@goodandready/dsh-cron 0.2.51 → 0.2.52

package/lib/api.js

@@ -1,3 +1,4 @@
+import { approvalManager } from './approval.js';
 import { sanitizeValidators } from './validators.js';
 /**
  * REST surface of the plugin: the /dsh-cron/tasks and /dsh-cron/action route
@@ -371,6 +372,41 @@ async function handleItemPost({ store, scheduler, req, res, url, id, action }) {
     sendJson(res, 200, { ok: true, delivery, run });
     return true;
   }
+  if (action === 'approve' || action === 'reject') {
+    const task = store.get(id);
+    if (!task) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    const body = await readBodyJson(req).catch(() => ({}));
+    const proposalId = body.proposalId || url.searchParams.get('proposalId');
+    const proposal = proposalId
+      ? approvalManager.getProposal(proposalId)
+      : approvalManager.getPendingProposalForTask(id);
+
+    if (!proposal) {
+      sendJson(res, 404, { ok: false, error: 'No pending approval proposal found for this task' });
+      return true;
+    }
+
+    const decision = action === 'approve' ? 'approve' : 'reject';
+    const result = approvalManager.decide(proposal.id, decision, {
+      decidedBy: body.decidedBy || 'web-user',
+      reason: body.reason || '',
+    });
+
+    if (!result.ok) {
+      sendJson(res, 400, result);
+      return true;
+    }
+
+    if (decision === 'approve') {
+      scheduler.runTask(id, { approvedBy: body.decidedBy || 'web-user' }).catch(() => {});
+    }
+
+    sendJson(res, 200, { ok: true, proposal: result.proposal });
+    return true;
+  }
   if (action === 'run') {
     if (!store.get(id)) {
       sendJson(res, 404, NOT_FOUND);

