@goodandready/dsh-cron 0.3.18 → 0.3.19

package/lib/http-utils.js

@@ -124,21 +124,48 @@ export function getDshConnection(req, options = {}) {
 export function getRequestRejection(req, options = {}) {
   if (!req) return 403;
 
-  // 1. Validate Origin header if present: cannot be null, must match Host (CSRF guard)
   const headers = req.headers || {};
   const origin = headers.origin;
+  const referer = headers.referer;
   const host = headers.host || '';
+
+  // 1. Check token authentication first: Bearer auth or custom header (#54, #86, #371)
+  const token = extractBearerToken(req);
+  const expectedToken = options.apiToken || process.env.DSH_AUTH_TOKEN || process.env.DSH_TOKEN;
+  const isTokenAuthenticated = Boolean(expectedToken && token && token === expectedToken);
+
+  // 2. Check DSH connection service if available (#357)
+  const conn = getDshConnection(req, options);
+  let connRejection;
+  if (conn && typeof conn.requestRejection === 'function') {
+    connRejection = conn.requestRejection(req);
+    if (connRejection === 403) {
+      return 403;
+    }
+  }
+
+  // Valid Bearer / API token admits caller immediately without browser origin checks (#54, #371)
+  if (isTokenAuthenticated) {
+    return undefined;
+  }
+
+  // 3. Validate Origin header if present: cannot be null, host must match Host (CSRF guard)
   if (origin !== undefined) {
     if (origin === 'null' || !origin) return 403;
     try {
       const parsed = new URL(origin);
-      if (!parsed.host || !host || parsed.host !== host) return 403;
+      if (parsed.protocol === 'dsh-app:') {
+        const appHost = parsed.host.toLowerCase();
+        if (appHost && appHost !== 'app' && appHost !== 'localhost') return 403;
+      } else {
+        if (!parsed.host || !host || parsed.host.toLowerCase() !== host.toLowerCase()) return 403;
+      }
     } catch {
       return 403;
     }
   }
 
-  // 2. Validate Sec-Fetch-Site header if present
+  // 4. Validate Sec-Fetch-Site header if present
   const site = headers['sec-fetch-site'];
   if (site !== undefined) {
     if (site !== 'same-origin' && site !== 'none') {
@@ -146,50 +173,62 @@ export function getRequestRejection(req, options = {}) {
     }
   }
 
-  // 3. Check DSH connection service if available (#357)
-  const conn = getDshConnection(req, options);
-  let connRejection;
-  if (conn && typeof conn.requestRejection === 'function') {
-    connRejection = conn.requestRejection(req);
-    if (connRejection === 403) {
-      return 403;
-    }
-  }
-
-  // 4. Check token authentication
-  const token = extractBearerToken(req);
-  const expectedToken = options.apiToken || process.env.DSH_AUTH_TOKEN || process.env.DSH_TOKEN;
-  const isTokenAuthenticated = Boolean(expectedToken && token && token === expectedToken);
-
-  // If DSH connection service admitted the request (undefined rejection)
-  const isConnectionAdmitted = Boolean(conn && connRejection === undefined);
-
-  // Check loopback address
+  // 5. Check socket loopback address & remote connection (#357)
   const remote = req.socket?.remoteAddress || req.connection?.remoteAddress;
   const hasRemote = Boolean(remote && typeof remote === 'string');
   const isLoopback = Boolean(hasRemote && isLoopbackAddress(remote));
 
   // FAIL-CLOSED AUTHENTICATION CHECK (#357):
   if (conn) {
-    if (!isConnectionAdmitted && !isTokenAuthenticated) {
-      return connRejection === 403 ? 403 : 401;
+    if (connRejection !== undefined) {
+      return connRejection;
     }
   } else {
-    if (!isTokenAuthenticated && !isLoopback) {
-      if (token || !hasRemote) {
-        return 401;
-      }
+    if (!hasRemote) {
+      return 401;
+    }
+    if (!isLoopback) {
       return 403;
     }
   }
 
