@goodandready/dsh-cron 0.2.51 → 0.3.0

package/lib/global-budgets.js

@@ -0,0 +1,137 @@
+import { logger } from './logger.js';
+
+/**
+ * Global & Provider/Model Budgets and Rate Limits (#320).
+ * Manages shared expenditure windows and concurrent reservations
+ * across all scheduled tasks.
+ */
+
+export class GlobalBudgetManager {
+  constructor() {
+    this.reservations = new Map(); // reservationId -> { provider, model, costUsd, at }
+  }
+
+  /**
+   * Calculate total expenditure from store history across all tasks
+   * filtered by provider/model and window.
+   */
+  calculateUsage(store, { provider = null, model = null, windowMs = 86400000, now = Date.now() } = {}) {
+    const cutoff = now - windowMs;
+    let totalCostUsd = 0;
+    let totalTokens = 0;
+    let runCount = 0;
+
+    const allTasks = store.list ? store.list() : [];
+    for (const task of allTasks) {
+      if (provider && task.provider && task.provider !== provider) continue;
+      if (model && task.model && task.model !== model) continue;
+
+      const runs = (store.history && store.history.get(task.id)) || [];
+      for (const r of runs) {
+        if (r && typeof r.at === 'number' && r.at >= cutoff) {
+          totalCostUsd += Number(r.costUsd) || 0;
+          if (typeof r.tokens === 'number') {
+            totalTokens += r.tokens;
+          } else if (r.usage) {
+            totalTokens += (r.usage.inputTokens || 0) + (r.usage.outputTokens || 0) + (r.usage.cacheReadTokens || 0);
+          }
+          runCount++;
+        }
+      }
+    }
+
+    return {
+      totalCostUsd: Number(totalCostUsd.toFixed(6)),
+      totalTokens,
+      runCount,
+    };
+  }
+
+  /**
+   * Check if global or provider budget limits are exceeded.
+   */
+  checkBudget(store, task, settings = {}, now = Date.now()) {
+    // 1. Global Monthly / Daily Cost Limit
+    const globalDailyCostLimit = Number(settings.globalDailyCostLimitUsd) || 0;
+    if (globalDailyCostLimit > 0) {
+      const usage = this.calculateUsage(store, { windowMs: 86400000, now });
+      const pendingReservationsCost = this.getActiveReservationsCost();
+      if ((usage.totalCostUsd + pendingReservationsCost) >= globalDailyCostLimit) {
+        return {
+          exceeded: true,
+          type: 'globalDailyCostLimitUsd',
+          reason: `Global daily budget exceeded: $${(usage.totalCostUsd + pendingReservationsCost).toFixed(4)} >= $${globalDailyCostLimit.toFixed(4)}`,
+          current: usage.totalCostUsd,
+          limit: globalDailyCostLimit,
+        };
+      }
+    }
+
+    // 2. Provider Rate Limit (max runs per minute / hour)
+    const provider = task.provider || 'default';
+    const providerHourlyLimit = (settings.providerHourlyRunLimits && Number(settings.providerHourlyRunLimits[provider])) || 0;
+    if (providerHourlyLimit > 0) {
+      const pUsage = this.calculateUsage(store, { provider, windowMs: 3600000, now });
+      if (pUsage.runCount >= providerHourlyLimit) {
+        return {
+          exceeded: true,
+          type: 'providerHourlyLimit',
+          reason: `Provider "${provider}" hourly run limit reached: ${pUsage.runCount} >= ${providerHourlyLimit}`,
+          current: pUsage.runCount,
+          limit: providerHourlyLimit,
+        };
+      }
+    }
+
+    // 3. Model Rate Limit
+    const model = task.model || 'default';
+    const modelHourlyLimit = (settings.modelHourlyRunLimits && Number(settings.modelHourlyRunLimits[model])) || 0;
+    if (modelHourlyLimit > 0) {
+      const mUsage = this.calculateUsage(store, { model, windowMs: 3600000, now });
+      if (mUsage.runCount >= modelHourlyLimit) {
+        return {
+          exceeded: true,
+          type: 'modelHourlyLimit',
+          reason: `Model "${model}" hourly run limit reached: ${mUsage.runCount} >= ${modelHourlyLimit}`,
+          current: mUsage.runCount,
+          limit: modelHourlyLimit,
+        };
+      }
+    }
+
+    return { exceeded: false };
+  }
+
+  reserve(task, estimatedCostUsd = 0.05) {
+    const id = 'res_' + Math.random().toString(36).slice(2, 9);
+    this.reservations.set(id, {
+      taskId: task.id,
+      provider: task.provider || 'default',
+      model: task.model || 'default',
+      costUsd: Number(estimatedCostUsd) || 0,
+      at: Date.now(),
+    });
+    return id;
+  }
+
+  settle(reservationId) {
+    if (reservationId) {
+      this.reservations.delete(reservationId);
+    }
+  }
+
+  getActiveReservationsCost() {
+    let sum = 0;
+    const cutoff = Date.now() - 300000; // 5 min TTL on stale reservations
+    for (const [id, r] of this.reservations.entries()) {
+      if (r.at < cutoff) {
+        this.reservations.delete(id);
+      } else {
+        sum += r.costUsd;
+      }
+    }
+    return sum;
+  }
+}
+
+export const globalBudgetManager = new GlobalBudgetManager();

