@goodandready/dsh-cron 0.3.24 → 0.3.26

package/lib/external-api.js

@@ -1,74 +1 @@
-/**
- * External REST surface under /dsh-cron/api/* (#54, ADR-0001).
- *
- * Everything a browser panel needs stays on the local, cross-origin-protected
- * routes; this prefix exists for CI and host-side automation, so it is the only
- * surface guarded by a bearer token. The token lives in the plugin settings as
- * a masked value: an unconfigured token disables the surface (503) instead of
- * leaving it open, and a wrong token is answered with 401.
- *
- * The operations themselves are shared with the panel routes (lib/api.js), so
- * the confirmation gate for code-executing tasks and the config-owned refusals
- * apply here exactly as they do over HTTP from the UI.
- */
-
-import { timingSafeEqual } from 'node:crypto';
-import { sendJson } from './http-utils.js';
-import { handleExternalTaskRequest } from './api.js';
-
-/** Settings key that holds the bearer token. */
-export const API_TOKEN_SETTING_KEY = 'apiToken';
-
-/** Route prefix owned by this surface. */
-export const EXTERNAL_API_PREFIX = '/dsh-cron/api';
-
-/**
- * Constant-time token comparison. Length is compared first because
- * timingSafeEqual throws on buffers of different sizes; a length mismatch is
- * not a secret worth hiding for a fixed-length token.
- */
-export function tokenMatches(expected, provided) {
-  if (!expected || !provided) return false;
-  const a = Buffer.from(String(expected), 'utf8');
-  const b = Buffer.from(String(provided), 'utf8');
-  if (a.length !== b.length) return false;
-  return timingSafeEqual(a, b);
-}
-
-/** Bearer token of a request, or an empty string when there is none. */
-export function readBearerToken(req) {
-  const header = String((req.headers && req.headers.authorization) || '');
-  const match = header.match(/^Bearer\s+(.+)$/i);
-  return match ? match[1].trim() : '';
-}
-
-/**
- * Guard the external prefix, then hand the request to the shared task
- * operations. `getToken` is read per request so a settings change applies
- * without a restart.
- */
-export function createExternalApiHandler({ store, scheduler, getToken }) {
-  return async function handleExternalApi(req, res) {
-    const expected = typeof getToken === 'function' ? getToken() : '';
-    if (!expected) {
-      sendJson(res, 503, {
-        ok: false,
-        error: 'External API is disabled: set the "' + API_TOKEN_SETTING_KEY + '" setting to enable it',
-      });
-      return;
-    }
-    if (!tokenMatches(expected, readBearerToken(req))) {
-      sendJson(res, 401, { ok: false, error: 'Unauthorized' });
-      return;
-    }
-    const url = new URL(req.url, 'http://127.0.0.1');
-    // `url` must be inside the try: a malformed body (an unparseable schedule,
-    // for example) surfaces as a thrown error from the shared handlers, and an
-    // unhandled rejection here would answer nothing at all.
-    try {
-      await handleExternalTaskRequest({ store, scheduler, req, res, url, apiToken: expected });
-    } catch (err) {
-      sendJson(res, (err && err.statusCode) || 500, { ok: false, error: (err && err.message) || String(err) });
-    }
-  };
-}
+export * from './routes/external-api.js';

package/lib/index.js

@@ -1,3 +1,6 @@
+import { applyTuiSettings, buildTuiSection } from './tui-settings.js';
+import { registerCommands, executeCronCommand } from './commands.js';
+export { applyTuiSettings, buildTuiSection, registerCommands, executeCronCommand };
 import {
   TaskSchema,
   validateTaskRecord,
@@ -376,6 +379,20 @@ export function apply(ctx, rawConfig) {
   }), 'dsh-cron: /settings');
 
   // 2. Tools: unified background automation runner (Issue #196: 9 tools -> 1)
+    // TUI settings section (#387)
+  applyTuiSettings(ctx, {
+    store,
+    scheduler,
+    live: () => ({
+      ...unwrapConfig(getContextConfig(ctx, rawConfig)),
+      ...activeVolatileConfig,
+      ...store.getSettings(),
+    }),
+  });
+
+  // Slash commands (#388)
+  registerCommands(ctx, { store, scheduler });
+
   ctx.tools.register(defineTool({
     name: 'cron',
     description: 'Background automation runner for DSH: isolated agent runs, script/node/python/http/ssh/docker runtimes, cost guard, notifications, heartbeats. For simple reminders in the current chat, use the built-in schedule_create tool instead. Actions: create, list, get, update, pause, resume, run, delete.',

package/lib/log-streamer.js

@@ -50,12 +50,15 @@ export class LogStreamer extends EventEmitter {
       ts: Date.now(),
     };
 