+  // 6. Source authorization gate (Issue #371):
+  // A loopback socket alone is not trusted for write actions or reading /tasks:
+  // dsh-lanmode proxies LAN/Tailscale clients into the host over loopback.
+  // Browsers attach Origin/Referer; non-browser calls without one are rejected fail-closed.
+  const method = String(req.method || 'GET').toUpperCase();
+  const isMutating = method !== '' && method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS';
+  const urlStr = String(req.url || '');
+  const isTasksRead = !isMutating && (urlStr === '/dsh-cron/tasks' || urlStr.startsWith('/dsh-cron/tasks?') || urlStr === '/tasks' || urlStr.startsWith('/tasks?'));
+
+  const hostStr = host.toLowerCase().split(':')[0];
+  const isLoopbackHost = hostStr === '' || hostStr === 'localhost' || hostStr === '127.0.0.1' || hostStr === '::1';
+  const requireSource = Boolean(options.requireSource || isMutating || (isTasksRead && !isLoopbackHost));
+
+  if (requireSource) {
+    if (!origin && !referer) {
+      return 403;
+    }
+    if (!origin && referer) {
+      try {
+        const parsedRef = new URL(referer);
+        if (parsedRef.protocol === 'dsh-app:') {
+          const appHost = parsedRef.host.toLowerCase();
+          if (appHost && appHost !== 'app' && appHost !== 'localhost') return 403;
+        } else {
+          if (!parsedRef.host || !host || parsedRef.host.toLowerCase() !== host.toLowerCase()) {
+            return 403;
+          }
+        }
+      } catch {
+        return 403;
+      }
+    }
+  }
+
   return undefined; // Admitted
 }
 
-/**
- * Validate that an incoming request originates from a trusted local caller,
- * an admitted DSH browser session, or an authenticated client (Issue #86, #357).
- */
 export function isTrustedRequest(req, options = {}) {
   return getRequestRejection(req, options) === undefined;
 }
@@ -242,15 +281,15 @@ export function sendJson(res, statusCode, data) {
 }
 
 export function rejectCrossOrigin(req, res, options = {}) {
-  const rejection = getRequestRejection(req, options);
-  if (rejection !== undefined) {
-    const errorMsg = rejection === 401
-      ? 'Unauthorized: authentication required'
-      : 'Forbidden: untrusted or cross-origin request';
-    sendJson(res, rejection, { ok: false, error: errorMsg });
-    return true;
+  if (isTrustedRequest(req, options)) {
+    return false;
   }
-  return false;
+  const rejection = getRequestRejection(req, options) || 403;
+  const errorMsg = rejection === 401
+    ? 'Unauthorized: authentication required'
+    : 'Forbidden: untrusted or cross-origin request';
+  sendJson(res, rejection, { ok: false, error: errorMsg });
+  return true;
 }
 
