@goodandready/dsh-cron 0.3.1 → 0.3.2

package/lib/dag.js

@@ -0,0 +1,330 @@
+/**
+ * Directed Acyclic Graph (DAG) Engine for Chained Tasks (#328, #334)
+ * Provides cycle detection, topological sorting, dependency resolution,
+ * and graph visualization modeling for multi-step task workflows.
+ */
+
+/**
+ * Normalizes dependency specifications into an array of string task IDs.
+ * Accepts arrays, comma/space separated strings, or single task IDs.
+ *
+ * @param {string|string[]|undefined|null} deps
+ * @returns {string[]} Deduplicated array of valid task IDs
+ */
+export function sanitizeDependsOn(deps) {
+  if (!deps) return [];
+  let rawList = [];
+  if (Array.isArray(deps)) {
+    rawList = deps;
+  } else if (typeof deps === 'string') {
+    rawList = deps.split(/[,;\s]+/);
+  }
+  const result = [];
+  const seen = new Set();
+  for (const item of rawList) {
+    if (typeof item !== 'string') continue;
+    const trimmed = item.trim();
+    if (trimmed && !seen.has(trimmed)) {
+      seen.add(trimmed);
+      result.push(trimmed);
+    }
+  }
+  return result;
+}
+
+/**
+ * Validates join policy string.
+ *
+ * @param {string|undefined} policy
+ * @returns {'all_success'|'any_success'}
+ */
+export function sanitizeJoinPolicy(policy) {
+  if (policy === 'any_success') return 'any_success';
+  return 'all_success';
+}
+
+/**
+ * Parses and returns a list of target task IDs for chaining (onSuccess / onFailure).
+ * Supports single ID, comma-separated IDs, or arrays of IDs.
+ *
+ * @param {string|string[]|undefined|null} target
+ * @returns {string[]}
+ */
+export function parseChainTargets(target) {
+  if (!target) return [];
+  if (Array.isArray(target)) {
+    return target.map((t) => String(t || '').trim()).filter(Boolean);
+  }
+  if (typeof target === 'string') {
+    return target.split(/[,;\s]+/).map((t) => t.trim()).filter(Boolean);
+  }
+  return [];
+}
+
+/**
+ * Validates that adding or updating a task does not introduce cyclic dependencies.
+ * Analyzes both `dependsOn` relationships and `onSuccess` chain links.
+ *
+ * @param {Array<Object>|Map<string, Object>|Object} allTasks All current tasks
+ * @param {Object} [pendingTask] Task being created or updated
+ * @returns {{ ok: boolean, error?: string, cycle?: string[] }}
+ */
+export function validateDAG(allTasks, pendingTask = null) {
+  // Build task dictionary
+  const taskMap = new Map();
+  if (Array.isArray(allTasks)) {
+    for (const t of allTasks) {
+      if (t && t.id) taskMap.set(t.id, t);
+    }
+  } else if (allTasks instanceof Map) {
+    for (const [k, v] of allTasks.entries()) {
+      if (v && v.id) taskMap.set(v.id, v);
+    }
+  } else if (allTasks && typeof allTasks === 'object') {
+    for (const k of Object.keys(allTasks)) {
+      const t = allTasks[k];
+      if (t && t.id) taskMap.set(t.id, t);
+    }
+  }
+
+  // Merge pending task if provided
+  if (pendingTask && pendingTask.id) {
+    taskMap.set(pendingTask.id, { ...(taskMap.get(pendingTask.id) || {}), ...pendingTask });
+  }
+
+  // Self-dependency check
+  for (const [id, task] of taskMap.entries()) {
+    const deps = sanitizeDependsOn(task.dependsOn);
+    if (deps.includes(id)) {
+      return { ok: false, error: `Task "${task.title || id}" cannot depend on itself`, cycle: [id, id] };