+    entry.eventSeq = (entry.eventSeq || 0) + 1;
+    item.id = entry.eventSeq;
+
     entry.buffer.push(item);
     if (entry.buffer.length > MAX_BUFFER_LINES) {
       entry.buffer.shift();
     }
 
-    const ssePayload = `event: log\ndata: ${JSON.stringify(item)}\n\n`;
+    const ssePayload = `id: ${item.id}\nevent: log\ndata: ${JSON.stringify(item)}\n\n`;
     for (const res of entry.subscribers) {
       try {
         res.write(ssePayload);
@@ -111,12 +114,17 @@ export class LogStreamer extends EventEmitter {
 
     const entry = this.streams.get(taskId);
 
+    // Support W3C Last-Event-ID for reconnection (#392)
+    const lastEventIdStr = req?.headers ? req.headers['last-event-id'] : undefined;
+    const lastEventId = lastEventIdStr ? parseInt(lastEventIdStr, 10) : 0;
+    const effectiveLogs = (entry?.buffer || []).filter((item) => !lastEventId || (item.id && item.id > lastEventId));
+
     // Initial event with current state and buffered logs
     const initData = {
       taskId,
       runId: entry?.runId || null,
       status: entry ? (entry.completed ? 'completed' : 'running') : 'idle',
-      bufferedLogs: entry?.buffer || [],
+      bufferedLogs: effectiveLogs,
     };
     res.write(`event: init\ndata: ${JSON.stringify(initData)}\n\n`);
 

