@goodandready/dsh-cron 0.3.11 → 0.3.12

package/README.md

@@ -625,7 +625,8 @@ Connect to `GET /dsh-cron/tasks/:id/stream` using Server-Sent Events (SSE) to re
 
 Execute tasks instantaneously on external events via incoming HTTP POST requests with enterprise-grade security and dynamic template interpolation:
 
-- **Authentication & Verification**: Supports HMAC SHA-256 signatures (`x-hub-signature-256` or `x-signature-sha256`) using task-level `webhookSecret`, bearer tokens (`x-dsh-cron-webhook-token`, `Authorization: Bearer <token>`, or `?token=<token>`) against task `webhookToken` or master `apiToken`. Fail-closed security rejects unconfigured webhooks.
+- **Authentication & Verification**: Supports HMAC SHA-256 signatures (`x-hub-signature-256` or `x-signature-sha256`) using task-level `webhookSecret`, bearer tokens passed via headers (`x-dsh-cron-webhook-token`, `x-webhook-token`, `Authorization: Bearer <token>`) against task `webhookToken` or master `apiToken`. Query parameter token authentication (`?token=`) is strictly rejected to prevent secret leakage in proxy logs and browser history (#358). Fail-closed security rejects unconfigured webhooks.
+- **Fail-Closed API Authentication**: All REST routes verify callers via DSH `ctx.connection.requestRejection(req)`, token verification, and loopback verification. Requests without socket/remoteAddress and without valid authentication are strictly rejected with 401/403, preventing remote unauthenticated state modification and RCE (#357).
 - **Deep JSON Payload Interpolation**: Dynamic prompt variables resolve incoming payload fields using dot notation (`{webhook.body.repository.full_name}`, `{webhook.headers.x_github_event}`, `{webhook.query.ref}`, `{webhook.body}`).
 - **Script Environment Injection**: Script and shell tasks automatically receive the raw request body and headers in `DSH_CRON_WEBHOOK_BODY` and `DSH_CRON_WEBHOOK_HEADERS`.
 - **Anti-Spam Debouncing**: Configurable per-task `webhookDebounceMs` (default 500ms) guarantees protection against webhook storms and burst duplicate executions.

package/README.ru.md

@@ -577,7 +577,8 @@ bash deploy.sh verify [exact-version]
 ### 32. Входящие HTTP Webhook триггеры и естественно-языковой парсер расписаний (v0.3.11, #348, #349)
 
 - **Входящие Webhook триггеры (`/dsh-cron/webhook/:id`)**: Моментальный запуск задач по внешним событиям (GitHub, Gitea, CI/CD, сторонние сервисы).
-  - **Аутентификация и безопасность**: Поддержка HMAC SHA-256 подписи (`x-hub-signature-256`, `x-signature-sha256`) через `webhookSecret`, индивидуальных токенов задачи (`webhookToken`) через `x-dsh-cron-webhook-token`, Bearer или query-параметр, а также мастер-токена `apiToken`. Fail-closed архитектура отклоняет запросы к незащищенным задачам.
+  - **Аутентификация и безопасность**: Поддержка HMAC SHA-256 подписи (`x-hub-signature-256`, `x-signature-sha256`) через `webhookSecret`, индивидуальных токенов задачи (`webhookToken`) исключительно через заголовки (`x-dsh-cron-webhook-token`, `x-webhook-token`, `Authorization: Bearer`), а также мастер-токена `apiToken`. Приём токенов из query-параметров (`?token=`) строго заблокирован для предотвращения утечки в логи прокси и историю браузера (#358).
+  - **Fail-closed защита API и RCE Guard (#357)**: Все маршруты плагина проверяются через DSH `ctx.connection.requestRejection(req)` для допуска браузерных сессий DSH, а также требуют валидный Bearer-токен или локальный loopback адрес. Запросы без валидной аутентификации отсекаются с 401/403 до парсинга тела, предотвращая несанкционированное создание задач и удалённое выполнение кода.
   - **Глубокая интерполяция payload**: Шаблоны `{webhook.body.path.to.key}`, `{webhook.headers.key}`, `{webhook.query.param}` и `{webhook.body}` автоматически раскрываются в промпте задачи.
   - **Проброс в окружение**: Скриптовым и shell-задачам передаются переменные `DSH_CRON_WEBHOOK_BODY` и `DSH_CRON_WEBHOOK_HEADERS`.
   - **Дебаунс от штормов**: Настраиваемый `webhookDebounceMs` (по умолчанию 500 мс) защищает от дублирующих всплесков событий.

