@goodandready/dsh-cron 0.3.11 → 0.3.13

package/lib/http-utils.js

@@ -77,65 +77,142 @@ export function parseJsonBody(req, limit = MAX_BODY_BYTES) {
 }
 
 /**
- * Validate that an incoming request originates from a trusted local caller or
- * an authenticated client (Issue #86).
+ * Safe helper to get the DSH connection service from context or request (#357).
+ */
+export function getConnection(ctx) {
+  if (!ctx) return null;
+  return Reflect.get(ctx, 'connection') || ctx.connection || null;
+}
+
+export function getDshConnection(req, options = {}) {
+  if (options.connection) return options.connection;
+  if (options.ctx) {
+    const conn = getConnection(options.ctx);
+    if (conn) return conn;
+  }
+  if (req) {
+    if (req.connectionService) return req.connectionService;
+    if (req.ctx) {
+      const conn = getConnection(req.ctx);
+      if (conn) return conn;
+    }
+  }
+  return null;
+}
+
+/**
+ * Determine if an incoming request should be rejected, and with which HTTP status (401 or 403).
+ * Returns undefined if the request is admitted, or 401 / 403 if rejected (#357).
  *
  * Rules:
- * 1. Non-loopback remote callers are rejected unless authenticated with a valid token.
- * 2. Host header must be present and non-empty.
- * 3. Origin header (if present) cannot be null and its host must match Host.
- * 4. Sec-Fetch-Site (if present) must be same-origin or none (cross-site/same-site rejected).
- * 5. Mutating requests (POST, PUT, PATCH, DELETE) must provide browser proof (same-origin / matching Origin)
- *    or an explicit capability header (confirm header, token, or update header).
+ * 1. If DSH connection service is available, consult its admission first.
+ *    - Connection service rejection 403 (untrusted Host / Origin / CSRF) is strictly rejected.
+ *    - Connection service admission (undefined rejection) admits the request (browser session / Peer).
+ * 2. Token authentication: valid Bearer token matching options.apiToken, DSH_AUTH_TOKEN or DSH_TOKEN.
+ * 3. Local loopback caller: 127.0.0.1 or ::1 when connection service is not bound (standalone/CLI/test).
+ * 4. FAIL-CLOSED: if connection service is bound, request must have DSH admission or valid API token.
+ *    If connection service is not bound, request must have valid API token or verified loopback IP.
+ *    Requests with missing socket / missing remoteAddress and no token are rejected (401).
+ * 5. Origin and Sec-Fetch-Site: cannot be null, Origin host must match Host, Sec-Fetch-Site must be same-origin or none.
  */
-export function isTrustedRequest(req, options = {}) {
-  if (!req) return false;
+export function getRequestRejection(req, options = {}) {
+  if (!req) return 403;
+
+  // 1. Validate Origin header if present: cannot be null, must match Host (CSRF guard)
   const headers = req.headers || {};
+  const origin = headers.origin;
+  const host = headers.host || '';
+  if (origin !== undefined) {
+    if (origin === 'null' || !origin) return 403;
+    try {
+      const parsed = new URL(origin);
+      if (!parsed.host || !host || parsed.host !== host) return 403;
+    } catch {
+      return 403;
+    }
+  }
 
-  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress;
-  const hasRemote = Boolean(remote && typeof remote === 'string');
-  const isLoopback = Boolean(hasRemote && isLoopbackAddress(remote));
+  // 2. Validate Sec-Fetch-Site header if present
+  const site = headers['sec-fetch-site'];
+  if (site !== undefined) {
+    if (site !== 'same-origin' && site !== 'none') {
+      return 403;
+    }
+  }
 
+  // 3. Check DSH connection service if available (#357)
+  const conn = getDshConnection(req, options);
+  let connRejection;
+  if (conn && typeof conn.requestRejection === 'function') {
+    connRejection = conn.requestRejection(req);
+    if (connRejection === 403) {
+      return 403;
+    }
+  }
+
+  // 4. Check token authentication
   const token = extractBearerToken(req);
   const expectedToken = options.apiToken || process.env.DSH_AUTH_TOKEN || process.env.DSH_TOKEN;
   const isTokenAuthenticated = Boolean(expectedToken && token && token === expectedToken);
 