package/lib/metrics.js

@@ -1,125 +1 @@
-import { rejectCrossOrigin } from './http-utils.js';
-/**
- * Prometheus exposition of the scheduler (#53).
- *
- * The renderer is hand-rolled on purpose: the profile has no prom-client and
- * adding a production dependency for a handful of counters is not justified.
- * Only counts, statuses and durations are exported — never prompts, run output
- * or task configuration, so the endpoint can be scraped without leaking work
- * content.
- */
-
-export const METRICS_CONTENT_TYPE = 'text/plain; version=0.0.4; charset=utf-8';
-
-/** Run statuses the scheduler can finish with. */
-export const RUN_STATUSES = ['success', 'error', 'timeout', 'skipped', 'missed'];
-
-const NL = String.fromCharCode(10);
-const BACKSLASH = String.fromCharCode(92);
-const QUOTE = String.fromCharCode(34);
-
-/** Escape a label value for the Prometheus text format. */
-export function escapeLabel(value) {
-  return String(value)
-    .split(BACKSLASH).join(BACKSLASH + BACKSLASH)
-    .split(QUOTE).join(BACKSLASH + QUOTE)
-    .split(NL).join(BACKSLASH + 'n');
-}
-
-function sample(name, labels, value) {
-  const rendered = Object.keys(labels)
-    .map((key) => key + '=' + QUOTE + escapeLabel(labels[key]) + QUOTE)
-    .join(',');
-  return name + (rendered ? '{' + rendered + '}' : '') + ' ' + value;
-}
-
-/**
- * Render the current scheduler state as Prometheus text exposition.
- * Pure function over plain data so it is testable without a store.
- */
-export function renderMetrics({ tasks = [], stats = {}, runCounters = {}, scheduler } = {}) {
-  const lines = [];
-  const byStatus = {};
-  for (const task of tasks) {
-    const status = task.status || 'unknown';
-    byStatus[status] = (byStatus[status] || 0) + 1;
-  }
-
-  lines.push('# HELP dsh_cron_tasks_total Scheduled tasks by status.');
-  // A gauge despite the name: this is a snapshot of how many tasks are in each
-  // state, not a monotonically growing total.
-  lines.push('# TYPE dsh_cron_tasks_total gauge');
-  for (const status of Object.keys(byStatus).sort()) {
-    lines.push(sample('dsh_cron_tasks_total', { status }, byStatus[status]));
-  }
-
-  lines.push('# HELP dsh_cron_task_last_duration_seconds Duration of the last finished run of a task.');
-  lines.push('# TYPE dsh_cron_task_last_duration_seconds gauge');
-  for (const task of tasks) {
-    // lastRunAt marks a finished run: a task that never ran still carries
-    // lastDurationMs = 0, and exporting that would show instant runs in
-    // monitoring.
-    if (!Number.isFinite(task.lastDurationMs) || !task.lastRunAt) continue;
-    lines.push(sample('dsh_cron_task_last_duration_seconds', { task: task.id }, task.lastDurationMs / 1000));
-  }
-
-  lines.push('# HELP dsh_cron_runs_total Finished runs since the plugin started, by status.');
-  lines.push('# TYPE dsh_cron_runs_total counter');
-  for (const status of RUN_STATUSES) {
-    lines.push(sample('dsh_cron_runs_total', { status }, Number(runCounters[status]) || 0));
-  }
-
-  lines.push('# HELP dsh_cron_run_records Run records currently kept in memory.');
-  lines.push('# TYPE dsh_cron_run_records gauge');
-  lines.push('dsh_cron_run_records ' + (Number(stats.totalRuns) || 0));
-
-  if (scheduler && typeof scheduler.runningCount === 'function') {
-    lines.push('# HELP dsh_cron_concurrent_running Number of currently executing tasks.');
-    lines.push('# TYPE dsh_cron_concurrent_running gauge');
-    lines.push('dsh_cron_concurrent_running ' + (Number(scheduler.runningCount()) || 0));
-  }
-
-  lines.push('# HELP dsh_cron_task_tokens_total Cumulative tokens consumed by task.');
-  lines.push('# TYPE dsh_cron_task_tokens_total counter');
-  for (const task of tasks) {
-    if (Number(task.totalTokens) > 0) {
-      lines.push(sample('dsh_cron_task_tokens_total', { task: task.id }, task.totalTokens));
-    }
-  }
-
-  lines.push('# HELP dsh_cron_task_cost_usd_total Estimated cumulative LLM cost in USD.');
-  lines.push('# TYPE dsh_cron_task_cost_usd_total counter');
-  for (const task of tasks) {
-    if (Number(task.totalCostUsd) > 0) {
-      lines.push(sample('dsh_cron_task_cost_usd_total', { task: task.id }, task.totalCostUsd));
-    }
-  }
-
-  return lines.join(NL) + NL;
-}
-
-/**
- * GET /dsh-cron/metrics — read-only. A scraper is a plain local client, so no
- * cross-origin check applies, and nothing sensitive is exposed.
- */
-export function createMetricsHandler({ store, scheduler }) {
-  return function handleMetrics(req, res) {
-    if (req.method !== 'GET' && req.method !== 'HEAD') {
-      res.writeHead(405, { 'Content-Type': 'text/plain; charset=utf-8' });
-      res.end('Method not allowed' + NL);
-      return;
-    }
-    const settings = store && typeof store.getSettings === 'function' ? store.getSettings() : {};
-    const apiToken = settings.apiToken;
-    if (rejectCrossOrigin(req, res, { apiToken })) return;
-
-    const body = renderMetrics({
-      tasks: store.list({ status: 'all' }),
-      stats: store.getAggregatedStats(),
-      runCounters: typeof scheduler.getRunCounters === 'function' ? scheduler.getRunCounters() : {},
-      scheduler,
-    });
-    res.writeHead(200, { 'Content-Type': METRICS_CONTENT_TYPE, 'Cache-Control': 'no-store' });
-    res.end(req.method === 'HEAD' ? undefined : body);
-  };
-}
+export * from './routes/metrics.js';