 export async function readBody(req, res) {

package/lib/locales.json

@@ -0,0 +1,336 @@
+{
+  "zh": {
+    "sidebar.label": "定时任务",
+    "sidebar.jobsTitle": "运行中任务",
+    "sidebar.noActiveJobs": "无运行中任务",
+    "sidebar.moreJobs": "及另外 {count} 个",
+    "chip.title": "定时任务 (Cron)",
+    "panel.back": "返回对话",
+    "panel.title": "定时任务",
+    "panel.subtitle": "让 DSH 规划任务、设置提醒或跟踪状态",
+    "actions.create": "新建",
+    "actions.createWithDsh": "💬 让 DSH 创建",
+    "actions.setupManually": "✏️ 手动配置",
+    "actions.runNow": "立即运行",
+    "actions.runNowShort": "运行",
+    "actions.edit": "编辑 / 详情",
+    "actions.duplicate": "复制任务",
+    "actions.tuneWithDsh": "让 DSH 优化",
+    "tune.startFailed": "无法启动优化会话: {error}",
+    "actions.delete": "删除任务",
+    "duplicate.done": "已创建副本并处于暂停状态：恢复前请先核对调度时间。",
+    "duplicate.oneShotHint": "该副本为一次性任务且已暂停，请设定新的执行时间后再启用。",
+    "duplicate.failed": "复制任务失败: {error}",
+    "transfer.exportTitle": "导出任务",
+    "transfer.importTitle": "导入任务",
+    "transfer.exported": "已成功导出 {count} 个任务。",
+    "transfer.exportFailed": "导出失败: {error}",
+    "transfer.importTitleModal": "导入任务",
+    "transfer.importHint": "仅导出任务静态配置：不包含历史记录与计数器。渠道通过凭据名称引用；注意完整导出保留自定义环境变量和 HTTP 请求头。",
+    "transfer.exportPrompt": "请选择导出模式：\\n确定 = 净化导出（移除自定义环境变量与请求头）\\n取消 = 完整原始导出",
+    "transfer.strategyAdd": "作为新任务导入（分配新 ID）",
+    "transfer.strategyReplace": "覆盖同 ID 任务",
+    "transfer.strategySkip": "跳过已存在的同 ID 任务",
+    "transfer.summary": "该文件包含 {total} 个任务：{add} 个新增，{replace} 个覆盖，{skip} 个跳过。",
+    "transfer.confirm": "开始导入",
+    "transfer.imported": "已成功导出 {count} 个任务。",
+    "transfer.importFailed": "导入失败: {error}",
+    "transfer.badFile": "所选文件不是有效的 JSON 导出文件: {error}",
+    "actions.pause": "暂停",
+    "actions.resume": "恢复",
+    "actions.settings": "通知与渠道设置",
+    "actions.dryRun": "空跑测试",
+    "actions.dryRunTitle": "空跑测试（模拟执行，不产生副作用且不发送通知）",
+    "actions.archive": "历史归档",
+    "actions.archiveTitle": "查看执行历史与日志归档",
+    "dryRun.title": "🧪 空跑模拟结果",
+    "dryRun.task": "任务",
+    "dryRun.status": "模拟状态",
+    "dryRun.duration": "耗时",
+    "dryRun.output": "模拟输出",
+    "dryRun.preflight": "预检结果",
+    "dryRun.close": "关闭",
+    "archive.title": "📜 运行历史归档",
+    "archive.totalRuns": "共记录 {total} 次运行",
+    "archive.empty": "该任务暂无历史运行归档。",
+    "archive.loadMore": "加载更多 ({shown} / {total})",
+    "archive.close": "关闭",
+    "form.reliabilityTitle": "🛡️ 可靠性、心跳监听与自愈",
+    "form.preflightLabel": "预检健康探测",
+    "form.preflightNone": "无",
+    "form.preflightHttp": "HTTP (2xx 探测)",
+    "form.preflightShell": "Shell 探测 (退出码 0)",
+    "form.preflightDisk": "磁盘空间探测 (挂载点:最小百分比)",
+    "form.preflightTargetLabel": "预检目标参数",
+    "form.preflightTargetPlaceholder": "https://example.com/healthz 或 ls /data 或 /:10%",
+    "form.heartbeatIntervalLabel": "心跳打卡时限 (秒, 0 = 禁用)",
+    "form.gracePeriodLabel": "心跳宽限期 (秒)",
+    "form.priorityLabel": "队列优先级 (1-10，数值越大越先执行)",
+    "form.concurrencyGroupLabel": "并发分组名称",
+    "form.selfHealingLabel": "故障自愈脚本 (Shell)",
+    "form.selfHealingPlaceholder": "systemctl restart app || true",
+    "form.autoDiagnoseLabel": "任务失败时启用 AI 智能分析诊断",
+    "form.agentPresetLabel": "智能体预设 (Agent Preset)",
+    "form.agentPresetPlaceholder": "standard (留空使用全局默认预设)",
+    "form.agentPresetHint": "来自 dsh-agent-presets 的智能体预设（如 standard, minimal, cordis, ptc），挂载工作区工具与文件读写能力。",
+    "form.sessionTitleLabel": "会话标题模板 (Session Title)",
+    "form.sessionTitlePlaceholder": "如 {{date}} 市场早报 (支持 {{date}} 变量)",
+    "form.sessionTitleHint": "此任务运行生成的会话标题。支持 {{date}} (年-月-日)。留空默认为 \"<YYYY-MM-DD> <任务名>\"。",
+    "form.targetSessionIdLabel": "目标常驻会话 ID (Target Session ID)",