-  // 1. Non-loopback socket callers (or callers with missing remoteAddress) require explicit token authentication (#86, #295)
-  if (req.socket || req.connection || hasRemote) {
-    if (!isLoopback && !isTokenAuthenticated) {
-      return false;
+  // If DSH connection service admitted the request (undefined rejection)
+  const isConnectionAdmitted = Boolean(conn && connRejection === undefined);
+
+  // Check loopback address
+  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress;
+  const hasRemote = Boolean(remote && typeof remote === 'string');
+  const isLoopback = Boolean(hasRemote && isLoopbackAddress(remote));
+
+  // FAIL-CLOSED AUTHENTICATION CHECK (#357):
+  if (conn) {
+    if (!isConnectionAdmitted && !isTokenAuthenticated) {
+      return connRejection === 403 ? 403 : 401;
+    }
+  } else {
+    if (!isTokenAuthenticated && !isLoopback) {
+      if (token || !hasRemote) {
+        return 401;
+      }
+      return 403;
     }
   }
 
-  // 2. Validate Origin header if present: cannot be null, must match Host
+  return undefined; // Admitted
+}
+
+/**
+ * Validate that an incoming request originates from a trusted local caller,
+ * an admitted DSH browser session, or an authenticated client (Issue #86, #357).
+ */
+export function isTrustedRequest(req, options = {}) {
+  return getRequestRejection(req, options) === undefined;
+}
+
+/**
+ * Backward-compatible helper for checking cross-origin browser headers (Origin / Sec-Fetch-Site).
+ */
+export function isCrossOrigin(req, options) {
+  if (!req) return true;
+  const headers = req.headers || {};
   const origin = headers.origin;
   const host = headers.host || '';
   if (origin !== undefined) {
-    if (origin === 'null' || !origin) return false;
+    if (origin === 'null' || !origin) return true;
     try {
       const parsed = new URL(origin);
-      if (!parsed.host || !host || parsed.host !== host) return false;
+      if (!parsed.host || !host || parsed.host !== host) return true;
     } catch {
-      return false;
+      return true;
     }
   }
 
-  // 3. Validate Sec-Fetch-Site header if present
   const site = headers['sec-fetch-site'];
   if (site !== undefined) {
     if (site !== 'same-origin' && site !== 'none') {
-      return false;
+      return true;
     }
   }
-
-  return true;
-}
-
-/**
- * Backward-compatible wrapper for checking cross-origin / untrusted requests.
- */
-export function isCrossOrigin(req, options) {
-  return !isTrustedRequest(req, options);
+  return false;
 }
 
 /**
@@ -158,9 +235,13 @@ export function sendJson(res, statusCode, data) {
   res.end(JSON.stringify(data));
 }
 
-export function rejectCrossOrigin(req, res, options) {
-  if (!isTrustedRequest(req, options)) {
-    sendJson(res, 403, { ok: false, error: 'Forbidden: untrusted or cross-origin request' });
+export function rejectCrossOrigin(req, res, options = {}) {
+  const rejection = getRequestRejection(req, options);
+  if (rejection !== undefined) {
+    const errorMsg = rejection === 401
+      ? 'Unauthorized: authentication required'
+      : 'Forbidden: untrusted or cross-origin request';
+    sendJson(res, rejection, { ok: false, error: errorMsg });
     return true;
   }
   return false;

package/lib/index.js

@@ -307,7 +307,7 @@ export function apply(ctx, rawConfig) {
       try {
         const settings = store && typeof store.getSettings === 'function' ? store.getSettings() : {};
         const apiToken = settings.apiToken;
-        if (rejectCrossOrigin(req, res, { apiToken })) return;
+        if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
 
         if (req.method === 'GET') {
           const unwrapped = {
@@ -324,7 +324,7 @@ export function apply(ctx, rawConfig) {
           return;
         }
         if (req.method === 'POST') {
-          if (rejectCrossOrigin(req, res)) return;
+          if (rejectCrossOrigin(req, res, { ctx })) return;
           const { body, error } = await readBody(req, res);
           if (error) return;
           const payload = sanitizeSettingsPayload(body);

package/lib/routes.js

@@ -20,20 +20,20 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
   ctx.effect(() => ctx.webServer.register({
     kind: 'prefix',
     path: '/dsh-cron/tasks',
-    handler: createCronApiHandler(store, scheduler, { recommendations })
+    handler: createCronApiHandler(store, scheduler, { recommendations, ctx })
   }), 'dsh-cron: /tasks[...]');
 
