@goodandready/dsh-cron 0.3.11 → 0.3.13

package/README.md

@@ -90,6 +90,18 @@ graph TD
 
 ## ✨ Features & Capabilities
 
+### 🔀 Decision Nodes & Conditional IF/ELSE Branching (#352)
+- **Conditional Routing**: Tasks can define `branchRules` evaluating execution outcomes (`exitCode`, `output`, `output.json.<path>`, `status`) with operators (`equals`, `notequals`, `contains`, `gt`, `gte`, `lt`, `lte`, `regex`, `exists`).
+- **Fallback Else**: Optional `elseTask` triggers when no branch condition matches.
+- **Deadlock-Free Synchronization**: Untriggered branch tasks are safely recorded with `status: 'skipped'`, unblocking downstream join barriers (`joinPolicy: 'all_success'`).
+- **Graph Visualization**: DAG Graph View displays decision badges (`🔀 Decision`) and condition labels on connecting edges.
+
+### 🩺 Autonomous Self-Healing Doctor (#353)
+- **Failure Classification**: Automatic detection of 8 failure categories: `syntax_error`, `dependency_missing`, `rate_limit`, `auth_failed`, `schema_change`, `timeout`, `network_error`, `runtime_error`.
+- **Unified Diff**: Clean line-by-line diff preview of proposed fixes before application.
+- **1-Click Apply & Revert**: Dedicated `/doctor/apply` and `/doctor/revert` endpoints with full revision backup (up to 10 versions preserved in `task.revisions`).
+- **Guarded Autonomous Auto-Healing**: When `autoHeal: true`, high-confidence fixes are applied automatically with a strict 24-hour rate limit to prevent repair loops.
+
 ### 1. Visual Task Manager & Sidebar Action
 Click the clock icon in the DSH sidebar (positioned next to the new-session button) to open the management panel:
 * **Status Filter Tabs**: toggle between **All**, **Active**, **Paused**, and **Completed** tasks.
@@ -625,7 +637,8 @@ Connect to `GET /dsh-cron/tasks/:id/stream` using Server-Sent Events (SSE) to re
 
 Execute tasks instantaneously on external events via incoming HTTP POST requests with enterprise-grade security and dynamic template interpolation:
 
-- **Authentication & Verification**: Supports HMAC SHA-256 signatures (`x-hub-signature-256` or `x-signature-sha256`) using task-level `webhookSecret`, bearer tokens (`x-dsh-cron-webhook-token`, `Authorization: Bearer <token>`, or `?token=<token>`) against task `webhookToken` or master `apiToken`. Fail-closed security rejects unconfigured webhooks.
+- **Authentication & Verification**: Supports HMAC SHA-256 signatures (`x-hub-signature-256` or `x-signature-sha256`) using task-level `webhookSecret`, bearer tokens passed via headers (`x-dsh-cron-webhook-token`, `x-webhook-token`, `Authorization: Bearer <token>`) against task `webhookToken` or master `apiToken`. Query parameter token authentication (`?token=`) is strictly rejected to prevent secret leakage in proxy logs and browser history (#358). Fail-closed security rejects unconfigured webhooks.
+- **Fail-Closed API Authentication**: All REST routes verify callers via DSH `ctx.connection.requestRejection(req)`, token verification, and loopback verification. Requests without socket/remoteAddress and without valid authentication are strictly rejected with 401/403, preventing remote unauthenticated state modification and RCE (#357).
 - **Deep JSON Payload Interpolation**: Dynamic prompt variables resolve incoming payload fields using dot notation (`{webhook.body.repository.full_name}`, `{webhook.headers.x_github_event}`, `{webhook.query.ref}`, `{webhook.body}`).
 - **Script Environment Injection**: Script and shell tasks automatically receive the raw request body and headers in `DSH_CRON_WEBHOOK_BODY` and `DSH_CRON_WEBHOOK_HEADERS`.
 - **Anti-Spam Debouncing**: Configurable per-task `webhookDebounceMs` (default 500ms) guarantees protection against webhook storms and burst duplicate executions.