+    }
+    const chainTargets = parseChainTargets(task.onSuccess);
+    if (chainTargets.includes(id)) {
+      return { ok: false, error: `Task "${task.title || id}" cannot trigger itself as next step`, cycle: [id, id] };
+    }
+  }
+
+  // Construct adjacency list: Edge from U to V means U must complete before V runs.
+  // Sources of edges:
+  // 1) dependsOn: If V depends on U, then U -> V
+  // 2) onSuccess: If U has onSuccess V, then U -> V
+  const adj = new Map();
+  for (const id of taskMap.keys()) {
+    adj.set(id, new Set());
+  }
+
+  for (const [id, task] of taskMap.entries()) {
+    // 1) dependsOn (deps -> id)
+    const deps = sanitizeDependsOn(task.dependsOn);
+    for (const depId of deps) {
+      if (!adj.has(depId)) adj.set(depId, new Set());
+      adj.get(depId).add(id);
+    }
+
+    // 2) onSuccess (id -> target)
+    const targets = parseChainTargets(task.onSuccess);
+    for (const targetId of targets) {
+      if (!adj.has(id)) adj.set(id, new Set());
+      adj.get(id).add(targetId);
+    }
+  }
+
+  // DFS Cycle Detection (3 colors: 0=unvisited, 1=visiting, 2=visited)
+  const state = new Map(); // id -> 0 | 1 | 2
+  const path = [];
+
+  for (const node of adj.keys()) {
+    state.set(node, 0);
+  }
+
+  function dfs(u) {
+    state.set(u, 1);
+    path.push(u);
+
+    const neighbors = adj.get(u) || new Set();
+    for (const v of neighbors) {
+      const vState = state.get(v) || 0;
+      if (vState === 1) {
+        // Cycle detected
+        const cycleStartIndex = path.indexOf(v);
+        const cyclePath = path.slice(cycleStartIndex).concat(v);
+        return { ok: false, error: `Cyclic dependency detected: ${cyclePath.join(' -> ')}`, cycle: cyclePath };
+      }
+      if (vState === 0) {
+        const res = dfs(v);
+        if (!res.ok) return res;
+      }
+    }
+
+    path.pop();
+    state.set(u, 2);
+    return { ok: true };
+  }
+
+  for (const node of adj.keys()) {
+    if ((state.get(node) || 0) === 0) {
+      const res = dfs(node);
+      if (!res.ok) return res;
+    }
+  }
+
+  return { ok: true };
+}
+
+/**
+ * Returns topological sort of task IDs or throws error if cycle exists.
+ *
+ * @param {Array<Object>|Map<string, Object>} tasks
+ * @returns {string[]} Ordered task IDs
+ */
+export function topologicalSort(tasks) {
+  const check = validateDAG(tasks);
+  if (!check.ok) {
+    throw new Error(check.error || 'Cyclic dependency in task DAG');
+  }
+
+  const taskMap = new Map();
+  if (Array.isArray(tasks)) {
+    for (const t of tasks) if (t?.id) taskMap.set(t.id, t);
+  } else if (tasks instanceof Map) {
+    for (const [k, v] of tasks.entries()) if (v?.id) taskMap.set(v.id, v);
+  }
+
+  // In-degree calculation
+  const inDegree = new Map();
+  const adj = new Map();
+  for (const id of taskMap.keys()) {
+    inDegree.set(id, 0);
+    adj.set(id, new Set());
+  }
+
+  for (const [id, task] of taskMap.entries()) {
+    const deps = sanitizeDependsOn(task.dependsOn);
+    for (const depId of deps) {
+      if (taskMap.has(depId)) {
+        adj.get(depId).add(id);
+        inDegree.set(id, (inDegree.get(id) || 0) + 1);
+      }
+    }
+    const targets = parseChainTargets(task.onSuccess);
+    for (const targetId of targets) {