+    "form.targetSessionIdPlaceholder": "如 audit-chat 或 dev-summary（留空为单次隔离运行）",
+    "form.targetSessionIdHint": "配置后定时任务将在此常驻会话中持续交互，跨周期保留历史上下文对话记忆，不再每次新建孤立会话。",
+    "form.targetSessionResetLabel": "上下文轮转策略 (Session Rotation)",
+    "form.targetSessionResetNever": "永不轮转（单一会话持续累积）",
+    "form.targetSessionResetDaily": "每日轮转（每日自动开启新会话）",
+    "form.targetSessionResetWeekly": "每周轮转（每周自动开启新会话）",
+    "form.targetSessionResetHint": "自动按周期加注日期后缀轮转会话，有效防止长时间运行导致的模型上下文窗口超限与 Token 浪费。",
+    "form.previewSchedule": "预测下次运行时间",
+    "form.previewScheduleTitle": "未来 5 次计划运行时间:",
+    "search.placeholder": "搜索定时任务",
+    "filters.title": "筛选",
+    "filters.type": "类型",
+    "filters.model": "模型",
+    "filters.channel": "渠道",
+    "filters.any": "全部",
+    "filters.reset": "重置筛选",
+    "filters.empty": "没有匹配当前筛选条件的任务。",
+    "filters.showing": "显示 {shown} / 共 {total}",
+    "stats.activeTasks": "活跃任务",
+    "stats.totalRuns": "总运行次数",
+    "stats.totalTokens": "消耗 Token",
+    "stats.totalCost": "预估成本",
+    "tabs.all": "全部",
+    "tabs.active": "运行中",
+    "tabs.paused": "已暂停",
+    "tabs.completed": "已完成",
+    "list.empty": "暂无定时任务",
+    "list.emptyHint": "点击下方按钮让 DSH 规划任务，或手动配置。",
+    "list.oneShot": "一次性",
+    "list.runCount": "{count} 次运行",
+    "list.consecutiveFailures": "连续 {count} 次失败",
+    "list.lastRun": "上次: {time}",
+    "list.nextRun": "下次: {time}",
+    "list.badgeActive": "活跃",
+    "list.badgePaused": "已暂停",
+    "list.badgeCompleted": "已完成",
+    "list.configManaged": "配置只读",
+    "channel.telegram": "Telegram",
+    "channel.discord": "Discord",
+    "channel.slack": "Slack",
+    "channel.ntfy": "ntfy",
+    "channel.bark": "Bark",
+    "channel.pushplus": "PushPlus",
+    "channel.voice": "语音通话",
+    "channel.gitea": "Gitea",
+    "channel.webhook": "Webhook",
+    "modal.editTitle": "编辑任务",
+    "modal.newTitle": "新建定时任务",
+    "modal.statusActive": "活跃",
+    "modal.statusPaused": "已暂停",
+    "modal.params": "配置参数",
+    "modal.history": "运行历史 ({count})",
+    "modal.cancel": "取消",
+    "modal.confirmDiscard": "放弃未保存的内容？",
+    "modal.save": "保存修改",
+    "modal.create": "创建任务",
+    "history.loading": "正在加载历史记录...",
+    "history.empty": "暂无运行记录",
+    "history.summaryTokens": "消耗 Token: {count}",
+    "history.summaryCost": "预估成本: ${cost}",
+    "history.errorLabel": "错误详情:",
+    "history.outputLabel": "执行输出:",
+    "history.statusUncertain": "不确定",
+    "history.artifacts": "产物文件",
+    "history.resolveCompleted": "标记已完成",
+    "history.resolveFailed": "标记失败",
+    "history.statusUncertainHint": "服务重启中断 — 请确认结果",
+    "form.titleLabel": "任务名称 *",
+    "form.titlePlaceholder": "例如: 每周备份检查",
+    "form.typeLabel": "执行类型 *",
+    "form.promptLabel": "提示词内容 *",
+    "form.promptPlaceholder": "输入发送给智能体的执行指令...",
+    "form.modelLabel": "AI 模型",
+    "form.modelDefault": "默认模型",
+    "form.fallbackModelLabel": "备用模型 (主模型失败时使用)",
+    "form.fallbackModelNone": "不使用备用模型",
+    "form.pipelineGroupLabel": "任务流水线串联",
+    "form.onSuccessLabel": "成功后触发 (任务 ID)",
+    "form.onSuccessPlaceholder": "例如: task_upload_backup",
+    "form.onFailureLabel": "失败后触发 (任务 ID)",
+    "form.onFailurePlaceholder": "例如: task_notify_incident",
+    "form.scheduleLabel": "调度计划 (Cron 或相对时间) *",
+    "form.schedulePlaceholder": "例如: 0 9 * * 1-5 或 15m 或 in 2 hours",
+    "form.channelsLabel": "通知渠道",
+    "form.channelsHint": "任务执行完毕后推送报告的目标渠道。",
+    "form.templateLabel": "自定义消息模板",
+    "form.templatePlaceholder": "留空使用默认摘要",
+    "form.templateHint": "支持变量: {title}, {status}, {output}, {error}, {durationMs}, {time}",
+    "form.silentRuleLabel": "静默规则 (可选)",
+    "form.silentRulePlaceholder": "例如: ALL_OK 或 status == 200",
