Output matches forbidden pattern /${pattern}/` : `Output does not match required pattern /${pattern}/`);
+        details.push({ type: 'regex', passed, message });
+        if (!passed) {
+          return { ok: false, status: 'failed', error: message, details };
+        }
+      } else if (type === 'file') {
+        const relPath = String(v.path || '').trim();
+        if (!relPath) {
+          details.push({ type: 'file', passed: false, message: 'File path cannot be empty' });
+          return { ok: false, status: 'failed', error: 'File path cannot be empty', details };
+        }
+        // Guard against directory traversal escaping baseDir
+        const resolvedPath = path.resolve(baseDir, relPath);
+        const resolvedBase = path.resolve(baseDir);
+        if (!resolvedPath.startsWith(resolvedBase)) {
+          const message = `File path "${relPath}" escapes allowed directory boundary`;
+          details.push({ type: 'file', passed: false, message });
+          return { ok: false, status: 'failed', error: message, details };
+        }
+
+        const exists = fs.existsSync(resolvedPath);
+        if (v.mustExist !== false && !exists) {
+          const message = `Required file not found: "${relPath}"`;
+          details.push({ type: 'file', passed: false, message });
+          return { ok: false, status: 'failed', error: message, details };
+        }
+
+        if (exists && v.minBytes !== undefined) {
+          const stats = fs.statSync(resolvedPath);
+          if (stats.size < Number(v.minBytes)) {
+            const message = `File "${relPath}" size (${stats.size} bytes) is below minimum (${v.minBytes} bytes)`;
+            details.push({ type: 'file', passed: false, message });
+            return { ok: false, status: 'failed', error: message, details };
+          }
+        }
+        details.push({ type: 'file', passed: true, message: `File check passed for "${relPath}"` });
+      } else {
+        const message = `Unknown validator type "${type}"`;
+        details.push({ type: 'unknown', passed: false, message });
+        return { ok: false, status: 'failed', error: message, details };
+      }
+    } catch (valErr) {
+      const message = `Validator error in ${type}: ${valErr.message}`;
+      details.push({ type, passed: false, message });
+      return { ok: false, status: 'error', error: message, details };
+    }
+  }
+
+  return { ok: true, status: 'passed', details };
+}
+
+function getTargetText(runInfo, target) {
+  if (target === 'stdout') return String(runInfo.stdout ?? runInfo.output ?? '');
+  if (target === 'stderr') return String(runInfo.stderr ?? '');
+  return String(runInfo.output ?? '');
+}
+
+/**
+ * Sanitize and validate validator list for persistence.
+ */
+export function sanitizeValidators(validators) {
+  if (!Array.isArray(validators)) return [];
+  return validators.filter((v) => v && typeof v === 'object' && VALIDATOR_TYPES.includes(String(v.type).toLowerCase())).map((v) => ({
+    type: String(v.type).toLowerCase(),
+    ...(v.pattern !== undefined ? { pattern: String(v.pattern) } : {}),
+    ...(v.text !== undefined ? { text: String(v.text) } : {}),
+    ...(v.flags !== undefined ? { flags: String(v.flags) } : {}),
+    ...(v.negate !== undefined ? { negate: Boolean(v.negate) } : {}),
+    ...(v.statusKey !== undefined ? { statusKey: String(v.statusKey) } : {}),
+    ...(v.expected !== undefined ? { expected: v.expected } : {}),
+    ...(v.path !== undefined ? { path: String(v.path) } : {}),
+    ...(v.mustExist !== undefined ? { mustExist: Boolean(v.mustExist) } : {}),
+    ...(v.minBytes !== undefined ? { minBytes: Number(v.minBytes) } : {}),
+    ...(v.target !== undefined ? { target: String(v.target) } : {}),
+  }));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cron",
-  "version": "0.2.49",
+  "version": "0.2.51",
   "description": "Background automation runner for DSH: isolated agent runs, script/HTTP/SSH/Docker runtimes, cost guard, notifications, heartbeats.",
   "type": "module",
   "main": "lib/index.js",