+      if (taskMap.has(targetId)) {
+        adj.get(id).add(targetId);
+        inDegree.set(targetId, (inDegree.get(targetId) || 0) + 1);
+      }
+    }
+  }
+
+  const queue = [];
+  for (const [id, deg] of inDegree.entries()) {
+    if (deg === 0) queue.push(id);
+  }
+
+  const order = [];
+  while (queue.length > 0) {
+    const u = queue.shift();
+    order.push(u);
+    for (const v of adj.get(u) || []) {
+      const newDeg = (inDegree.get(v) || 0) - 1;
+      inDegree.set(v, newDeg);
+      if (newDeg === 0) queue.push(v);
+    }
+  }
+
+  return order;
+}
+
+/**
+ * Builds a visual graph model (nodes and edges) for UI rendering (#334).
+ *
+ * @param {Array<Object>} tasks All relevant tasks
+ * @param {Array<Object>} [snapshots] Checkpoints for the chain run
+ * @param {string} [focusTaskId] Task ID to center or highlight
+ * @returns {{ nodes: Array<Object>, edges: Array<Object>, hasFailure: boolean }}
+ */
+export function buildTaskGraphModel(tasks = [], snapshots = [], focusTaskId = null) {
+  const taskMap = new Map();
+  for (const t of tasks) {
+    if (t?.id) taskMap.set(t.id, t);
+  }
+
+  const snapshotMap = new Map();
+  for (const s of snapshots) {
+    if (s?.stepTaskId) snapshotMap.set(s.stepTaskId, s);
+  }
+
+  const nodes = [];
+  const edges = [];
+  let hasFailure = false;
+
+  for (const [id, task] of taskMap.entries()) {
+    const snap = snapshotMap.get(id);
+    let nodeStatus = 'pending';
+    let durationMs = 0;
+    let outputSnippet = '';
+    let retryCount = 0;
+
+    if (snap) {
+      nodeStatus = snap.status === 'completed' || snap.status === 'success' ? 'success' : 'failed';
+      durationMs = snap.durationMs || 0;
+      retryCount = snap.retryCount || 0;
+      if (snap.output) {
+        outputSnippet = String(snap.output).slice(0, 200);
+      }
+      if (nodeStatus === 'failed') {
+        hasFailure = true;
+      }
+    } else if (task.status === 'running') {
+      nodeStatus = 'running';
+    }
+
+    nodes.push({
+      id,
+      title: task.title || id,
+      type: task.type || 'prompt',
+      status: nodeStatus,
+      durationMs,
+      retryCount,
+      outputSnippet,
+      isFocus: Boolean(focusTaskId && id === focusTaskId),
+      isRetryable: nodeStatus === 'failed',
+      dependsOn: sanitizeDependsOn(task.dependsOn),
+      joinPolicy: sanitizeJoinPolicy(task.joinPolicy),
+    });
+
+    // Edges from dependsOn
+    const deps = sanitizeDependsOn(task.dependsOn);
+    for (const depId of deps) {
+      edges.push({
+        from: depId,
+        to: id,
+        type: 'dependsOn',
+        label: task.joinPolicy === 'any_success' ? 'join:any' : 'join:all',
+      });
+    }
+
+    // Edges from onSuccess
+    const targets = parseChainTargets(task.onSuccess);
+    for (const targetId of targets) {
+      edges.push({
+        from: id,
+        to: targetId,
+        type: 'onSuccess',
+        label: 'onSuccess',
+      });
+    }
+
+    // Edges from onFailure
+    const failTargets = parseChainTargets(task.onFailure);
+    for (const failId of failTargets) {
+      edges.push({
+        from: id,
+        to: failId,
+        type: 'onFailure',
+        label: 'onFailure',
+      });
+    }
+  }
+
+  return { nodes, edges, hasFailure };
+}