+    "form.silentRuleHint": "若输出符合此规则，将不发送任何通知。",
+    "form.advancedToggle": "高级执行选项",
+    "form.timezoneLabel": "时区 (IANA 时区名)",
+    "form.timezonePlaceholder": "例如: Asia/Shanghai 或 UTC (留空使用服务器时区)",
+    "form.misfireLabel": "错过执行策略 (Misfire Policy)",
+    "form.misfireSkip": "跳过 (默认)",
+    "form.misfireRunOnce": "补跑一次",
+    "form.maxRetriesLabel": "失败重试次数 (0 = 不重试)",
+    "form.permissionPresetLabel": "权限预设",
+    "form.permissionDefault": "默认 (继承主配置)",
+    "form.permissionRestricted": "受限模式 (只读)",
+    "form.permissionFull": "完全访问权限",
+    "form.envLabel": "环境变量 (KEY=VALUE, 每行一个)",
+    "form.envPlaceholder": "FOO=bar\\nAPI_KEY=secret",
+    "form.cwdLabel": "工作目录 (绝对路径)",
+    "form.cwdPlaceholder": "/var/www/my-project",
+    "form.workspaceIdLabel": "关联 DSH Workspace ID",
+    "form.workspaceIdPlaceholder": "留空使用默认工作区",
+    "form.worktreeLabel": "在独立的临时 Git Worktree 中执行",
+    "form.keepWorktreeLabel": "执行结束后保留 Git Worktree (不自动清理)",
+    "form.timeoutLabel": "超时时间 (秒)",
+    "form.overlapLabel": "并发策略",
+    "form.overlapSkip": "跳过 (默认)",
+    "form.overlapQueue": "排队等待",
+    "form.overlapTerminate": "终止前次运行",
+    "form.overlapAllow": "允许并发",
+    "form.kanbanLabel": "看板同步模式",
+    "form.kanbanNone": "不同步到看板",
+    "form.kanbanCreate": "仅创建新卡片",
+    "form.kanbanSync": "保持卡片同步更新",
+    "settings.deliveryChannels": "推送渠道配置",
+    "settings.credentialsHint": "安全凭据在 DSH Credentials 服务中统一管理。",
+    "settings.saveChannels": "保存渠道配置",
+    "settings.testing": "正在测试...",
+    "settings.testSuccess": "✅ 测试成功！",
+    "settings.automationHint": "用于静默规则研判和故障诊断的辅助模型。留空沿用任务自身模型。",
+    "settings.silentRuleModelLabel": "静默规则研判模型",
+    "settings.secretsOnCard": "设置中引用的凭据将在前端脱敏展示，并通过名称引用。",
+    "form.nextRunLabel": "下次执行: ",
+    "form.notScheduled": "未安排计划",
+    "settings.loading": "正在加载设置...",
+    "settings.unavailable": "设置当前不可用。",
+    "settings.retry": "重试",
+    "settings.cardTitle": "⏰ 定时任务调度器 (Cron)",
+    "settings.cardDesc": "定时计划任务（Cron/间隔）、后台智能体场景以及支持 Telegram、Discord、Slack、ntfy、Bark、PushPlus、语音和 Gitea 的通知推送。",
+    "settings.openPanel": "打开任务管理看板",
+    "settings.modalTitle": "通知与渠道设置",
+    "settings.tokenLabel": "Telegram Bot Token",
+    "settings.tokenPlaceholder": "123456789:ABCdefGhIJKlmNoPQRsTUVwxyZ",
+    "settings.tokenPlaceholderDefault": "使用 DSH 全局配置的机器人 (或在此输入自定义 Token)",
+    "settings.defaultHint": "✓ 检测到 DSH 环境已配置默认 Bot",
+    "settings.chatIdLabel": "Telegram Chat ID",
+    "settings.chatIdPlaceholder": "例如: 345678901",
+    "settings.kanbanUrlLabel": "Kanban 服务基础地址",
+    "settings.globalNotify": "全局开启所有任务结果推送至 Telegram",
+    "settings.globalOnlyFailure": "全局模式：仅在失败时推送 (成功静默)",
+    "settings.dynamicCredentials": "动态凭据解析 (credential://...)",
+    "settings.dynamicCredentialsHint": "运行时从凭据服务动态解析 credential://... 且不泄露到存储 (#335)",
+    "settings.testTelegram": "🔔 测试 Telegram 发送",
+    "settings.testKanban": "📋 测试 Kanban",
+    "settings.sending": "正在发送...",
+    "settings.checkingKanban": "正在连接 Kanban...",
+    "settings.testOk": "✅ 测试消息已成功发送至 Telegram！",
+    "settings.testFail": "❌ 发送失败: {error}",
+    "settings.kanbanOk": "✅ Kanban 卡片创建成功",
+    "settings.kanbanFail": "❌ {error}",
+    "settings.save": "保存设置",
+    "settings.saved": "✓ 已保存",
+    "settings.saveError": "保存失败: {error}",
+    "settings.saveErrorUnknown": "未知错误",
+    "updater.title": "插件自更新",
+    "updater.btnCheck": "检查更新",
+    "updater.checking": "正在检查...",
+    "updater.btnUpdate": "升级至 v{version}",
+    "updater.updating": "正在更新...",
+    "updater.desc": "通过 npm 仓库在线检查并就地升级插件，无需 SSH 终端操作。",
+    "updater.current": "当前版本: v{version}",