package/README.ru.md

@@ -90,6 +90,18 @@ graph TD
 
 ## ✨ Возможности
 
+### 🔀 Решающие узлы и условные развилки IF/ELSE (#352)
+- **Маршрутизация по условию**: Задачи могут задавать `branchRules` для проверки результата (`exitCode`, `output`, `output.json.<path>`, `status`) через операторы (`equals`, `notequals`, `contains`, `gt`, `gte`, `lt`, `lte`, `regex`, `exists`).
+- **Ветка Else**: Резервная задача `elseTask` запускается, если ни одно из правил не совпало.
+- **Защита от взаимных блокировок**: Невыбранные ветви автоматически регистрируются со статусом `skipped`, предотвращая зависание барьеров синхронизации (`joinPolicy: 'all_success'`).
+- **Визуализация в графе**: DAG Graph View отображает бейджи решающих узлов (`🔀 Decision`) и условия на соединительных линиях.
+
+### 🩺 Автономный Доктор самовосстановления (Self-Healing Doctor) (#353)
+- **Классификация сбоев**: Автоматическое распознавание 8 типов ошибок (`syntax_error`, `dependency_missing`, `rate_limit`, `auth_failed`, `schema_change`, `timeout`, `network_error`, `runtime_error`).
+- **Unified Diff**: Наглядный просмотр диффа предлагаемого исправления до его применения.
+- **1-Click применение и откат**: API эндпоинты `/doctor/apply` и `/doctor/revert` с сохранением до 10 ревизий в `task.revisions`.
+- **Безопасная авто-починка**: При включённом `autoHeal: true` патчи с высокой уверенностью (`high`) применяются автоматически с лимитом не чаще 1 раза в сутки.
+
 ### 1. Визуальный менеджер задач
 Нажмите на иконку-часы в сайдбаре DSH (рядом с кнопкой новой сессии), чтобы открыть панель:
 * **Табы фильтрации**: **Все**, **Активные**, **На паузе**, **Завершённые**.
@@ -577,7 +589,8 @@ bash deploy.sh verify [exact-version]
 ### 32. Входящие HTTP Webhook триггеры и естественно-языковой парсер расписаний (v0.3.11, #348, #349)
 
 - **Входящие Webhook триггеры (`/dsh-cron/webhook/:id`)**: Моментальный запуск задач по внешним событиям (GitHub, Gitea, CI/CD, сторонние сервисы).
-  - **Аутентификация и безопасность**: Поддержка HMAC SHA-256 подписи (`x-hub-signature-256`, `x-signature-sha256`) через `webhookSecret`, индивидуальных токенов задачи (`webhookToken`) через `x-dsh-cron-webhook-token`, Bearer или query-параметр, а также мастер-токена `apiToken`. Fail-closed архитектура отклоняет запросы к незащищенным задачам.
+  - **Аутентификация и безопасность**: Поддержка HMAC SHA-256 подписи (`x-hub-signature-256`, `x-signature-sha256`) через `webhookSecret`, индивидуальных токенов задачи (`webhookToken`) исключительно через заголовки (`x-dsh-cron-webhook-token`, `x-webhook-token`, `Authorization: Bearer`), а также мастер-токена `apiToken`. Приём токенов из query-параметров (`?token=`) строго заблокирован для предотвращения утечки в логи прокси и историю браузера (#358).
+  - **Fail-closed защита API и RCE Guard (#357)**: Все маршруты плагина проверяются через DSH `ctx.connection.requestRejection(req)` для допуска браузерных сессий DSH, а также требуют валидный Bearer-токен или локальный loopback адрес. Запросы без валидной аутентификации отсекаются с 401/403 до парсинга тела, предотвращая несанкционированное создание задач и удалённое выполнение кода.
   - **Глубокая интерполяция payload**: Шаблоны `{webhook.body.path.to.key}`, `{webhook.headers.key}`, `{webhook.query.param}` и `{webhook.body}` автоматически раскрываются в промпте задачи.
   - **Проброс в окружение**: Скриптовым и shell-задачам передаются переменные `DSH_CRON_WEBHOOK_BODY` и `DSH_CRON_WEBHOOK_HEADERS`.
   - **Дебаунс от штормов**: Настраиваемый `webhookDebounceMs` (по умолчанию 500 мс) защищает от дублирующих всплесков событий.