package/lib/approval.js

@@ -0,0 +1,143 @@
+import { randomUUID } from 'node:crypto';
+import { logger } from './logger.js';
+
+/**
+ * Human-in-the-Loop Action Approval Engine (#318).
+ * Manages action approval proposals before execution, ensuring
+ * no dangerous side effects execute without authorized human confirmation.
+ */
+
+export const APPROVAL_STATES = {
+  PENDING: 'pending',
+  APPROVED: 'approved',
+  REJECTED: 'rejected',
+  EXPIRED: 'expired',
+  CANCELLED: 'cancelled',
+};
+
+/**
+ * Clean proposal object for storage and API responses.
+ */
+export function sanitizeProposal(proposal) {
+  if (!proposal || typeof proposal !== 'object') return null;
+  return {
+    id: String(proposal.id || randomUUID()),
+    taskId: String(proposal.taskId || ''),
+    runId: proposal.runId ? String(proposal.runId) : null,
+    actionType: String(proposal.actionType || 'execute'),
+    summary: String(proposal.summary || ''),
+    details: proposal.details && typeof proposal.details === 'object' ? proposal.details : {},
+    requestedAt: Number(proposal.requestedAt) || Date.now(),
+    expiresAt: Number(proposal.expiresAt) || (Date.now() + 3600000), // Default 1 hour
+    state: Object.values(APPROVAL_STATES).includes(proposal.state) ? proposal.state : APPROVAL_STATES.PENDING,
+    decidedAt: proposal.decidedAt ? Number(proposal.decidedAt) : null,
+    decidedBy: proposal.decidedBy ? String(proposal.decidedBy) : null,
+    reason: proposal.reason ? String(proposal.reason) : null,
+  };
+}
+
+/**
+ * In-memory / persistent registry for task proposals.
+ */
+export class ApprovalManager {
+  constructor() {
+    this.proposals = new Map();
+  }
+
+  /**
+   * Create a new pending approval proposal for a task.
+   */
+  createProposal(taskId, runId, { actionType = 'execute', summary = '', details = {}, timeoutMs = 3600000 } = {}) {
+    // If an existing pending proposal exists for this task, invalidate it as superseded
+    for (const [id, prop] of this.proposals.entries()) {
+      if (prop.taskId === taskId && prop.state === APPROVAL_STATES.PENDING) {
+        prop.state = APPROVAL_STATES.CANCELLED;
+        prop.decidedAt = Date.now();
+        prop.reason = 'Superseded by newer proposal';
+      }
+    }
+
+    const proposal = sanitizeProposal({
+      id: 'appr_' + randomUUID().replace(/-/g, '').slice(0, 12),
+      taskId,
+      runId,
+      actionType,
+      summary,
+      details,
+      requestedAt: Date.now(),
+      expiresAt: Date.now() + (Number(timeoutMs) > 0 ? Number(timeoutMs) : 3600000),
+      state: APPROVAL_STATES.PENDING,
+    });
+
+    this.proposals.set(proposal.id, proposal);
+    logger.info(`[dsh-cron] created approval proposal "${proposal.id}" for task "${taskId}": ${summary}`);
+    return proposal;
+  }
+
+  getProposal(proposalId) {
+    const prop = this.proposals.get(proposalId);
+    if (!prop) return null;
+    // Check expiration on read
+    if (prop.state === APPROVAL_STATES.PENDING && Date.now() > prop.expiresAt) {
+      prop.state = APPROVAL_STATES.EXPIRED;
+      prop.decidedAt = Date.now();
+      prop.reason = 'Approval expired';
+    }
+    return prop;
+  }
+
+  getPendingProposalForTask(taskId) {
+    for (const prop of this.proposals.values()) {
+      if (prop.taskId === taskId && prop.state === APPROVAL_STATES.PENDING) {
+        if (Date.now() > prop.expiresAt) {
+          prop.state = APPROVAL_STATES.EXPIRED;
+          prop.decidedAt = Date.now();
+          prop.reason = 'Approval expired';
+          continue;
+        }
+        return prop;
+      }
+    }
+    return null;
+  }
+
+  listProposals({ taskId = null, state = null } = {}) {
+    const list = [];
+    const now = Date.now();
+    for (const prop of this.proposals.values()) {
+      if (prop.state === APPROVAL_STATES.PENDING && now > prop.expiresAt) {
+        prop.state = APPROVAL_STATES.EXPIRED;
+        prop.decidedAt = now;
+        prop.reason = 'Approval expired';
+      }
+      if (taskId && prop.taskId !== taskId) continue;
+      if (state && prop.state !== state) continue;
+      list.push({ ...prop });
+    }
+    return list.sort((a, b) => b.requestedAt - a.requestedAt);
+  }
+
+  /**
+   * Decide on a proposal (approve or reject) with replay and double-click protection.
+   */
+  decide(proposalId, decision, { decidedBy = 'user', reason = '' } = {}) {
+    const prop = this.getProposal(proposalId);
+    if (!prop) {
+      return { ok: false, error: 'Proposal not found' };
+    }
+    if (prop.state !== APPROVAL_STATES.PENDING) {
+      return { ok: false, error: `Proposal already resolved with state: ${prop.state}`, proposal: prop };
+    }
+
+    const state = decision === 'approve' ? APPROVAL_STATES.APPROVED : APPROVAL_STATES.REJECTED;
+    prop.state = state;
+    prop.decidedAt = Date.now();
+    prop.decidedBy = decidedBy;
+    prop.reason = reason;
+
+    logger.info(`[dsh-cron] proposal "${proposalId}" ${state} by ${decidedBy}${reason ? ': ' + reason : ''}`);
+    return { ok: true, proposal: prop };
+  }
+}
+
+export const approvalManager = new ApprovalManager();