package/README.zh.md

@@ -574,6 +574,17 @@ dsh-cron:
 
 ---
 
+### 32. 入站 HTTP Webhook 与接口鉴权加固 (v0.3.12, #348, #357, #358)
+
+- **入站 HTTP Webhook 触发器 (`/dsh-cron/webhook/:id`)**：外部事件（GitHub、Gitea、CI/CD 及第三方服务）实时触发任务执行。
+  - **安全鉴权**：支持基于任务级 `webhookSecret` 的 HMAC SHA-256 签名（`x-hub-signature-256`、`x-signature-sha256`）、任务级 `webhookToken`（仅限标头：`x-dsh-cron-webhook-token`、`x-webhook-token`、`Authorization: Bearer`）以及全局 `apiToken` 鉴权。严格禁止从 URL 查询参数（`?token=`）传递令牌以防止日志泄露（#358）。
+  - **深度 JSON 负载插值**：提示词中通过 `{webhook.body.path.to.key}`、`{webhook.headers.key}`、`{webhook.query.param}` 及 `{webhook.body}` 自动解构提取入站数据。
+  - **环境注入**：脚本与 shell 任务自动注入 `DSH_CRON_WEBHOOK_BODY` 和 `DSH_CRON_WEBHOOK_HEADERS` 环境变量。
+  - **防抖保护**：可配置 `webhookDebounceMs`（默认 500ms）有效防止 Webhook 事件风暴与瞬态重复触发。
+- **Fail-Closed 接口鉴权与 RCE 防御（#357）**：所有 REST 端点通过 DSH `ctx.connection.requestRejection(req)` 校验会话权限，并对无有效令牌及非本地回环地址的请求实行 Fail-closed 严格拦截（401/403），杜绝未授权远程任务创建与代码执行。
+
+---
+
 ## 🧪 测试与预检门禁 (Preflight)
 
 运行全套自动化测试（调度表达式解析、调度器引擎、原子存储、HTTP 辅助函数、通知与工具契约）：

package/lib/api-helpers.js

@@ -4,13 +4,13 @@ import { sendJson, readBody, rejectCrossOrigin } from './http-utils.js';
 
 const NOT_ALLOWED = { ok: false, error: 'Method not allowed' };
 
-export function handleHeartbeatPing({ store, req, res, taskId, apiToken: explicitToken }) {
+export function handleHeartbeatPing({ store, req, res, taskId, apiToken: explicitToken, ctx }) {
   if (req.method !== 'POST') {
     sendJson(res, 405, NOT_ALLOWED);
     return;
   }
   const apiToken = explicitToken || store?.getSettings?.()?.apiToken;
-  if (rejectCrossOrigin(req, res, { apiToken })) return;
+  if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
 
   const task = store.get(taskId);
   if (!task) {
@@ -25,9 +25,9 @@ export function handleHeartbeatPing({ store, req, res, taskId, apiToken: explici
   sendJson(res, 200, result);
 }
 
-export async function handleSchedulePreview({ req, res, url, store, apiToken: explicitToken }) {
+export async function handleSchedulePreview({ req, res, url, store, apiToken: explicitToken, ctx }) {
   const apiToken = explicitToken || store?.getSettings?.()?.apiToken;
-  if (rejectCrossOrigin(req, res, { apiToken })) return;
+  if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
 
   let schedule = '';
   let timezone = '';
@@ -61,9 +61,9 @@ export async function handleSchedulePreview({ req, res, url, store, apiToken: ex
   }
 }
 
