@goodandready/dsh-cron 0.3.20 → 0.3.22

package/README.md

@@ -96,8 +96,9 @@ graph TD
 - **Automated Synthesis**: Aggregates worker outputs into a structured Markdown digest or delegates synthesis to a designated synthesizer model.
 - **Swarm Metrics & History**: Run history records total, succeeded, failed counts, and duration alongside detailed per-worker execution logs.
 
-### 🔍 Git Diff & Interactive Patch Review (#351)
-- **Automatic Diff Capture**: Tasks running in Git worktrees capture modified files, stat summary, and unified diffs (up to 256 KiB) automatically.
+### 🔍 Git Diff & Interactive Patch Review (#351, #379)
+- **Scoped Diff Capture**: Tasks running in Git worktrees capture modified files, stat summary, and unified diffs (up to 256 KiB) automatically. Non-worktree tasks ignore repository diffs by default, avoiding storage bloat, but can opt in explicitly via `captureGitDiff: true`.
+- **Lightweight Archive Storage**: Historical run archives automatically strip heavy raw diff payloads into concise excerpts with byte-budget caps (max 15MB) and automatic cleanup of orphaned `.tmp.*` files.
 - **1-Click Discard**: Revert uncommitted working directory changes safely with a single click (`git reset --hard HEAD && git clean -fd`).
 - **1-Click Apply**: Re-apply previously captured diffs directly to the repository (`git apply --whitespace=fix`).
 - **Interactive Run Preview**: Color-coded diff inspector embedded directly into the execution history drawer.
@@ -215,7 +216,7 @@ Every task picks its own runtime; non-LLM runtimes need no model and consume no
 
 ### 8. Session Integration & Permissions
 * **Real Assistant Output & Terminal Status Extraction** — Isolates current turn session events, extracts the actual assistant message text (excluding previous turn history in persistent sessions), and validates terminal turn status (`turn/end` errors or interruptions) to guarantee accurate reporting, chaining, and structured action execution.
-* **Per-task permission presets** — `default`, `read-only`, `workspace-write`, or `full` are applied to the task's agent session before the prompt runs.
+* **Per-task permission presets & unattended approval** — `default`, `read-only`, `workspace-write`, or `danger-full-access` (aliased as `full`) are mapped directly to host `SandboxMode` and applied to the task's agent session before the prompt runs. For unattended background runs, approval policy is pinned to `never` via host `approval` service to eliminate interactive approval stalls.
 * **Session auto-archive** — isolated cron sessions are archived after each run (best-effort) so they do not clutter the chat list.
 * **History → session navigation** — every LLM run records its session; open it straight from the run history entry.
 

package/lib/api-collection.js

@@ -169,7 +169,7 @@ export function buildTaskRecord(store, body, taskType, parsed) {
     misfirePolicy: ['skip', 'runOnce', 'catchUpAll'].includes(body.misfirePolicy) ? body.misfirePolicy : (current ? (current.misfirePolicy || 'skip') : 'skip'),
     maxRetries: body.maxRetries !== undefined ? Math.max(0, Number(body.maxRetries) || 0) : (current ? (Number(current.maxRetries) || 0) : 0),
     retryBackoffMs: body.retryBackoffMs !== undefined ? Math.max(1000, Number(body.retryBackoffMs) || 30000) : (current ? (Number(current.retryBackoffMs) || 30000) : 30000),
-    permissionPreset: !EXTERNAL_RUNTIMES.includes(taskType) && ['default', 'read-only', 'workspace-write', 'full'].includes(body.permissionPreset) ? body.permissionPreset : (current && !EXTERNAL_RUNTIMES.includes(taskType) ? (current.permissionPreset || 'default') : 'default'),
+    permissionPreset: !EXTERNAL_RUNTIMES.includes(taskType) && ['default', 'read-only', 'workspace-write', 'danger-full-access', 'full'].includes(body.permissionPreset) ? body.permissionPreset : (current && !EXTERNAL_RUNTIMES.includes(taskType) ? (current.permissionPreset || 'default') : 'default'),
     validators: Array.isArray(body.validators) ? sanitizeValidators(body.validators) : (current ? current.validators : undefined),
     ...mergeExecutionFields(current, body, parsed),
   };
@@ -194,6 +194,7 @@ export function mergeExecutionFields(current, body, parsed) {
     workspaceId: body.workspaceId !== undefined ? String(body.workspaceId).trim() : (current ? current.workspaceId : ''),
     worktree: body.worktree !== undefined ? Boolean(body.worktree) : (current ? Boolean(current.worktree) : false),
     keepWorktree: body.keepWorktree !== undefined ? Boolean(body.keepWorktree) : (current ? Boolean(current.keepWorktree) : false),
+    captureGitDiff: body.captureGitDiff !== undefined ? Boolean(body.captureGitDiff) : (body.captureDiff !== undefined ? Boolean(body.captureDiff) : (current ? current.captureGitDiff : undefined)),
     httpMethod: body.httpMethod ? String(body.httpMethod).toUpperCase() : (current ? current.httpMethod : 'GET'),
     httpUrl: body.httpUrl !== undefined ? String(body.httpUrl).trim() : (current ? current.httpUrl : ''),
     httpHeaders: body.httpHeaders !== undefined ? body.httpHeaders : (current ? current.httpHeaders : undefined),

