@goodandready/dsh-cron 0.2.52 → 0.3.1

package/lib/routes.js

@@ -44,6 +44,21 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
     handler: createCronApiHandler(store, scheduler, null)
   }), 'dsh-cron: /schedule[...]');
 
+
+  // Chain retry from failed step (#319)
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'prefix',
+    path: '/dsh-cron/chains',
+    handler: (req, res) => handleChainRoutes(store, scheduler, req, res)
+  }), 'dsh-cron: /chains[...]');
+
+  // Run artifacts listing, download and safe preview (#321)
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'prefix',
+    path: '/dsh-cron/runs',
+    handler: (req, res) => handleRunArtifactRoutes(store, req, res)
+  }), 'dsh-cron: /runs[...]');
+
   // GET /dsh-cron/metrics (#53) — Prometheus text exposition
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
@@ -198,3 +213,72 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
   }), 'dsh-cron: /kanban/test');
 }
 
+
+/**
+ * Handler for chain step retries (#319)
+ */
+export async function handleChainRoutes(store, scheduler, req, res) {
+  if (req.method === 'POST' && rejectCrossOrigin(req, res)) return;
+  const url = new URL(req.url, 'http://localhost');
+  const m = url.pathname.match(/^\/dsh-cron\/chains\/([^\/]+)\/retry-from\/([^\/]+)$/);
+  if (!m) {
+    sendJson(res, 404, { ok: false, error: 'Route not found' });
+    return;
+  }
+  if (req.method !== 'POST') {
+    sendJson(res, 405, { ok: false, error: 'Method not allowed' });
+    return;
+  }
+  const [, chainRunId, stepTaskId] = m;
+  const result = await store.chainCheckpointManager.retryChainFromStep(scheduler, chainRunId, stepTaskId);
+  if (!result.ok) {
+    sendJson(res, 400, result);
+    return;
+  }
+  sendJson(res, 200, result);
+}
+
+/**
+ * Handler for run artifacts (#321)
+ */
+export async function handleRunArtifactRoutes(store, req, res) {
+  const url = new URL(req.url, 'http://localhost');
+  const m = url.pathname.match(/^\/dsh-cron\/runs\/([^\/]+)\/artifacts(?:\/([^\/]+)(?:\/(preview))?)?$/);
+  if (!m) {
+    sendJson(res, 404, { ok: false, error: 'Route not found' });
+    return;
+  }
+  if (req.method !== 'GET') {
+    sendJson(res, 405, { ok: false, error: 'Method not allowed' });
+    return;
+  }
+  const [, runId, artifactId, action] = m;
+  if (!artifactId) {
+    const artifacts = store.getArtifactsForRun(runId);
+    sendJson(res, 200, { ok: true, runId, artifacts });
+    return;
+  }
+  const artifacts = store.getArtifactsForRun(runId);
+  const record = artifacts.find((a) => a.id === artifactId);
+  if (!record) {
+    sendJson(res, 404, { ok: false, error: 'Artifact record not found' });
+    return;
+  }
+  if (action === 'preview') {
+    const preview = store.artifactManager.generatePreview(artifactId, record.name);
+    sendJson(res, preview.ok ? 200 : 404, preview);
+    return;
+  }
+  const buf = store.artifactManager.readArtifact(artifactId, record.name);
+  if (!buf) {
+    sendJson(res, 404, { ok: false, error: 'Artifact file missing from disk (expired or removed)' });
+    return;
+  }
+  res.writeHead(200, {
+    'Content-Type': record.mimeType || 'application/octet-stream',
+    'Content-Disposition': `attachment; filename="${encodeURIComponent(record.name)}"`,
+    'Content-Length': buf.length,
+    'X-Content-Type-Options': 'nosniff',
+  });
+  res.end(buf);
+}

package/lib/runner.js

@@ -1,6 +1,7 @@
 import { logger } from './logger.js';
 import { bestEffort } from './best-effort.js';
 import { estimateTokenCost } from './integrations.js';
+import { resolveDynamicCredentialsInText, resolveDynamicCredentialsInObject } from './secrets.js';
 import {
   EXTERNAL_RUNTIMES,
   normalizeTaskType,
@@ -144,7 +145,104 @@ export class SessionRunner {
   async _run(task, signal, options = {}) {
     logger.info(`[dsh-cron] executing task "${task.title}" (${task.id})`);
 