package/lib/prompt-interpolation.js

@@ -30,7 +30,7 @@ export function buildPromptContext(task = {}, options = {}) {
   const fileSize = options.fileSize != null ? String(options.fileSize) : '';
   const fileEvent = options.fileEvent != null ? String(options.fileEvent) : '';
 
-  return {
+  const ctx = {
     // Chaining context
     'prev.output': prevOutput,
     'prev_output': prevOutput,
@@ -72,17 +72,41 @@ export function buildPromptContext(task = {}, options = {}) {
     'task.title': task.title || '',
     'task_title': task.title || '',
   };
+
+  // DAG / Fan-In predecessor outputs (#328)
+  if (options.prevOutputs && typeof options.prevOutputs === 'object') {
+    for (const [k, v] of Object.entries(options.prevOutputs)) {
+      const valStr = v != null ? String(v) : '';
+      ctx[`prevOutputs.${k}`] = valStr;
+      ctx[`outputs.${k}`] = valStr;
+      ctx[`step.${k}.output`] = valStr;
+      ctx[`prevOutputs['${k}']`] = valStr;
+      ctx[`prevOutputs["${k}"]`] = valStr;
+    }
+  }
+
+  return ctx;
 }
 
 /**
  * Replace {{var}} or {var} placeholders with values from context.
- * Supports dot notation like {{prev.output}}. Unknown variables are left untouched.
+ * Supports dot notation like {{prev.output}} and bracket notation like {{prevOutputs['step1']}}.
  */
 export function interpolateTaskPrompt(text, context = {}) {
   if (typeof text !== 'string') return text;
   if (!text) return '';
 
-  return text.replace(/\{\{([a-zA-Z0-9_.]+)\}\}/g, (match, varName) => {
+  // 1. Bracket notation: {{prevOutputs['step1']}} or {prevOutputs['step1']} or with double quotes
+  let result = text.replace(/\{\{?prevOutputs\[['"]([^'"]+)['"]\]\}?\}/g, (match, stepId) => {
+    const key = `prevOutputs.${stepId}`;
+    if (Object.prototype.hasOwnProperty.call(context, key)) {
+      return context[key];
+    }
+    return match;
+  });
+
+  // 2. Standard {{var}} and {var}
+  result = result.replace(/\{\{([a-zA-Z0-9_.]+)\}\}/g, (match, varName) => {
     if (Object.prototype.hasOwnProperty.call(context, varName)) {
       const val = context[varName];
       return val == null ? '' : String(val);
@@ -95,6 +119,8 @@ export function interpolateTaskPrompt(text, context = {}) {
     }
     return match;
   });
+
+  return result;
 }
 
 /**

package/lib/routes.js

@@ -10,6 +10,7 @@ import { recipesByCategory } from './recipes.js';
 import { sendTelegramMessage, createTelegramTaskKeyboard } from './telegram.js';
 import { createKanbanCard } from './integrations.js';
 import { sanitizeSettingsPayload, applySettingsToScope } from './settings.js';
+import { buildTaskGraphModel } from './dag.js';
 
 export function registerRoutes(ctx, { store, scheduler, recommendations }) {
   // handler per route family; registered WITHOUT the trailing slash (#96)
@@ -220,6 +221,27 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
 export async function handleChainRoutes(store, scheduler, req, res) {
   if (req.method === 'POST' && rejectCrossOrigin(req, res)) return;
   const url = new URL(req.url, 'http://localhost');
+
+  // GET /dsh-cron/chains/:chainRunId (#334)
+  const getMatch = url.pathname.match(/^\/dsh-cron\/chains\/([^\/]+)$/);
+  if (getMatch && req.method === 'GET') {
+    const chainRunId = getMatch[1];
+    const snapshots = store.chainCheckpointManager ? store.chainCheckpointManager.getChainSnapshots(chainRunId) : [];
+    const relevantTasks = [];
+    const stepIds = new Set(snapshots.map((s) => s.stepTaskId));
+    if (store.tasks) {
+      for (const t of Object.values(store.tasks)) {
+        if (t && (stepIds.has(t.id) || t.onSuccess || t.onFailure || t.dependsOn)) {
+          relevantTasks.push(t);
+        }
+      }
+    }
+    const graph = buildTaskGraphModel(relevantTasks, snapshots);
+    sendJson(res, 200, { ok: true, chainRunId, snapshots, graph });
+    return;
+  }
+
+  // POST /dsh-cron/chains/:chainRunId/retry-from/:stepTaskId (#319, #328)
   const m = url.pathname.match(/^\/dsh-cron\/chains\/([^\/]+)\/retry-from\/([^\/]+)$/);
   if (!m) {
     sendJson(res, 404, { ok: false, error: 'Route not found' });

package/lib/scheduler-execution.js

@@ -10,6 +10,7 @@ import fs from 'node:fs';
 import { parseLlmActionDirectives, executeLlmActionDirectives } from './llm-actions.js';
 import { applySilentRule } from './silent-rule.js';
 import { inspectFailure } from './failure-inspector.js';
+import { parseChainTargets, sanitizeDependsOn } from './dag.js';
 