-export async function handleDryRunTask({ store, scheduler, req, res, id }) {
-  const apiToken = store?.getSettings?.()?.apiToken;
-  if (rejectCrossOrigin(req, res, { apiToken })) return;
+export async function handleDryRunTask({ store, scheduler, req, res, id, apiToken: explicitToken, ctx }) {
+  const apiToken = explicitToken || store?.getSettings?.()?.apiToken;
+  if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
   const task = store.get(id);
   if (!task) {
     sendJson(res, 404, { ok: false, error: 'Task not found' });
@@ -78,9 +78,9 @@ export async function handleDryRunTask({ store, scheduler, req, res, id }) {
   }
 }
 
-export async function handleScheduleTimeline({ req, res, url, store, scheduler, apiToken: explicitToken }) {
+export async function handleScheduleTimeline({ req, res, url, store, scheduler, apiToken: explicitToken, ctx }) {
   const apiToken = explicitToken || store?.getSettings?.()?.apiToken;
-  if (rejectCrossOrigin(req, res, { apiToken })) return;
+  if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
 
   if (req.method !== 'GET') {
     sendJson(res, 405, NOT_ALLOWED);

package/lib/api-task-webhook.js

@@ -38,19 +38,19 @@ export function verifyHmacSignature(rawBuffer, secret, signatureHeader) {
 }
 
 /**
- * Verify token from header, Bearer auth, or query param.
+ * Verify token from header or Bearer auth.
+ * Query parameter authentication is strictly rejected to prevent token leakage in proxy logs and browser history (#358).
  */
 export function verifyToken(expectedToken, req, url) {
   if (!expectedToken) return false;
-  const headers = req.headers || {};
+  const headers = req?.headers || {};
   const headerToken = headers['x-dsh-cron-webhook-token'] || headers['x-webhook-token'];
   const authHeader = headers['authorization'];
   let bearerToken = '';
   if (authHeader && /^Bearer\s+/i.test(authHeader)) {
     bearerToken = authHeader.replace(/^Bearer\s+/i, '').trim();
   }
-  const queryToken = url?.searchParams?.get('token');
-  const candidate = headerToken || bearerToken || queryToken;
+  const candidate = headerToken || bearerToken;
   if (!candidate) return false;
   return safeCompare(expectedToken, candidate);
 }

package/lib/api.js

@@ -71,9 +71,11 @@ function refuseConfigOwned(res, id) {
  * deeper path unrouted (#96). Exported for unit tests.
  */
 export function createCronApiHandler(store, scheduler, collection) {
+  const ctx = collection?.ctx;
   return async function handleCronApi(req, res) {
     try {
       const apiToken = store?.getSettings?.()?.apiToken;
+      const authOptions = { apiToken, ctx };
       const url = new URL(req.url, 'http://127.0.0.1');
       const parts = url.pathname.split('/').filter(Boolean);
       const scope = parts[1]; // 'tasks' | 'action' | 'heartbeat-ping'
@@ -90,25 +92,25 @@ export function createCronApiHandler(store, scheduler, collection) {
       }
 
       if ((scope === 'heartbeat' || scope === 'heartbeat-ping') && id) {
-        handleHeartbeatPing({ store, req, res, taskId: id });
+        handleHeartbeatPing({ store, req, res, taskId: id, apiToken, ctx });
         return;
       }
 
       if (scope === 'schedule' && id === 'preview') {
-        await handleSchedulePreview({ req, res, url, store });
+        await handleSchedulePreview({ req, res, url, store, apiToken, ctx });
         return;
       }
       if (scope === 'schedule' && id === 'timeline-24h') {
-        await handleScheduleTimeline({ req, res, url, store, scheduler });
+        await handleScheduleTimeline({ req, res, url, store, scheduler, apiToken, ctx });
         return;
       }
 
       if (!id) {
-        await handleTaskCollection({ store, scheduler, collection, req, res, url, scope, apiToken });
+        await handleTaskCollection({ store, scheduler, collection, req, res, url, scope, apiToken, ctx });
         return;
       }
 