package/lib/recipes-catalog.js

@@ -0,0 +1,107 @@
+import { RECIPES as BASE_RECIPES } from './recipes.js';
+
+/**
+ * Enhanced Verified Recipes Catalog with guided parameters, dependencies, and test runs (#322).
+ */
+
+export const EXTENDED_RECIPES = [
+  ...BASE_RECIPES,
+  {
+    id: 'recipe_gitea_issues_digest',
+    category: 'maintenance',
+    title: 'Gitea Issues Weekly Digest',
+    description: 'Summarises open bugs and feature issues from local Gitea and reports triage status.',
+    type: 'llm',
+    schedule: '0 9 * * 1',
+    scheduleText: 'Mondays at 09:00',
+    prompt: 'Query open Gitea issues. Group by priority and scope, highlight stale issues, and produce an actionable weekly triage digest.',
+    channels: ['telegram'],
+    silentRule: 'Stay silent when there are no new or updated issues in the past 7 days.',
+    dependencies: {
+      integrations: ['gitea'],
+      credentials: ['giteaTokenRef'],
+    },
+    parameters: [
+      { name: 'repo', label: 'Repository (owner/name)', type: 'string', default: 'goodandready/dsh-cron' },
+      { name: 'daysBack', label: 'Days back', type: 'number', default: 7 },
+    ],
+  },
+  {
+    id: 'recipe_security_dependency_audit',
+    category: 'security',
+    title: 'NPM Dependency Security Audit',
+    description: 'Runs npm audit in repository directory and alerts on critical or high vulnerabilities.',
+    type: 'script',
+    schedule: '0 6 * * 1',
+    scheduleText: 'Mondays at 06:00',
+    prompt: 'npm audit --audit-level=high 2>&1 || { echo "CRITICAL / HIGH vulnerabilities found!"; exit 1; }',
+    channels: ['telegram'],
+    silentRule: 'Stay silent when npm audit finds 0 high/critical vulnerabilities.',
+    dependencies: {
+      integrations: ['shell'],
+    },
+    parameters: [
+      { name: 'cwd', label: 'Working Directory', type: 'string', default: '.' },
+    ],
+  },
+  {
+    id: 'recipe_model_cost_summary',
+    category: 'system',
+    title: 'Daily Model Spend & Token Telemetry',
+    description: 'Computes rolling 24h spend across all models and warns if daily cost exceeds threshold.',
+    type: 'llm',
+    schedule: '0 23 * * *',
+    scheduleText: 'Every day at 23:00',
+    prompt: 'Analyze token usage ledger across all active cron jobs. Provide cost breakdown per model and identify anomalies.',
+    channels: ['telegram'],
+    silentRule: 'Stay silent when total daily expenditure is under $0.10.',
+    dependencies: {
+      integrations: ['cron-store'],
+    },
+    parameters: [
+      { name: 'thresholdUsd', label: 'Alert Threshold (USD)', type: 'number', default: 1.0 },
+    ],
+  },
+];
+
+/**
+ * Validate recipe dependencies against host settings.
+ * Returns { ok: boolean, missing: string[] }
+ */
+export function validateRecipeDependencies(recipe, settings = {}) {
+  if (!recipe || !recipe.dependencies) return { ok: true, missing: [] };
+  const missing = [];
+  const deps = recipe.dependencies;
+
+  if (Array.isArray(deps.credentials)) {
+    for (const cred of deps.credentials) {
+      if (!settings[cred] && !settings[cred.replace('Ref', '')]) {
+        missing.push(`Credential: ${cred}`);
+      }
+    }
+  }
+
+  if (Array.isArray(deps.integrations)) {
+    for (const integ of deps.integrations) {
+      if (integ === 'gitea' && !settings.giteaBaseUrl) {
+        missing.push('Integration: Gitea (giteaBaseUrl not configured)');
+      }
+    }
+  }
+
+  return {
+    ok: missing.length === 0,
+    missing,
+  };
+}
+
+export function listVerifiedRecipes(settings = {}) {
+  return EXTENDED_RECIPES.map((r) => {
+    const depCheck = validateRecipeDependencies(r, settings);
+    return {
+      ...r,
+      dependenciesValid: depCheck.ok,
+      missingDependencies: depCheck.missing,
+    };
+  });
+}