 /** Task types that talk to a model and can therefore use a fallback model. */
 export const AGENT_TASK_TYPES = ['llm', 'skill', 'workflow'];
@@ -735,15 +736,24 @@ export async function handleCompleteRun(scheduler, task, taskId, currentRun, out
     runInfo.artifacts = scheduler.store.getArtifactsForRun(runInfo.runId);
   }
 
-  // Chain Checkpoints (#319)
-  const chainedTarget = outcome.status === 'success' ? task.onSuccess : task.onFailure;
-  const chainRunId = options.chainRunId || (chainedTarget ? ('chain_' + Math.random().toString(36).slice(2, 10)) : null);
+  // Chain Checkpoints (#319, #328)
+  const chainedTargets = parseChainTargets(outcome.status === 'success' ? task.onSuccess : task.onFailure);
+  let hasDependents = false;
+  if (scheduler.store?.tasks) {
+    for (const t of Object.values(scheduler.store.tasks)) {
+      if (t && sanitizeDependsOn(t.dependsOn).includes(taskId)) {
+        hasDependents = true;
+        break;
+      }
+    }
+  }
+  const chainRunId = options.chainRunId || ((chainedTargets.length > 0 || hasDependents) ? ('chain_' + Math.random().toString(36).slice(2, 10)) : null);
   if (chainRunId) {
     runInfo.chainRunId = chainRunId;
     if (scheduler.store.chainCheckpointManager) {
       scheduler.store.chainCheckpointManager.recordStepSnapshot(chainRunId, taskId, {
         status: outcome.status,
-        input: { prompt: task.prompt, prevOutput: options.prevOutput || options.chainPrevOutput || '' },
+        input: { prompt: task.prompt, prevOutput: options.prevOutput || options.chainPrevOutput || '', prevOutputs: options.prevOutputs || {} },
         output: outcome.output || outcome.error || '',
         durationMs: executionMs,
       });
@@ -842,14 +852,42 @@ export async function handleCompleteRun(scheduler, task, taskId, currentRun, out
     }
   }
 
