@goodandready/dsh-cron 0.3.0 → 0.3.2

package/lib/scheduler-execution.js

@@ -10,6 +10,7 @@ import fs from 'node:fs';
 import { parseLlmActionDirectives, executeLlmActionDirectives } from './llm-actions.js';
 import { applySilentRule } from './silent-rule.js';
 import { inspectFailure } from './failure-inspector.js';
+import { parseChainTargets, sanitizeDependsOn } from './dag.js';
 
 /** Task types that talk to a model and can therefore use a fallback model. */
 export const AGENT_TASK_TYPES = ['llm', 'skill', 'workflow'];
@@ -735,15 +736,24 @@ export async function handleCompleteRun(scheduler, task, taskId, currentRun, out
     runInfo.artifacts = scheduler.store.getArtifactsForRun(runInfo.runId);
   }
 
-  // Chain Checkpoints (#319)
-  const chainedTarget = outcome.status === 'success' ? task.onSuccess : task.onFailure;
-  const chainRunId = options.chainRunId || (chainedTarget ? ('chain_' + Math.random().toString(36).slice(2, 10)) : null);
+  // Chain Checkpoints (#319, #328)
+  const chainedTargets = parseChainTargets(outcome.status === 'success' ? task.onSuccess : task.onFailure);
+  let hasDependents = false;
+  if (scheduler.store?.tasks) {
+    for (const t of Object.values(scheduler.store.tasks)) {
+      if (t && sanitizeDependsOn(t.dependsOn).includes(taskId)) {
+        hasDependents = true;
+        break;
+      }
+    }
+  }
+  const chainRunId = options.chainRunId || ((chainedTargets.length > 0 || hasDependents) ? ('chain_' + Math.random().toString(36).slice(2, 10)) : null);
   if (chainRunId) {
     runInfo.chainRunId = chainRunId;
     if (scheduler.store.chainCheckpointManager) {
       scheduler.store.chainCheckpointManager.recordStepSnapshot(chainRunId, taskId, {
         status: outcome.status,
-        input: { prompt: task.prompt, prevOutput: options.prevOutput || options.chainPrevOutput || '' },
+        input: { prompt: task.prompt, prevOutput: options.prevOutput || options.chainPrevOutput || '', prevOutputs: options.prevOutputs || {} },
         output: outcome.output || outcome.error || '',
         durationMs: executionMs,
       });
@@ -842,14 +852,42 @@ export async function handleCompleteRun(scheduler, task, taskId, currentRun, out
     }
   }
 