-    // 1. Non-LLM runtimes: shell, Node.js, Python, HTTP, SSH, Docker (#4 #5 #7 #8 #9)
+    // Dynamic credentials resolution in-memory (#335)
+    let effectiveTask = task;
+    const resolvedSecrets = [];
+    const settings = (this.store && typeof this.store.getSettings === 'function')
+      ? this.store.getSettings()
+      : {};
+
+    if (settings.enableDynamicCredentials) {
+      effectiveTask = { ...task };
+      if (typeof effectiveTask.prompt === 'string') {
+        const res = await resolveDynamicCredentialsInText(effectiveTask.prompt, this.ctx);
+        effectiveTask.prompt = res.text;
+        resolvedSecrets.push(...res.resolvedSecrets);
+      }
+      if (typeof effectiveTask.script === 'string') {
+        const res = await resolveDynamicCredentialsInText(effectiveTask.script, this.ctx);
+        effectiveTask.script = res.text;
+        resolvedSecrets.push(...res.resolvedSecrets);
+      }
+      if (typeof effectiveTask.command === 'string') {
+        const res = await resolveDynamicCredentialsInText(effectiveTask.command, this.ctx);
+        effectiveTask.command = res.text;
+        resolvedSecrets.push(...res.resolvedSecrets);
+      }
+      if (typeof effectiveTask.httpUrl === 'string') {
+        const res = await resolveDynamicCredentialsInText(effectiveTask.httpUrl, this.ctx);
+        effectiveTask.httpUrl = res.text;
+        resolvedSecrets.push(...res.resolvedSecrets);
+      }
+      if (typeof effectiveTask.httpBody === 'string') {
+        const res = await resolveDynamicCredentialsInText(effectiveTask.httpBody, this.ctx);
+        effectiveTask.httpBody = res.text;
+        resolvedSecrets.push(...res.resolvedSecrets);
+      }
+      if (effectiveTask.httpHeaders) {
+        const res = await resolveDynamicCredentialsInObject(effectiveTask.httpHeaders, this.ctx);
+        effectiveTask.httpHeaders = res.data;
+        resolvedSecrets.push(...res.resolvedSecrets);
+      }
+      if (effectiveTask.env) {
+        const res = await resolveDynamicCredentialsInObject(effectiveTask.env, this.ctx);
+        effectiveTask.env = res.data;
+        resolvedSecrets.push(...res.resolvedSecrets);
+      }
+    }
+
+    const maskSecrets = (result) => {
+      if (!result || typeof result !== 'object') return result;
+      if (resolvedSecrets.length > 0 && typeof result.output === 'string') {
+        let out = result.output;
+        for (const secret of resolvedSecrets) {
+          if (secret && String(secret).length >= 4 && out.includes(secret)) {
+            out = out.replaceAll(secret, '[REDACTED_CREDENTIAL]');
+          }
+        }
+        result.output = out;
+      }
+      return result;
+    };
+
+    const runInternal = async () => {
+      // 1. Non-LLM runtimes: shell, Node.js, Python, HTTP, SSH, Docker (#4 #5 #7 #8 #9)
+      const runtime = normalizeTaskType(effectiveTask.type);
+      if (EXTERNAL_RUNTIMES.includes(runtime) || effectiveTask.mode === 'no-llm') {
+        return this._runExternal(effectiveTask, runtime === 'llm' ? 'script' : runtime, signal, options);
+      }
+
+      // 2. Agent session, when the harness exposes one
+      if (this.ctx && this.ctx.agents && typeof this.ctx.agents.create === 'function') {
+        return this._runAgentSession(effectiveTask, runtime, signal, options);
+      }
+
+      // 3. Legacy session service
+      if (this.ctx && this.ctx.session && typeof this.ctx.session.create === 'function') {
+        return this._runLegacySession(effectiveTask, options);
+      }
+
+      // 4. Nothing to run through: report the prompt as triggered
+      return this._runBare(effectiveTask, options);
+    };
+
+    try {
+      const outcome = await runInternal();
+      return maskSecrets(outcome);
+    } catch (err) {
+      if (resolvedSecrets.length > 0 && err && err.message) {
+        for (const secret of resolvedSecrets) {
+          if (secret && String(secret).length >= 4 && err.message.includes(secret)) {
+            err.message = err.message.replaceAll(secret, '[REDACTED_CREDENTIAL]');
+          }
+        }
+      }
+      throw err;
+    }
+  }
+
+  // Legacy dispatch replaced above; original runner helpers remain unchanged below:
+  async _runOriginalDispatch(task, signal, options = {}) {
     const runtime = normalizeTaskType(task.type);
     if (EXTERNAL_RUNTIMES.includes(runtime) || task.mode === 'no-llm') {
       return this._runExternal(task, runtime === 'llm' ? 'script' : runtime, signal, options);