package/lib/routes.js

@@ -1,3 +1,4 @@
+import { listVerifiedRecipes } from './recipes-catalog.js';
 import { randomUUID } from 'node:crypto';
 import { createCronApiHandler } from './api.js';
 import { createMetricsHandler } from './metrics.js';
@@ -43,6 +44,21 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
     handler: createCronApiHandler(store, scheduler, null)
   }), 'dsh-cron: /schedule[...]');
 
+
+  // Chain retry from failed step (#319)
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'prefix',
+    path: '/dsh-cron/chains',
+    handler: (req, res) => handleChainRoutes(store, scheduler, req, res)
+  }), 'dsh-cron: /chains[...]');
+
+  // Run artifacts listing, download and safe preview (#321)
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'prefix',
+    path: '/dsh-cron/runs',
+    handler: (req, res) => handleRunArtifactRoutes(store, req, res)
+  }), 'dsh-cron: /runs[...]');
+
   // GET /dsh-cron/metrics (#53) — Prometheus text exposition
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
@@ -93,8 +109,9 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
           sendJson(res, 405, { ok: false, error: 'Method not allowed' });
           return;
         }
+        const settings = store.getSettings ? store.getSettings() : {};
         const categories = recipesByCategory();
-        const recipes = categories.reduce((acc, category) => acc.concat(category.recipes), []);
+        const recipes = listVerifiedRecipes(settings);
         sendJson(res, 200, { ok: true, categories, recipes });
       } catch (err) {
         sendJson(res, err.statusCode || 500, { ok: false, error: err.message });
@@ -196,3 +213,72 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
   }), 'dsh-cron: /kanban/test');
 }
 