-      if (rejectCrossOrigin(req, res, { apiToken })) return;
+      if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
 
       // Export/import are collection operations that live under /tasks/:id/…,
       // so they are matched before the generic id handling below.
@@ -129,7 +131,7 @@ export function createCronApiHandler(store, scheduler, collection) {
         return;
       }
 
-      await handleTaskItem({ store, scheduler, req, res, url, id, action, apiToken });
+      await handleTaskItem({ store, scheduler, req, res, url, id, action, apiToken, ctx });
     } catch (err) {
       sendJson(res, err.statusCode || 500, { ok: false, error: err.message });
     }
@@ -138,19 +140,19 @@ export function createCronApiHandler(store, scheduler, collection) {
 
 // ------------------------------------------------------------- collection
 
-async function handleTaskCollection({ store, scheduler, collection, req, res, url, scope, apiToken }) {
+async function handleTaskCollection({ store, scheduler, collection, req, res, url, scope, apiToken, ctx }) {
   // The alias family only exists for individual tasks.
   if (scope === 'action' || !collection) {
     sendJson(res, 405, NOT_ALLOWED);
     return;
   }
   if (req.method === 'GET') {
-    if (rejectCrossOrigin(req, res, { apiToken })) return;
+    if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
     listTasks({ store, scheduler, collection, req, res, url });
     return;
   }
   if (req.method === 'POST') {
-    await createOrUpdateTask({ store, scheduler, req, res, apiToken });
+    await createOrUpdateTask({ store, scheduler, req, res, apiToken, ctx: undefined });
     return;
   }
   sendJson(res, 405, NOT_ALLOWED);
@@ -187,8 +189,8 @@ function listTasks({ store, scheduler, collection, req, res, url }) {
   sendJson(res, 200, payload);
 }
 
-async function createOrUpdateTask({ store, scheduler, req, res, apiToken }) {
-  if (rejectCrossOrigin(req, res, { apiToken })) return;
+async function createOrUpdateTask({ store, scheduler, req, res, apiToken, ctx }) {
+  if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
   const { body: rawBody, error } = await readBody(req, res);
   if (error) return;
   const existing = rawBody.id ? store.get(rawBody.id) : null;
@@ -291,14 +293,14 @@ function buildTaskRecord(store, body, taskType, parsed) {
 
 // ------------------------------------------------------------ single task
 
-async function handleTaskItem({ store, scheduler, req, res, url, id, action, apiToken }) {
+async function handleTaskItem({ store, scheduler, req, res, url, id, action, apiToken, ctx }) {
   if (action === 'heartbeat') {
-    handleHeartbeatPing({ store, req, res, taskId: id });
+    handleHeartbeatPing({ store, req, res, taskId: id, apiToken, ctx });
     return;
   }
 
   if (req.method === 'POST' && action === 'dry-run') {
-    await handleDryRunTask({ store, scheduler, req, res, id });
+    await handleDryRunTask({ store, scheduler, req, res, id, apiToken, ctx });
     return;
   }
 
@@ -307,7 +309,7 @@ async function handleTaskItem({ store, scheduler, req, res, url, id, action, api
       logStreamer.handleSseRequest(id, req, res);
       return;
     }
-    if (rejectCrossOrigin(req, res, { apiToken })) return;
+    if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
     if (action === 'archive') {
       const limit = parseInt(url.searchParams.get('limit') || '50', 10);
       const offset = parseInt(url.searchParams.get('offset') || '0', 10);
@@ -706,7 +708,7 @@ export async function handleExternalTaskRequest({ store, scheduler, req, res, ur
       return;
     }
     if (req.method === 'POST') {
-      await createOrUpdateTask({ store, scheduler, req, res, apiToken });
+      await createOrUpdateTask({ store, scheduler, req, res, apiToken, ctx: undefined });
       return;
     }
     sendJson(res, 405, NOT_ALLOWED);

package/lib/http-utils.js

@@ -77,65 +77,142 @@ export function parseJsonBody(req, limit = MAX_BODY_BYTES) {
 }
 