package/lib/scheduler-execution.js

@@ -310,6 +310,23 @@ export async function executeTask(scheduler, taskId, options = {}) {
       model: outcome.model || task.model || '',
     };
   }
+  // 0. Idempotency Check (#317): deduplicate runs with an already completed idempotency key
+  if (options.idempotencyKey && scheduler.store.durableJournal) {
+    const existing = scheduler.store.durableJournal.isIdempotencyKeyExecuted(taskId, options.idempotencyKey);
+    if (existing) {
+      logger.info(`[dsh-cron] Idempotency key "${options.idempotencyKey}" already executed for task "${taskId}", returning cached run`);
+      return {
+        ok: existing.status === 'completed' || existing.status === 'success',
+        idempotentReplay: true,
+        runId: existing.id,
+        status: existing.status,
+        output: existing.output,
+        costUsd: existing.costUsd,
+        durationMs: existing.durationMs,
+      };
+    }
+  }
+
 
   // 1. Approval Gate (#318): Human-in-the-loop check before executing actions requiring approval
   if (task.requireApproval && !options.approvedBy) {
@@ -699,6 +716,46 @@ export async function handleCompleteRun(scheduler, task, taskId, currentRun, out
     kind: (Number(outcome.costUsd) > 0) ? 'exact' : ((task.type === 'llm' || task.type === 'skill' || task.type === 'workflow') ? 'unknown' : 'exact'),
   };
   runInfo.stoppedReason = computeStoppedReason(outcome.status, valRes, outcome.error);
+  // Durable journal & Idempotency (#317)
+  runInfo.idempotencyKey = options.idempotencyKey || currentRun?.idempotencyKey || null;
+
+  // Artifacts capture (#321)
+  if (Array.isArray(outcome.artifacts) && scheduler.store.artifactManager) {
+    for (const art of outcome.artifacts) {
+      if (art && art.name && (art.content || art.data)) {
+        try {
+          scheduler.store.artifactManager.saveArtifact(runInfo.runId, taskId, art.name, art.content || art.data);
+        } catch (artErr) {
+          logger.warn(`[dsh-cron] failed to save artifact ${art.name}:`, artErr.message);
+        }
+      }
+    }
+  }
+  if (scheduler.store.getArtifactsForRun) {
+    runInfo.artifacts = scheduler.store.getArtifactsForRun(runInfo.runId);
+  }
+
+  // Chain Checkpoints (#319)
+  const chainedTarget = outcome.status === 'success' ? task.onSuccess : task.onFailure;
+  const chainRunId = options.chainRunId || (chainedTarget ? ('chain_' + Math.random().toString(36).slice(2, 10)) : null);
+  if (chainRunId) {
+    runInfo.chainRunId = chainRunId;
+    if (scheduler.store.chainCheckpointManager) {
+      scheduler.store.chainCheckpointManager.recordStepSnapshot(chainRunId, taskId, {
+        status: outcome.status,
+        input: { prompt: task.prompt, prevOutput: options.prevOutput || options.chainPrevOutput || '' },
+        output: outcome.output || outcome.error || '',
+        durationMs: executionMs,
+      });
+    }
+  }
+
+  // Update Durable Journal (#317)
+  if (scheduler.store.durableJournal) {
+    const journalState = outcome.status === 'success' ? 'completed' : (outcome.status === 'uncertain' ? 'uncertain' : 'failed');
+    scheduler.store.durableJournal.transition(taskId, runInfo.runId, journalState, runInfo);
+  }
+
 
   try {
     scheduler.store.recordRun(taskId, runInfo);
@@ -795,6 +852,7 @@ export async function handleCompleteRun(scheduler, task, taskId, currentRun, out
       if (nextTask) {
         logger.info(`[dsh-cron] triggering chained task "${nextTask.title}" (${targetId}) from "${task.title}" (depth ${currentDepth + 1})`);
         scheduler.runNow(targetId, {
+          chainRunId,
           chainDepth: currentDepth + 1,
           prevOutput: outcome.output || outcome.error || '',
           prevTaskId: task.id,