package/lib/client.js

@@ -140,14 +140,6 @@ window.__ModuleLoader__.load({
         'history.stage_validation': 'Validation',
         'history.stage_delivery': 'Delivery',
         'history.refresh': 'Refresh history',
-        'history.stoppedReasonTitle': '停止原因:',
-        'history.retryDelivery': '重试推送',
-        'history.retryingDelivery': '重试中...',
-        'history.statusValidationFailed': '校验未通过',
-        'history.stage_queue': '排队',
-        'history.stage_preflight': '前置检查',
-        'history.stage_execution': '执行',
-        'history.stage_validation': '校验',
         'history.stage_delivery': '推送',
         'history.statusSuccess': 'Success',
         'history.statusSkipped': 'Skipped',
@@ -367,6 +359,14 @@ window.__ModuleLoader__.load({
         'form.targetSessionResetDaily': 'Daily rotation (new session each day)',
         'form.targetSessionResetWeekly': 'Weekly rotation (new session each week)',
         'form.targetSessionResetHint': 'Automatically rotates the session identifier to prevent context window explosion over long periods.',
+                'form.requireApprovalLabel': 'Require human approval before execution',
+        'form.requireApprovalHint': 'When enabled, the task will not execute until an authorized user approves the run proposal (#318).',
+        'actions.approve': 'Approve',
+        'actions.reject': 'Reject',
+        'approval.waiting': 'Awaiting human approval',
+        'approval.approved': 'Approved',
+        'approval.rejected': 'Rejected',
+        'recipe.dependenciesMissing': 'Missing required integrations or credentials',
         'form.previewSchedule': 'Preview next runs',
         'form.previewScheduleTitle': 'Next 5 scheduled runs:',
       },
@@ -616,6 +616,14 @@ window.__ModuleLoader__.load({
         'dsh.startFailed': '启动智能体对话失败: {error}',
         'dsh.launchError': '执行错误: {error}',
         'confirm.delete': '确定删除该任务吗？',
+                'form.requireApprovalLabel': '执行前需人工确认审批',
+        'form.requireApprovalHint': '开启后，任务执行前将挂起并等待授权用户批准提议 (#318)。',
+        'actions.approve': '批准',
+        'actions.reject': '拒绝',
+        'approval.waiting': '等待人工审批',
+        'approval.approved': '已批准',
+        'approval.rejected': '已拒绝',
+        'recipe.dependenciesMissing': '缺少必要集成服务或凭据',
         'list.loadErrorPrefix': '加载任务列表失败'
       }
     };
@@ -1272,6 +1280,7 @@ window.__ModuleLoader__.load({
       const [formFallbackModel, setFormFallbackModel] = React.useState('');
       const [formSilentRule, setFormSilentRule] = React.useState('');
       const [formInspectOnFailure, setFormInspectOnFailure] = React.useState(false);
+      const [formRequireApproval, setFormRequireApproval] = React.useState(false);
       const [formDelivery, setFormDelivery] = React.useState('isolated');
       const [selectedTaskMeta, setSelectedTaskMeta] = React.useState(null);
       const [modalTab, setModalTab] = React.useState('params');
@@ -1341,6 +1350,7 @@ window.__ModuleLoader__.load({
         fallbackModel: String(formFallbackModel || ''),
         silentRule: String(formSilentRule || ''),
         inspectOnFailure: Boolean(formInspectOnFailure),
+        requireApproval: Boolean(formRequireApproval),
         delivery: String(formDelivery || 'isolated'),
         notifyTelegram: Boolean(formNotifyTelegram),
         channels: Array.isArray(formChannels) ? [...formChannels].sort() : [],
@@ -1907,6 +1917,42 @@ window.__ModuleLoader__.load({
         }
       };
 