   // Alias route /dsh-cron/action/:id/:action for backward compatibility (#66)
   ctx.effect(() => ctx.webServer.register({
     kind: 'prefix',
     path: '/dsh-cron/action',
-    handler: createCronApiHandler(store, scheduler, null)
+    handler: createCronApiHandler(store, scheduler, { ctx })
   }), 'dsh-cron: /action/:id/:action');
 
   ctx.effect(() => ctx.webServer.register({
     kind: 'prefix',
     path: '/dsh-cron/telegram',
-    handler: createCronApiHandler(store, scheduler, null)
+    handler: createCronApiHandler(store, scheduler, { ctx })
   }), 'dsh-cron: /telegram[...]');
 
   // Incoming HTTP Webhook triggers (#348)
@@ -46,13 +46,13 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
   ctx.effect(() => ctx.webServer.register({
     kind: 'prefix',
     path: '/dsh-cron/heartbeat-ping',
-    handler: createCronApiHandler(store, scheduler, null)
+    handler: createCronApiHandler(store, scheduler, { ctx })
   }), 'dsh-cron: /heartbeat-ping[...]');
 
   ctx.effect(() => ctx.webServer.register({
     kind: 'prefix',
     path: '/dsh-cron/schedule',
-    handler: createCronApiHandler(store, scheduler, null)
+    handler: createCronApiHandler(store, scheduler, { ctx })
   }), 'dsh-cron: /schedule[...]');
 
 
@@ -60,14 +60,14 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
   ctx.effect(() => ctx.webServer.register({
     kind: 'prefix',
     path: '/dsh-cron/chains',
-    handler: (req, res) => handleChainRoutes(store, scheduler, req, res)
+    handler: (req, res) => handleChainRoutes(store, scheduler, req, res, ctx)
   }), 'dsh-cron: /chains[...]');
 
   // Run artifacts listing, download and safe preview (#321)
   ctx.effect(() => ctx.webServer.register({
     kind: 'prefix',
     path: '/dsh-cron/runs',
-    handler: (req, res) => handleRunArtifactRoutes(store, req, res)
+    handler: (req, res) => handleRunArtifactRoutes(store, req, res, ctx)
   }), 'dsh-cron: /runs[...]');
 
   // GET /dsh-cron/metrics (#53) — Prometheus text exposition
@@ -98,7 +98,7 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
     handler: async (req, res) => {
       const settings = store && typeof store.getSettings === 'function' ? store.getSettings() : {};
       const apiToken = settings.apiToken;
-      if (rejectCrossOrigin(req, res, { apiToken })) return;
+      if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
       await getModelsHandler(ctx, req, res, sendJson);
     }
   }), 'dsh-cron: /models');
@@ -108,7 +108,7 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
     kind: 'exact',
     path: '/dsh-cron/chat/start',
     handler: async (req, res) => {
-      if (req.method === 'POST' && rejectCrossOrigin(req, res)) return;
+      if (req.method === 'POST' && rejectCrossOrigin(req, res, { ctx })) return;
       await chatStartHandler(ctx, req, res, parseJsonBody, sendJson, randomUUID);
     }
   }), 'dsh-cron: /chat/start');
@@ -121,7 +121,7 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
       try {
         const settings = store && typeof store.getSettings === 'function' ? store.getSettings() : {};
         const apiToken = settings.apiToken;
-        if (rejectCrossOrigin(req, res, { apiToken })) return;
+        if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
 
         const url = new URL(req.url, 'http://127.0.0.1');
         const path = url.pathname;
@@ -169,7 +169,7 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
         }
 
         if (req.method === 'POST') {
-          if (rejectCrossOrigin(req, res)) return;
+          if (rejectCrossOrigin(req, res, { ctx })) return;
           const { body } = await readBody(req, res);
           const days = parseInt(body?.days || url.searchParams.get('days') || '7', 10);
           const tasks = store.list ? store.list() : Object.values(store.tasks || {});
@@ -227,7 +227,7 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
         }
         const settings = store.getSettings ? store.getSettings() : {};
         const apiToken = settings.apiToken;
-        if (rejectCrossOrigin(req, res, { apiToken })) return;
+        if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
         const categories = recipesByCategory();
         const recipes = listVerifiedRecipes(settings);
         sendJson(res, 200, { ok: true, categories, recipes });
@@ -249,7 +249,7 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
         }
         const settings = store.getSettings ? store.getSettings() : {};
         const apiToken = settings.apiToken;
-        if (rejectCrossOrigin(req, res, { apiToken })) return;
+        if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
 