 /**
- * Validate that an incoming request originates from a trusted local caller or
- * an authenticated client (Issue #86).
+ * Safe helper to get the DSH connection service from context or request (#357).
+ */
+export function getConnection(ctx) {
+  if (!ctx) return null;
+  return Reflect.get(ctx, 'connection') || ctx.connection || null;
+}
+
+export function getDshConnection(req, options = {}) {
+  if (options.connection) return options.connection;
+  if (options.ctx) {
+    const conn = getConnection(options.ctx);
+    if (conn) return conn;
+  }
+  if (req) {
+    if (req.connectionService) return req.connectionService;
+    if (req.ctx) {
+      const conn = getConnection(req.ctx);
+      if (conn) return conn;
+    }
+  }
+  return null;
+}
+
+/**
+ * Determine if an incoming request should be rejected, and with which HTTP status (401 or 403).
+ * Returns undefined if the request is admitted, or 401 / 403 if rejected (#357).
  *
  * Rules:
- * 1. Non-loopback remote callers are rejected unless authenticated with a valid token.
- * 2. Host header must be present and non-empty.
- * 3. Origin header (if present) cannot be null and its host must match Host.
- * 4. Sec-Fetch-Site (if present) must be same-origin or none (cross-site/same-site rejected).
- * 5. Mutating requests (POST, PUT, PATCH, DELETE) must provide browser proof (same-origin / matching Origin)
- *    or an explicit capability header (confirm header, token, or update header).
+ * 1. If DSH connection service is available, consult its admission first.
+ *    - Connection service rejection 403 (untrusted Host / Origin / CSRF) is strictly rejected.
+ *    - Connection service admission (undefined rejection) admits the request (browser session / Peer).
+ * 2. Token authentication: valid Bearer token matching options.apiToken, DSH_AUTH_TOKEN or DSH_TOKEN.
+ * 3. Local loopback caller: 127.0.0.1 or ::1 when connection service is not bound (standalone/CLI/test).
+ * 4. FAIL-CLOSED: if connection service is bound, request must have DSH admission or valid API token.
+ *    If connection service is not bound, request must have valid API token or verified loopback IP.
+ *    Requests with missing socket / missing remoteAddress and no token are rejected (401).
+ * 5. Origin and Sec-Fetch-Site: cannot be null, Origin host must match Host, Sec-Fetch-Site must be same-origin or none.
  */
-export function isTrustedRequest(req, options = {}) {
-  if (!req) return false;
+export function getRequestRejection(req, options = {}) {
+  if (!req) return 403;
+
+  // 1. Validate Origin header if present: cannot be null, must match Host (CSRF guard)
   const headers = req.headers || {};
+  const origin = headers.origin;
+  const host = headers.host || '';
+  if (origin !== undefined) {
+    if (origin === 'null' || !origin) return 403;
+    try {
+      const parsed = new URL(origin);
+      if (!parsed.host || !host || parsed.host !== host) return 403;
+    } catch {
+      return 403;
+    }
+  }
 
-  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress;
-  const hasRemote = Boolean(remote && typeof remote === 'string');
-  const isLoopback = Boolean(hasRemote && isLoopbackAddress(remote));
+  // 2. Validate Sec-Fetch-Site header if present
+  const site = headers['sec-fetch-site'];
+  if (site !== undefined) {
+    if (site !== 'same-origin' && site !== 'none') {
+      return 403;
+    }
+  }
 
+  // 3. Check DSH connection service if available (#357)
+  const conn = getDshConnection(req, options);
+  let connRejection;
+  if (conn && typeof conn.requestRejection === 'function') {
+    connRejection = conn.requestRejection(req);
+    if (connRejection === 403) {
+      return 403;
+    }
+  }
+
+  // 4. Check token authentication
   const token = extractBearerToken(req);
   const expectedToken = options.apiToken || process.env.DSH_AUTH_TOKEN || process.env.DSH_TOKEN;
   const isTokenAuthenticated = Boolean(expectedToken && token && token === expectedToken);
 