-  // 2. Task Chaining (#137)
-  const nextTaskId = isSuccess ? task.onSuccess : (isFailure ? task.onFailure : null);
-  if (nextTaskId && typeof nextTaskId === 'string' && nextTaskId.trim()) {
-    const currentDepth = options.chainDepth || 0;
-    if (currentDepth < 4) {
-      const targetId = nextTaskId.trim();
+  // 2. Task Chaining (#137, #328 Fan-Out / Fan-In)
+  const targets = parseChainTargets(isSuccess ? task.onSuccess : (isFailure ? task.onFailure : null));
+  const currentDepth = options.chainDepth || 0;
+
+  if (currentDepth < 4) {
+    // 2.1 Trigger explicit targets (Fan-Out)
+    for (const targetId of targets) {
       const nextTask = scheduler.store.get(targetId);
-      if (nextTask) {
+      if (!nextTask) {
+        logger.warn(`[dsh-cron] chained task target not found: ${targetId}`);
+        continue;
+      }
+      const deps = sanitizeDependsOn(nextTask.dependsOn);
+      if (deps.length > 0 && scheduler.store.chainCheckpointManager) {
+        const barrier = scheduler.store.chainCheckpointManager.checkJoinBarrier(chainRunId, nextTask);
+        if (barrier.ready && scheduler.store.chainCheckpointManager.canTriggerBarrier(chainRunId, nextTask.id)) {
+          scheduler.store.chainCheckpointManager.markBarrierTriggered(chainRunId, nextTask.id);
+          logger.info(`[dsh-cron] triggering joined task "${nextTask.title}" (${targetId}) (barrier satisfied)`);
+          scheduler.runNow(targetId, {
+            chainRunId,
+            chainDepth: currentDepth + 1,
+            prevOutputs: barrier.outputs,
+            prevOutput: barrier.latestOutput,
+            prevTaskId: task.id,
+            prevStatus: outcome.status,
+            prevDurationMs: Date.now() - start,
+            prevCostUsd: outcome.costUsd || 0,
+          }).catch((err) => {
+            logger.warn(`[dsh-cron] chained joined task ${targetId} failed to trigger:`, err.message);
+          });
+        } else if (barrier.pending) {
+          logger.info(`[dsh-cron] task "${nextTask.title}" (${targetId}) waiting for dependencies: ${barrier.waitingFor?.join(', ')}`);
+        } else if (barrier.failed) {
+          logger.warn(`[dsh-cron] task "${nextTask.title}" (${targetId}) barrier failed due to dependency: ${barrier.failedDep}`);
+        }
+      } else {
         logger.info(`[dsh-cron] triggering chained task "${nextTask.title}" (${targetId}) from "${task.title}" (depth ${currentDepth + 1})`);
         scheduler.runNow(targetId, {
           chainRunId,
@@ -862,12 +900,41 @@ export async function handleCompleteRun(scheduler, task, taskId, currentRun, out
         }).catch((err) => {
           logger.warn(`[dsh-cron] chained task ${targetId} failed to trigger:`, err.message);
         });
-      } else {
-        logger.warn(`[dsh-cron] chained task target not found: ${targetId}`);
       }
-    } else {
-      logger.warn(`[dsh-cron] chained task depth limit (5) reached for task ${task.id} -> ${nextTaskId}. Loop prevented.`);
     }
+
+    // 2.2 Trigger any other tasks in store that depend on this task via dependsOn (Fan-In join step)
+    if (chainRunId && scheduler.store?.tasks && scheduler.store.chainCheckpointManager) {
+      for (const candidate of Object.values(scheduler.store.tasks)) {
+        if (!candidate || candidate.id === taskId || targets.includes(candidate.id)) continue;
+        const deps = sanitizeDependsOn(candidate.dependsOn);
+        if (deps.includes(taskId)) {
+          const barrier = scheduler.store.chainCheckpointManager.checkJoinBarrier(chainRunId, candidate);
+          if (barrier.ready && scheduler.store.chainCheckpointManager.canTriggerBarrier(chainRunId, candidate.id)) {
+            scheduler.store.chainCheckpointManager.markBarrierTriggered(chainRunId, candidate.id);
+            logger.info(`[dsh-cron] triggering dependent joined task "${candidate.title}" (${candidate.id}) (barrier satisfied)`);
+            scheduler.runNow(candidate.id, {
+              chainRunId,
+              chainDepth: currentDepth + 1,
+              prevOutputs: barrier.outputs,
+              prevOutput: barrier.latestOutput,
+              prevTaskId: task.id,
+              prevStatus: outcome.status,
+              prevDurationMs: Date.now() - start,
+              prevCostUsd: outcome.costUsd || 0,
+            }).catch((err) => {
+              logger.warn(`[dsh-cron] dependent joined task ${candidate.id} failed to trigger:`, err.message);
+            });
+          } else if (barrier.pending) {
+            logger.info(`[dsh-cron] task "${candidate.title}" (${candidate.id}) waiting for dependencies: ${barrier.waitingFor?.join(', ')}`);
+          } else if (barrier.failed) {
+            logger.warn(`[dsh-cron] task "${candidate.title}" (${candidate.id}) barrier failed due to dependency: ${barrier.failedDep}`);
+          }
+        }
+      }
+    }
+  } else {
+    logger.warn(`[dsh-cron] chained task depth limit (5) reached for task ${task.id}. Loop prevented.`);
   }
 }
 

package/lib/task-create.js

@@ -4,6 +4,7 @@ import { validateTaskType } from './task-transfer.js';
 import { parseScheduleExpression } from './scheduler.js';
 import { CHANNEL_IDS } from './channels.js';
 import { redactTaskSecrets } from './http-utils.js';
+import { sanitizeDependsOn, sanitizeJoinPolicy, validateDAG } from './dag.js';
 