package/README.zh.md

@@ -90,6 +90,18 @@ graph TD
 
 ## ✨ 功能与能力
 
+### 🔀 决策节点与条件分支 IF/ELSE (#352)
+- **条件路由**：任务可配置 `branchRules`（评估 `exitCode`、`output`、`output.json.<path>` 等字段），支持 `equals`、`notequals`、`contains`、`gt`、`lt`、`regex` 等操作符。
+- **回退分支**：若无匹配规则，自动执行 `elseTask`。
+- **死锁防护**：未触发的分支自动标记为 `skipped`，确保后续汇聚栅栏（`joinPolicy: 'all_success'`）正常通过。
+- **DAG 可视化**：图谱界面直观展示决策标识（`🔀 Decision`）与连线判断条件。
+
+### 🩺 自愈医生（Self-Healing Doctor）(#353)
+- **故障诊断分类**：自动分类 8 类运行故障（语法错误、缺少依赖、频率限制、认证失效、架构变更、超时、网络错误、运行时异常）。
+- **统一代码差分**：生成直观的标准 Unified Diff 对比。
+- **一键应用与回滚**：提供 `/doctor/apply` 与 `/doctor/revert` 接口，自动保留多达 10 个历史版本（`task.revisions`）。
+- **受控自主修复**：启用 `autoHeal: true` 时，高可信度（`high`）修复自动生效，且强制 24 小时频次限制防止死循环。
+
 ### 1. 可视化任务管理器
 点击 DSH 侧边栏中的时钟图标（位于“新会话”按钮旁）打开管理面板：
 * **状态过滤标签**：**全部**、**活跃**、**已暂停**、**已完成**。
@@ -574,6 +586,17 @@ dsh-cron:
 
 ---
 
+### 32. 入站 HTTP Webhook 与接口鉴权加固 (v0.3.12, #348, #357, #358)
+
+- **入站 HTTP Webhook 触发器 (`/dsh-cron/webhook/:id`)**：外部事件（GitHub、Gitea、CI/CD 及第三方服务）实时触发任务执行。
+  - **安全鉴权**：支持基于任务级 `webhookSecret` 的 HMAC SHA-256 签名（`x-hub-signature-256`、`x-signature-sha256`）、任务级 `webhookToken`（仅限标头：`x-dsh-cron-webhook-token`、`x-webhook-token`、`Authorization: Bearer`）以及全局 `apiToken` 鉴权。严格禁止从 URL 查询参数（`?token=`）传递令牌以防止日志泄露（#358）。
+  - **深度 JSON 负载插值**：提示词中通过 `{webhook.body.path.to.key}`、`{webhook.headers.key}`、`{webhook.query.param}` 及 `{webhook.body}` 自动解构提取入站数据。
+  - **环境注入**：脚本与 shell 任务自动注入 `DSH_CRON_WEBHOOK_BODY` 和 `DSH_CRON_WEBHOOK_HEADERS` 环境变量。
+  - **防抖保护**：可配置 `webhookDebounceMs`（默认 500ms）有效防止 Webhook 事件风暴与瞬态重复触发。
+- **Fail-Closed 接口鉴权与 RCE 防御（#357）**：所有 REST 端点通过 DSH `ctx.connection.requestRejection(req)` 校验会话权限，并对无有效令牌及非本地回环地址的请求实行 Fail-closed 严格拦截（401/403），杜绝未授权远程任务创建与代码执行。
+
+---
+
 ## 🧪 测试与预检门禁 (Preflight)
 