-  // 1. Non-loopback socket callers (or callers with missing remoteAddress) require explicit token authentication (#86, #295)
-  if (req.socket || req.connection || hasRemote) {
-    if (!isLoopback && !isTokenAuthenticated) {
-      return false;
+  // If DSH connection service admitted the request (undefined rejection)
+  const isConnectionAdmitted = Boolean(conn && connRejection === undefined);
+
+  // Check loopback address
+  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress;
+  const hasRemote = Boolean(remote && typeof remote === 'string');
+  const isLoopback = Boolean(hasRemote && isLoopbackAddress(remote));
+
+  // FAIL-CLOSED AUTHENTICATION CHECK (#357):
+  if (conn) {
+    if (!isConnectionAdmitted && !isTokenAuthenticated) {
+      return connRejection === 403 ? 403 : 401;
+    }
+  } else {
+    if (!isTokenAuthenticated && !isLoopback) {
+      if (token || !hasRemote) {
+        return 401;
+      }
+      return 403;
     }
   }
 
-  // 2. Validate Origin header if present: cannot be null, must match Host
+  return undefined; // Admitted
+}
+
+/**
+ * Validate that an incoming request originates from a trusted local caller,
+ * an admitted DSH browser session, or an authenticated client (Issue #86, #357).
+ */
+export function isTrustedRequest(req, options = {}) {
+  return getRequestRejection(req, options) === undefined;
+}
+
+/**
+ * Backward-compatible helper for checking cross-origin browser headers (Origin / Sec-Fetch-Site).
+ */
+export function isCrossOrigin(req, options) {
+  if (!req) return true;
+  const headers = req.headers || {};
   const origin = headers.origin;
   const host = headers.host || '';
   if (origin !== undefined) {
-    if (origin === 'null' || !origin) return false;
+    if (origin === 'null' || !origin) return true;
     try {
       const parsed = new URL(origin);
-      if (!parsed.host || !host || parsed.host !== host) return false;
+      if (!parsed.host || !host || parsed.host !== host) return true;
     } catch {
-      return false;
+      return true;
     }
   }
 
-  // 3. Validate Sec-Fetch-Site header if present
   const site = headers['sec-fetch-site'];
   if (site !== undefined) {
     if (site !== 'same-origin' && site !== 'none') {
-      return false;
+      return true;
     }
   }
-
-  return true;
-}
-
-/**
- * Backward-compatible wrapper for checking cross-origin / untrusted requests.
- */
-export function isCrossOrigin(req, options) {
-  return !isTrustedRequest(req, options);
+  return false;
 }
 
 /**
@@ -158,9 +235,13 @@ export function sendJson(res, statusCode, data) {
   res.end(JSON.stringify(data));
 }
 
-export function rejectCrossOrigin(req, res, options) {
-  if (!isTrustedRequest(req, options)) {
-    sendJson(res, 403, { ok: false, error: 'Forbidden: untrusted or cross-origin request' });
+export function rejectCrossOrigin(req, res, options = {}) {
+  const rejection = getRequestRejection(req, options);
+  if (rejection !== undefined) {
+    const errorMsg = rejection === 401
+      ? 'Unauthorized: authentication required'
+      : 'Forbidden: untrusted or cross-origin request';
+    sendJson(res, rejection, { ok: false, error: errorMsg });
     return true;
   }
   return false;

package/lib/index.js

@@ -307,7 +307,7 @@ export function apply(ctx, rawConfig) {
       try {
         const settings = store && typeof store.getSettings === 'function' ? store.getSettings() : {};
         const apiToken = settings.apiToken;
-        if (rejectCrossOrigin(req, res, { apiToken })) return;
+        if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
 