package/lib/client.js

@@ -313,7 +313,206 @@ en: {
 'form.previewScheduleTitle': 'Next 5 scheduled runs:',
 },
 zh: {
-'modal.confirmDiscard': '放弃未保存的内容？',
+'sidebar.label': '定时任务', 'sidebar.jobsTitle': '运行中任务',
+'sidebar.noActiveJobs': '无运行中任务', 'sidebar.moreJobs': '及另外 {count} 个',
+'chip.title': '定时任务 (Cron)', 'panel.back': '返回对话',
+'panel.title': '定时任务', 'panel.subtitle': '让 DSH 规划任务、设置提醒或跟踪状态',
+'actions.create': '新建', 'actions.createWithDsh': '💬 让 DSH 创建',
+'actions.setupManually': '✏️ 手动配置', 'actions.runNow': '立即运行',
+'actions.runNowShort': '运行', 'actions.edit': '编辑 / 详情',
+'actions.duplicate': '复制任务', 'actions.tuneWithDsh': '让 DSH 优化',
+'tune.startFailed': '无法启动优化会话: {error}', 'actions.delete': '删除任务',
+'duplicate.done': '已创建副本并处于暂停状态：恢复前请先核对调度时间。', 'duplicate.oneShotHint': '该副本为一次性任务且已暂停，请设定新的执行时间后再启用。',
+'duplicate.failed': '复制任务失败: {error}', 'transfer.exportTitle': '导出任务',
+'transfer.importTitle': '导入任务', 'transfer.exported': '已成功导出 {count} 个任务。',
+'transfer.exportFailed': '导出失败: {error}', 'transfer.importTitleModal': '导入任务',
+'transfer.importHint': '仅导出任务静态配置：不包含历史记录与计数器。渠道通过凭据名称引用；注意完整导出保留自定义环境变量和 HTTP 请求头。', 'transfer.exportPrompt': '选择导出模式：\n确定 = 净化导出（移除自定义环境变量与请求头）\n取消 = 完整原始导出',
+'transfer.strategyAdd': '作为新任务导入（分配新 ID）', 'transfer.strategyReplace': '覆盖同 ID 任务',
+'transfer.strategySkip': '跳过已存在的同 ID 任务', 'transfer.summary': '该文件包含 {total} 个任务：{add} 个新增，{replace} 个覆盖，{skip} 个跳过。',
+'transfer.confirm': '开始导入', 'transfer.imported': '已成功导入 {count} 个任务。',
+'transfer.importFailed': '导入失败: {error}', 'transfer.badFile': '所选文件不是有效的 JSON 导出文件: {error}',
+'actions.pause': '暂停', 'actions.resume': '恢复',
+'actions.settings': '通知与渠道设置', 'search.placeholder': '搜索定时任务',
+'filters.title': '筛选', 'filters.type': '类型',
+'filters.model': '模型', 'filters.channel': '渠道',
+'filters.any': '全部', 'filters.reset': '重置筛选',
+'filters.empty': '没有匹配当前筛选条件的任务。', 'filters.showing': '显示 {shown} / 共 {total}',
+'stats.activeTasks': '活跃任务', 'stats.totalRuns': '总运行次数',
+'stats.totalTokens': '消耗 Token', 'stats.totalCost': '预估成本',
+'tabs.all': '全部', 'tabs.active': '运行中',
+'tabs.paused': '已暂停', 'tabs.completed': '已完成',
+'banner.loadError': '加载任务失败: {error}', 'banner.retry': '重试',
+'list.loading': '正在加载定时任务...', 'list.empty': '暂无定时任务',
+'list.typeShell': 'Shell 脚本', 'list.typeLlm': 'LLM 智能体',
+'list.oneShot': '一次性', 'list.configManaged': '配置只读',
+'list.configManagedHint': '由配置文件中的 config.jobs 声明；要修改或删除请编辑该文件', 'list.next': ' · 下次: {time}',
+'recs.title': '推荐任务', 'recs.hint': '开箱即用的配方。点一下就会把表单填好——保存之前不会创建任何任务。',
+'modal.editTitle': '编辑任务', 'modal.newTitle': '新建定时任务',
+'modal.statusActive': '活跃', 'modal.statusPaused': '已暂停',
+'modal.params': '配置参数', 'modal.history': '运行历史 ({count})',
+'modal.cancel': '取消', 'modal.confirmDiscard': '放弃未保存的内容？',
+'modal.save': '保存修改', 'modal.create': '创建任务',
+'modal.close': '关闭', 'history.loading': '正在加载历史记录...',
+'history.empty': '暂无运行记录', 'history.stoppedReasonTitle': '停止原因:',
+'history.retryDelivery': '重试推送', 'history.retryingDelivery': '正在重试...',
+'history.statusValidationFailed': '校验失败', 'history.stage_queue': '排队',
+'history.stage_preflight': '预检', 'history.stage_execution': '执行',
+'history.stage_validation': '校验', 'history.stage_delivery': '推送',
+'history.refresh': '刷新历史', 'history.statusSuccess': '成功',
+'history.statusUncertain': '不确定', 'history.artifacts': '产物文件',
+'history.resolveCompleted': '标记已完成', 'history.resolveFailed': '标记失败',
+'history.statusUncertainHint': '服务重启中断 — 请确认结果', 'history.statusSkipped': '已跳过',
+'history.statusMissed': '已错过', 'history.statusTimeout': '超时',
+'history.statusFailed': '失败', 'form.nameLabel': '任务名称',
+'form.namePlaceholder': '例如: dsh-tags-watch', 'form.typeLabel': '执行类型 *',
+'form.typeLlm': 'LLM（AI 智能体）', 'form.typeScript': 'Shell 命令 / 脚本',
+'form.typeNode': 'Node.js', 'form.typePython': 'Python',
+'form.typeHttp': 'HTTP 请求 / Webhook', 'form.typeSsh': '远程 SSH',
+'form.typeDocker': 'Docker 容器', 'form.typeSkill': 'DSH 技能',
+'form.typeWorkflow': 'DSH 工作流', 'form.envLabel': '环境变量 (KEY=VALUE, 每行一个)',
+'form.envPlaceholder': 'NODE_ENV=production\nTZ=Europe/Berlin', 'form.envHint': '仅对非 LLM 运行时生效。不要在这里存放密钥。',
+'form.cwdLabel': '工作目录 (绝对路径)', 'form.workspaceLabel': '工作区 ID 或路径（可选）',
+'form.worktreeLabel': '在独立的临时 Git Worktree 中执行', 'form.keepWorktreeLabel': '执行结束后保留 Git Worktree (不自动清理)',
+'form.httpMethodLabel': 'HTTP 方法', 'form.httpUrlLabel': 'URL',
+'form.httpHeadersLabel': '请求头（JSON，可选）', 'form.httpBodyLabel': '请求体（可选）',
+'form.sshProfileLabel': 'dsh-remote-workspace 配置 ID', 'form.sshProfileHint': '推荐用法：主机与凭据都放在 remote-workspace 插件里。',
+'form.sshTargetLabel': '备用目标（user@host，可选）', 'form.sshKeyLabel': '私钥路径（备用，可选）',
+'form.dockerImageLabel': '容器镜像', 'form.skillNameLabel': '技能名称',
+'form.workflowNameLabel': '工作流名称', 'form.scheduleLabel': '调度计划 (Cron 或相对时间) *',
+'form.schedulePlaceholder': '例如: 0 9 * * 1-5 或 15m 或 in 2 hours', 'form.timeoutLabel': '超时时间 (秒)',
+'form.overlapLabel': '并发策略', 'form.overlapSkip': '跳过 (默认)',
+'form.overlapQueue': '排队等待', 'form.overlapReplace': '取消当前运行并重新开始 (replace)',
+'form.kanbanLabel': '看板同步模式', 'form.kanbanNone': '不同步到看板',
+'form.kanbanOnFailure': '失败时创建工单（进 Backlog）', 'form.kanbanAlways': '每次完成都建卡片（Done / Backlog）',
+'form.providerLabel': 'LLM 服务商', 'form.providerDefault': '默认（DSH）',
+'form.modelLabel': 'AI 模型', 'form.modelDefault': '默认模型',
+'form.silentRuleLabel': '静默规则 (可选)', 'form.silentRulePlaceholder': '例如: ALL_OK 或 status == 200',
+'form.silentRuleHint': '若输出符合此规则，将不发送任何通知。', 'history.silentSkip': '保持静默:',
+'history.diagnosis': '诊断', 'history.applySuggestion': '用这条建议打开编辑表单',
+'form.inspectOnFailureLabel': '用模型诊断失败原因', 'form.inspectOnFailureHint': '运行失败后，由模型读一遍提示词、错误和输出，把诊断结论和修改建议随这次运行一起保存。不会自动应用任何改动。',
+'settings.inspectorModelLabel': '失败诊断模型', 'form.fallbackModelLabel': '备用模型 (主模型失败时使用)',
+'form.fallbackModelPlaceholder': '例如: deepseek-reasoner', 'form.fallbackModelHint': '主模型运行失败时，用这个模型再试一次。两次尝试都计入成本。',
+'form.promptLabelScript': 'Shell 命令或脚本', 'form.promptLabelLlm': '给智能体的指令 / 提示词',
+'form.promptPlaceholderScript': 'curl -fsSL https://... || exit 1', 'form.promptPlaceholderLlm': '精确描述智能体要做什么...',
+'form.timezoneLabel': '时区 (IANA 时区名)', 'form.timezonePlaceholder': '例如: Asia/Shanghai 或 UTC (留空使用服务器时区)',
+'form.misfireLabel': '错过执行策略 (Misfire Policy)', 'form.misfireSkip': '跳过 (默认)',
+'form.misfireRunOnce': '补跑一次', 'form.misfireCatchUp': '迟到时补跑一次并记录缺口 (catchUpAll)',
+'form.retriesLabel': '失败自动重试次数（0 = 关闭）', 'form.permissionLabel': '会话权限',
+'form.permissionDefault': '默认 (继承主配置)', 'form.permissionReadonly': '只读',
+'form.permissionWrite': '工作区写入', 'form.permissionFull': '完全访问权限',
+'list.runningNow': '正在运行', 'history.openSession': '打开会话',
+'form.notifyTitle': 'Telegram 通知', 'form.notifyTelegram': '把运行报告发送到 Telegram',
+'form.notifyOnlyFailure': '仅失败时发送（onlyOnFailure / 成功静默）', 'form.channelsTitle': '推送渠道',