 运行全套自动化测试（调度表达式解析、调度器引擎、原子存储、HTTP 辅助函数、通知与工具契约）：

package/lib/api-helpers.js

@@ -4,13 +4,13 @@ import { sendJson, readBody, rejectCrossOrigin } from './http-utils.js';
 
 const NOT_ALLOWED = { ok: false, error: 'Method not allowed' };
 
-export function handleHeartbeatPing({ store, req, res, taskId, apiToken: explicitToken }) {
+export function handleHeartbeatPing({ store, req, res, taskId, apiToken: explicitToken, ctx }) {
   if (req.method !== 'POST') {
     sendJson(res, 405, NOT_ALLOWED);
     return;
   }
   const apiToken = explicitToken || store?.getSettings?.()?.apiToken;
-  if (rejectCrossOrigin(req, res, { apiToken })) return;
+  if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
 
   const task = store.get(taskId);
   if (!task) {
@@ -25,9 +25,9 @@ export function handleHeartbeatPing({ store, req, res, taskId, apiToken: explici
   sendJson(res, 200, result);
 }
 
-export async function handleSchedulePreview({ req, res, url, store, apiToken: explicitToken }) {
+export async function handleSchedulePreview({ req, res, url, store, apiToken: explicitToken, ctx }) {
   const apiToken = explicitToken || store?.getSettings?.()?.apiToken;
-  if (rejectCrossOrigin(req, res, { apiToken })) return;
+  if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
 
   let schedule = '';
   let timezone = '';
@@ -61,9 +61,9 @@ export async function handleSchedulePreview({ req, res, url, store, apiToken: ex
   }
 }
 
-export async function handleDryRunTask({ store, scheduler, req, res, id }) {
-  const apiToken = store?.getSettings?.()?.apiToken;
-  if (rejectCrossOrigin(req, res, { apiToken })) return;
+export async function handleDryRunTask({ store, scheduler, req, res, id, apiToken: explicitToken, ctx }) {
+  const apiToken = explicitToken || store?.getSettings?.()?.apiToken;
+  if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
   const task = store.get(id);
   if (!task) {
     sendJson(res, 404, { ok: false, error: 'Task not found' });
@@ -78,9 +78,9 @@ export async function handleDryRunTask({ store, scheduler, req, res, id }) {
   }
 }
 
-export async function handleScheduleTimeline({ req, res, url, store, scheduler, apiToken: explicitToken }) {
+export async function handleScheduleTimeline({ req, res, url, store, scheduler, apiToken: explicitToken, ctx }) {
   const apiToken = explicitToken || store?.getSettings?.()?.apiToken;
-  if (rejectCrossOrigin(req, res, { apiToken })) return;
+  if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
 
   if (req.method !== 'GET') {
     sendJson(res, 405, NOT_ALLOWED);

package/lib/api-task-webhook.js

@@ -38,19 +38,19 @@ export function verifyHmacSignature(rawBuffer, secret, signatureHeader) {
 }
 
 /**
- * Verify token from header, Bearer auth, or query param.
+ * Verify token from header or Bearer auth.
+ * Query parameter authentication is strictly rejected to prevent token leakage in proxy logs and browser history (#358).
  */
 export function verifyToken(expectedToken, req, url) {
   if (!expectedToken) return false;
-  const headers = req.headers || {};
+  const headers = req?.headers || {};
   const headerToken = headers['x-dsh-cron-webhook-token'] || headers['x-webhook-token'];
   const authHeader = headers['authorization'];
   let bearerToken = '';
   if (authHeader && /^Bearer\s+/i.test(authHeader)) {
     bearerToken = authHeader.replace(/^Bearer\s+/i, '').trim();
   }
-  const queryToken = url?.searchParams?.get('token');
-  const candidate = headerToken || bearerToken || queryToken;
+  const candidate = headerToken || bearerToken;
   if (!candidate) return false;
   return safeCompare(expectedToken, candidate);
 }