         if (req.method === 'GET') {
           const unwrapped = {
@@ -324,7 +324,7 @@ export function apply(ctx, rawConfig) {
           return;
         }
         if (req.method === 'POST') {
-          if (rejectCrossOrigin(req, res)) return;
+          if (rejectCrossOrigin(req, res, { ctx })) return;
           const { body, error } = await readBody(req, res);
           if (error) return;
           const payload = sanitizeSettingsPayload(body);

package/lib/routes.js

@@ -20,20 +20,20 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
   ctx.effect(() => ctx.webServer.register({
     kind: 'prefix',
     path: '/dsh-cron/tasks',
-    handler: createCronApiHandler(store, scheduler, { recommendations })
+    handler: createCronApiHandler(store, scheduler, { recommendations, ctx })
   }), 'dsh-cron: /tasks[...]');
 
   // Alias route /dsh-cron/action/:id/:action for backward compatibility (#66)
   ctx.effect(() => ctx.webServer.register({
     kind: 'prefix',
     path: '/dsh-cron/action',
-    handler: createCronApiHandler(store, scheduler, null)
+    handler: createCronApiHandler(store, scheduler, { ctx })
   }), 'dsh-cron: /action/:id/:action');
 
   ctx.effect(() => ctx.webServer.register({
     kind: 'prefix',
     path: '/dsh-cron/telegram',
-    handler: createCronApiHandler(store, scheduler, null)
+    handler: createCronApiHandler(store, scheduler, { ctx })
   }), 'dsh-cron: /telegram[...]');
 
   // Incoming HTTP Webhook triggers (#348)
@@ -46,13 +46,13 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
   ctx.effect(() => ctx.webServer.register({
     kind: 'prefix',
     path: '/dsh-cron/heartbeat-ping',
-    handler: createCronApiHandler(store, scheduler, null)
+    handler: createCronApiHandler(store, scheduler, { ctx })
   }), 'dsh-cron: /heartbeat-ping[...]');
 
   ctx.effect(() => ctx.webServer.register({
     kind: 'prefix',
     path: '/dsh-cron/schedule',
-    handler: createCronApiHandler(store, scheduler, null)
+    handler: createCronApiHandler(store, scheduler, { ctx })
   }), 'dsh-cron: /schedule[...]');
 
 
@@ -60,14 +60,14 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
   ctx.effect(() => ctx.webServer.register({
     kind: 'prefix',
     path: '/dsh-cron/chains',
-    handler: (req, res) => handleChainRoutes(store, scheduler, req, res)
+    handler: (req, res) => handleChainRoutes(store, scheduler, req, res, ctx)
   }), 'dsh-cron: /chains[...]');
 
   // Run artifacts listing, download and safe preview (#321)
   ctx.effect(() => ctx.webServer.register({
     kind: 'prefix',
     path: '/dsh-cron/runs',
-    handler: (req, res) => handleRunArtifactRoutes(store, req, res)
+    handler: (req, res) => handleRunArtifactRoutes(store, req, res, ctx)
   }), 'dsh-cron: /runs[...]');
 
   // GET /dsh-cron/metrics (#53) — Prometheus text exposition
@@ -98,7 +98,7 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
     handler: async (req, res) => {
       const settings = store && typeof store.getSettings === 'function' ? store.getSettings() : {};
       const apiToken = settings.apiToken;
-      if (rejectCrossOrigin(req, res, { apiToken })) return;
+      if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
       await getModelsHandler(ctx, req, res, sendJson);
     }
   }), 'dsh-cron: /models');
@@ -108,7 +108,7 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
     kind: 'exact',
     path: '/dsh-cron/chat/start',
     handler: async (req, res) => {
-      if (req.method === 'POST' && rejectCrossOrigin(req, res)) return;
+      if (req.method === 'POST' && rejectCrossOrigin(req, res, { ctx })) return;
       await chatStartHandler(ctx, req, res, parseJsonBody, sendJson, randomUUID);
     }
   }), 'dsh-cron: /chat/start');
@@ -121,7 +121,7 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
       try {
         const settings = store && typeof store.getSettings === 'function' ? store.getSettings() : {};
         const apiToken = settings.apiToken;
-        if (rejectCrossOrigin(req, res, { apiToken })) return;
+        if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
 