         const tasks = store.list({ status: 'active' });
         const lastRuns = tasks.map((t) => t.lastRunAt || 0);
@@ -276,7 +276,7 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
           sendJson(res, 405, { ok: false, error: 'Method not allowed' });
           return;
         }
-        if (rejectCrossOrigin(req, res)) return;
+        if (rejectCrossOrigin(req, res, { ctx })) return;
         const { body, error } = await readBody(req, res);
         if (error) return;
         const settings = store.getSettings();
@@ -308,7 +308,7 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
           sendJson(res, 405, { ok: false, error: 'Method not allowed' });
           return;
         }
-        if (rejectCrossOrigin(req, res)) return;
+        if (rejectCrossOrigin(req, res, { ctx })) return;
         const { body, error } = await readBody(req, res);
         if (error) return;
         const settings = store.getSettings();
@@ -339,10 +339,10 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
 /**
  * Handler for chain step retries (#319)
  */
-export async function handleChainRoutes(store, scheduler, req, res) {
+export async function handleChainRoutes(store, scheduler, req, res, ctx) {
   const settings = store && typeof store.getSettings === 'function' ? store.getSettings() : {};
   const apiToken = settings.apiToken;
-  if (rejectCrossOrigin(req, res, { apiToken })) return;
+  if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
   const url = new URL(req.url, 'http://localhost');
 
   // GET /dsh-cron/chains/:chainRunId (#334)
@@ -386,7 +386,7 @@ export async function handleChainRoutes(store, scheduler, req, res) {
 /**
  * Handler for run artifacts (#321)
  */
-export async function handleRunArtifactRoutes(store, req, res) {
+export async function handleRunArtifactRoutes(store, req, res, ctx) {
   const url = new URL(req.url, 'http://localhost');
   const m = url.pathname.match(/^\/dsh-cron\/runs\/([^\/]+)\/artifacts(?:\/([^\/]+)(?:\/(preview))?)?$/);
   if (!m) {
@@ -399,7 +399,7 @@ export async function handleRunArtifactRoutes(store, req, res) {
   }
   const settings = store && typeof store.getSettings === 'function' ? store.getSettings() : {};
   const apiToken = settings.apiToken;
-  if (rejectCrossOrigin(req, res, { apiToken })) return;
+  if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
 
   const [, runId, artifactId, action] = m;
   if (!artifactId) {

package/lib/scheduler-execution.js

@@ -1,3 +1,5 @@
+import { resolveBranchTargets } from './branching.js';
+import { shouldAutoHeal, applyDoctorFix } from './doctor.js';
 import { recordPromptRunOutcome } from './prompt-evolver.js';
 import { evaluateAdaptiveRun, calculateNextAdaptiveState } from './adaptive.js';
 import { approvalManager } from './approval.js';
@@ -441,14 +443,42 @@ export async function applySilentRuleToRun(task, runInfo, { askModel, readSettin
 /**
  * Run the model-assisted steps for a finished run.
  */
-export async function applyModelAssists(task, runInfo, options) {
+export async function applyModelAssists(task, runInfo, options = {}) {
   const inspection = await inspectFailureRun(task, runInfo, options);
   if (inspection.inspected) {
     runInfo.diagnosis = inspection.diagnosis;
     runInfo.suggestion = inspection.suggestion;
     runInfo.confidence = inspection.confidence;
+    runInfo.doctorReport = inspection.doctorReport || {
+      category: inspection.category || 'runtime_error',
+      cause: inspection.diagnosis,
+      suggestedFix: inspection.suggestion,
+      confidence: inspection.confidence,
+      diff: inspection.diff || '',
+      timestamp: Date.now(),
+      applied: false,
+      autoHealed: false,
+    };
     logger.info(`[dsh-cron] task "${task.title}" failure diagnosed (${inspection.confidence}): ${inspection.diagnosis}`);
-  } else if (inspection.error && task.inspectOnFailure) {
+
+    // Safe Auto-Heal Check (#353)
+    if (shouldAutoHeal(task, runInfo.doctorReport)) {
+      try {
+        const healResult = await applyDoctorFix(task, runInfo.doctorReport, {
+          store: options.store,
+          user: 'scheduler:auto-heal',
+          isAutoHeal: true,
+        });
+        if (healResult.ok) {
+          logger.info(`[dsh-cron] task "${task.title}" auto-healed successfully with doctor fix!`);
+          runInfo.autoHealed = true;
+          if (runInfo.doctorReport) runInfo.doctorReport.autoHealed = true;
+        }
+      } catch (autoHealErr) {
+        logger.warn(`[dsh-cron] failed to auto-heal task "${task.title}":`, autoHealErr.message);
+      }
+    }
+  } else if (inspection.error && (task.inspectOnFailure || task.autoDiagnose || task.autoHeal)) {
     logger.warn(`[dsh-cron] failure inspection for "${task.title}" not applied: ${inspection.error}`);
   }
 