+
+/**
+ * Handler for chain step retries (#319)
+ */
+export async function handleChainRoutes(store, scheduler, req, res) {
+  if (req.method === 'POST' && rejectCrossOrigin(req, res)) return;
+  const url = new URL(req.url, 'http://localhost');
+  const m = url.pathname.match(/^\/dsh-cron\/chains\/([^\/]+)\/retry-from\/([^\/]+)$/);
+  if (!m) {
+    sendJson(res, 404, { ok: false, error: 'Route not found' });
+    return;
+  }
+  if (req.method !== 'POST') {
+    sendJson(res, 405, { ok: false, error: 'Method not allowed' });
+    return;
+  }
+  const [, chainRunId, stepTaskId] = m;
+  const result = await store.chainCheckpointManager.retryChainFromStep(scheduler, chainRunId, stepTaskId);
+  if (!result.ok) {
+    sendJson(res, 400, result);
+    return;
+  }
+  sendJson(res, 200, result);
+}
+
+/**
+ * Handler for run artifacts (#321)
+ */
+export async function handleRunArtifactRoutes(store, req, res) {
+  const url = new URL(req.url, 'http://localhost');
+  const m = url.pathname.match(/^\/dsh-cron\/runs\/([^\/]+)\/artifacts(?:\/([^\/]+)(?:\/(preview))?)?$/);
+  if (!m) {
+    sendJson(res, 404, { ok: false, error: 'Route not found' });
+    return;
+  }
+  if (req.method !== 'GET') {
+    sendJson(res, 405, { ok: false, error: 'Method not allowed' });
+    return;
+  }
+  const [, runId, artifactId, action] = m;
+  if (!artifactId) {
+    const artifacts = store.getArtifactsForRun(runId);
+    sendJson(res, 200, { ok: true, runId, artifacts });
+    return;
+  }
+  const artifacts = store.getArtifactsForRun(runId);
+  const record = artifacts.find((a) => a.id === artifactId);
+  if (!record) {
+    sendJson(res, 404, { ok: false, error: 'Artifact record not found' });
+    return;
+  }
+  if (action === 'preview') {
+    const preview = store.artifactManager.generatePreview(artifactId, record.name);
+    sendJson(res, preview.ok ? 200 : 404, preview);
+    return;
+  }
+  const buf = store.artifactManager.readArtifact(artifactId, record.name);
+  if (!buf) {
+    sendJson(res, 404, { ok: false, error: 'Artifact file missing from disk (expired or removed)' });
+    return;
+  }
+  res.writeHead(200, {
+    'Content-Type': record.mimeType || 'application/octet-stream',
+    'Content-Disposition': `attachment; filename="${encodeURIComponent(record.name)}"`,
+    'Content-Length': buf.length,
+    'X-Content-Type-Options': 'nosniff',
+  });
+  res.end(buf);
+}

package/lib/scheduler-execution.js

@@ -1,3 +1,5 @@
+import { approvalManager } from './approval.js';
+import { globalBudgetManager } from './global-budgets.js';
 import { validateRunResult } from './validators.js';
 import { logger } from './logger.js';
 import { checkAndApplyBurnGuard, checkTaskBudgetLimits } from './burn-guard.js';
@@ -308,6 +310,47 @@ export async function executeTask(scheduler, taskId, options = {}) {
       model: outcome.model || task.model || '',
     };
   }
+  // 0. Idempotency Check (#317): deduplicate runs with an already completed idempotency key
+  if (options.idempotencyKey && scheduler.store.durableJournal) {
+    const existing = scheduler.store.durableJournal.isIdempotencyKeyExecuted(taskId, options.idempotencyKey);
+    if (existing) {
+      logger.info(`[dsh-cron] Idempotency key "${options.idempotencyKey}" already executed for task "${taskId}", returning cached run`);
+      return {
+        ok: existing.status === 'completed' || existing.status === 'success',
+        idempotentReplay: true,
+        runId: existing.id,
+        status: existing.status,
+        output: existing.output,
+        costUsd: existing.costUsd,
+        durationMs: existing.durationMs,
+      };
+    }
+  }
+
+
+  // 1. Approval Gate (#318): Human-in-the-loop check before executing actions requiring approval
+  if (task.requireApproval && !options.approvedBy) {
+    let pending = approvalManager.getPendingProposalForTask(taskId);
+    if (!pending) {
+      pending = approvalManager.createProposal(taskId, null, {
+        actionType: 'run',
+        summary: `Execution of task "${task.title}" requires human approval`,
+        details: { prompt: task.prompt, type: task.type, model: task.model }
+      });
+    }
+    logger.info(`[dsh-cron] Task "${task.title}" (${taskId}) paused awaiting human approval (${pending.id})`);
+    scheduler.recordSkipped(taskId, `Awaiting human approval: proposal ${pending.id}`);
+    return { ok: false, status: 'waiting_approval', proposalId: pending.id, stoppedReason: 'Awaiting human approval' };
+  }
+
+  // 2. Global & Provider/Model Budgets (#320)
+  const settings = typeof scheduler.store.getSettings === 'function' ? scheduler.store.getSettings() : {};
+  const globalBudget = globalBudgetManager.checkBudget(scheduler.store, task, settings);
+  if (globalBudget.exceeded) {
+    logger.warn(`[dsh-cron] Global budget limit blocked task "${task.title}" (${taskId}): ${globalBudget.reason}`);
+    scheduler.recordSkipped(taskId, `Budget limit reached: ${globalBudget.reason}`);
+    return { ok: false, status: 'error', error: globalBudget.reason, budgetBlocked: true };
+  }
 