+'form.channelsHint': '任务执行完毕后推送报告的目标渠道。', 'form.templateLabel': '自定义消息模板',
+'form.templatePlaceholder': '⏰ {title} — {status}，耗时 {duration}', 'form.templateHint': '可用变量: {title} {id} {status} {output} {error} {duration} {schedule} {time} {tokens} {cost} {model}。留空使用内置文案。',
+'form.channelTelegram': 'Telegram', 'form.channelKanban': 'dsh-kanban 卡片',
+'form.channelDiscord': 'Discord', 'form.channelSlack': 'Slack',
+'form.channelNtfy': 'ntfy', 'form.channelBark': 'Bark',
+'form.channelPushplus': 'PushPlus', 'form.channelTts': '语音（dsh-tts）',
+'form.channelGitea': 'Gitea Issue', 'settings.deliverySection': '推送渠道',
+'settings.secretsSection': '凭据（引用）', 'settings.secretsHint': '这里填 DSH 凭据的「名称」，不是密钥本身。密钥保存在凭据服务里。',
+'settings.telegramSection': 'Telegram', 'settings.templatesSection': '消息模板',
+'settings.channelTemplateLabel': '{channel} 的消息模板', 'settings.botTokenRefLabel': 'Bot Token 凭据名称',
+'settings.botTokenRefPlaceholder': '例如: TELEGRAM_BOT_TOKEN', 'settings.apiTokenLabel': '外部 API Token',
+'settings.apiTokenPlaceholder': '用于 /dsh-cron/api/* 的 Bearer token（留空 = 关闭）', 'settings.discordLabel': 'Discord Webhook URL',
+'settings.slackLabel': 'Slack Webhook URL', 'settings.ntfyUrlLabel': 'ntfy 服务器地址',
+'settings.ntfyTopicLabel': 'ntfy 主题', 'settings.ntfyTokenRefLabel': 'ntfy Token 凭据名称',
+'settings.barkServerLabel': 'Bark 服务器地址', 'settings.barkKeyLabel': 'Bark 设备 Key',
+'settings.pushplusTokenRefLabel': 'PushPlus Token 凭据名称', 'settings.pushplusUrlLabel': 'PushPlus 接口地址',
+'settings.ttsBaseUrlLabel': 'dsh-tts 服务地址', 'settings.giteaBaseUrlLabel': 'Gitea 服务地址',
+'settings.giteaRepoLabel': 'Gitea 仓库（owner/repo）', 'settings.giteaTokenRefLabel': 'Gitea Token 凭据名称',
+'settings.templateLabel': '默认消息模板', 'settings.templateHint': '作用于所有没有单独模板的渠道。留空用内置文案。',
+'settings.deliveryTimeoutMsLabel': '每个渠道的推送超时（毫秒）', 'settings.automationSection': '自动化模型',
+'settings.automationHint': '用于静默规则研判和故障诊断的辅助模型。留空沿用任务自身模型。', 'settings.silentRuleModelLabel': '静默规则研判模型',
+'settings.secretsOnCard': '设置中引用的凭据将在前端脱敏展示，并通过名称引用。', 'form.nextRunLabel': '下次执行: ',
+'form.notScheduled': '未安排计划', 'settings.loading': '正在加载设置...',
+'settings.unavailable': '设置当前不可用。', 'settings.retry': '重试',
+'settings.cardTitle': '⏰ 定时任务调度器 (Cron)', 'settings.cardDesc': '定时计划任务（Cron/间隔）、后台智能体场景以及支持 Telegram、Discord、Slack、ntfy、Bark、PushPlus、语音和 Gitea 的通知推送。',
+'settings.openPanel': '打开任务管理看板', 'settings.modalTitle': '通知与渠道设置',
+'settings.tokenLabel': 'Telegram Bot Token', 'settings.tokenPlaceholder': '123456789:ABCdefGhIJKlmNoPQRsTUVwxyZ',
+'settings.tokenPlaceholderDefault': '使用 DSH 全局配置的机器人 (或在此输入自定义 Token)', 'settings.defaultHint': '✓ 检测到 DSH 环境已配置默认 Bot',
+'settings.chatIdLabel': 'Telegram Chat ID', 'settings.chatIdPlaceholder': '例如: 345678901',
+'settings.kanbanUrlLabel': 'Kanban 服务基础地址', 'settings.globalNotify': '全局开启所有任务结果推送至 Telegram',
+'settings.globalOnlyFailure': '全局模式：仅在失败时推送 (成功静默)', 'settings.dynamicCredentials': '动态凭据解析 (credential://...)',
+'settings.dynamicCredentialsHint': '运行时从凭据服务动态解析 credential://... 且不泄露到存储 (#335)', 'settings.testTelegram': '🔔 测试 Telegram 发送',
+'settings.testKanban': '📋 测试 Kanban', 'settings.sending': '正在发送...',
+'settings.checkingKanban': '正在连接 Kanban...', 'settings.testOk': '✅ 测试消息已成功发送至 Telegram！',
+'settings.testFail': '❌ 发送失败: {error}', 'settings.kanbanOk': '✅ Kanban 卡片创建成功',
+'settings.kanbanFail': '❌ {error}', 'settings.save': '保存设置',
+'settings.saved': '✓ 已保存', 'settings.saveError': '保存失败: {error}',
+'settings.saveErrorUnknown': '未知错误', 'updater.title': '插件自更新',
+'updater.btnCheck': '检查更新', 'updater.checking': '正在检查...',
+'updater.btnUpdate': '升级至 v{version}', 'updater.updating': '正在更新...',
+'updater.desc': '通过 npm 仓库在线检查并就地升级插件，无需 SSH 终端操作。', 'updater.current': '当前版本: v{version}',
+'updater.available': '发现新版本: v{version}', 'updater.upToDate': '已是最新版本',
+'updater.success': '已成功升级至 v{version}。请重启 DSH 或重载配置以应用更新。', 'dsh.modalTitle': '让 DSH 智能体创建任务',
+'dsh.descLabel': '请描述你的任务目标和执行频率:', 'dsh.placeholder': '例如: 每两小时检查一次磁盘空间和失败的 systemd 守护进程，并在异常时报警...',
+'dsh.sendHint': '按 Ctrl+Enter 发送', 'dsh.sendTitle': '提交给智能体',
+'dsh.startFailed': '启动智能体对话失败: {error}', 'dsh.launchError': '执行错误: {error}',
+'confirm.delete': '确定删除该任务吗？', 'list.loadErrorPrefix': '加载任务列表失败',
+'actions.dryRun': '空跑测试', 'actions.dryRunTitle': '空跑测试（模拟执行，不产生副作用且不发送通知）',
+'actions.archive': '历史归档', 'actions.archiveTitle': '查看执行历史与日志归档',
+'dryRun.title': '🧪 空跑模拟结果', 'dryRun.task': '任务',
+'dryRun.status': '模拟状态', 'dryRun.duration': '耗时',
+'dryRun.output': '模拟输出', 'dryRun.preflight': '预检结果',
+'dryRun.close': '关闭', 'archive.title': '📜 运行历史归档',
+'archive.totalRuns': '共记录 {total} 次运行', 'archive.empty': '该任务暂无历史运行归档。',
+'archive.loadMore': '加载更多 ({shown} / {total})', 'archive.close': '关闭',
+'form.reliabilityTitle': '🛡️ 可靠性、心跳监听与自愈', 'form.preflightLabel': '预检健康探测',
+'form.preflightNone': '无', 'form.preflightHttp': 'HTTP (2xx 探测)',
+'form.preflightShell': 'Shell 探测 (退出码 0)', 'form.preflightDisk': '磁盘空间探测 (挂载点:最小百分比)',
+'form.preflightTargetLabel': '预检目标参数', 'form.preflightTargetPlaceholder': 'https://example.com/healthz 或 ls /data 或 /:10%',
+'form.heartbeatIntervalLabel': '心跳打卡时限 (秒, 0 = 禁用)', 'form.gracePeriodLabel': '心跳宽限期 (秒)',
+'form.priorityLabel': '队列优先级 (1-10，数值越大越先执行)', 'form.concurrencyGroupLabel': '并发分组名称',
+'form.selfHealingLabel': '故障自愈脚本 (Shell)', 'form.selfHealingPlaceholder': 'systemctl restart app || true',
+'form.autoDiagnoseLabel': '任务失败时启用 AI 智能分析诊断', 'form.agentPresetLabel': '智能体预设 (Agent Preset)',
+'form.agentPresetPlaceholder': 'standard (留空使用全局默认预设)', 'form.agentPresetHint': '来自 dsh-agent-presets 的智能体预设（如 standard, minimal, cordis, ptc），挂载工作区工具与文件读写能力。',
+'form.sessionTitleLabel': '会话标题模板 (Session Title)', 'form.sessionTitlePlaceholder': '如 {{date}} 市场早报 (支持 {{date}} 变量)',
+'form.sessionTitleHint': '此任务运行生成的会话标题。支持 {{date}} (年-月-日)。留空默认为 "<YYYY-MM-DD> <任务名>"。', 'form.targetSessionIdLabel': '目标常驻会话 ID (Target Session ID)',
+'form.targetSessionIdPlaceholder': '如 audit-chat 或 dev-summary（留空为单次隔离运行）', 'form.targetSessionIdHint': '配置后定时任务将在此常驻会话中持续交互，跨周期保留历史上下文对话记忆，不再每次新建孤立会话。',
+'form.targetSessionResetLabel': '上下文轮转策略 (Session Rotation)', 'form.targetSessionResetNever': '永不轮转（单一会话持续累积）',
+'form.targetSessionResetDaily': '每日轮转（每日自动开启新会话）', 'form.targetSessionResetWeekly': '每周轮转（每周自动开启新会话）',
+'form.targetSessionResetHint': '自动按周期加注日期后缀轮转会话，有效防止长时间运行导致的模型上下文窗口超限与 Token 浪费。', 'form.requireApprovalLabel': '执行前需人工确认审批',
+'form.requireApprovalHint': '开启后，任务执行前将挂起并等待授权用户批准提议 (#318)。', 'actions.approve': '批准',
+'actions.reject': '拒绝', 'approval.waiting': '等待人工审批',
+'approval.approved': '已批准', 'approval.rejected': '已拒绝',
+'chainGraph.modalTitle': '任务链与检查点依赖图', 'chainGraph.viewGraph': '任务链图',
+'chainGraph.noNodes': '未找到该任务或运行的关联步骤。', 'chainGraph.retryStep': '重试此步骤',
+'chainGraph.stepSuccess': '成功', 'chainGraph.stepFailed': '失败',