-  // 2. Task Chaining (#137)
-  const nextTaskId = isSuccess ? task.onSuccess : (isFailure ? task.onFailure : null);
-  if (nextTaskId && typeof nextTaskId === 'string' && nextTaskId.trim()) {
-    const currentDepth = options.chainDepth || 0;
-    if (currentDepth < 4) {
-      const targetId = nextTaskId.trim();
+  // 2. Task Chaining (#137, #328 Fan-Out / Fan-In)
+  const targets = parseChainTargets(isSuccess ? task.onSuccess : (isFailure ? task.onFailure : null));
+  const currentDepth = options.chainDepth || 0;
+
+  if (currentDepth < 4) {
+    // 2.1 Trigger explicit targets (Fan-Out)
+    for (const targetId of targets) {
       const nextTask = scheduler.store.get(targetId);
-      if (nextTask) {
+      if (!nextTask) {
+        logger.warn(`[dsh-cron] chained task target not found: ${targetId}`);
+        continue;
+      }
+      const deps = sanitizeDependsOn(nextTask.dependsOn);
+      if (deps.length > 0 && scheduler.store.chainCheckpointManager) {
+        const barrier = scheduler.store.chainCheckpointManager.checkJoinBarrier(chainRunId, nextTask);
+        if (barrier.ready && scheduler.store.chainCheckpointManager.canTriggerBarrier(chainRunId, nextTask.id)) {
+          scheduler.store.chainCheckpointManager.markBarrierTriggered(chainRunId, nextTask.id);
+          logger.info(`[dsh-cron] triggering joined task "${nextTask.title}" (${targetId}) (barrier satisfied)`);
+          scheduler.runNow(targetId, {
+            chainRunId,
+            chainDepth: currentDepth + 1,
+            prevOutputs: barrier.outputs,
+            prevOutput: barrier.latestOutput,
+            prevTaskId: task.id,
+            prevStatus: outcome.status,
+            prevDurationMs: Date.now() - start,
+            prevCostUsd: outcome.costUsd || 0,
+          }).catch((err) => {
+            logger.warn(`[dsh-cron] chained joined task ${targetId} failed to trigger:`, err.message);
+          });
+        } else if (barrier.pending) {
+          logger.info(`[dsh-cron] task "${nextTask.title}" (${targetId}) waiting for dependencies: ${barrier.waitingFor?.join(', ')}`);
+        } else if (barrier.failed) {
+          logger.warn(`[dsh-cron] task "${nextTask.title}" (${targetId}) barrier failed due to dependency: ${barrier.failedDep}`);
+        }
+      } else {
         logger.info(`[dsh-cron] triggering chained task "${nextTask.title}" (${targetId}) from "${task.title}" (depth ${currentDepth + 1})`);
         scheduler.runNow(targetId, {
           chainRunId,
@@ -862,12 +900,41 @@ export async function handleCompleteRun(scheduler, task, taskId, currentRun, out
         }).catch((err) => {
           logger.warn(`[dsh-cron] chained task ${targetId} failed to trigger:`, err.message);
         });
-      } else {
-        logger.warn(`[dsh-cron] chained task target not found: ${targetId}`);
       }
-    } else {
-      logger.warn(`[dsh-cron] chained task depth limit (5) reached for task ${task.id} -> ${nextTaskId}. Loop prevented.`);
     }
+
+    // 2.2 Trigger any other tasks in store that depend on this task via dependsOn (Fan-In join step)
+    if (chainRunId && scheduler.store?.tasks && scheduler.store.chainCheckpointManager) {
+      for (const candidate of Object.values(scheduler.store.tasks)) {
+        if (!candidate || candidate.id === taskId || targets.includes(candidate.id)) continue;
+        const deps = sanitizeDependsOn(candidate.dependsOn);
+        if (deps.includes(taskId)) {
+          const barrier = scheduler.store.chainCheckpointManager.checkJoinBarrier(chainRunId, candidate);
+          if (barrier.ready && scheduler.store.chainCheckpointManager.canTriggerBarrier(chainRunId, candidate.id)) {
+            scheduler.store.chainCheckpointManager.markBarrierTriggered(chainRunId, candidate.id);
+            logger.info(`[dsh-cron] triggering dependent joined task "${candidate.title}" (${candidate.id}) (barrier satisfied)`);
+            scheduler.runNow(candidate.id, {
+              chainRunId,
+              chainDepth: currentDepth + 1,
+              prevOutputs: barrier.outputs,
+              prevOutput: barrier.latestOutput,
+              prevTaskId: task.id,
+              prevStatus: outcome.status,
+              prevDurationMs: Date.now() - start,
+              prevCostUsd: outcome.costUsd || 0,
+            }).catch((err) => {
+              logger.warn(`[dsh-cron] dependent joined task ${candidate.id} failed to trigger:`, err.message);
+            });
+          } else if (barrier.pending) {
+            logger.info(`[dsh-cron] task "${candidate.title}" (${candidate.id}) waiting for dependencies: ${barrier.waitingFor?.join(', ')}`);
+          } else if (barrier.failed) {
+            logger.warn(`[dsh-cron] task "${candidate.title}" (${candidate.id}) barrier failed due to dependency: ${barrier.failedDep}`);
+          }
+        }
+      }
+    }
+  } else {
+    logger.warn(`[dsh-cron] chained task depth limit (5) reached for task ${task.id}. Loop prevented.`);
   }
 }
 

package/lib/scheduler-lifecycle.js

@@ -92,6 +92,9 @@ export function pauseTask(scheduler, taskId, reason = null) {
     clearTimeout(scheduler.timers.get(taskId));
     scheduler.timers.delete(taskId);
   }
+  if (scheduler.watcherManager) {
+    scheduler.watcherManager.unwatchTask(taskId);
+  }
   const running = scheduler.running.get(taskId);
   if (running) {
     bestEffort('abort-paused-task', () => running.controller.abort(new Error('Task paused')), scheduler.logger);
@@ -115,6 +118,9 @@ export function removeTask(scheduler, taskId) {
     clearTimeout(scheduler.timers.get(taskId));
     scheduler.timers.delete(taskId);
   }
+  if (scheduler.watcherManager) {
+    scheduler.watcherManager.unwatchTask(taskId);
+  }
   const running = scheduler.running.get(taskId);
   if (running) {
     bestEffort('abort-deleted-task', () => running.controller.abort(new Error('Task deleted')), scheduler.logger);

package/lib/scheduler.js

@@ -1,6 +1,7 @@
 import { logger } from './logger.js';
 import { bestEffort } from './best-effort.js';
 import { Cron } from 'croner';
+import { FileSystemWatcherManager } from './watcher.js';
 