package/lib/api.js

@@ -1,3 +1,4 @@
+import { applyDoctorFix, revertDoctorFix, diagnoseFailure } from './doctor.js';
 import { handleTaskWebhookRoute } from './api-task-webhook.js';
 import { rollbackPromptVersion, sanitizePromptHistory } from './prompt-evolver.js';
 import { sanitizeAdaptiveConfig } from './adaptive.js';
@@ -71,14 +72,17 @@ function refuseConfigOwned(res, id) {
  * deeper path unrouted (#96). Exported for unit tests.
  */
 export function createCronApiHandler(store, scheduler, collection) {
+  const ctx = collection?.ctx;
   return async function handleCronApi(req, res) {
     try {
       const apiToken = store?.getSettings?.()?.apiToken;
+      const authOptions = { apiToken, ctx };
       const url = new URL(req.url, 'http://127.0.0.1');
       const parts = url.pathname.split('/').filter(Boolean);
       const scope = parts[1]; // 'tasks' | 'action' | 'heartbeat-ping'
       const id = parts[2];
       const action = parts[3];
+      const subAction = parts[4];
 
       if (scope === 'telegram' && id === 'webhook') {
         await handleTelegramWebhook({ store, scheduler, req, res });
@@ -90,25 +94,25 @@ export function createCronApiHandler(store, scheduler, collection) {
       }
 
       if ((scope === 'heartbeat' || scope === 'heartbeat-ping') && id) {
-        handleHeartbeatPing({ store, req, res, taskId: id });
+        handleHeartbeatPing({ store, req, res, taskId: id, apiToken, ctx });
         return;
       }
 
       if (scope === 'schedule' && id === 'preview') {
-        await handleSchedulePreview({ req, res, url, store });
+        await handleSchedulePreview({ req, res, url, store, apiToken, ctx });
         return;
       }
       if (scope === 'schedule' && id === 'timeline-24h') {
-        await handleScheduleTimeline({ req, res, url, store, scheduler });
+        await handleScheduleTimeline({ req, res, url, store, scheduler, apiToken, ctx });
         return;
       }
 
       if (!id) {
-        await handleTaskCollection({ store, scheduler, collection, req, res, url, scope, apiToken });
+        await handleTaskCollection({ store, scheduler, collection, req, res, url, scope, apiToken, ctx });
         return;
       }
 
-      if (rejectCrossOrigin(req, res, { apiToken })) return;
+      if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
 
       // Export/import are collection operations that live under /tasks/:id/…,
       // so they are matched before the generic id handling below.
@@ -129,7 +133,7 @@ export function createCronApiHandler(store, scheduler, collection) {
         return;
       }
 
-      await handleTaskItem({ store, scheduler, req, res, url, id, action, apiToken });
+      await handleTaskItem({ store, scheduler, req, res, url, id, action, subAction, apiToken, ctx });
     } catch (err) {
       sendJson(res, err.statusCode || 500, { ok: false, error: err.message });
     }
@@ -138,19 +142,19 @@ export function createCronApiHandler(store, scheduler, collection) {
 
 // ------------------------------------------------------------- collection
 
-async function handleTaskCollection({ store, scheduler, collection, req, res, url, scope, apiToken }) {
+async function handleTaskCollection({ store, scheduler, collection, req, res, url, scope, apiToken, ctx }) {
   // The alias family only exists for individual tasks.
   if (scope === 'action' || !collection) {
     sendJson(res, 405, NOT_ALLOWED);
     return;
   }
   if (req.method === 'GET') {
-    if (rejectCrossOrigin(req, res, { apiToken })) return;
+    if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
     listTasks({ store, scheduler, collection, req, res, url });
     return;
   }
   if (req.method === 'POST') {
-    await createOrUpdateTask({ store, scheduler, req, res, apiToken });
+    await createOrUpdateTask({ store, scheduler, req, res, apiToken, ctx: undefined });
     return;
   }
   sendJson(res, 405, NOT_ALLOWED);
@@ -187,8 +191,8 @@ function listTasks({ store, scheduler, collection, req, res, url }) {
   sendJson(res, 200, payload);
 }
 