+    "updater.available": "发现新版本: v{version}",
+    "updater.upToDate": "已是最新版本",
+    "updater.success": "已成功升级至 v{version}。请重启 DSH 或重载配置以应用更新。",
+    "dsh.modalTitle": "让 DSH 智能体创建任务",
+    "dsh.descLabel": "请描述你的任务目标和执行频率:",
+    "dsh.placeholder": "例如: 每两小时检查一次磁盘空间和失败的 systemd 守护进程，并在异常时报警...",
+    "dsh.sendHint": "按 Ctrl+Enter 发送",
+    "dsh.sendTitle": "提交给智能体",
+    "dsh.startFailed": "启动智能体对话失败: {error}",
+    "dsh.launchError": "执行错误: {error}",
+    "confirm.delete": "确定删除该任务吗？",
+    "form.requireApprovalLabel": "执行前需人工确认审批",
+    "form.requireApprovalHint": "开启后，任务执行前将挂起并等待授权用户批准提议 (#318)。",
+    "actions.approve": "批准",
+    "actions.reject": "拒绝",
+    "approval.waiting": "等待人工审批",
+    "approval.approved": "已批准",
+    "approval.rejected": "已拒绝",
+    "chainGraph.modalTitle": "任务链与检查点依赖图",
+    "chainGraph.viewGraph": "任务链图",
+    "chainGraph.noNodes": "未找到该任务或运行的关联步骤。",
+    "chainGraph.retryStep": "重试此步骤",
+    "chainGraph.stepSuccess": "成功",
+    "chainGraph.stepFailed": "失败",
+    "chainGraph.stepPending": "等待中",
+    "chainGraph.close": "关闭",
+    "chainGraph.decisionNode": "条件决策节点",
+    "chainGraph.stepSkipped": "已跳过",
+    "history.doctorDiagnosis": "Doctor 诊断与建议修复",
+    "history.doctorApply": "一键应用修复",
+    "history.doctorRevert": "恢复上一版本代码",
+    "history.autoHealed": "已由 Doctor 自动修复",
+    "form.autoHealLabel": "自主 Self-Healing Doctor 自动修复",
+    "form.autoHealHint": "当任务失败时自动诊断并安全修复（每天上限 1 次）",
+    "form.elseTaskLabel": "默认后备任务 (elseTask)",
+    "form.elseTaskHint": "当没有分支条件匹配时触发的目标任务",
+    "form.elseTaskPlaceholder": "如 task-fallback",
+    "adaptive.badge": "自适应",
+    "adaptive.idle": "空闲",
+    "adaptive.backoff": "避让中",
+    "form.adaptiveEnabled": "自适应轮询 (Adaptive Polling)",
+    "form.adaptiveHint": "数据无变化时指数级延长执行间隔",
+    "liveLog.modalTitle": "实时任务执行日志流",
+    "liveLog.viewLog": "实时日志",
+    "liveLog.autoScroll": "自动滚动",
+    "liveLog.connecting": "正在连接日志流...",
+    "liveLog.waiting": "等待运行器输出...",
+    "liveLog.completed": "日志流已结束",
+    "liveLog.close": "关闭日志流",
+    "timeline.modalTitle": "24小时调度时间线",
+    "timeline.buttonLabel": "时间线",
+    "timeline.buttonTitle": "查看24小时预测任务调度与并发时间线",
+    "timeline.tabTimeline": "调度时间线",
+    "timeline.legendDesc": "未来24小时各时段任务预计执行分布：",
+    "timeline.peakWarning": "并发峰值预警",
+    "heatmap.modalTitle": "成本与Token消耗热力图",
+    "heatmap.buttonLabel": "热力图",
+    "heatmap.tabHeatmap": "成本热力图",
+    "heatmap.matrixDesc": "每周各时段成本分布矩阵（7天 × 24小时）：",
+    "digest.modalTitle": "自动化与成本分析摘要",
+    "digest.buttonLabel": "分析摘要",
+    "digest.buttonTitle": "查看 7 天或 30 天运行统计与花费摘要",
+    "digest.period7": "最近 7 天",
+    "digest.period30": "最近 30 天",
+    "digest.executions": "执行次数",
+    "digest.tokens": "Token 消耗",
+    "digest.cost": "花费 (USD)",
+    "digest.fleet": "任务总览",
+    "digest.unstableTitle": "最不稳定任务排行",
+    "digest.expensiveTitle": "资源消耗排行",
+    "digest.sendTelegram": "发送至 Telegram",
+    "digest.copyMarkdown": "复制 Markdown",
+    "digest.copied": "已复制!",
+    "digest.sentSuccess": "已成功发送至 Telegram!",
+    "prompt.version": "提示词版本",
+    "prompt.rollback": "回退至 v",
+    "prompt.history": "提示词历史",
+    "prompt.successRate": "成功率",
+    "form.chainingTitle": "任务链与 DAG 编排",
+    "form.onSuccessHint": "成功后并发触发的任务 ID，逗号分隔 (Fan-Out)",
+    "form.onFailureHint": "失败后触发的任务 ID，逗号分隔",
+    "form.dependsOnLabel": "依赖任务 (dependsOn)",
+    "form.dependsOnHint": "执行前需等待的前置任务 ID，逗号分隔 (Fan-In)",
+    "form.joinPolicyLabel": "合并策略",
+    "form.joinPolicyAll": "所有前置均成功 (all_success)",
+    "form.joinPolicyAny": "任一前置成功即可 (any_success)",
+    "recipe.dependenciesMissing": "缺少必要集成服务或凭据",
+    "list.loadErrorPrefix": "加载任务列表失败"
+  }
+}