+      const handleApproveProposal = async (taskId, proposalId) => {
+        try {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks/' + encodeURIComponent(taskId) + '/approve', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ proposalId, decidedBy: 'web-user' })
+          });
+          if (data && data.ok) {
+            alert(T_KEY(t, 'approval.approved') || 'Approved');
+            setTimeout(() => fetchTasks(), 1000);
+          } else {
+            alert('Approval failed: ' + ((data && data.error) || ''));
+          }
+        } catch (err) {
+          alert('Approval request failed: ' + err.message);
+        }
+      };
+
+      const handleRejectProposal = async (taskId, proposalId) => {
+        try {
+          const { res, data } = await fetchJsonWithTimeout('/dsh-cron/tasks/' + encodeURIComponent(taskId) + '/reject', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ proposalId, decidedBy: 'web-user' })
+          });
+          if (data && data.ok) {
+            alert(T_KEY(t, 'approval.rejected') || 'Rejected');
+            setTimeout(() => fetchTasks(), 1000);
+          } else {
+            alert('Rejection failed: ' + ((data && data.error) || ''));
+          }
+        } catch (err) {
+          alert('Rejection request failed: ' + err.message);
+        }
+      };
+
       const handleDelete = async (id) => {
         if (!confirm(T_KEY(t, 'confirm.delete'))) return;
         try {
@@ -2049,6 +2095,7 @@ window.__ModuleLoader__.load({
         setFormFallbackModel('');
         setFormSilentRule('');
         setFormInspectOnFailure(false);
+        setFormRequireApproval(false);
         if (preset) {
           setFormTitle(preset.title || '');
           setFormSchedule(preset.schedule || '');
@@ -2058,6 +2105,7 @@ window.__ModuleLoader__.load({
           if (preset.silentRule !== undefined) setFormSilentRule(preset.silentRule || '');
           if (preset.fallbackModel !== undefined) setFormFallbackModel(preset.fallbackModel || '');
           if (preset.inspectOnFailure !== undefined) setFormInspectOnFailure(Boolean(preset.inspectOnFailure));
+          if (preset.requireApproval !== undefined) setFormRequireApproval(Boolean(preset.requireApproval));
           setFormOnlyOnFailure(Boolean(preset.onlyOnFailure));
           setFormProvider(defaultModelInfo?.provider || '');
           setFormModel(defaultModelInfo?.model || '');
@@ -2080,6 +2128,7 @@ window.__ModuleLoader__.load({
           fallbackModel: String((preset && preset.fallbackModel) || '').trim(),
           silentRule: String((preset && preset.silentRule) || '').trim(),
           inspectOnFailure: Boolean(preset && preset.inspectOnFailure),
+          requireApproval: Boolean(preset && preset.requireApproval),
           delivery: 'isolated',
           notifyTelegram: false,
           channels: Array.isArray(preset && preset.channels) ? [...preset.channels].filter((c) => DELIVERY_CHANNELS.includes(c)).sort() : [],
@@ -2174,6 +2223,7 @@ window.__ModuleLoader__.load({
         setFormFallbackModel(task.fallbackModel || '');
         setFormSilentRule(task.silentRule || '');
         setFormInspectOnFailure(Boolean(task.inspectOnFailure));
+        setFormRequireApproval(Boolean(task.requireApproval));
         setFormDelivery(task.delivery || 'isolated');
         setFormNotifyTelegram(Boolean(task.notifyTelegram));
         setFormChannels(Array.isArray(task.channels) ? task.channels.filter((c) => DELIVERY_CHANNELS.includes(c)) : []);
@@ -2271,6 +2321,7 @@ window.__ModuleLoader__.load({
             concurrencyGroup: formConcurrencyGroup.trim() || 'default',
             selfHealingCommand: formSelfHealingCommand.trim() || undefined,
             autoDiagnose: Boolean(formAutoDiagnose),
+            requireApproval: Boolean(formRequireApproval),
             env: parseEnvText(formEnv),
             cwd: formCwd.trim(),
             workspaceId: formWorkspaceId.trim(),
@@ -3057,7 +3108,16 @@ window.__ModuleLoader__.load({
                     }),
                     React.createElement('span', null, T_KEY(t, 'form.inspectOnFailureLabel'))
                   ),
-                  formInspectOnFailure && React.createElement('div', { className: 'dsh-cron-hint' }, T_KEY(t, 'form.inspectOnFailureHint'))
+                  formInspectOnFailure && React.createElement('div', { className: 'dsh-cron-hint' }, T_KEY(t, 'form.inspectOnFailureHint')),
+                  React.createElement('label', { className: 'dsh-cron-checkbox-row', style: { marginTop: '8px' } },
+                    React.createElement('input', {
+                      type: 'checkbox',
+                      checked: formRequireApproval,
+                      onChange: (e) => setFormRequireApproval(e.target.checked)
+                    }),
+                    React.createElement('span', null, T_KEY(t, 'form.requireApprovalLabel'))
+                  ),
+                  formRequireApproval && React.createElement('div', { className: 'dsh-cron-hint' }, T_KEY(t, 'form.requireApprovalHint'))
                 ),
                 formType === 'http' && React.createElement('div', { className: 'dsh-cron-form-row' },
                   React.createElement('div', { className: 'dsh-cron-form-group' },