@@ -769,8 +799,14 @@ export async function handleCompleteRun(scheduler, task, taskId, currentRun, out
     runInfo.artifacts = scheduler.store.getArtifactsForRun(runInfo.runId);
   }
 
-  // Chain Checkpoints (#319, #328)
-  const chainedTargets = parseChainTargets(outcome.status === 'success' ? task.onSuccess : task.onFailure);
+  // Chain Checkpoints & Decision Nodes (#319, #328, #352)
+  const branchResult = resolveBranchTargets(task, outcome, runInfo);
+  if (branchResult && branchResult.decision) {
+    runInfo.branchDecision = branchResult.decision;
+  }
+  const chainedTargets = branchResult
+    ? branchResult.targets
+    : parseChainTargets(outcome.status === 'success' ? task.onSuccess : task.onFailure);
   let hasDependents = false;
   if (scheduler.store?.tasks) {
     for (const t of Object.values(scheduler.store.tasks)) {
@@ -888,10 +924,27 @@ export async function handleCompleteRun(scheduler, task, taskId, currentRun, out
     }
   }
 
-  // 2. Task Chaining (#137, #328 Fan-Out / Fan-In)
-  const targets = parseChainTargets(isSuccess ? task.onSuccess : (isFailure ? task.onFailure : null));
+  // 2. Task Chaining & Decision Nodes (#137, #328, #352 Fan-Out / Fan-In)
+  const targets = branchResult
+    ? branchResult.targets
+    : parseChainTargets(isSuccess ? task.onSuccess : (isFailure ? task.onFailure : null));
   const currentDepth = options.chainDepth || 0;
 
+  if (branchResult && branchResult.decision) {
+    logger.info(`[dsh-cron] decision node in "${task.title}": routed to ${targets.join(', ') || 'none'} (${branchResult.decision.isElse ? 'fallback else' : (branchResult.decision.matched ? `rule #${branchResult.decision.matchedIndex + 1}` : 'unmatched')})`);
+    if (chainRunId && scheduler.store.chainCheckpointManager && Array.isArray(task.branchRules)) {
+      for (const rule of task.branchRules) {
+        if (rule && rule.targetTask && !targets.includes(rule.targetTask)) {
+          scheduler.store.chainCheckpointManager.recordStepSnapshot(chainRunId, rule.targetTask, {
+            status: 'skipped',
+            skippedReason: 'condition not met',
+            durationMs: 0,
+          });
+        }
+      }
+    }
+  }
+
   if (currentDepth < 4) {
     // 2.1 Trigger explicit targets (Fan-Out)
     for (const targetId of targets) {