+'chainGraph.stepPending': '等待中', 'chainGraph.close': '关闭',
+'chainGraph.decisionNode': '条件决策节点', 'chainGraph.stepSkipped': '已跳过',
+'history.doctorDiagnosis': 'Doctor 诊断与建议修复', 'history.doctorApply': '一键应用修复',
+'history.doctorRevert': '恢复上一版本代码', 'history.autoHealed': '已由 Doctor 自动修复',
+'form.autoHealLabel': '自主 Self-Healing Doctor 自动修复', 'form.autoHealHint': '当任务失败时自动诊断并安全修复（每天上限 1 次）',
+'form.elseTaskLabel': '默认后备任务 (elseTask)', 'form.elseTaskHint': '当没有分支条件匹配时触发的目标任务',
+'form.elseTaskPlaceholder': '如 task-fallback', 'adaptive.badge': '自适应',
+'adaptive.idle': '空闲', 'adaptive.backoff': '避让中',
+'form.adaptiveEnabled': '自适应轮询 (Adaptive Polling)', 'form.adaptiveHint': '数据无变化时指数级延长执行间隔',
+'liveLog.modalTitle': '实时任务执行日志流', 'liveLog.viewLog': '实时日志',
+'liveLog.autoScroll': '自动滚动', 'liveLog.connecting': '正在连接日志流...',
+'liveLog.waiting': '等待运行器输出...', 'liveLog.completed': '日志流已结束',
+'liveLog.close': '关闭日志流', 'timeline.modalTitle': '24小时调度时间线',
+'timeline.buttonLabel': '时间线', 'timeline.buttonTitle': '查看24小时预测任务调度与并发时间线',
+'timeline.tabTimeline': '调度时间线', 'timeline.legendDesc': '未来24小时各时段任务预计执行分布：',
+'timeline.peakWarning': '并发峰值预警', 'heatmap.modalTitle': '成本与Token消耗热力图',
+'heatmap.buttonLabel': '热力图', 'heatmap.tabHeatmap': '成本热力图',
+'heatmap.matrixDesc': '每周各时段成本分布矩阵（7天 × 24小时）：', 'digest.modalTitle': '自动化与成本分析摘要',
+'digest.buttonLabel': '分析摘要', 'digest.buttonTitle': '查看 7 天或 30 天运行统计与花费摘要',
+'digest.period7': '最近 7 天', 'digest.period30': '最近 30 天',
+'digest.executions': '执行次数', 'digest.tokens': 'Token 消耗',
+'digest.cost': '花费 (USD)', 'digest.fleet': '任务总览',
+'digest.unstableTitle': '最不稳定任务排行', 'digest.expensiveTitle': '资源消耗排行',
+'digest.sendTelegram': '发送至 Telegram', 'digest.copyMarkdown': '复制 Markdown',
+'digest.copied': '已复制!', 'digest.sentSuccess': '已成功发送至 Telegram!',
+'prompt.version': '提示词版本', 'prompt.rollback': '回退至 v',
+'prompt.history': '提示词历史', 'prompt.successRate': '成功率',
+'form.chainingTitle': '任务链与 DAG 编排', 'form.onSuccessLabel': '成功后触发 (任务 ID)',
+'form.onSuccessHint': '成功后并发触发的任务 ID，逗号分隔 (Fan-Out)', 'form.onFailureLabel': '失败后触发 (任务 ID)',
+'form.onFailureHint': '失败后触发的任务 ID，逗号分隔', 'form.dependsOnLabel': '依赖任务 (dependsOn)',
+'form.dependsOnHint': '执行前需等待的前置任务 ID，逗号分隔 (Fan-In)', 'form.joinPolicyLabel': '合并策略',
+'form.joinPolicyAll': '所有前置均成功 (all_success)', 'form.joinPolicyAny': '任一前置成功即可 (any_success)',
+'recipe.dependenciesMissing': '缺少必要集成服务或凭据', 'form.previewSchedule': '预测下次运行时间',
+'form.previewScheduleTitle': '未来 5 次计划运行时间:',
 }
 };
 let translate = (key, vars) => {
@@ -1441,6 +1640,7 @@ const [formCwd, setFormCwd] = React.useState('');
 const [formWorkspaceId, setFormWorkspaceId] = React.useState('');
 const [formWorktree, setFormWorktree] = React.useState(false);
 const [formKeepWorktree, setFormKeepWorktree] = React.useState(false);
+const [formCaptureGitDiff, setFormCaptureGitDiff] = React.useState(false);
 const [formHttpMethod, setFormHttpMethod] = React.useState('GET');
 const [formHttpUrl, setFormHttpUrl] = React.useState('');
 const [formHttpHeaders, setFormHttpHeaders] = React.useState('');
@@ -1496,6 +1696,7 @@ cwd: String(formCwd || '').trim(),
 workspaceId: String(formWorkspaceId || '').trim(),
 worktree: Boolean(formWorktree),
 keepWorktree: Boolean(formKeepWorktree),
+captureGitDiff: Boolean(formCaptureGitDiff),
 httpMethod: String(formHttpMethod || 'GET'),
 httpUrl: String(formHttpUrl || '').trim(),
 httpHttpHeaders: String(formHttpHeaders || '').trim(),
@@ -2130,6 +2331,7 @@ setFormCwd('');
 setFormWorkspaceId('');
 setFormWorktree(false);
 setFormKeepWorktree(false);
+setFormCaptureGitDiff(false);
 setFormHttpMethod('GET');
 setFormHttpUrl('');
 setFormHttpHeaders('');
@@ -2217,6 +2419,7 @@ cwd: '',
 workspaceId: '',
 worktree: false,
 keepWorktree: false,
+captureGitDiff: false,
 httpMethod: 'GET',
 httpUrl: '',
 httpHttpHeaders: '',
@@ -2342,7 +2545,7 @@ setSchedulePreviewRuns(null);
 setFormTimezone(task.timezone || '');
 setFormMisfirePolicy(task.misfirePolicy || 'skip');
 setFormMaxRetries(task.maxRetries !== undefined ? task.maxRetries : 0);
-setFormPermissionPreset(task.permissionPreset || 'default');
+setFormPermissionPreset(task.permissionPreset === 'full' ? 'danger-full-access' : (task.permissionPreset || 'default'));
 setFormAgentPreset(task.agentPreset || '');
 setFormSessionTitle(task.sessionTitle || '');
 setFormTargetSessionId(task.targetSessionId || '');
@@ -2352,6 +2555,7 @@ setFormCwd(task.cwd || '');
 setFormWorkspaceId(task.workspaceId || '');
 setFormWorktree(Boolean(task.worktree));
 setFormKeepWorktree(Boolean(task.keepWorktree));
+setFormCaptureGitDiff(task.captureGitDiff !== undefined ? Boolean(task.captureGitDiff) : Boolean(task.worktree));
 setFormHttpMethod(task.httpMethod || 'GET');
 setFormHttpUrl(task.httpUrl || '');
 setFormHttpHeaders(typeof task.httpHeaders === 'string' ? task.httpHeaders : (task.httpHeaders ? JSON.stringify(task.httpHeaders) : ''));
@@ -2426,6 +2630,7 @@ cwd: formCwd.trim(),
 workspaceId: formWorkspaceId.trim(),
 worktree: isAgentType ? Boolean(formWorktree) : false,
 keepWorktree: isAgentType ? Boolean(formKeepWorktree) : false,
+captureGitDiff: Boolean(formCaptureGitDiff),
 httpMethod: formHttpMethod,
 httpUrl: formHttpUrl.trim(),
 httpHeaders: formHttpHeaders.trim() || undefined,
@@ -3423,7 +3628,7 @@ onChange: (e) => setFormPermissionPreset(e.target.value)
 _h('option', { value: 'default' }, T_KEY(t, 'form.permissionDefault')),
 _h('option', { value: 'read-only' }, T_KEY(t, 'form.permissionReadonly')),
 _h('option', { value: 'workspace-write' }, T_KEY(t, 'form.permissionWrite')),
-_h('option', { value: 'full' }, T_KEY(t, 'form.permissionFull'))
+_h('option', { value: 'danger-full-access' }, T_KEY(t, 'form.permissionFull'))
 )
 )
 )
@@ -3683,6 +3888,14 @@ checked: formKeepWorktree,
 onChange: (e) => setFormKeepWorktree(e.target.checked)
 }),
 _h('span', null, T_KEY(t, 'form.keepWorktreeLabel'))
+),
+_h('label', { className: 'dsh-cron-checkbox-row', style: { marginLeft: formWorktree ? '24px' : '0px', marginTop: '6px' } },
+_h('input', {
+type: 'checkbox',
+checked: formCaptureGitDiff,
+onChange: (e) => setFormCaptureGitDiff(e.target.checked)
+}),
+_h('span', null, T_KEY(t, 'form.captureGitDiffLabel'))
 )
 ),
 formType !== 'http' && _h('div', { className: 'dsh-cron-form-group' },
@@ -5002,7 +5215,9 @@ return false;
 function apply(ctx) {
 const stopStyleSelfHeal = startStyleSelfHeal();
 try {
-if (ctx.locale && typeof ctx.locale.register === 'function') {
+if (ctx.locale && typeof ctx.locale.register === 'function' && typeof ctx.effect === 'function') {
+ctx.effect(() => ctx.locale.register(NS, STRINGS), 'dsh-cron: locale dictionaries');
+} else if (ctx.locale && typeof ctx.locale.register === 'function') {
 ctx.locale.register(NS, STRINGS);
 }
 } catch (e) {