package/lib/cron-tool.js

@@ -152,6 +152,10 @@ export const cronToolParameters = {
     enum: ['default', 'read-only', 'workspace-write', 'full'],
     description: 'Permission preset applied to the task session (only used for agent session tasks: llm, skill, workflow)',
   },
+  requireApproval: {
+    type: 'boolean',
+    description: 'Require explicit human approval before execution (#318)',
+  },
   validators: {
     type: 'array',
     description: 'Declarative post-execution validation checks (json, regex, text, exitCode, file)',

package/lib/global-budgets.js

@@ -0,0 +1,137 @@
+import { logger } from './logger.js';
+
+/**
+ * Global & Provider/Model Budgets and Rate Limits (#320).
+ * Manages shared expenditure windows and concurrent reservations
+ * across all scheduled tasks.
+ */
+
+export class GlobalBudgetManager {
+  constructor() {
+    this.reservations = new Map(); // reservationId -> { provider, model, costUsd, at }
+  }
+
+  /**
+   * Calculate total expenditure from store history across all tasks
+   * filtered by provider/model and window.
+   */
+  calculateUsage(store, { provider = null, model = null, windowMs = 86400000, now = Date.now() } = {}) {
+    const cutoff = now - windowMs;
+    let totalCostUsd = 0;
+    let totalTokens = 0;
+    let runCount = 0;
+
+    const allTasks = store.list ? store.list() : [];
+    for (const task of allTasks) {
+      if (provider && task.provider && task.provider !== provider) continue;
+      if (model && task.model && task.model !== model) continue;
+
+      const runs = (store.history && store.history.get(task.id)) || [];
+      for (const r of runs) {
+        if (r && typeof r.at === 'number' && r.at >= cutoff) {
+          totalCostUsd += Number(r.costUsd) || 0;
+          if (typeof r.tokens === 'number') {
+            totalTokens += r.tokens;
+          } else if (r.usage) {
+            totalTokens += (r.usage.inputTokens || 0) + (r.usage.outputTokens || 0) + (r.usage.cacheReadTokens || 0);
+          }
+          runCount++;
+        }
+      }
+    }
+
+    return {
+      totalCostUsd: Number(totalCostUsd.toFixed(6)),
+      totalTokens,
+      runCount,
+    };
+  }
+
+  /**
+   * Check if global or provider budget limits are exceeded.
+   */
+  checkBudget(store, task, settings = {}, now = Date.now()) {
+    // 1. Global Monthly / Daily Cost Limit
+    const globalDailyCostLimit = Number(settings.globalDailyCostLimitUsd) || 0;
+    if (globalDailyCostLimit > 0) {
+      const usage = this.calculateUsage(store, { windowMs: 86400000, now });
+      const pendingReservationsCost = this.getActiveReservationsCost();
+      if ((usage.totalCostUsd + pendingReservationsCost) >= globalDailyCostLimit) {
+        return {
+          exceeded: true,
+          type: 'globalDailyCostLimitUsd',
+          reason: `Global daily budget exceeded: $${(usage.totalCostUsd + pendingReservationsCost).toFixed(4)} >= $${globalDailyCostLimit.toFixed(4)}`,
+          current: usage.totalCostUsd,
+          limit: globalDailyCostLimit,
+        };
+      }
+    }
+
+    // 2. Provider Rate Limit (max runs per minute / hour)
+    const provider = task.provider || 'default';
+    const providerHourlyLimit = (settings.providerHourlyRunLimits && Number(settings.providerHourlyRunLimits[provider])) || 0;
+    if (providerHourlyLimit > 0) {
+      const pUsage = this.calculateUsage(store, { provider, windowMs: 3600000, now });
+      if (pUsage.runCount >= providerHourlyLimit) {
+        return {
+          exceeded: true,
+          type: 'providerHourlyLimit',
+          reason: `Provider "${provider}" hourly run limit reached: ${pUsage.runCount} >= ${providerHourlyLimit}`,
+          current: pUsage.runCount,
+          limit: providerHourlyLimit,
+        };
+      }
+    }
+
+    // 3. Model Rate Limit
+    const model = task.model || 'default';
+    const modelHourlyLimit = (settings.modelHourlyRunLimits && Number(settings.modelHourlyRunLimits[model])) || 0;
+    if (modelHourlyLimit > 0) {
+      const mUsage = this.calculateUsage(store, { model, windowMs: 3600000, now });
+      if (mUsage.runCount >= modelHourlyLimit) {
+        return {
+          exceeded: true,
+          type: 'modelHourlyLimit',
+          reason: `Model "${model}" hourly run limit reached: ${mUsage.runCount} >= ${modelHourlyLimit}`,
+          current: mUsage.runCount,
+          limit: modelHourlyLimit,
+        };
+      }
+    }
+
+    return { exceeded: false };
+  }
+
+  reserve(task, estimatedCostUsd = 0.05) {
+    const id = 'res_' + Math.random().toString(36).slice(2, 9);
+    this.reservations.set(id, {
+      taskId: task.id,
+      provider: task.provider || 'default',
+      model: task.model || 'default',
+      costUsd: Number(estimatedCostUsd) || 0,
+      at: Date.now(),
+    });
+    return id;
+  }
+
+  settle(reservationId) {
+    if (reservationId) {
+      this.reservations.delete(reservationId);
+    }
+  }
+
+  getActiveReservationsCost() {
+    let sum = 0;
+    const cutoff = Date.now() - 300000; // 5 min TTL on stale reservations
+    for (const [id, r] of this.reservations.entries()) {
+      if (r.at < cutoff) {
+        this.reservations.delete(id);
+      } else {
+        sum += r.costUsd;
+      }
+    }
+    return sum;
+  }
+}
+
+export const globalBudgetManager = new GlobalBudgetManager();