   // Pre-flight Burn Guard check (#181): prevent executing task if budget already breached
   const runs = (scheduler.store.history && scheduler.store.history.get(taskId)) || [];
@@ -339,7 +382,13 @@ export async function executeTask(scheduler, taskId, options = {}) {
   }
 
   const start = Date.now();
-  const outcome = await scheduler.executeWithFallback(task, currentRun.controller.signal, options);
+  const reservationId = globalBudgetManager.reserve(task);
+  let outcome;
+  try {
+    outcome = await scheduler.executeWithFallback(task, currentRun.controller.signal, options);
+  } finally {
+    globalBudgetManager.settle(reservationId);
+  }
   await scheduler.completeRun(task, taskId, currentRun, outcome, start, {
     ...options,
     preflightDurationMs,
@@ -667,6 +716,46 @@ export async function handleCompleteRun(scheduler, task, taskId, currentRun, out
     kind: (Number(outcome.costUsd) > 0) ? 'exact' : ((task.type === 'llm' || task.type === 'skill' || task.type === 'workflow') ? 'unknown' : 'exact'),
   };
   runInfo.stoppedReason = computeStoppedReason(outcome.status, valRes, outcome.error);
+  // Durable journal & Idempotency (#317)
+  runInfo.idempotencyKey = options.idempotencyKey || currentRun?.idempotencyKey || null;
+
+  // Artifacts capture (#321)
+  if (Array.isArray(outcome.artifacts) && scheduler.store.artifactManager) {
+    for (const art of outcome.artifacts) {
+      if (art && art.name && (art.content || art.data)) {
+        try {
+          scheduler.store.artifactManager.saveArtifact(runInfo.runId, taskId, art.name, art.content || art.data);
+        } catch (artErr) {
+          logger.warn(`[dsh-cron] failed to save artifact ${art.name}:`, artErr.message);
+        }
+      }
+    }
+  }
+  if (scheduler.store.getArtifactsForRun) {
+    runInfo.artifacts = scheduler.store.getArtifactsForRun(runInfo.runId);
+  }
+
+  // Chain Checkpoints (#319)
+  const chainedTarget = outcome.status === 'success' ? task.onSuccess : task.onFailure;
+  const chainRunId = options.chainRunId || (chainedTarget ? ('chain_' + Math.random().toString(36).slice(2, 10)) : null);
+  if (chainRunId) {
+    runInfo.chainRunId = chainRunId;
+    if (scheduler.store.chainCheckpointManager) {
+      scheduler.store.chainCheckpointManager.recordStepSnapshot(chainRunId, taskId, {
+        status: outcome.status,
+        input: { prompt: task.prompt, prevOutput: options.prevOutput || options.chainPrevOutput || '' },
+        output: outcome.output || outcome.error || '',
+        durationMs: executionMs,
+      });
+    }
+  }
+
+  // Update Durable Journal (#317)
+  if (scheduler.store.durableJournal) {
+    const journalState = outcome.status === 'success' ? 'completed' : (outcome.status === 'uncertain' ? 'uncertain' : 'failed');
+    scheduler.store.durableJournal.transition(taskId, runInfo.runId, journalState, runInfo);
+  }
+
 
   try {
     scheduler.store.recordRun(taskId, runInfo);
@@ -763,6 +852,7 @@ export async function handleCompleteRun(scheduler, task, taskId, currentRun, out
       if (nextTask) {
         logger.info(`[dsh-cron] triggering chained task "${nextTask.title}" (${targetId}) from "${task.title}" (depth ${currentDepth + 1})`);
         scheduler.runNow(targetId, {
+          chainRunId,
           chainDepth: currentDepth + 1,
           prevOutput: outcome.output || outcome.error || '',
           prevTaskId: task.id,