         const url = new URL(req.url, 'http://127.0.0.1');
         const path = url.pathname;
@@ -169,7 +169,7 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
         }
 
         if (req.method === 'POST') {
-          if (rejectCrossOrigin(req, res)) return;
+          if (rejectCrossOrigin(req, res, { ctx })) return;
           const { body } = await readBody(req, res);
           const days = parseInt(body?.days || url.searchParams.get('days') || '7', 10);
           const tasks = store.list ? store.list() : Object.values(store.tasks || {});
@@ -227,7 +227,7 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
         }
         const settings = store.getSettings ? store.getSettings() : {};
         const apiToken = settings.apiToken;
-        if (rejectCrossOrigin(req, res, { apiToken })) return;
+        if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
         const categories = recipesByCategory();
         const recipes = listVerifiedRecipes(settings);
         sendJson(res, 200, { ok: true, categories, recipes });
@@ -249,7 +249,7 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
         }
         const settings = store.getSettings ? store.getSettings() : {};
         const apiToken = settings.apiToken;
-        if (rejectCrossOrigin(req, res, { apiToken })) return;
+        if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
 
         const tasks = store.list({ status: 'active' });
         const lastRuns = tasks.map((t) => t.lastRunAt || 0);
@@ -276,7 +276,7 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
           sendJson(res, 405, { ok: false, error: 'Method not allowed' });
           return;
         }
-        if (rejectCrossOrigin(req, res)) return;
+        if (rejectCrossOrigin(req, res, { ctx })) return;
         const { body, error } = await readBody(req, res);
         if (error) return;
         const settings = store.getSettings();
@@ -308,7 +308,7 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
           sendJson(res, 405, { ok: false, error: 'Method not allowed' });
           return;
         }
-        if (rejectCrossOrigin(req, res)) return;
+        if (rejectCrossOrigin(req, res, { ctx })) return;
         const { body, error } = await readBody(req, res);
         if (error) return;
         const settings = store.getSettings();
@@ -339,10 +339,10 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
 /**
  * Handler for chain step retries (#319)
  */
-export async function handleChainRoutes(store, scheduler, req, res) {
+export async function handleChainRoutes(store, scheduler, req, res, ctx) {
   const settings = store && typeof store.getSettings === 'function' ? store.getSettings() : {};
   const apiToken = settings.apiToken;
-  if (rejectCrossOrigin(req, res, { apiToken })) return;
+  if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
   const url = new URL(req.url, 'http://localhost');
 
   // GET /dsh-cron/chains/:chainRunId (#334)
@@ -386,7 +386,7 @@ export async function handleChainRoutes(store, scheduler, req, res) {
 /**
  * Handler for run artifacts (#321)
  */
-export async function handleRunArtifactRoutes(store, req, res) {
+export async function handleRunArtifactRoutes(store, req, res, ctx) {
   const url = new URL(req.url, 'http://localhost');
   const m = url.pathname.match(/^\/dsh-cron\/runs\/([^\/]+)\/artifacts(?:\/([^\/]+)(?:\/(preview))?)?$/);
   if (!m) {
@@ -399,7 +399,7 @@ export async function handleRunArtifactRoutes(store, req, res) {
   }
   const settings = store && typeof store.getSettings === 'function' ? store.getSettings() : {};
   const apiToken = settings.apiToken;
-  if (rejectCrossOrigin(req, res, { apiToken })) return;
+  if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
 
   const [, runId, artifactId, action] = m;
   if (!artifactId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cron",
-  "version": "0.3.11",
+  "version": "0.3.12",
   "description": "Background automation runner for DSH: isolated agent runs, script/HTTP/SSH/Docker runtimes, cost guard, notifications, heartbeats.",
   "type": "module",
   "main": "lib/index.js",