package/lib/recipes-catalog.js

@@ -0,0 +1,107 @@
+import { RECIPES as BASE_RECIPES } from './recipes.js';
+
+/**
+ * Enhanced Verified Recipes Catalog with guided parameters, dependencies, and test runs (#322).
+ */
+
+export const EXTENDED_RECIPES = [
+  ...BASE_RECIPES,
+  {
+    id: 'recipe_gitea_issues_digest',
+    category: 'maintenance',
+    title: 'Gitea Issues Weekly Digest',
+    description: 'Summarises open bugs and feature issues from local Gitea and reports triage status.',
+    type: 'llm',
+    schedule: '0 9 * * 1',
+    scheduleText: 'Mondays at 09:00',
+    prompt: 'Query open Gitea issues. Group by priority and scope, highlight stale issues, and produce an actionable weekly triage digest.',
+    channels: ['telegram'],
+    silentRule: 'Stay silent when there are no new or updated issues in the past 7 days.',
+    dependencies: {
+      integrations: ['gitea'],
+      credentials: ['giteaTokenRef'],
+    },
+    parameters: [
+      { name: 'repo', label: 'Repository (owner/name)', type: 'string', default: 'goodandready/dsh-cron' },
+      { name: 'daysBack', label: 'Days back', type: 'number', default: 7 },
+    ],
+  },
+  {
+    id: 'recipe_security_dependency_audit',
+    category: 'security',
+    title: 'NPM Dependency Security Audit',
+    description: 'Runs npm audit in repository directory and alerts on critical or high vulnerabilities.',
+    type: 'script',
+    schedule: '0 6 * * 1',
+    scheduleText: 'Mondays at 06:00',
+    prompt: 'npm audit --audit-level=high 2>&1 || { echo "CRITICAL / HIGH vulnerabilities found!"; exit 1; }',
+    channels: ['telegram'],
+    silentRule: 'Stay silent when npm audit finds 0 high/critical vulnerabilities.',
+    dependencies: {
+      integrations: ['shell'],
+    },
+    parameters: [
+      { name: 'cwd', label: 'Working Directory', type: 'string', default: '.' },
+    ],
+  },
+  {
+    id: 'recipe_model_cost_summary',
+    category: 'system',
+    title: 'Daily Model Spend & Token Telemetry',
+    description: 'Computes rolling 24h spend across all models and warns if daily cost exceeds threshold.',
+    type: 'llm',
+    schedule: '0 23 * * *',
+    scheduleText: 'Every day at 23:00',
+    prompt: 'Analyze token usage ledger across all active cron jobs. Provide cost breakdown per model and identify anomalies.',
+    channels: ['telegram'],
+    silentRule: 'Stay silent when total daily expenditure is under $0.10.',
+    dependencies: {
+      integrations: ['cron-store'],
+    },
+    parameters: [
+      { name: 'thresholdUsd', label: 'Alert Threshold (USD)', type: 'number', default: 1.0 },
+    ],
+  },
+];
+
+/**
+ * Validate recipe dependencies against host settings.
+ * Returns { ok: boolean, missing: string[] }
+ */
+export function validateRecipeDependencies(recipe, settings = {}) {
+  if (!recipe || !recipe.dependencies) return { ok: true, missing: [] };
+  const missing = [];
+  const deps = recipe.dependencies;
+
+  if (Array.isArray(deps.credentials)) {
+    for (const cred of deps.credentials) {
+      if (!settings[cred] && !settings[cred.replace('Ref', '')]) {
+        missing.push(`Credential: ${cred}`);
+      }
+    }
+  }
+
+  if (Array.isArray(deps.integrations)) {
+    for (const integ of deps.integrations) {
+      if (integ === 'gitea' && !settings.giteaBaseUrl) {
+        missing.push('Integration: Gitea (giteaBaseUrl not configured)');
+      }
+    }
+  }
+
+  return {
+    ok: missing.length === 0,
+    missing,
+  };
+}
+
+export function listVerifiedRecipes(settings = {}) {
+  return EXTENDED_RECIPES.map((r) => {
+    const depCheck = validateRecipeDependencies(r, settings);
+    return {
+      ...r,
+      dependenciesValid: depCheck.ok,
+      missingDependencies: depCheck.missing,
+    };
+  });
+}