 export function sanitizeFileWatch(fw) {
   if (!fw || typeof fw !== 'object') return undefined;
@@ -45,6 +46,8 @@ export function executeCreateTask(store, scheduler, args) {
     targetSessionReset: args.targetSessionReset ? String(args.targetSessionReset).trim() : 'never',
     onSuccess: args.onSuccess ? String(args.onSuccess).trim() : '',
     onFailure: args.onFailure ? String(args.onFailure).trim() : '',
+    dependsOn: args.dependsOn !== undefined ? sanitizeDependsOn(args.dependsOn) : undefined,
+    joinPolicy: args.joinPolicy !== undefined ? sanitizeJoinPolicy(args.joinPolicy) : undefined,
     heartbeatIntervalSeconds: Number(args.heartbeatIntervalSeconds) || 0,
     gracePeriodSeconds: Number(args.gracePeriodSeconds) || 300,
     preflightType: args.preflightType ? String(args.preflightType).trim().toLowerCase() : 'none',
@@ -93,12 +96,20 @@ export function executeCreateTask(store, scheduler, args) {
     requireApproval: Boolean(args.requireApproval),
     fileWatch: args.fileWatch && typeof args.fileWatch === 'object' ? sanitizeFileWatch(args.fileWatch) : undefined,
   };
+
   // Issue #310 / GH #5: strip any undefined properties before store.set()
   for (const k of Object.keys(taskData)) {
     if (taskData[k] === undefined) {
       delete taskData[k];
     }
   }
+
+  // DAG cycle validation (#328)
+  const dagCheck = validateDAG(store?.tasks || {}, taskData);
+  if (!dagCheck.ok) {
+    throw new Error(dagCheck.error);
+  }
+
   const task = store.set(taskData);
   scheduler.scheduleTask(task);
   return {
@@ -107,4 +118,3 @@ export function executeCreateTask(store, scheduler, args) {
     task: redactTaskSecrets(task),
   };
 }
-

package/lib/task-patch.js

@@ -1,5 +1,6 @@
 import { sanitizeValidators } from './validators.js';
 import { sanitizeFileWatch } from './task-create.js';
+import { sanitizeDependsOn, sanitizeJoinPolicy, validateDAG } from './dag.js';
 /**
  * Partial task updates, shared by the HTTP PATCH route and the cron tool (action: 'update')
  * tool (#49).
@@ -91,6 +92,12 @@ export function buildTaskPatch(current, body) {
   if (patch.requireApproval !== undefined) {
     patch.requireApproval = Boolean(patch.requireApproval);
   }
+  if (patch.dependsOn !== undefined) {
+    patch.dependsOn = sanitizeDependsOn(patch.dependsOn);
+  }
+  if (patch.joinPolicy !== undefined) {
+    patch.joinPolicy = sanitizeJoinPolicy(patch.joinPolicy);
+  }
   if (patch.fileWatch !== undefined) {
     patch.fileWatch = patch.fileWatch && typeof patch.fileWatch === 'object' ? sanitizeFileWatch(patch.fileWatch) : null;
   }
@@ -149,6 +156,12 @@ export function applyTaskPatch({ store, scheduler, id, body, allowCodeSwitch = f
   }
   const built = buildTaskPatch(current, body);
   if (!built.ok) return built;
+  if (built.patch.dependsOn !== undefined || built.patch.onSuccess !== undefined) {
+    const dagCheck = validateDAG(store?.tasks || {}, { ...current, ...built.patch, id });
+    if (!dagCheck.ok) {
+      return { ok: false, error: dagCheck.error };
+    }
+  }
   try {
     const task = store.set({ ...current, ...built.patch, id });
     if (task.status === 'active') scheduler.scheduleTask(task);

package/lib/task-transfer.js

@@ -77,6 +77,8 @@ export const PATCHABLE_TASK_FIELDS = [
   'validators',
   'requireApproval',
   'fileWatch',
+  'dependsOn',
+  'joinPolicy',
 ];
 
 /** Fields a duplicate inherits; anything else is runtime state, not config. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cron",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Background automation runner for DSH: isolated agent runs, script/HTTP/SSH/Docker runtimes, cost guard, notifications, heartbeats.",
   "type": "module",
   "main": "lib/index.js",