package/lib/scheduler-lifecycle.js

@@ -92,6 +92,9 @@ export function pauseTask(scheduler, taskId, reason = null) {
     clearTimeout(scheduler.timers.get(taskId));
     scheduler.timers.delete(taskId);
   }
+  if (scheduler.watcherManager) {
+    scheduler.watcherManager.unwatchTask(taskId);
+  }
   const running = scheduler.running.get(taskId);
   if (running) {
     bestEffort('abort-paused-task', () => running.controller.abort(new Error('Task paused')), scheduler.logger);
@@ -115,6 +118,9 @@ export function removeTask(scheduler, taskId) {
     clearTimeout(scheduler.timers.get(taskId));
     scheduler.timers.delete(taskId);
   }
+  if (scheduler.watcherManager) {
+    scheduler.watcherManager.unwatchTask(taskId);
+  }
   const running = scheduler.running.get(taskId);
   if (running) {
     bestEffort('abort-deleted-task', () => running.controller.abort(new Error('Task deleted')), scheduler.logger);

package/lib/scheduler.js

@@ -1,6 +1,7 @@
 import { logger } from './logger.js';
 import { bestEffort } from './best-effort.js';
 import { Cron } from 'croner';
+import { FileSystemWatcherManager } from './watcher.js';
 
 const MAX_TIMEOUT_MS = 2147483647; // 2^31 - 1 ms (~24.85 days)
 import {
@@ -51,6 +52,7 @@ export {
   removeTask,
   resumeTask,
   toggleTask,
+  FileSystemWatcherManager,
 };
 
 function pad(v) {
@@ -320,6 +322,7 @@ export class TaskScheduler {
     this.queue = [];
     this.groupLimits = opts.groupLimits instanceof Map ? opts.groupLimits : new Map(Object.entries(opts.groupLimits || {}));
     this.heartbeatTimer = null;
+    this.watcherManager = new FileSystemWatcherManager(this);
     this.logger = opts.logger || null;
     this.isStopped = false;
     this.generation = 0;
@@ -361,6 +364,26 @@ export class TaskScheduler {
   start() {
     this.isStopped = false;
     this.generation = (this.generation || 0) + 1;
+
+    // Recovery & cleanup on restart (#317, #321)
+    if (this.store && this.store.durableJournal) {
+      try {
+        const recovered = this.store.durableJournal.recoverPendingRuns(this);
+        if (recovered.uncertain.length > 0) {
+          logger.warn(`[dsh-cron] Recovered ${recovered.uncertain.length} in-flight run(s) interrupted by restart -> status marked uncertain`);
+        }
+      } catch (recErr) {
+        logger.error('[dsh-cron] restart recovery failed:', recErr.message);
+      }
+    }
+    if (this.store && this.store.artifactManager) {
+      try {
+        this.store.artifactManager.cleanupArtifacts(this.store);
+      } catch (cleanErr) {
+        logger.warn('[dsh-cron] artifact cleanup failed:', cleanErr.message);
+      }
+    }
+
     const tasks = this.store.list();
     const now = Date.now();
     for (const task of tasks) {
@@ -396,12 +419,18 @@ export class TaskScheduler {
       this.scheduleTask(task);
     }
     this.startHeartbeatWatcher();
+    if (this.watcherManager) {
+      this.watcherManager.syncAll(tasks);
+    }
   }
 
   stopAll() {
     this.isStopped = true;
     this.generation = (this.generation || 0) + 1;
     this.stopHeartbeatWatcher();
+    if (this.watcherManager) {
+      this.watcherManager.stopAll();
+    }
 
     // Clear concurrency queue (#217)
     this.queue = [];
@@ -432,6 +461,9 @@ export class TaskScheduler {
   }
 
   clearScheduled(taskId) {
+    if (this.watcherManager) {
+      this.watcherManager.unwatchTask(taskId);
+    }
     if (this.jobs.has(taskId)) {
       this.jobs.get(taskId).stop();
       this.jobs.delete(taskId);
@@ -496,6 +528,9 @@ export class TaskScheduler {
     this.clearScheduled(task.id);
     if (task.status !== 'active') return;
     this.clearRetryTimer(task.id);
+    if (this.watcherManager) {
+      this.watcherManager.watchTask(task);
+    }
 
     try {
       const parsed = parseScheduleExpression(task.schedule);