package/lib/task-create.js

@@ -1,3 +1,4 @@
+import { sanitizeBranchRules } from './branching.js';
 import { sanitizePromptHistory } from './prompt-evolver.js';
 import { sanitizeAdaptiveConfig } from './adaptive.js';
 import { sanitizeValidators } from './validators.js';
@@ -55,6 +56,14 @@ export function executeCreateTask(store, scheduler, args) {
     webhookDebounceMs: args.webhookDebounceMs !== undefined ? Number(args.webhookDebounceMs) : (args.webhookTrigger?.debounceMs !== undefined ? Number(args.webhookTrigger.debounceMs) : undefined),
     onSuccess: args.onSuccess ? String(args.onSuccess).trim() : '',
     onFailure: args.onFailure ? String(args.onFailure).trim() : '',
+    branchRules: args.branchRules !== undefined ? sanitizeBranchRules(args.branchRules) : undefined,
+    elseTask: args.elseTask ? String(args.elseTask).trim() : undefined,
+    autoHeal: args.autoHeal !== undefined ? Boolean(args.autoHeal) : undefined,
+    selfHealing: args.selfHealing && typeof args.selfHealing === 'object' ? {
+      autoApply: Boolean(args.selfHealing.autoApply),
+      lastPatchedAt: Number(args.selfHealing.lastPatchedAt) || 0,
+      autoPatchesCount: Number(args.selfHealing.autoPatchesCount) || 0,
+    } : undefined,
     dependsOn: args.dependsOn !== undefined ? sanitizeDependsOn(args.dependsOn) : undefined,
     joinPolicy: args.joinPolicy !== undefined ? sanitizeJoinPolicy(args.joinPolicy) : undefined,
     adaptive: args.adaptive !== undefined ? sanitizeAdaptiveConfig(args.adaptive) : undefined,

package/lib/task-patch.js

@@ -1,3 +1,4 @@
+import { sanitizeBranchRules } from './branching.js';
 import { trackPromptEdit, sanitizePromptHistory } from './prompt-evolver.js';
 import { sanitizeAdaptiveConfig } from './adaptive.js';
 import { sanitizeValidators } from './validators.js';
@@ -121,6 +122,22 @@ export function buildTaskPatch(current, body) {
   if (patch.validators !== undefined) {
     patch.validators = Array.isArray(patch.validators) ? sanitizeValidators(patch.validators) : [];
   }
+  if (patch.branchRules !== undefined) {
+    patch.branchRules = sanitizeBranchRules(patch.branchRules);
+  }
+  if (patch.elseTask !== undefined) {
+    patch.elseTask = patch.elseTask ? String(patch.elseTask).trim() : null;
+  }
+  if (patch.autoHeal !== undefined) {
+    patch.autoHeal = Boolean(patch.autoHeal);
+  }
+  if (patch.selfHealing !== undefined && patch.selfHealing && typeof patch.selfHealing === 'object') {
+    patch.selfHealing = {
+      autoApply: Boolean(patch.selfHealing.autoApply),
+      lastPatchedAt: Number(patch.selfHealing.lastPatchedAt) || 0,
+      autoPatchesCount: Number(patch.selfHealing.autoPatchesCount) || 0,
+    };
+  }
   if (patch.prompt !== undefined && current && typeof current.prompt === 'string') {
     const edit = trackPromptEdit(current, patch.prompt, body && body.promptNote ? body.promptNote : 'Manual edit');
     patch.prompt = edit.prompt;
@@ -181,7 +198,7 @@ export function applyTaskPatch({ store, scheduler, id, body, allowCodeSwitch = f
   }
   const built = buildTaskPatch(current, body);
   if (!built.ok) return built;
-  if (built.patch.dependsOn !== undefined || built.patch.onSuccess !== undefined) {
+  if (built.patch.dependsOn !== undefined || built.patch.onSuccess !== undefined || built.patch.branchRules !== undefined || built.patch.elseTask !== undefined) {
     const dagCheck = validateDAG(store?.tasks || {}, { ...current, ...built.patch, id });
     if (!dagCheck.ok) {
       return { ok: false, error: dagCheck.error };

package/lib/task-transfer.js

@@ -89,6 +89,13 @@ export const PATCHABLE_TASK_FIELDS = [
   'adaptiveState',
   'promptVersion',
   'promptHistory',
+  'branchRules',
+  'elseTask',
+  'autoHeal',
+  'selfHealing',
+  'revisions',
+  'previousPrompt',
+  'previousScript',
 ];
 
 /** Fields a duplicate inherits; anything else is runtime state, not config. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cron",
-  "version": "0.3.11",
+  "version": "0.3.13",
   "description": "Background automation runner for DSH: isolated agent runs, script/HTTP/SSH/Docker runtimes, cost guard, notifications, heartbeats.",
   "type": "module",
   "main": "lib/index.js",