package/lib/cron-tool.js

@@ -149,9 +149,13 @@ export const cronToolParameters = {
   },
   permissionPreset: {
     type: 'string',
-    enum: ['default', 'read-only', 'workspace-write', 'full'],
+    enum: ['default', 'read-only', 'workspace-write', 'danger-full-access', 'full'],
     description: 'Permission preset applied to the task session (only used for agent session tasks: llm, skill, workflow)',
   },
+  captureGitDiff: {
+    type: 'boolean',
+    description: 'Whether to capture git diff on run completion. Defaults to true for worktree tasks and false for non-worktree tasks.',
+  },
   sessionTitle: {
     type: 'string',
     description: 'Custom session title template for isolated agent runs (supports {{date}} placeholder, e.g. "{{date}} [Daily] Report")',

package/lib/locales.json

@@ -27,13 +27,13 @@
     "transfer.exportFailed": "导出失败: {error}",
     "transfer.importTitleModal": "导入任务",
     "transfer.importHint": "仅导出任务静态配置：不包含历史记录与计数器。渠道通过凭据名称引用；注意完整导出保留自定义环境变量和 HTTP 请求头。",
-    "transfer.exportPrompt": "请选择导出模式：\\n确定 = 净化导出（移除自定义环境变量与请求头）\\n取消 = 完整原始导出",
+    "transfer.exportPrompt": "选择导出模式：\n确定 = 净化导出（移除自定义环境变量与请求头）\n取消 = 完整原始导出",
     "transfer.strategyAdd": "作为新任务导入（分配新 ID）",
     "transfer.strategyReplace": "覆盖同 ID 任务",
     "transfer.strategySkip": "跳过已存在的同 ID 任务",
     "transfer.summary": "该文件包含 {total} 个任务：{add} 个新增，{replace} 个覆盖，{skip} 个跳过。",
     "transfer.confirm": "开始导入",
-    "transfer.imported": "已成功导出 {count} 个任务。",
+    "transfer.imported": "已成功导入 {count} 个任务。",
     "transfer.importFailed": "导入失败: {error}",
     "transfer.badFile": "所选文件不是有效的 JSON 导出文件: {error}",
     "actions.pause": "暂停",
@@ -104,25 +104,8 @@
     "tabs.paused": "已暂停",
     "tabs.completed": "已完成",
     "list.empty": "暂无定时任务",
-    "list.emptyHint": "点击下方按钮让 DSH 规划任务，或手动配置。",
     "list.oneShot": "一次性",
-    "list.runCount": "{count} 次运行",
-    "list.consecutiveFailures": "连续 {count} 次失败",
-    "list.lastRun": "上次: {time}",
-    "list.nextRun": "下次: {time}",
-    "list.badgeActive": "活跃",
-    "list.badgePaused": "已暂停",
-    "list.badgeCompleted": "已完成",
     "list.configManaged": "配置只读",
-    "channel.telegram": "Telegram",
-    "channel.discord": "Discord",
-    "channel.slack": "Slack",
-    "channel.ntfy": "ntfy",
-    "channel.bark": "Bark",
-    "channel.pushplus": "PushPlus",
-    "channel.voice": "语音通话",
-    "channel.gitea": "Gitea",
-    "channel.webhook": "Webhook",
     "modal.editTitle": "编辑任务",
     "modal.newTitle": "新建定时任务",
     "modal.statusActive": "活跃",
@@ -135,73 +118,44 @@
     "modal.create": "创建任务",
     "history.loading": "正在加载历史记录...",
     "history.empty": "暂无运行记录",
-    "history.summaryTokens": "消耗 Token: {count}",
-    "history.summaryCost": "预估成本: ${cost}",
-    "history.errorLabel": "错误详情:",
-    "history.outputLabel": "执行输出:",
     "history.statusUncertain": "不确定",
     "history.artifacts": "产物文件",
     "history.resolveCompleted": "标记已完成",
     "history.resolveFailed": "标记失败",
     "history.statusUncertainHint": "服务重启中断 — 请确认结果",
-    "form.titleLabel": "任务名称 *",
-    "form.titlePlaceholder": "例如: 每周备份检查",
     "form.typeLabel": "执行类型 *",
-    "form.promptLabel": "提示词内容 *",
-    "form.promptPlaceholder": "输入发送给智能体的执行指令...",
     "form.modelLabel": "AI 模型",
     "form.modelDefault": "默认模型",
     "form.fallbackModelLabel": "备用模型 (主模型失败时使用)",
-    "form.fallbackModelNone": "不使用备用模型",
-    "form.pipelineGroupLabel": "任务流水线串联",
     "form.onSuccessLabel": "成功后触发 (任务 ID)",
-    "form.onSuccessPlaceholder": "例如: task_upload_backup",
     "form.onFailureLabel": "失败后触发 (任务 ID)",
-    "form.onFailurePlaceholder": "例如: task_notify_incident",
     "form.scheduleLabel": "调度计划 (Cron 或相对时间) *",
     "form.schedulePlaceholder": "例如: 0 9 * * 1-5 或 15m 或 in 2 hours",
-    "form.channelsLabel": "通知渠道",
     "form.channelsHint": "任务执行完毕后推送报告的目标渠道。",
     "form.templateLabel": "自定义消息模板",
-    "form.templatePlaceholder": "留空使用默认摘要",
-    "form.templateHint": "支持变量: {title}, {status}, {output}, {error}, {durationMs}, {time}",
+    "form.templatePlaceholder": "⏰ {title} — {status}，耗时 {duration}",
+    "form.templateHint": "可用变量: {title} {id} {status} {output} {error} {duration} {schedule} {time} {tokens} {cost} {model}。留空使用内置文案。",
     "form.silentRuleLabel": "静默规则 (可选)",
     "form.silentRulePlaceholder": "例如: ALL_OK 或 status == 200",
     "form.silentRuleHint": "若输出符合此规则，将不发送任何通知。",
-    "form.advancedToggle": "高级执行选项",
     "form.timezoneLabel": "时区 (IANA 时区名)",
     "form.timezonePlaceholder": "例如: Asia/Shanghai 或 UTC (留空使用服务器时区)",
     "form.misfireLabel": "错过执行策略 (Misfire Policy)",
     "form.misfireSkip": "跳过 (默认)",
     "form.misfireRunOnce": "补跑一次",
-    "form.maxRetriesLabel": "失败重试次数 (0 = 不重试)",
-    "form.permissionPresetLabel": "权限预设",
     "form.permissionDefault": "默认 (继承主配置)",
-    "form.permissionRestricted": "受限模式 (只读)",
     "form.permissionFull": "完全访问权限",
     "form.envLabel": "环境变量 (KEY=VALUE, 每行一个)",
-    "form.envPlaceholder": "FOO=bar\\nAPI_KEY=secret",
+    "form.envPlaceholder": "NODE_ENV=production\nTZ=Europe/Berlin",
     "form.cwdLabel": "工作目录 (绝对路径)",
-    "form.cwdPlaceholder": "/var/www/my-project",
-    "form.workspaceIdLabel": "关联 DSH Workspace ID",
-    "form.workspaceIdPlaceholder": "留空使用默认工作区",
     "form.worktreeLabel": "在独立的临时 Git Worktree 中执行",
     "form.keepWorktreeLabel": "执行结束后保留 Git Worktree (不自动清理)",
     "form.timeoutLabel": "超时时间 (秒)",
     "form.overlapLabel": "并发策略",
     "form.overlapSkip": "跳过 (默认)",
     "form.overlapQueue": "排队等待",
-    "form.overlapTerminate": "终止前次运行",
-    "form.overlapAllow": "允许并发",
     "form.kanbanLabel": "看板同步模式",
     "form.kanbanNone": "不同步到看板",
-    "form.kanbanCreate": "仅创建新卡片",
-    "form.kanbanSync": "保持卡片同步更新",