package/lib/scheduler.js

@@ -361,6 +361,26 @@ export class TaskScheduler {
   start() {
     this.isStopped = false;
     this.generation = (this.generation || 0) + 1;
+
+    // Recovery & cleanup on restart (#317, #321)
+    if (this.store && this.store.durableJournal) {
+      try {
+        const recovered = this.store.durableJournal.recoverPendingRuns(this);
+        if (recovered.uncertain.length > 0) {
+          logger.warn(`[dsh-cron] Recovered ${recovered.uncertain.length} in-flight run(s) interrupted by restart -> status marked uncertain`);
+        }
+      } catch (recErr) {
+        logger.error('[dsh-cron] restart recovery failed:', recErr.message);
+      }
+    }
+    if (this.store && this.store.artifactManager) {
+      try {
+        this.store.artifactManager.cleanupArtifacts(this.store);
+      } catch (cleanErr) {
+        logger.warn('[dsh-cron] artifact cleanup failed:', cleanErr.message);
+      }
+    }
+
     const tasks = this.store.list();
     const now = Date.now();
     for (const task of tasks) {

package/lib/settings.js

@@ -47,6 +47,10 @@ export const Config = z.object({
   giteaLabels: z.any().default([]).description('Gitea label names or IDs for alert issues').volatile(),
   giteaLabelIds: z.any().default({}).description('Mapping of label name to integer ID for Gitea issues').volatile(),
   prReviewerEnabled: z.boolean().default(false).description('Enable automated PR Reviewer scheduled agent (#33)').volatile(),
+  // --- Global Budgets (#320) ---
+  globalDailyCostLimitUsd: z.number().default(0).description('Global daily expenditure limit in USD across all tasks (0 = unlimited)').volatile(),
+  providerHourlyRunLimits: z.object({}).default({}).description('Max runs per hour keyed by provider').volatile(),
+  modelHourlyRunLimits: z.object({}).default({}).description('Max runs per hour keyed by model').volatile(),
   // --- Declarative jobs (#50, ADR-0001) ---
   jobs: z.array(z.any()).default([]).description('Static jobs owned by the config; each entry needs id, title, schedule and (for agent types) prompt'),
   // --- External REST API (#54, ADR-0001) ---
@@ -83,6 +87,7 @@ export const SETTINGS_SYNC_KEYS = [
   'ttsBaseUrl',
   'giteaBaseUrl', 'giteaRepo', 'giteaTokenRef', 'giteaLabels', 'giteaLabelIds', 'prReviewerEnabled',
   'apiToken',
+  'globalDailyCostLimitUsd', 'providerHourlyRunLimits', 'modelHourlyRunLimits',
 ];
 
 /**

package/lib/store.js

@@ -1,3 +1,6 @@
+import { DurableJournal } from './durable-journal.js';
+import { ChainCheckpointManager } from './chain-checkpoints.js';
+import { ArtifactManager } from './artifacts.js';
 import { logger } from './logger.js';
 import { bestEffort } from './best-effort.js';
 import fs from 'node:fs';
@@ -36,6 +39,12 @@ export class TaskStore {
     this.tasks = new Map();
     this.history = new Map();
     this.settings = {};
+    this.chainCheckpoints = {};
+    this.artifacts = {};
+    const storeDir = path.dirname(this.filePath);
+    this.durableJournal = new DurableJournal(this);
+    this.chainCheckpointManager = new ChainCheckpointManager(this);
+    this.artifactManager = new ArtifactManager(path.join(storeDir, "artifacts"));
     this._lastBackupTime = 0;
     this._saveTimer = null;
     this._savePromise = Promise.resolve();
@@ -85,6 +94,12 @@ export class TaskStore {
       if (data.settings && typeof data.settings === 'object') {
         this.settings = data.settings;
       }
+      if (data.chainCheckpoints && typeof data.chainCheckpoints === 'object') {
+        this.chainCheckpoints = data.chainCheckpoints;
+      }
+      if (data.artifacts && typeof data.artifacts === 'object') {
+        this.artifacts = data.artifacts;
+      }
     };
 
     if (fs.existsSync(this.filePath)) {
@@ -189,6 +204,8 @@ export class TaskStore {
       tasks: tasksSnapshot,
       history: historySnapshot,
       settings: this.settings ? { ...this.settings } : {},
+      chainCheckpoints: this.chainCheckpoints ? { ...this.chainCheckpoints } : {},
+      artifacts: this.artifacts ? { ...this.artifacts } : {},
     };
   }
 