 const MAX_TIMEOUT_MS = 2147483647; // 2^31 - 1 ms (~24.85 days)
 import {
@@ -51,6 +52,7 @@ export {
   removeTask,
   resumeTask,
   toggleTask,
+  FileSystemWatcherManager,
 };
 
 function pad(v) {
@@ -320,6 +322,7 @@ export class TaskScheduler {
     this.queue = [];
     this.groupLimits = opts.groupLimits instanceof Map ? opts.groupLimits : new Map(Object.entries(opts.groupLimits || {}));
     this.heartbeatTimer = null;
+    this.watcherManager = new FileSystemWatcherManager(this);
     this.logger = opts.logger || null;
     this.isStopped = false;
     this.generation = 0;
@@ -416,12 +419,18 @@ export class TaskScheduler {
       this.scheduleTask(task);
     }
     this.startHeartbeatWatcher();
+    if (this.watcherManager) {
+      this.watcherManager.syncAll(tasks);
+    }
   }
 
   stopAll() {
     this.isStopped = true;
     this.generation = (this.generation || 0) + 1;
     this.stopHeartbeatWatcher();
+    if (this.watcherManager) {
+      this.watcherManager.stopAll();
+    }
 
     // Clear concurrency queue (#217)
     this.queue = [];
@@ -452,6 +461,9 @@ export class TaskScheduler {
   }
 
   clearScheduled(taskId) {
+    if (this.watcherManager) {
+      this.watcherManager.unwatchTask(taskId);
+    }
     if (this.jobs.has(taskId)) {
       this.jobs.get(taskId).stop();
       this.jobs.delete(taskId);
@@ -516,6 +528,9 @@ export class TaskScheduler {
     this.clearScheduled(task.id);
     if (task.status !== 'active') return;
     this.clearRetryTimer(task.id);
+    if (this.watcherManager) {
+      this.watcherManager.watchTask(task);
+    }
 
     try {
       const parsed = parseScheduleExpression(task.schedule);

package/lib/secrets.js

@@ -120,3 +120,117 @@ export async function resolveTelegramSecrets(ctx, settings = {}) {
   out.chatId = String(settings.chatId || '').trim();
   return out;
 }
+
+
+// --- Dynamic credential resolution (#335) ---
+export const CREDENTIAL_URI_REGEX = /^credential:\/\/(?:([a-zA-Z0-9_-]+)\/)?([a-zA-Z0-9_.-]+)$/;
+export const CREDENTIAL_URI_GLOBAL_REGEX = /credential:\/\/(?:[a-zA-Z0-9_-]+\/)?[a-zA-Z0-9_.-]+/g;
+
+/** Check if a string is a credential:// reference URI. */
+export function isCredentialUri(value) {
+  return typeof value === 'string' && CREDENTIAL_URI_REGEX.test(value.trim());
+}
+
+/** Parse a credential://[domain/]<key> URI into domain and key components. */
+export function parseCredentialUri(value) {
+  const match = String(value || '').trim().match(CREDENTIAL_URI_REGEX);
+  if (!match) return null;
+  return {
+    domain: match[1] || null,
+    key: match[2],
+  };
+}
+
+/**
+ * Resolve a single credential:// URI using harness credentials service or environment.
+ * If not resolvable, returns the original URI.
+ */
+export async function resolveCredentialReference(uri, ctx) {
+  if (typeof uri !== 'string') return uri;
+  const parsed = parseCredentialUri(uri);
+  if (!parsed) return uri;
+
+  try {
+    const creds = (ctx && typeof ctx.get === 'function' ? ctx.get('credentials') : null)
+      || (ctx && ctx.credentials);
+    if (creds && typeof creds.resolve === 'function') {
+      const hit = await creds.resolve(parsed.domain ? { domain: parsed.domain, name: parsed.key } : parsed.key);
+      if (hit && hit.value) return String(hit.value);
+    }
+  } catch {
+    // credentials service unavailable
+  }
+
+  // Fallback: resolve by key name
+  const fallback = await resolveCredentialValue(ctx, parsed.key);
+  if (fallback) return fallback;
+
+  // Fallback: check environment variable with DOMAIN_KEY
+  if (parsed.domain) {
+    const prefixedEnv = process.env[`${parsed.domain.toUpperCase()}_${parsed.key.toUpperCase()}`];
+    if (prefixedEnv) return String(prefixedEnv);
+  }
+
+  return uri;
+}
+
+/**
+ * Replace all credential://... references in a string with resolved secret values.
+ * Returns { text: string, resolvedSecrets: string[] }.
+ */
+export async function resolveDynamicCredentialsInText(text, ctx) {
+  if (typeof text !== 'string' || !text.includes('credential://')) {
+    return { text, resolvedSecrets: [] };
+  }
+
+  const matches = text.match(CREDENTIAL_URI_GLOBAL_REGEX);
+  if (!matches || !matches.length) {
+    return { text, resolvedSecrets: [] };
+  }
+
+  let result = text;
+  const resolvedSecrets = [];
+
+  for (const match of matches) {
+    const resolved = await resolveCredentialReference(match, ctx);
+    if (resolved && resolved !== match) {
+      result = result.replaceAll(match, resolved);
+      resolvedSecrets.push(resolved);
+    }
+  }
+
+  return { text: result, resolvedSecrets };
+}
+
+/**
+ * Recursively resolve credential://... references in strings, arrays, or objects.
+ * Returns { data: any, resolvedSecrets: string[] }.
+ */
+export async function resolveDynamicCredentialsInObject(obj, ctx) {
+  if (obj === null || obj === undefined) return { data: obj, resolvedSecrets: [] };
+  if (typeof obj === 'string') {
+    const textRes = await resolveDynamicCredentialsInText(obj, ctx);
+    return { data: textRes.text, resolvedSecrets: textRes.resolvedSecrets };
+  }
+  if (Array.isArray(obj)) {
+    const outArr = [];
+    const allSecrets = [];
+    for (const item of obj) {
+      const res = await resolveDynamicCredentialsInObject(item, ctx);
+      outArr.push(res.data);
+      allSecrets.push(...res.resolvedSecrets);
+    }
+    return { data: outArr, resolvedSecrets: allSecrets };
+  }
+  if (typeof obj === 'object') {
+    const outObj = {};
+    const allSecrets = [];
+    for (const [k, v] of Object.entries(obj)) {
+      const res = await resolveDynamicCredentialsInObject(v, ctx);
+      outObj[k] = res.data;
+      allSecrets.push(...res.resolvedSecrets);
+    }
+    return { data: outObj, resolvedSecrets: allSecrets };
+  }
+  return { data: obj, resolvedSecrets: [] };
+}