-    "settings.deliveryChannels": "推送渠道配置",
-    "settings.credentialsHint": "安全凭据在 DSH Credentials 服务中统一管理。",
-    "settings.saveChannels": "保存渠道配置",
-    "settings.testing": "正在测试...",
-    "settings.testSuccess": "✅ 测试成功！",
     "settings.automationHint": "用于静默规则研判和故障诊断的辅助模型。留空沿用任务自身模型。",
     "settings.silentRuleModelLabel": "静默规则研判模型",
     "settings.secretsOnCard": "设置中引用的凭据将在前端脱敏展示，并通过名称引用。",
@@ -331,6 +285,119 @@
     "form.joinPolicyAll": "所有前置均成功 (all_success)",
     "form.joinPolicyAny": "任一前置成功即可 (any_success)",
     "recipe.dependenciesMissing": "缺少必要集成服务或凭据",
-    "list.loadErrorPrefix": "加载任务列表失败"
+    "list.loadErrorPrefix": "加载任务列表失败",
+    "banner.loadError": "加载任务失败: {error}",
+    "banner.retry": "重试",
+    "list.loading": "正在加载定时任务...",
+    "list.typeShell": "Shell 脚本",
+    "list.typeLlm": "LLM 智能体",
+    "list.configManagedHint": "由配置文件中的 config.jobs 声明；要修改或删除请编辑该文件",
+    "list.next": " · 下次: {time}",
+    "recs.title": "推荐任务",
+    "recs.hint": "开箱即用的配方。点一下就会把表单填好——保存之前不会创建任何任务。",
+    "modal.close": "关闭",
+    "history.stoppedReasonTitle": "停止原因:",
+    "history.retryDelivery": "重试推送",
+    "history.retryingDelivery": "正在重试...",
+    "history.statusValidationFailed": "校验失败",
+    "history.stage_queue": "排队",
+    "history.stage_preflight": "预检",
+    "history.stage_execution": "执行",
+    "history.stage_validation": "校验",
+    "history.stage_delivery": "推送",
+    "history.refresh": "刷新历史",
+    "history.statusSuccess": "成功",
+    "history.statusSkipped": "已跳过",
+    "history.statusMissed": "已错过",
+    "history.statusTimeout": "超时",
+    "history.statusFailed": "失败",
+    "form.nameLabel": "任务名称",
+    "form.namePlaceholder": "例如: dsh-tags-watch",
+    "form.typeLlm": "LLM（AI 智能体）",
+    "form.typeScript": "Shell 命令 / 脚本",
+    "form.typeNode": "Node.js",
+    "form.typePython": "Python",
+    "form.typeHttp": "HTTP 请求 / Webhook",
+    "form.typeSsh": "远程 SSH",
+    "form.typeDocker": "Docker 容器",
+    "form.typeSkill": "DSH 技能",
+    "form.typeWorkflow": "DSH 工作流",
+    "form.envHint": "仅对非 LLM 运行时生效。不要在这里存放密钥。",
+    "form.workspaceLabel": "工作区 ID 或路径（可选）",
+    "form.httpMethodLabel": "HTTP 方法",
+    "form.httpUrlLabel": "URL",
+    "form.httpHeadersLabel": "请求头（JSON，可选）",
+    "form.httpBodyLabel": "请求体（可选）",
+    "form.sshProfileLabel": "dsh-remote-workspace 配置 ID",
+    "form.sshProfileHint": "推荐用法：主机与凭据都放在 remote-workspace 插件里。",
+    "form.sshTargetLabel": "备用目标（user@host，可选）",
+    "form.sshKeyLabel": "私钥路径（备用，可选）",
+    "form.dockerImageLabel": "容器镜像",
+    "form.skillNameLabel": "技能名称",
+    "form.workflowNameLabel": "工作流名称",
+    "form.overlapReplace": "取消当前运行并重新开始 (replace)",
+    "form.kanbanOnFailure": "失败时创建工单（进 Backlog）",
+    "form.kanbanAlways": "每次完成都建卡片（Done / Backlog）",
+    "form.providerLabel": "LLM 服务商",
+    "form.providerDefault": "默认（DSH）",
+    "history.silentSkip": "保持静默:",
+    "history.diagnosis": "诊断",
+    "history.applySuggestion": "用这条建议打开编辑表单",
+    "form.inspectOnFailureLabel": "用模型诊断失败原因",
+    "form.inspectOnFailureHint": "运行失败后，由模型读一遍提示词、错误和输出，把诊断结论和修改建议随这次运行一起保存。不会自动应用任何改动。",
+    "settings.inspectorModelLabel": "失败诊断模型",
+    "form.fallbackModelPlaceholder": "例如: deepseek-reasoner",
+    "form.fallbackModelHint": "主模型运行失败时，用这个模型再试一次。两次尝试都计入成本。",
+    "form.promptLabelScript": "Shell 命令或脚本",
+    "form.promptLabelLlm": "给智能体的指令 / 提示词",
+    "form.promptPlaceholderScript": "curl -fsSL https://... || exit 1",
+    "form.promptPlaceholderLlm": "精确描述智能体要做什么...",
+    "form.misfireCatchUp": "迟到时补跑一次并记录缺口 (catchUpAll)",
+    "form.retriesLabel": "失败自动重试次数（0 = 关闭）",
+    "form.permissionLabel": "会话权限",
+    "form.permissionReadonly": "只读",
+    "form.permissionWrite": "工作区写入",
+    "list.runningNow": "正在运行",
+    "history.openSession": "打开会话",
+    "form.notifyTitle": "Telegram 通知",
+    "form.notifyTelegram": "把运行报告发送到 Telegram",
+    "form.notifyOnlyFailure": "仅失败时发送（onlyOnFailure / 成功静默）",
+    "form.channelsTitle": "推送渠道",
+    "form.channelTelegram": "Telegram",
+    "form.channelKanban": "dsh-kanban 卡片",
+    "form.channelDiscord": "Discord",
+    "form.channelSlack": "Slack",
+    "form.channelNtfy": "ntfy",
+    "form.channelBark": "Bark",
+    "form.channelPushplus": "PushPlus",
+    "form.channelTts": "语音（dsh-tts）",
+    "form.channelGitea": "Gitea Issue",
+    "settings.deliverySection": "推送渠道",
+    "settings.secretsSection": "凭据（引用）",
+    "settings.secretsHint": "这里填 DSH 凭据的「名称」，不是密钥本身。密钥保存在凭据服务里。",
+    "settings.telegramSection": "Telegram",
+    "settings.templatesSection": "消息模板",
+    "settings.channelTemplateLabel": "{channel} 的消息模板",
+    "settings.botTokenRefLabel": "Bot Token 凭据名称",
+    "settings.botTokenRefPlaceholder": "例如: TELEGRAM_BOT_TOKEN",
+    "settings.apiTokenLabel": "外部 API Token",
+    "settings.apiTokenPlaceholder": "用于 /dsh-cron/api/* 的 Bearer token（留空 = 关闭）",
+    "settings.discordLabel": "Discord Webhook URL",
+    "settings.slackLabel": "Slack Webhook URL",
+    "settings.ntfyUrlLabel": "ntfy 服务器地址",
+    "settings.ntfyTopicLabel": "ntfy 主题",
+    "settings.ntfyTokenRefLabel": "ntfy Token 凭据名称",
+    "settings.barkServerLabel": "Bark 服务器地址",
+    "settings.barkKeyLabel": "Bark 设备 Key",
+    "settings.pushplusTokenRefLabel": "PushPlus Token 凭据名称",
+    "settings.pushplusUrlLabel": "PushPlus 接口地址",
+    "settings.ttsBaseUrlLabel": "dsh-tts 服务地址",
+    "settings.giteaBaseUrlLabel": "Gitea 服务地址",
+    "settings.giteaRepoLabel": "Gitea 仓库（owner/repo）",
+    "settings.giteaTokenRefLabel": "Gitea Token 凭据名称",
+    "settings.templateLabel": "默认消息模板",
+    "settings.templateHint": "作用于所有没有单独模板的渠道。留空用内置文案。",
+    "settings.deliveryTimeoutMsLabel": "每个渠道的推送超时（毫秒）",
+    "settings.automationSection": "自动化模型"
   }
-}
+}