package/lib/routes.js

@@ -1,3 +1,4 @@
+import { listVerifiedRecipes } from './recipes-catalog.js';
 import { randomUUID } from 'node:crypto';
 import { createCronApiHandler } from './api.js';
 import { createMetricsHandler } from './metrics.js';
@@ -93,8 +94,9 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
           sendJson(res, 405, { ok: false, error: 'Method not allowed' });
           return;
         }
+        const settings = store.getSettings ? store.getSettings() : {};
         const categories = recipesByCategory();
-        const recipes = categories.reduce((acc, category) => acc.concat(category.recipes), []);
+        const recipes = listVerifiedRecipes(settings);
         sendJson(res, 200, { ok: true, categories, recipes });
       } catch (err) {
         sendJson(res, err.statusCode || 500, { ok: false, error: err.message });

package/lib/scheduler-execution.js

@@ -1,3 +1,5 @@
+import { approvalManager } from './approval.js';
+import { globalBudgetManager } from './global-budgets.js';
 import { validateRunResult } from './validators.js';
 import { logger } from './logger.js';
 import { checkAndApplyBurnGuard, checkTaskBudgetLimits } from './burn-guard.js';
@@ -309,6 +311,30 @@ export async function executeTask(scheduler, taskId, options = {}) {
     };
   }
 
+  // 1. Approval Gate (#318): Human-in-the-loop check before executing actions requiring approval
+  if (task.requireApproval && !options.approvedBy) {
+    let pending = approvalManager.getPendingProposalForTask(taskId);
+    if (!pending) {
+      pending = approvalManager.createProposal(taskId, null, {
+        actionType: 'run',
+        summary: `Execution of task "${task.title}" requires human approval`,
+        details: { prompt: task.prompt, type: task.type, model: task.model }
+      });
+    }
+    logger.info(`[dsh-cron] Task "${task.title}" (${taskId}) paused awaiting human approval (${pending.id})`);
+    scheduler.recordSkipped(taskId, `Awaiting human approval: proposal ${pending.id}`);
+    return { ok: false, status: 'waiting_approval', proposalId: pending.id, stoppedReason: 'Awaiting human approval' };
+  }
+
+  // 2. Global & Provider/Model Budgets (#320)
+  const settings = typeof scheduler.store.getSettings === 'function' ? scheduler.store.getSettings() : {};
+  const globalBudget = globalBudgetManager.checkBudget(scheduler.store, task, settings);
+  if (globalBudget.exceeded) {
+    logger.warn(`[dsh-cron] Global budget limit blocked task "${task.title}" (${taskId}): ${globalBudget.reason}`);
+    scheduler.recordSkipped(taskId, `Budget limit reached: ${globalBudget.reason}`);
+    return { ok: false, status: 'error', error: globalBudget.reason, budgetBlocked: true };
+  }
+
   // Pre-flight Burn Guard check (#181): prevent executing task if budget already breached
   const runs = (scheduler.store.history && scheduler.store.history.get(taskId)) || [];
   const guard = checkTaskBudgetLimits(task, runs);
@@ -339,7 +365,13 @@ export async function executeTask(scheduler, taskId, options = {}) {
   }
 