package/lib/routes.js

@@ -1,3 +1,4 @@
+import { readFileSync } from 'node:fs';
 import { handleTaskWebhookRoute } from './api-task-webhook.js';
 import { calculateCostHeatmap } from './timeline.js';
 import { buildAnalyticsDigest, formatDigestMarkdown, sendAnalyticsDigest } from './analytics-digest.js';
@@ -15,7 +16,48 @@ import { createKanbanCard } from './integrations.js';
 import { sanitizeSettingsPayload, applySettingsToScope } from './settings.js';
 import { buildTaskGraphModel } from './dag.js';
 
+
+const CLIENT_CSS = readFileSync(new URL('./client.css', import.meta.url), 'utf8');
+const LOCALES_JSON = readFileSync(new URL('./locales.json', import.meta.url), 'utf8');
+
+
 export function registerRoutes(ctx, { store, scheduler, recommendations }) {
+  // Client locales route (#374)
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-cron/locales.json',
+    handler: (req, res) => {
+      if (req.method !== 'GET') {
+        res.writeHead(405, { 'content-type': 'text/plain; charset=utf-8' });
+        res.end('GET only');
+        return;
+      }
+      res.writeHead(200, {
+        'content-type': 'application/json; charset=utf-8',
+        'cache-control': 'public, max-age=300'
+      });
+      res.end(LOCALES_JSON);
+    }
+  }), 'dsh-cron: /locales.json');
+
+  // Client CSS stylesheet route (#374)
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-cron/client.css',
+    handler: (req, res) => {
+      if (req.method !== 'GET') {
+        res.writeHead(405, { 'content-type': 'text/plain; charset=utf-8' });
+        res.end('GET only');
+        return;
+      }
+      res.writeHead(200, {
+        'content-type': 'text/css; charset=utf-8',
+        'cache-control': 'public, max-age=300'
+      });
+      res.end(CLIENT_CSS);
+    }
+  }), 'dsh-cron: /client.css');
+
   // handler per route family; registered WITHOUT the trailing slash (#96)
   ctx.effect(() => ctx.webServer.register({
     kind: 'prefix',