package/lib/settings.js

@@ -47,6 +47,8 @@ export const Config = z.object({
   giteaLabels: z.any().default([]).description('Gitea label names or IDs for alert issues').volatile(),
   giteaLabelIds: z.any().default({}).description('Mapping of label name to integer ID for Gitea issues').volatile(),
   prReviewerEnabled: z.boolean().default(false).description('Enable automated PR Reviewer scheduled agent (#33)').volatile(),
+  // --- Dynamic credentials resolution (#335) ---
+  enableDynamicCredentials: z.boolean().default(false).description('Enable dynamic credential://... reference resolution at runtime (#335)').volatile(),
   // --- Global Budgets (#320) ---
   globalDailyCostLimitUsd: z.number().default(0).description('Global daily expenditure limit in USD across all tasks (0 = unlimited)').volatile(),
   providerHourlyRunLimits: z.object({}).default({}).description('Max runs per hour keyed by provider').volatile(),
@@ -85,7 +87,7 @@ export const SETTINGS_SYNC_KEYS = [
   'pushplusTokenRef',
   'pushplusUrl',
   'ttsBaseUrl',
-  'giteaBaseUrl', 'giteaRepo', 'giteaTokenRef', 'giteaLabels', 'giteaLabelIds', 'prReviewerEnabled',
+  'giteaBaseUrl', 'giteaRepo', 'giteaTokenRef', 'giteaLabels', 'giteaLabelIds', 'prReviewerEnabled', 'enableDynamicCredentials',
   'apiToken',
   'globalDailyCostLimitUsd', 'providerHourlyRunLimits', 'modelHourlyRunLimits',
 ];

package/lib/task-create.js

@@ -4,6 +4,23 @@ import { validateTaskType } from './task-transfer.js';
 import { parseScheduleExpression } from './scheduler.js';
 import { CHANNEL_IDS } from './channels.js';
 import { redactTaskSecrets } from './http-utils.js';
+import { sanitizeDependsOn, sanitizeJoinPolicy, validateDAG } from './dag.js';
+
+export function sanitizeFileWatch(fw) {
+  if (!fw || typeof fw !== 'object') return undefined;
+  const p = String(fw.path || '').trim();
+  if (!p) return undefined;
+  return {
+    enabled: Boolean(fw.enabled !== false),
+    path: p,
+    pattern: fw.pattern ? String(fw.pattern).trim() : '*',
+    events: Array.isArray(fw.events) && fw.events.length > 0
+      ? fw.events.map(String).filter((e) => ['create', 'modify', 'delete'].includes(e))
+      : ['create', 'modify'],
+    debounceMs: Math.max(50, Number(fw.debounceMs) || 500),
+    recursive: Boolean(fw.recursive),
+  };
+}
 