package/lib/secrets.js

@@ -120,3 +120,117 @@ export async function resolveTelegramSecrets(ctx, settings = {}) {
   out.chatId = String(settings.chatId || '').trim();
   return out;
 }
+
+
+// --- Dynamic credential resolution (#335) ---
+export const CREDENTIAL_URI_REGEX = /^credential:\/\/(?:([a-zA-Z0-9_-]+)\/)?([a-zA-Z0-9_.-]+)$/;
+export const CREDENTIAL_URI_GLOBAL_REGEX = /credential:\/\/(?:[a-zA-Z0-9_-]+\/)?[a-zA-Z0-9_.-]+/g;
+
+/** Check if a string is a credential:// reference URI. */
+export function isCredentialUri(value) {
+  return typeof value === 'string' && CREDENTIAL_URI_REGEX.test(value.trim());
+}
+
+/** Parse a credential://[domain/]<key> URI into domain and key components. */
+export function parseCredentialUri(value) {
+  const match = String(value || '').trim().match(CREDENTIAL_URI_REGEX);
+  if (!match) return null;
+  return {
+    domain: match[1] || null,
+    key: match[2],
+  };
+}
+
+/**
+ * Resolve a single credential:// URI using harness credentials service or environment.
+ * If not resolvable, returns the original URI.
+ */
+export async function resolveCredentialReference(uri, ctx) {
+  if (typeof uri !== 'string') return uri;
+  const parsed = parseCredentialUri(uri);
+  if (!parsed) return uri;
+
+  try {
+    const creds = (ctx && typeof ctx.get === 'function' ? ctx.get('credentials') : null)
+      || (ctx && ctx.credentials);
+    if (creds && typeof creds.resolve === 'function') {
+      const hit = await creds.resolve(parsed.domain ? { domain: parsed.domain, name: parsed.key } : parsed.key);
+      if (hit && hit.value) return String(hit.value);
+    }
+  } catch {
+    // credentials service unavailable
+  }
+
+  // Fallback: resolve by key name
+  const fallback = await resolveCredentialValue(ctx, parsed.key);
+  if (fallback) return fallback;
+
+  // Fallback: check environment variable with DOMAIN_KEY
+  if (parsed.domain) {
+    const prefixedEnv = process.env[`${parsed.domain.toUpperCase()}_${parsed.key.toUpperCase()}`];
+    if (prefixedEnv) return String(prefixedEnv);
+  }
+
+  return uri;
+}
+
+/**
+ * Replace all credential://... references in a string with resolved secret values.
+ * Returns { text: string, resolvedSecrets: string[] }.
+ */
+export async function resolveDynamicCredentialsInText(text, ctx) {
+  if (typeof text !== 'string' || !text.includes('credential://')) {
+    return { text, resolvedSecrets: [] };
+  }
+
+  const matches = text.match(CREDENTIAL_URI_GLOBAL_REGEX);
+  if (!matches || !matches.length) {
+    return { text, resolvedSecrets: [] };
+  }
+
+  let result = text;
+  const resolvedSecrets = [];
+
+  for (const match of matches) {
+    const resolved = await resolveCredentialReference(match, ctx);
+    if (resolved && resolved !== match) {
+      result = result.replaceAll(match, resolved);
+      resolvedSecrets.push(resolved);
+    }
+  }
+
+  return { text: result, resolvedSecrets };
+}
+
+/**
+ * Recursively resolve credential://... references in strings, arrays, or objects.
+ * Returns { data: any, resolvedSecrets: string[] }.
+ */
+export async function resolveDynamicCredentialsInObject(obj, ctx) {
+  if (obj === null || obj === undefined) return { data: obj, resolvedSecrets: [] };
+  if (typeof obj === 'string') {
+    const textRes = await resolveDynamicCredentialsInText(obj, ctx);
+    return { data: textRes.text, resolvedSecrets: textRes.resolvedSecrets };
+  }
+  if (Array.isArray(obj)) {
+    const outArr = [];
+    const allSecrets = [];
+    for (const item of obj) {
+      const res = await resolveDynamicCredentialsInObject(item, ctx);
+      outArr.push(res.data);
+      allSecrets.push(...res.resolvedSecrets);
+    }
+    return { data: outArr, resolvedSecrets: allSecrets };
+  }
+  if (typeof obj === 'object') {
+    const outObj = {};
+    const allSecrets = [];
+    for (const [k, v] of Object.entries(obj)) {
+      const res = await resolveDynamicCredentialsInObject(v, ctx);
+      outObj[k] = res.data;
+      allSecrets.push(...res.resolvedSecrets);
+    }
+    return { data: outObj, resolvedSecrets: allSecrets };
+  }
+  return { data: obj, resolvedSecrets: [] };
+}