package/lib/secrets.js

@@ -147,6 +147,7 @@ export function parseCredentialUri(value) {
  */
 export async function resolveCredentialReference(uri, ctx) {
   if (typeof uri !== 'string') return uri;
+  if (!isCredentialUri(uri)) return uri;
   const parsed = parseCredentialUri(uri);
   if (!parsed) return uri;
 

package/lib/store.js

@@ -213,12 +213,45 @@ export class TaskStore {
    * Asynchronously serialize and write tasks store to disk using fs.promises queue (#244, #301, #303).
    * Safe mode 0600 on files and 0700 on dir (#222).
    */
+  /**
+   * Wait until diskVersion or lastSyncVersion is at least the target version (#372).
+   */
+  _waitForDiskVersion(version) {
+    if ((this._diskVersion || 0) >= version || (this._lastSyncVersion || 0) >= version) {
+      return Promise.resolve();
+    }
+    return new Promise((resolve, reject) => {
+      if (!this._diskWaiters) this._diskWaiters = [];
+      this._diskWaiters.push({ version, resolve, reject });
+    });
+  }
+
+  _notifyDiskVersion(writtenVersion, err = null) {
+    if (!this._diskWaiters || this._diskWaiters.length === 0) return;
+    const remaining = [];
+    for (const waiter of this._diskWaiters) {
+      if (err) {
+        waiter.reject(err);
+      } else if ((this._diskVersion || 0) >= waiter.version || (this._lastSyncVersion || 0) >= waiter.version) {
+        waiter.resolve();
+      } else {
+        remaining.push(waiter);
+      }
+    }
+    this._diskWaiters = remaining;
+  }
+
   async saveAsync() {
+    if (this._saveTimer) {
+      clearTimeout(this._saveTimer);
+      this._saveTimer = null;
+    }
     const version = ++this._saveVersion;
     const data = this._createSnapshot();
 
     const writeOp = async () => {
       if ((this._diskVersion || 0) >= version || (this._lastSyncVersion || 0) >= version) {
+        this._notifyDiskVersion(version);
         return;
       }
       const dir = path.dirname(this.filePath);
@@ -238,12 +271,14 @@ export class TaskStore {
       } catch (writeErr) {
         await fs.promises.unlink(tmp).catch(() => {});
         if (this._currentAsyncTmp === tmp) this._currentAsyncTmp = null;
+        this._notifyDiskVersion(null, writeErr);
         throw writeErr;
       }
 
       if ((this._diskVersion || 0) >= version || (this._lastSyncVersion || 0) >= version || this._saveVersion > version) {
         await fs.promises.unlink(tmp).catch(() => {});
         if (this._currentAsyncTmp === tmp) this._currentAsyncTmp = null;
+        // Do not notify waiters yet: a newer queued saveOp will write to disk and notify (#372)
         return;
       }
 
@@ -251,14 +286,17 @@ export class TaskStore {
         await fs.promises.rename(tmp, this.filePath);
         bestEffort('chmod-store', () => fs.chmodSync(this.filePath, 0o600));
         this._currentAsyncTmp = null;
-        this._diskVersion = version;
-        this._lastWrittenVersion = version;
+        this._diskVersion = Math.max(this._diskVersion || 0, version);
+        this._lastWrittenVersion = this._diskVersion;
+        this._notifyDiskVersion(this._diskVersion);
       } catch (err) {
         this._currentAsyncTmp = null;
         // If tmp was unlinked by newer sync save, rename will fail with ENOENT - safely ignore only in that case (#244)
         if (err.code === 'ENOENT' && (this._lastSyncVersion || 0) >= version) {
+          this._notifyDiskVersion(version);
           return;
         }
+        this._notifyDiskVersion(null, err);
         throw err;
       }
 
@@ -276,7 +314,8 @@ export class TaskStore {
     };
 
     this._savePromise = this._savePromise.then(writeOp, writeOp);
-    return this._savePromise;
+    await this._savePromise;
+    await this._waitForDiskVersion(version);
   }
 
   /**
@@ -410,6 +449,7 @@ export class TaskStore {
       bestEffort('chmod-store', () => fs.chmodSync(this.filePath, 0o600));
       this._diskVersion = Math.max(this._diskVersion || 0, version);
       this._lastWrittenVersion = this._diskVersion;
+      this._notifyDiskVersion(this._diskVersion);
 
       // Throttled backup (.bak): avoid expensive copyFileSync on every micro-save
       const now = Date.now();