 export function executeCreateTask(store, scheduler, args) {
   const taskType = normalizeTaskType(args.type);
@@ -29,6 +46,8 @@ export function executeCreateTask(store, scheduler, args) {
     targetSessionReset: args.targetSessionReset ? String(args.targetSessionReset).trim() : 'never',
     onSuccess: args.onSuccess ? String(args.onSuccess).trim() : '',
     onFailure: args.onFailure ? String(args.onFailure).trim() : '',
+    dependsOn: args.dependsOn !== undefined ? sanitizeDependsOn(args.dependsOn) : undefined,
+    joinPolicy: args.joinPolicy !== undefined ? sanitizeJoinPolicy(args.joinPolicy) : undefined,
     heartbeatIntervalSeconds: Number(args.heartbeatIntervalSeconds) || 0,
     gracePeriodSeconds: Number(args.gracePeriodSeconds) || 300,
     preflightType: args.preflightType ? String(args.preflightType).trim().toLowerCase() : 'none',
@@ -75,13 +94,22 @@ export function executeCreateTask(store, scheduler, args) {
     tokenLimit: Number(args.tokenLimit) > 0 ? Number(args.tokenLimit) : undefined,
     validators: Array.isArray(args.validators) ? sanitizeValidators(args.validators) : undefined,
     requireApproval: Boolean(args.requireApproval),
+    fileWatch: args.fileWatch && typeof args.fileWatch === 'object' ? sanitizeFileWatch(args.fileWatch) : undefined,
   };
+
   // Issue #310 / GH #5: strip any undefined properties before store.set()
   for (const k of Object.keys(taskData)) {
     if (taskData[k] === undefined) {
       delete taskData[k];
     }
   }
+
+  // DAG cycle validation (#328)
+  const dagCheck = validateDAG(store?.tasks || {}, taskData);
+  if (!dagCheck.ok) {
+    throw new Error(dagCheck.error);
+  }
+
   const task = store.set(taskData);
   scheduler.scheduleTask(task);
   return {
@@ -90,4 +118,3 @@ export function executeCreateTask(store, scheduler, args) {
     task: redactTaskSecrets(task),
   };
 }
-

package/lib/task-patch.js

@@ -1,4 +1,6 @@
 import { sanitizeValidators } from './validators.js';
+import { sanitizeFileWatch } from './task-create.js';
+import { sanitizeDependsOn, sanitizeJoinPolicy, validateDAG } from './dag.js';
 /**
  * Partial task updates, shared by the HTTP PATCH route and the cron tool (action: 'update')
  * tool (#49).
@@ -90,6 +92,15 @@ export function buildTaskPatch(current, body) {
   if (patch.requireApproval !== undefined) {
     patch.requireApproval = Boolean(patch.requireApproval);
   }
+  if (patch.dependsOn !== undefined) {
+    patch.dependsOn = sanitizeDependsOn(patch.dependsOn);
+  }
+  if (patch.joinPolicy !== undefined) {
+    patch.joinPolicy = sanitizeJoinPolicy(patch.joinPolicy);
+  }
+  if (patch.fileWatch !== undefined) {
+    patch.fileWatch = patch.fileWatch && typeof patch.fileWatch === 'object' ? sanitizeFileWatch(patch.fileWatch) : null;
+  }
   if (patch.validators !== undefined) {
     patch.validators = Array.isArray(patch.validators) ? sanitizeValidators(patch.validators) : [];
   }
@@ -145,6 +156,12 @@ export function applyTaskPatch({ store, scheduler, id, body, allowCodeSwitch = f
   }
   const built = buildTaskPatch(current, body);
   if (!built.ok) return built;
+  if (built.patch.dependsOn !== undefined || built.patch.onSuccess !== undefined) {
+    const dagCheck = validateDAG(store?.tasks || {}, { ...current, ...built.patch, id });
+    if (!dagCheck.ok) {
+      return { ok: false, error: dagCheck.error };
+    }
+  }
   try {
     const task = store.set({ ...current, ...built.patch, id });
     if (task.status === 'active') scheduler.scheduleTask(task);

package/lib/task-transfer.js

@@ -76,6 +76,9 @@ export const PATCHABLE_TASK_FIELDS = [
   'pausedReason',
   'validators',
   'requireApproval',
+  'fileWatch',
+  'dependsOn',
+  'joinPolicy',
 ];
 
 /** Fields a duplicate inherits; anything else is runtime state, not config. */