package/lib/routes/api-actions.js

@@ -0,0 +1,317 @@
+import { randomUUID } from 'node:crypto';
+import { captureGitDiff, discardGitChanges, applyGitDiff } from '../git-diff.js';
+import { applyDoctorFix, revertDoctorFix, diagnoseFailure } from '../doctor.js';
+import { rollbackPromptVersion } from '../prompt-evolver.js';
+import { approvalManager } from '../approval.js';
+import { MANAGED_BY_CONFIG } from '../config-jobs.js';
+import { sendJson, readBody, redactTaskSecrets } from '../http-utils.js';
+import { buildDuplicateTask } from '../task-transfer.js';
+import { refuseConfigOwned, NOT_FOUND } from './api-collection.js';
+
+export async function handleItemPost({ store, scheduler, req, res, url, id, action, subAction }) {
+  if (action === 'git-diff' && (subAction === 'discard' || subAction === 'revert')) {
+    const task = store.get(id);
+    if (!task) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    const targetDir = task.cwd;
+    if (!targetDir) {
+      sendJson(res, 400, { ok: false, error: 'Task does not define a working directory (cwd)' });
+      return true;
+    }
+    const result = await discardGitChanges(targetDir);
+    sendJson(res, result.ok ? 200 : 500, result);
+    return true;
+  }
+
+  if (action === 'git-diff' && subAction === 'apply') {
+    const task = store.get(id);
+    if (!task) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    const body = await readBody(req, res);
+    const bodyData = (body && body.body) || {};
+    let patch = bodyData.diff || bodyData.patch;
+    if (!patch) {
+      const runs = store.getHistory(id, 5);
+      const targetRun = runs.find((r) => r.gitDiff?.diff);
+      patch = targetRun?.gitDiff?.diff;
+    }
+    if (!patch) {
+      sendJson(res, 400, { ok: false, error: 'No diff patch provided or found in run history' });
+      return true;
+    }
+    const targetDir = task.cwd;
+    if (!targetDir) {
+      sendJson(res, 400, { ok: false, error: 'Task does not define a working directory (cwd)' });
+      return true;
+    }
+    const result = await applyGitDiff(targetDir, patch);
+    sendJson(res, result.ok ? 200 : 500, result);
+    return true;
+  }
+
+  if ((action === 'doctor' && subAction === 'apply') || action === 'doctor-apply') {
+    const task = store.get(id);
+    if (!task) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    const body = await readBody(req, res);
+    const bodyData = (body && body.body) || {};
+    let fix = bodyData.fix || bodyData.doctorReport;
+    if (!fix) {
+      const runs = store.getHistory(id, 5);
+      const reportRun = runs.find((r) => r.doctorReport);
+      fix = reportRun?.doctorReport;
+    }
+    if (!fix || !fix.suggestedFix) {
+      sendJson(res, 400, { ok: false, error: 'No doctor fix found to apply' });
+      return true;
+    }
+    try {
+      const result = await applyDoctorFix(task, fix, { store, user: bodyData.user || 'operator' });
+      if (!result.ok) {
+        sendJson(res, 400, { ok: false, error: result.error });
+        return true;
+      }
+      sendJson(res, 200, {
+        ok: true,
+        taskId: id,
+        task: redactTaskSecrets(task),
+        revision: result.revision,
+      });
+    } catch (err) {
+      sendJson(res, 500, { ok: false, error: err.message });
+    }
+    return true;
+  }
+
+  if ((action === 'doctor' && subAction === 'revert') || action === 'doctor-revert') {
+    const task = store.get(id);
+    if (!task) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    const body = await readBody(req, res);
+    const bodyData = (body && body.body) || {};
+    try {
+      const result = await revertDoctorFix(task, { store, user: bodyData.user || 'operator' });
+      if (!result.ok) {
+        sendJson(res, 400, { ok: false, error: result.error });
+        return true;
+      }
+      sendJson(res, 200, {
+        ok: true,
+        taskId: id,
+        task: redactTaskSecrets(task),
+        revertedCode: result.revertedCode,
+      });
+    } catch (err) {
+      sendJson(res, 500, { ok: false, error: err.message });
+    }
+    return true;
+  }
+
+  if ((action === 'doctor' && subAction === 'diagnose') || action === 'doctor-diagnose') {
+    const task = store.get(id);
+    if (!task) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    const body = await readBody(req, res);
+    const bodyData = (body && body.body) || {};
+    const runId = bodyData.runId;
+    const runs = store.getHistory(id, 10);
+    const targetRun = runId ? runs.find((r) => r.id === runId) : runs[0];
+    if (!targetRun) {
+      sendJson(res, 404, { ok: false, error: 'No run history found to diagnose' });
+      return true;
+    }
+    try {
+      const doctorReport = await diagnoseFailure({
+        task,
+        runInfo: targetRun,
+        ask: scheduler?.askModel,
+      });
+      targetRun.doctorReport = doctorReport;
+      sendJson(res, 200, { ok: true, taskId: id, doctorReport });
+    } catch (err) {
+      sendJson(res, 500, { ok: false, error: err.message });
+    }
+    return true;
+  }
+  if (action === 'prompt-rollback') {
+    const task = store.get(id);
+    if (!task) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    const body = await readBodyJson(req).catch(() => ({}));
+    const targetVersion = Number(body.version || url.searchParams.get('version'));