package/lib/settings.js

@@ -47,6 +47,8 @@ export const Config = z.object({
   giteaLabels: z.any().default([]).description('Gitea label names or IDs for alert issues').volatile(),
   giteaLabelIds: z.any().default({}).description('Mapping of label name to integer ID for Gitea issues').volatile(),
   prReviewerEnabled: z.boolean().default(false).description('Enable automated PR Reviewer scheduled agent (#33)').volatile(),
+  // --- Dynamic credentials resolution (#335) ---
+  enableDynamicCredentials: z.boolean().default(false).description('Enable dynamic credential://... reference resolution at runtime (#335)').volatile(),
   // --- Global Budgets (#320) ---
   globalDailyCostLimitUsd: z.number().default(0).description('Global daily expenditure limit in USD across all tasks (0 = unlimited)').volatile(),
   providerHourlyRunLimits: z.object({}).default({}).description('Max runs per hour keyed by provider').volatile(),
@@ -85,7 +87,7 @@ export const SETTINGS_SYNC_KEYS = [
   'pushplusTokenRef',
   'pushplusUrl',
   'ttsBaseUrl',
-  'giteaBaseUrl', 'giteaRepo', 'giteaTokenRef', 'giteaLabels', 'giteaLabelIds', 'prReviewerEnabled',
+  'giteaBaseUrl', 'giteaRepo', 'giteaTokenRef', 'giteaLabels', 'giteaLabelIds', 'prReviewerEnabled', 'enableDynamicCredentials',
   'apiToken',
   'globalDailyCostLimitUsd', 'providerHourlyRunLimits', 'modelHourlyRunLimits',
 ];

package/lib/store.js

@@ -1,3 +1,6 @@
+import { DurableJournal } from './durable-journal.js';
+import { ChainCheckpointManager } from './chain-checkpoints.js';
+import { ArtifactManager } from './artifacts.js';
 import { logger } from './logger.js';
 import { bestEffort } from './best-effort.js';
 import fs from 'node:fs';
@@ -36,6 +39,12 @@ export class TaskStore {
     this.tasks = new Map();
     this.history = new Map();
     this.settings = {};
+    this.chainCheckpoints = {};
+    this.artifacts = {};
+    const storeDir = path.dirname(this.filePath);
+    this.durableJournal = new DurableJournal(this);
+    this.chainCheckpointManager = new ChainCheckpointManager(this);
+    this.artifactManager = new ArtifactManager(path.join(storeDir, "artifacts"));
     this._lastBackupTime = 0;
     this._saveTimer = null;
     this._savePromise = Promise.resolve();
@@ -85,6 +94,12 @@ export class TaskStore {
       if (data.settings && typeof data.settings === 'object') {
         this.settings = data.settings;
       }
+      if (data.chainCheckpoints && typeof data.chainCheckpoints === 'object') {
+        this.chainCheckpoints = data.chainCheckpoints;
+      }
+      if (data.artifacts && typeof data.artifacts === 'object') {
+        this.artifacts = data.artifacts;
+      }
     };
 
     if (fs.existsSync(this.filePath)) {
@@ -189,6 +204,8 @@ export class TaskStore {
       tasks: tasksSnapshot,
       history: historySnapshot,
       settings: this.settings ? { ...this.settings } : {},
+      chainCheckpoints: this.chainCheckpoints ? { ...this.chainCheckpoints } : {},
+      artifacts: this.artifacts ? { ...this.artifacts } : {},
     };
   }
 