package/lib/runner.js

@@ -644,16 +644,37 @@ export class SessionRunner {
     }
   }
 
-  /** Per-job permission preset (#32): read-only | workspace-write | full. */
+  /** Per-job permission preset (#32, #380, GH #18): read-only | workspace-write | danger-full-access (or full alias). */
   _applyPermissionPreset(task, handle) {
-    if (!task.permissionPreset || task.permissionPreset === 'default') return;
+    if (!task.permissionPreset || task.permissionPreset === 'default') {
+      this._pinApprovalPolicy(handle);
+      return;
+    }
+    const targetPreset = task.permissionPreset === 'full' ? 'danger-full-access' : task.permissionPreset;
     try {
-      const presets = this.ctx.get && this.ctx.get('permissionPresets');
+      const presets = this.ctx.get ? this.ctx.get('permissionPresets') : this.ctx.permissionPresets;
       if (presets && typeof presets.set === 'function') {
-        presets.set(handle.agent.session, task.permissionPreset);
+        presets.set(handle.agent.session, targetPreset);
       }
     } catch (ppErr) {
-      logger.warn('[dsh-cron] permission preset not applied:', ppErr.message);
+      logger.warn(`[dsh-cron] permission preset "${task.permissionPreset}" (target: "${targetPreset}") not applied to task ${task.id || ''}:`, ppErr.message);
+    }
+    this._pinApprovalPolicy(handle);
+  }
+
+  _pinApprovalPolicy(handle) {
+    try {
+      const approval = this.ctx.get ? this.ctx.get('approval') : this.ctx.approval;
+      if (approval && typeof approval.setPolicy === 'function') {
+        if (handle?.agent) {
+          bestEffort('approval-set-policy-agent', () => approval.setPolicy(handle.agent, 'never'), logger);
+        }
+        if (handle?.agent?.session) {
+          bestEffort('approval-set-policy-session', () => approval.setPolicy(handle.agent.session, 'never'), logger);
+        }
+      }
+    } catch (appErr) {
+      logger.warn('[dsh-cron] approval setPolicy not applied:', appErr.message);
     }
   }
 

package/lib/scheduler-completion.js

@@ -142,16 +142,20 @@ export async function handleCompleteRun(scheduler, task, taskId, currentRun, out
     runInfo.swarmStats = outcome.swarmStats;
   }
 