@@ -347,7 +364,10 @@ export class TaskStore {
         yield ']';
         await new Promise((r) => setImmediate(r));
       }
-      yield '}}';
+      yield '}';
+      yield ',"chainCheckpoints":' + JSON.stringify(data.chainCheckpoints || {});
+      yield ',"artifacts":' + JSON.stringify(data.artifacts || {});
+      yield '}';
     }
 
     try {
@@ -407,6 +427,32 @@ export class TaskStore {
     }
   }
 
+  getRun(runId) {
+    if (!runId) return null;
+    for (const [taskId, runs] of this.history.entries()) {
+      if (Array.isArray(runs)) {
+        const found = runs.find((r) => r.id === runId);
+        if (found) return { ...found, taskId };
+      }
+    }
+    return null;
+  }
+
+  recordArtifact(runIdOrRecord, maybeRecord) {
+    const runId = maybeRecord ? runIdOrRecord : (runIdOrRecord && runIdOrRecord.runId);
+    const artifactRecord = maybeRecord ? maybeRecord : runIdOrRecord;
+    if (!runId || !artifactRecord) return;
+    this.artifacts = this.artifacts || {};
+    this.artifacts[runId] = this.artifacts[runId] || [];
+    this.artifacts[runId].push(artifactRecord);
+    this.scheduleSave(50);
+  }
+
+  getArtifactsForRun(runId) {
+    if (!runId || !this.artifacts) return [];
+    return this.artifacts[runId] || [];
+  }
+
   getSettings() {
     const defaults = getDshDefaultTelegramCredentials();
     const base = { ...this.settings };
@@ -706,6 +752,9 @@ export class TaskStore {
         },
         delivery: runInfo.delivery || null,
         validation: runInfo.validation || null,
+        idempotencyKey: runInfo.idempotencyKey || null,
+        chainRunId: runInfo.chainRunId || null,
+        artifacts: runInfo.artifacts || null,
         sessionId: runInfo.sessionId || null,
         // #45: which model produced the run, and whether it only finished thanks
         // to the configured fallback.

package/lib/task-create.js

@@ -74,6 +74,7 @@ export function executeCreateTask(store, scheduler, args) {
     dailyCostLimitUsd: Number(args.dailyCostLimitUsd) > 0 ? Number(args.dailyCostLimitUsd) : undefined,
     tokenLimit: Number(args.tokenLimit) > 0 ? Number(args.tokenLimit) : undefined,
     validators: Array.isArray(args.validators) ? sanitizeValidators(args.validators) : undefined,
+    requireApproval: Boolean(args.requireApproval),
   };
   // Issue #310 / GH #5: strip any undefined properties before store.set()
   for (const k of Object.keys(taskData)) {

package/lib/task-patch.js

@@ -87,6 +87,9 @@ export function buildTaskPatch(current, body) {
       return { ok: false, error: err.message };
     }
   }
+  if (patch.requireApproval !== undefined) {
+    patch.requireApproval = Boolean(patch.requireApproval);
+  }
   if (patch.validators !== undefined) {
     patch.validators = Array.isArray(patch.validators) ? sanitizeValidators(patch.validators) : [];
   }

package/lib/task-transfer.js

@@ -75,6 +75,7 @@ export const PATCHABLE_TASK_FIELDS = [
   'tokenLimit',
   'pausedReason',
   'validators',
+  'requireApproval',
 ];
 
 /** Fields a duplicate inherits; anything else is runtime state, not config. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cron",
-  "version": "0.2.51",
+  "version": "0.3.0",
   "description": "Background automation runner for DSH: isolated agent runs, script/HTTP/SSH/Docker runtimes, cost guard, notifications, heartbeats.",
   "type": "module",
   "main": "lib/index.js",