-async function createOrUpdateTask({ store, scheduler, req, res, apiToken }) {
-  if (rejectCrossOrigin(req, res, { apiToken })) return;
+async function createOrUpdateTask({ store, scheduler, req, res, apiToken, ctx }) {
+  if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
   const { body: rawBody, error } = await readBody(req, res);
   if (error) return;
   const existing = rawBody.id ? store.get(rawBody.id) : null;
@@ -291,14 +295,14 @@ function buildTaskRecord(store, body, taskType, parsed) {
 
 // ------------------------------------------------------------ single task
 
-async function handleTaskItem({ store, scheduler, req, res, url, id, action, apiToken }) {
+async function handleTaskItem({ store, scheduler, req, res, url, id, action, subAction, apiToken, ctx }) {
   if (action === 'heartbeat') {
-    handleHeartbeatPing({ store, req, res, taskId: id });
+    handleHeartbeatPing({ store, req, res, taskId: id, apiToken, ctx });
     return;
   }
 
   if (req.method === 'POST' && action === 'dry-run') {
-    await handleDryRunTask({ store, scheduler, req, res, id });
+    await handleDryRunTask({ store, scheduler, req, res, id, apiToken, ctx });
     return;
   }
 
@@ -307,7 +311,7 @@ async function handleTaskItem({ store, scheduler, req, res, url, id, action, api
       logStreamer.handleSseRequest(id, req, res);
       return;
     }
-    if (rejectCrossOrigin(req, res, { apiToken })) return;
+    if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
     if (action === 'archive') {
       const limit = parseInt(url.searchParams.get('limit') || '50', 10);
       const offset = parseInt(url.searchParams.get('offset') || '0', 10);
@@ -342,6 +346,25 @@ async function handleTaskItem({ store, scheduler, req, res, url, id, action, api
       sendJson(res, 200, { ok: true, history: store.getHistory(id, limit) });
       return;
     }
+    if (action === 'doctor') {
+      const task = store.get(id);
+      if (!task) {
+        sendJson(res, 404, NOT_FOUND);
+        return;
+      }
+      const runs = store.getHistory(id, 5);
+      const latestRun = runs[0] || null;
+      const reportRun = runs.find((r) => r.doctorReport) || latestRun;
+      sendJson(res, 200, {
+        ok: true,
+        taskId: id,
+        doctorReport: reportRun?.doctorReport || null,
+        revisions: task.revisions || [],
+        previousPrompt: task.previousPrompt || null,
+        autoHeal: Boolean(task.autoHeal || task.selfHealing?.autoApply),
+      });
+      return;
+    }
     if (!action) {
       const task = store.get(id);
       if (!task) {
@@ -360,7 +383,7 @@ async function handleTaskItem({ store, scheduler, req, res, url, id, action, api
     }
   }
   if (req.method === 'POST') {
-    const handled = await handleItemPost({ store, scheduler, req, res, url, id, action });
+    const handled = await handleItemPost({ store, scheduler, req, res, url, id, action, subAction });
     if (handled) return;
   }
   if (req.method === 'PATCH') {
@@ -375,7 +398,97 @@ async function handleTaskItem({ store, scheduler, req, res, url, id, action, api
 }
 