+    if (!targetVersion || targetVersion < 1) {
+      sendJson(res, 400, { ok: false, error: 'A valid target prompt version is required' });
+      return true;
+    }
+    try {
+      rollbackPromptVersion(task, targetVersion);
+      store.set(task);
+      sendJson(res, 200, {
+        ok: true,
+        task: redactTaskSecrets(task),
+        promptVersion: task.promptVersion,
+        promptHistory: task.promptHistory,
+      });
+    } catch (err) {
+      sendJson(res, 400, { ok: false, error: err.message });
+    }
+    return true;
+  }
+  if (action === 'retry-delivery') {
+    const task = store.get(id);
+    if (!task) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    const body = await readBodyJson(req).catch(() => ({}));
+    const runId = body.runId || url.searchParams.get('runId');
+    const runs = store.history.get(id) || [];
+    const run = runId ? runs.find(r => r.id === runId) : runs[0];
+    if (!run) {
+      sendJson(res, 404, { ok: false, error: 'Run not found' });
+      return true;
+    }
+    const delivery = await scheduler.deliverNotifications(task, run);
+    run.delivery = delivery;
+    if (Array.isArray(run.stages)) {
+      const deliveryStage = run.stages.find(s => s.name === 'delivery');
+      if (deliveryStage) {
+        deliveryStage.status = delivery?.status || 'delivered';
+        deliveryStage.delivered = delivery?.delivered;
+        deliveryStage.failures = delivery?.failures;
+      }
+    }
+    store.scheduleSave();
+    sendJson(res, 200, { ok: true, delivery, run });
+    return true;
+  }
+  if (action === 'approve' || action === 'reject') {
+    const task = store.get(id);
+    if (!task) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    const body = await readBodyJson(req).catch(() => ({}));
+    const proposalId = body.proposalId || url.searchParams.get('proposalId');
+    const proposal = proposalId
+      ? approvalManager.getProposal(proposalId)
+      : approvalManager.getPendingProposalForTask(id);
+
+    if (!proposal) {
+      sendJson(res, 404, { ok: false, error: 'No pending approval proposal found for this task' });
+      return true;
+    }
+
+    const decision = action === 'approve' ? 'approve' : 'reject';
+    const result = approvalManager.decide(proposal.id, decision, {
+      decidedBy: body.decidedBy || 'web-user',
+      reason: body.reason || '',
+    });
+
+    if (!result.ok) {
+      sendJson(res, 400, result);
+      return true;
+    }
+
+    if (decision === 'approve') {
+      scheduler.runTask(id, { approvedBy: body.decidedBy || 'web-user' }).catch(() => {});
+    }
+
+    sendJson(res, 200, { ok: true, proposal: result.proposal });
+    return true;
+  }
+  if (action === 'resolve-uncertain') {
+    const task = store.get(id);
+    if (!task) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    const body = await readBody(req).then(b => JSON.parse(b || '{}')).catch(() => ({}));
+    const runId = body.runId || url.searchParams.get('runId');
+    if (!runId) {
+      sendJson(res, 400, { ok: false, error: 'runId is required' });
+      return true;
+    }
+    const result = store.durableJournal.resolveUncertain(id, runId, {
+      decision: body.decision || 'mark_failed',
+      note: body.note || '',
+      resolvedBy: body.resolvedBy || 'user',
+    });
+    if (!result.ok) {
+      sendJson(res, 400, result);
+      return true;
+    }
+    sendJson(res, 200, result);
+    return true;
+  }
+  if (action === 'run') {
+    if (!store.get(id)) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    await scheduler.triggerManualRun(id);
+    sendJson(res, 200, { ok: true, task: redactTaskSecrets(store.get(id)) });
+    return true;
+  }
+  if (action === 'duplicate') {
+    const source = store.get(id);
+    if (!source) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    const copy = buildDuplicateTask(source, { id: randomUUID() });
+    try {
+      store.set(copy);
+    } catch (err) {
+      sendJson(res, 500, { ok: false, error: 'Failed to persist duplicate task: ' + err.message });
+      return true;
+    }
+    // A copy starts paused: it must never fire on its own before the user
+    // reviews the schedule (a duplicated one-shot may point at a past time).
+    scheduler.pauseTask(copy.id);
+    sendJson(res, 200, { ok: true, task: redactTaskSecrets(copy) });
+    return true;
+  }
+  if (action === 'pause' || action === 'resume') {
+    if (store.get(id) && store.get(id).managedBy === MANAGED_BY_CONFIG) {
+      refuseConfigOwned(res, id);
+      return true;
+    }
+    const task = action === 'pause' ? scheduler.pauseTask(id) : scheduler.resumeTask(id);
+    if (!task) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    sendJson(res, 200, { ok: true, task: redactTaskSecrets(task) });
+    return true;
+  }
+  if (action === 'toggle' || (!action && url.searchParams.get('action') === 'toggle')) {
+    const stored = store.get(id);
+    if (!stored) {
+      sendJson(res, 404, NOT_FOUND);
+      return true;
+    }
+    if (stored.managedBy === MANAGED_BY_CONFIG) {
+      refuseConfigOwned(res, id);
+      return true;
+    }
+    const task = scheduler.toggleTask(id);
+    sendJson(res, 200, { ok: true, task: redactTaskSecrets(task) });
+    return true;
+  }
+  return false;
+}
+
+