-  // Capture git diff if task runs in a worktree or custom git cwd (#351)
-  const diffDir = task.worktree ? (runInfo.worktreePath || task.cwd) : task.cwd;
+  // Capture git diff if task runs in a worktree or explicitly opted in (#351, #379, GH #17)
+  const explicitCapture = (typeof task.captureGitDiff === 'boolean')
+    ? task.captureGitDiff
+    : ((typeof task.captureDiff === 'boolean') ? task.captureDiff : null);
+  const shouldCaptureDiff = explicitCapture !== null ? explicitCapture : Boolean(task.worktree);
+  const diffDir = shouldCaptureDiff ? (task.worktree ? (runInfo.worktreePath || task.cwd) : task.cwd) : null;
   if (diffDir) {
     try {
       const diffResult = await captureGitDiff(diffDir);
       if (diffResult && diffResult.hasChanges) {
         runInfo.gitDiff = diffResult;
       }
-    } catch {
-      // Non-fatal if diff capture fails
+    } catch (diffErr) {
+      bestEffort('log-diff-error', () => scheduler?.logger?.debug?.(`[dsh-cron] git diff capture failed: ${diffErr?.message}`));
     }
   }
 

package/lib/store.js

@@ -60,6 +60,7 @@ export class TaskStore {
       fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
     }
     bestEffort('chmod-dir', () => fs.chmodSync(dir, 0o700));
+    this._cleanOrphanedTmpFiles(dir);
     const bakPath = `${this.filePath}.bak`;
 
     const loadData = (raw) => {
@@ -823,6 +824,17 @@ export class TaskStore {
       },
       ...prevRuns,
     ];
+    // Truncate raw diff in older active history entries to bound memory and JSON size (#379, GH #17)
+    for (let i = 10; i < runs.length; i++) {
+      const r = runs[i];
+      if (r && r.gitDiff && r.gitDiff.diff && r.gitDiff.diff.length > 2000) {
+        r.gitDiff = {
+          ...r.gitDiff,
+          diff: r.gitDiff.diff.slice(0, 2000) + '\n... [diff truncated in history]',
+          truncated: true,
+        };
+      }
+    }
     // Keep up to 100 runs in active store; archive older runs to tasks-history-archive.json (#134)
     if (runs.length > 100) {
       const overflow = runs.splice(100);
@@ -833,7 +845,32 @@ export class TaskStore {
   }
 
   /**
-   * Append rotated overflow history entries into tasks-history-archive.json (#134).
+   * Remove orphaned temporary write files older than 10 minutes (#379, GH #17).
+   */
+  _cleanOrphanedTmpFiles(dir) {
+    try {
+      if (!fs.existsSync(dir)) return;
+      const entries = fs.readdirSync(dir);
+      const now = Date.now();
+      const tenMinutesMs = 10 * 60 * 1000;
+      for (const entry of entries) {
+        if (entry.includes('.tmp.')) {
+          const fullPath = path.join(dir, entry);
+          bestEffort('clean-tmp-file', () => {
+            const stat = fs.statSync(fullPath);
+            if (stat.isFile() && (now - stat.mtimeMs > tenMinutesMs)) {
+              fs.unlinkSync(fullPath);
+            }
+          });
+        }
+      }
+    } catch (dirErr) {
+      bestEffort('log-clean-tmp-dir-error', () => logger.debug?.(`[dsh-cron] clean orphaned tmp dir error: ${dirErr?.message}`));
+    }
+  }
+
+  /**
+   * Append rotated overflow history entries into tasks-history-archive.json (#134, #379, GH #17).
    */
   _archiveHistoryRuns(id, overflowRuns) {
     if (!Array.isArray(overflowRuns) || overflowRuns.length === 0) return;
@@ -845,14 +882,43 @@ export class TaskStore {
         archive = bestEffort('parse-history-archive', () => JSON.parse(fs.readFileSync(archivePath, 'utf-8'))) || {};
       }
       if (!Array.isArray(archive[id])) archive[id] = [];
-      archive[id].push(...overflowRuns);
+
+      // Strip full raw diff payload from archived overflow runs to prevent runaway JSON growth (#379, GH #17)
+      const sanitizedOverflow = overflowRuns.map((r) => {
+        if (!r || !r.gitDiff) return r;
+        const { diff, ...gitDiffMeta } = r.gitDiff;
+        return {
+          ...r,
+          gitDiff: {
+            ...gitDiffMeta,
+            diffExcerpt: diff ? diff.slice(0, 500) : '',
+            hasChanges: Boolean(gitDiffMeta.hasChanges),
+            archived: true,
+          },
+        };
+      });
+
+      archive[id].push(...sanitizedOverflow);
       if (archive[id].length > 1000) {
         archive[id] = archive[id].slice(-1000);
       }
+
+      // Enforce total archive size budget (max 15MB) across tasks (#379, GH #17)
+      const MAX_ARCHIVE_BYTES = 15 * 1024 * 1024;
+      let serialized = JSON.stringify(archive);
+      if (serialized.length > MAX_ARCHIVE_BYTES) {
+        for (const taskId of Object.keys(archive)) {
+          if (Array.isArray(archive[taskId]) && archive[taskId].length > 100) {
+            archive[taskId] = archive[taskId].slice(-100);
+          }
+        }
+        serialized = JSON.stringify(archive);
+      }
+
       // Write atomically with tmp file using compact JSON (avoiding mega-lines and null, 2 serialization bloat)
       const rand = Math.random().toString(36).slice(2, 8);
       const tmp = `${archivePath}.tmp.${process.pid}_${Date.now()}_${rand}`;
-      fs.writeFileSync(tmp, JSON.stringify(archive), { encoding: 'utf-8', mode: 0o600 });
+      fs.writeFileSync(tmp, serialized, { encoding: 'utf-8', mode: 0o600 });
       bestEffort('chmod-tmp', () => fs.chmodSync(tmp, 0o600));
       fs.renameSync(tmp, archivePath);
       bestEffort('chmod-archive', () => fs.chmodSync(archivePath, 0o600));

package/lib/task-create.js

@@ -85,7 +85,8 @@ export function executeCreateTask(store, scheduler, args) {
     misfirePolicy: ['skip', 'runOnce', 'catchUpAll'].includes(args.misfirePolicy) ? args.misfirePolicy : 'skip',
     maxRetries: Number(args.maxRetries) > 0 ? Number(args.maxRetries) : 0,
     retryBackoffMs: Number(args.retryBackoffMs) > 0 ? Number(args.retryBackoffMs) : 30000,
-    permissionPreset: !EXTERNAL_RUNTIMES.includes(taskType) && ['default', 'read-only', 'workspace-write', 'full'].includes(args.permissionPreset) ? args.permissionPreset : 'default',
+    permissionPreset: !EXTERNAL_RUNTIMES.includes(taskType) && ['default', 'read-only', 'workspace-write', 'danger-full-access', 'full'].includes(args.permissionPreset) ? args.permissionPreset : 'default',
+    captureGitDiff: typeof args.captureGitDiff === 'boolean' ? args.captureGitDiff : (typeof args.captureDiff === 'boolean' ? args.captureDiff : undefined),
     kanbanMode: args.kanbanMode || 'none',
     channels: Array.isArray(args.channels) ? args.channels.filter((c) => CHANNEL_IDS.includes(c)) : undefined,
     template: args.template ? String(args.template) : '',

package/lib/task-patch.js

@@ -156,6 +156,16 @@ export function buildTaskPatch(current, body) {
   if (patch.tokenLimit !== undefined) {
     patch.tokenLimit = patch.tokenLimit === null ? null : (Number(patch.tokenLimit) > 0 ? Number(patch.tokenLimit) : null);
   }
+  if (patch.permissionPreset !== undefined) {
+    patch.permissionPreset = ['default', 'read-only', 'workspace-write', 'danger-full-access', 'full'].includes(patch.permissionPreset)
+      ? patch.permissionPreset
+      : 'default';
+  }
+  if (patch.captureGitDiff !== undefined) {
+    patch.captureGitDiff = Boolean(patch.captureGitDiff);
+  } else if (patch.captureDiff !== undefined) {
+    patch.captureGitDiff = Boolean(patch.captureDiff);
+  }
   const effectiveType = patch.type !== undefined ? normalizeTaskType(patch.type) : current.type;
   if (EXTERNAL_RUNTIMES.includes(effectiveType) && patch.permissionPreset !== undefined) {
     patch.permissionPreset = 'default';

package/lib/task-transfer.js

@@ -44,6 +44,7 @@ export const PATCHABLE_TASK_FIELDS = [
   'workspaceId',
   'worktree',
   'keepWorktree',
+  'captureGitDiff',
   'httpMethod',
   'httpUrl',
   'httpHeaders',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cron",
-  "version": "0.3.20",
+  "version": "0.3.22",
   "description": "Background automation runner for DSH: isolated agent runs, script/HTTP/SSH/Docker runtimes, cost guard, notifications, heartbeats.",
   "type": "module",
   "main": "lib/index.js",