   const start = Date.now();
-  const outcome = await scheduler.executeWithFallback(task, currentRun.controller.signal, options);
+  const reservationId = globalBudgetManager.reserve(task);
+  let outcome;
+  try {
+    outcome = await scheduler.executeWithFallback(task, currentRun.controller.signal, options);
+  } finally {
+    globalBudgetManager.settle(reservationId);
+  }
   await scheduler.completeRun(task, taskId, currentRun, outcome, start, {
     ...options,
     preflightDurationMs,

package/lib/settings.js

@@ -47,6 +47,10 @@ export const Config = z.object({
   giteaLabels: z.any().default([]).description('Gitea label names or IDs for alert issues').volatile(),
   giteaLabelIds: z.any().default({}).description('Mapping of label name to integer ID for Gitea issues').volatile(),
   prReviewerEnabled: z.boolean().default(false).description('Enable automated PR Reviewer scheduled agent (#33)').volatile(),
+  // --- Global Budgets (#320) ---
+  globalDailyCostLimitUsd: z.number().default(0).description('Global daily expenditure limit in USD across all tasks (0 = unlimited)').volatile(),
+  providerHourlyRunLimits: z.object({}).default({}).description('Max runs per hour keyed by provider').volatile(),
+  modelHourlyRunLimits: z.object({}).default({}).description('Max runs per hour keyed by model').volatile(),
   // --- Declarative jobs (#50, ADR-0001) ---
   jobs: z.array(z.any()).default([]).description('Static jobs owned by the config; each entry needs id, title, schedule and (for agent types) prompt'),
   // --- External REST API (#54, ADR-0001) ---
@@ -83,6 +87,7 @@ export const SETTINGS_SYNC_KEYS = [
   'ttsBaseUrl',
   'giteaBaseUrl', 'giteaRepo', 'giteaTokenRef', 'giteaLabels', 'giteaLabelIds', 'prReviewerEnabled',
   'apiToken',
+  'globalDailyCostLimitUsd', 'providerHourlyRunLimits', 'modelHourlyRunLimits',
 ];
 
 /**

package/lib/task-create.js

@@ -74,6 +74,7 @@ export function executeCreateTask(store, scheduler, args) {
     dailyCostLimitUsd: Number(args.dailyCostLimitUsd) > 0 ? Number(args.dailyCostLimitUsd) : undefined,
     tokenLimit: Number(args.tokenLimit) > 0 ? Number(args.tokenLimit) : undefined,
     validators: Array.isArray(args.validators) ? sanitizeValidators(args.validators) : undefined,
+    requireApproval: Boolean(args.requireApproval),
   };
   // Issue #310 / GH #5: strip any undefined properties before store.set()
   for (const k of Object.keys(taskData)) {

package/lib/task-patch.js

@@ -87,6 +87,9 @@ export function buildTaskPatch(current, body) {
       return { ok: false, error: err.message };
     }
   }
+  if (patch.requireApproval !== undefined) {
+    patch.requireApproval = Boolean(patch.requireApproval);
+  }
   if (patch.validators !== undefined) {
     patch.validators = Array.isArray(patch.validators) ? sanitizeValidators(patch.validators) : [];
   }

package/lib/task-transfer.js

@@ -75,6 +75,7 @@ export const PATCHABLE_TASK_FIELDS = [
   'tokenLimit',
   'pausedReason',
   'validators',
+  'requireApproval',
 ];
 
 /** Fields a duplicate inherits; anything else is runtime state, not config. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cron",
-  "version": "0.2.51",
+  "version": "0.2.52",
   "description": "Background automation runner for DSH: isolated agent runs, script/HTTP/SSH/Docker runtimes, cost guard, notifications, heartbeats.",
   "type": "module",
   "main": "lib/index.js",