 /** Task actions that are plain POSTs. Returns true when one matched. */
-async function handleItemPost({ store, scheduler, req, res, url, id, action }) {
+async function handleItemPost({ store, scheduler, req, res, url, id, action, subAction }) {
+  if ((action === 'doctor' && subAction === 'apply') || action === 'doctor-apply') {
+    const task = store.get(id);
+    if (!task) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    const body = await readBody(req, res);
+    const bodyData = (body && body.body) || {};
+    let fix = bodyData.fix || bodyData.doctorReport;
+    if (!fix) {
+      const runs = store.getHistory(id, 5);
+      const reportRun = runs.find((r) => r.doctorReport);
+      fix = reportRun?.doctorReport;
+    }
+    if (!fix || !fix.suggestedFix) {
+      sendJson(res, 400, { ok: false, error: 'No doctor fix found to apply' });
+      return true;
+    }
+    try {
+      const result = await applyDoctorFix(task, fix, { store, user: bodyData.user || 'operator' });
+      if (!result.ok) {
+        sendJson(res, 400, { ok: false, error: result.error });
+        return true;
+      }
+      sendJson(res, 200, {
+        ok: true,
+        taskId: id,
+        task: redactTaskSecrets(task),
+        revision: result.revision,
+      });
+    } catch (err) {
+      sendJson(res, 500, { ok: false, error: err.message });
+    }
+    return true;
+  }
+
+  if ((action === 'doctor' && subAction === 'revert') || action === 'doctor-revert') {
+    const task = store.get(id);
+    if (!task) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    const body = await readBody(req, res);
+    const bodyData = (body && body.body) || {};
+    try {
+      const result = await revertDoctorFix(task, { store, user: bodyData.user || 'operator' });
+      if (!result.ok) {
+        sendJson(res, 400, { ok: false, error: result.error });
+        return true;
+      }
+      sendJson(res, 200, {
+        ok: true,
+        taskId: id,
+        task: redactTaskSecrets(task),
+        revertedCode: result.revertedCode,
+      });
+    } catch (err) {
+      sendJson(res, 500, { ok: false, error: err.message });
+    }
+    return true;
+  }
+
+  if ((action === 'doctor' && subAction === 'diagnose') || action === 'doctor-diagnose') {
+    const task = store.get(id);
+    if (!task) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    const body = await readBody(req, res);
+    const bodyData = (body && body.body) || {};
+    const runId = bodyData.runId;
+    const runs = store.getHistory(id, 10);
+    const targetRun = runId ? runs.find((r) => r.id === runId) : runs[0];
+    if (!targetRun) {
+      sendJson(res, 404, { ok: false, error: 'No run history found to diagnose' });
+      return true;
+    }
+    try {
+      const doctorReport = await diagnoseFailure({
+        task,
+        runInfo: targetRun,
+        ask: scheduler?.askModel,
+      });
+      targetRun.doctorReport = doctorReport;
+      sendJson(res, 200, { ok: true, taskId: id, doctorReport });
+    } catch (err) {
+      sendJson(res, 500, { ok: false, error: err.message });
+    }
+    return true;
+  }
   if (action === 'prompt-rollback') {
     const task = store.get(id);
     if (!task) {
@@ -696,6 +809,7 @@ export async function handleExternalTaskRequest({ store, scheduler, req, res, ur
   }
   const id = parts[3];
   const action = parts[4];
+  const subAction = parts[5];
 
   if (!id) {
     if (req.method === 'GET') {
@@ -706,7 +820,7 @@ export async function handleExternalTaskRequest({ store, scheduler, req, res, ur
       return;
     }
     if (req.method === 'POST') {
-      await createOrUpdateTask({ store, scheduler, req, res, apiToken });
+      await createOrUpdateTask({ store, scheduler, req, res, apiToken, ctx: undefined });
       return;
     }
     sendJson(res, 405, NOT_ALLOWED);
@@ -714,7 +828,7 @@ export async function handleExternalTaskRequest({ store, scheduler, req, res, ur
   }
 
   if (req.method === 'POST') {
-    const handled = await handleItemPost({ store, scheduler, req, res, url, id, action });
+    const handled = await handleItemPost({ store, scheduler, req, res, url, id, action, subAction });
     if (handled) return;
   }
   if (req.method === 'GET' && !action) {