@@ -347,7 +364,10 @@ export class TaskStore {
         yield ']';
         await new Promise((r) => setImmediate(r));
       }
-      yield '}}';
+      yield '}';
+      yield ',"chainCheckpoints":' + JSON.stringify(data.chainCheckpoints || {});
+      yield ',"artifacts":' + JSON.stringify(data.artifacts || {});
+      yield '}';
     }
 
     try {
@@ -407,6 +427,32 @@ export class TaskStore {
     }
   }
 
+  getRun(runId) {
+    if (!runId) return null;
+    for (const [taskId, runs] of this.history.entries()) {
+      if (Array.isArray(runs)) {
+        const found = runs.find((r) => r.id === runId);
+        if (found) return { ...found, taskId };
+      }
+    }
+    return null;
+  }
+
+  recordArtifact(runIdOrRecord, maybeRecord) {
+    const runId = maybeRecord ? runIdOrRecord : (runIdOrRecord && runIdOrRecord.runId);
+    const artifactRecord = maybeRecord ? maybeRecord : runIdOrRecord;
+    if (!runId || !artifactRecord) return;
+    this.artifacts = this.artifacts || {};
+    this.artifacts[runId] = this.artifacts[runId] || [];
+    this.artifacts[runId].push(artifactRecord);
+    this.scheduleSave(50);
+  }
+
+  getArtifactsForRun(runId) {
+    if (!runId || !this.artifacts) return [];
+    return this.artifacts[runId] || [];
+  }
+
   getSettings() {
     const defaults = getDshDefaultTelegramCredentials();
     const base = { ...this.settings };
@@ -706,6 +752,9 @@ export class TaskStore {
         },
         delivery: runInfo.delivery || null,
         validation: runInfo.validation || null,
+        idempotencyKey: runInfo.idempotencyKey || null,
+        chainRunId: runInfo.chainRunId || null,
+        artifacts: runInfo.artifacts || null,
         sessionId: runInfo.sessionId || null,
         // #45: which model produced the run, and whether it only finished thanks
         // to the configured fallback.

package/lib/task-create.js

@@ -5,6 +5,22 @@ import { parseScheduleExpression } from './scheduler.js';
 import { CHANNEL_IDS } from './channels.js';
 import { redactTaskSecrets } from './http-utils.js';
 
+export function sanitizeFileWatch(fw) {
+  if (!fw || typeof fw !== 'object') return undefined;
+  const p = String(fw.path || '').trim();
+  if (!p) return undefined;
+  return {
+    enabled: Boolean(fw.enabled !== false),
+    path: p,
+    pattern: fw.pattern ? String(fw.pattern).trim() : '*',
+    events: Array.isArray(fw.events) && fw.events.length > 0
+      ? fw.events.map(String).filter((e) => ['create', 'modify', 'delete'].includes(e))
+      : ['create', 'modify'],
+    debounceMs: Math.max(50, Number(fw.debounceMs) || 500),
+    recursive: Boolean(fw.recursive),
+  };
+}
+
 export function executeCreateTask(store, scheduler, args) {
   const taskType = normalizeTaskType(args.type);
   const typeError = validateTaskType(taskType, args);
@@ -75,6 +91,7 @@ export function executeCreateTask(store, scheduler, args) {
     tokenLimit: Number(args.tokenLimit) > 0 ? Number(args.tokenLimit) : undefined,
     validators: Array.isArray(args.validators) ? sanitizeValidators(args.validators) : undefined,
     requireApproval: Boolean(args.requireApproval),
+    fileWatch: args.fileWatch && typeof args.fileWatch === 'object' ? sanitizeFileWatch(args.fileWatch) : undefined,
   };
   // Issue #310 / GH #5: strip any undefined properties before store.set()
   for (const k of Object.keys(taskData)) {

package/lib/task-patch.js

@@ -1,4 +1,5 @@
 import { sanitizeValidators } from './validators.js';
+import { sanitizeFileWatch } from './task-create.js';
 /**
  * Partial task updates, shared by the HTTP PATCH route and the cron tool (action: 'update')
  * tool (#49).
@@ -90,6 +91,9 @@ export function buildTaskPatch(current, body) {
   if (patch.requireApproval !== undefined) {
     patch.requireApproval = Boolean(patch.requireApproval);
   }
+  if (patch.fileWatch !== undefined) {
+    patch.fileWatch = patch.fileWatch && typeof patch.fileWatch === 'object' ? sanitizeFileWatch(patch.fileWatch) : null;
+  }
   if (patch.validators !== undefined) {
     patch.validators = Array.isArray(patch.validators) ? sanitizeValidators(patch.validators) : [];
   }

package/lib/task-transfer.js

@@ -76,6 +76,7 @@ export const PATCHABLE_TASK_FIELDS = [
   'pausedReason',
   'validators',
   'requireApproval',
+  'fileWatch',
 ];
 
 /** Fields a duplicate inherits; anything else is runtime state, not config. */