@goodandready/dsh-cron 0.3.25 → 0.3.26

package/lib/client-src/90-close.js

@@ -0,0 +1,200 @@
+    function mountCronScreen(ctx, toggle) {
+      if (typeof document === 'undefined') return () => {};
+      let root;
+      let container;
+
+      const teardownPanel = () => {
+        if (root !== undefined) {
+          try { root.unmount(); } catch (e) { /* ignore */ }
+          root = undefined;
+        }
+        if (container !== undefined) {
+          try { container.remove(); } catch (e) { /* ignore */ }
+          container = undefined;
+        }
+      };
+
+      const ensure = () => {
+        if (!toggle.isOpen()) {
+          teardownPanel();
+          return;
+        }
+        if (container !== undefined && container.isConnected) return;
+        const column = document.querySelector(COLUMN_SELECTOR);
+        if (column === null) return;
+        container = document.createElement('div');
+        container.setAttribute(VIEW_ATTR, '');
+        container.setAttribute('data-dsh-plugin', 'dsh-cron');
+        column.appendChild(container);
+        if (ReactDOM && typeof ReactDOM.createRoot === 'function') {
+          root = ReactDOM.createRoot(container);
+          root.render(React.createElement(ErrorBoundary, null, React.createElement(CronScreen, { ctx, toggle, onClose: () => toggle.set(false), t: translate })));
+        } else if (ReactDOM && typeof ReactDOM.render === 'function') {
+          ReactDOM.render(React.createElement(CronScreen, { ctx, toggle, onClose: () => toggle.set(false), t: translate }), container);
+        }
+      };
+
+      const applyActive = () => {
+        if (toggle.isOpen()) {
+          // Repair a dropped stylesheet before the panel paints, so opening the
+          // screen never shows an unstyled page (see startStyleSelfHeal).
+          ensureStyles();
+          document.documentElement.setAttribute(ACTIVE_ATTR, '');
+          document.dispatchEvent(new CustomEvent(ACTIVATE_EVENT, { detail: PANEL }));
+          ensure();
+        } else {
+          document.documentElement.removeAttribute(ACTIVE_ATTR);
+          teardownPanel();
+        }
+      };
+
+      const onOtherActivate = (event) => {
+        if (event.detail !== PANEL && toggle.isOpen()) toggle.set(false);
+      };
+      const onSidebarClick = (event) => {
+        if (!toggle.isOpen()) return;
+        const target = event.target;
+        if (target !== null && target.closest && target.closest(SESSION_ROW_SELECTOR) !== null) toggle.set(false);
+      };
+
+      const waitObserver = new MutationObserver(ensure);
+      waitObserver.observe(document.body, { childList: true, subtree: true });
+      document.addEventListener(ACTIVATE_EVENT, onOtherActivate);
+      document.addEventListener('click', onSidebarClick, true);
+      const unsubscribe = toggle.subscribe(applyActive);
+      applyActive();
+      ensure();
+
+      return () => {
+        waitObserver.disconnect();
+        document.removeEventListener(ACTIVATE_EVENT, onOtherActivate);
+        document.removeEventListener('click', onSidebarClick, true);
+        unsubscribe();
+        document.documentElement.removeAttribute(ACTIVE_ATTR);
+        teardownPanel();
+      };
+    }
+
+    /**
+     * Register a card into a DSH mount point. Mount points are populated via
+     * ctx.slots.inject(mount, cb) — a direct slots.register does not throw but
+     * also never appears in the target surface (settings plugins tab, header),
+     * so the inject contract is mandatory (#85).
+     */
+    function registerIntoMount(ctx, mountName, entry, component) {
+      if (!ctx || !ctx.slots || typeof ctx.slots.inject !== 'function') return false;
+      try {
+        return !!ctx.slots.inject(mountName, () => {
+          ctx.slots.register(entry, component);
+        });
+      } catch (err) {
+        console.warn('[dsh-cron] slot injection skipped:', mountName, '-', err && err.message);
+        return false;
+      }
+    }
+
+    function apply(ctx) {
+      const stopStyleSelfHeal = startStyleSelfHeal();
+
+      // Register the English canonical strings; rebinding the translator lets
+      // the translation plugin drive the active language at runtime (#87).
+      // Own the dictionary as an effect: fiber dispose/HMR removes exactly this
+      // registration, so a re-applied plugin registers again instead of throwing
+      // "locale namespace ... already has locale ..." into a swallowed catch and
+      // leaving the previously registered (stale) dictionary in place.
+      try {
+        if (ctx.locale && typeof ctx.locale.register === 'function' && typeof ctx.effect === 'function') {
+          ctx.effect(() => ctx.locale.register(NS, STRINGS), 'dsh-cron: locale dictionaries');
+        } else if (ctx.locale && typeof ctx.locale.register === 'function') {
+          ctx.locale.register(NS, STRINGS);
+        }
+      } catch (e) {
+        // A plain re-registration in the same session throws; the effect form above avoids it.
+      }
+      try {
+        if (ctx.locale && typeof ctx.locale.bind === 'function') {
+          translate = ctx.locale.bind(NS);
+        }
+      } catch (err) {
+        /* locale bind unavailable, fallback to default translate */
+      }
+
+      const toggle = createToggle();
+
+      // The settings card lives ONLY in the plugins settings tab (#102): no
+      // top-level section fallback — the flat sidebar list is a shared core
+      // resource, and the card slot is proven on current builds (#85).
+      function SettingsCardWithBoundary(props) {
+        return React.createElement(ErrorBoundary, null, CronSettingsCard(props));
+      }
+      // List seat (plugins.item): the seat the Plugins page renders as the plugin's own
+      // page with its configuration. The label is a static string on purpose — it is
+      // resolved while the page renders, and a locale lookup there would take the whole
+      // client batch down with it.
+      const itemOk = registerIntoMount(ctx, 'plugins.item', {
+        name: 'plugins.item',
+        id: ROW_ID,
+        order: 60,
+        label: () => 'Cron',
+        locale: NS,
+        inject: () => ({ ctx, toggle }),
+      }, SettingsCardWithBoundary);
+      if (!itemOk) {
+        console.warn('[dsh-cron] plugins.item slot unavailable — plugin page card not registered');
+      }
+      // Row seat and the legacy settings.plugin.item seat stay as fallbacks
+      // (#102: still no top-level section fallback).
+      const rowOk = registerIntoMount(ctx, 'plugins.row.config', {
+        name: 'plugins.row.config',
+        key: ROW_CONFIG_KEY,
+        locale: NS,
+        inject: () => ({ ctx, toggle }),
+      }, SettingsCardWithBoundary);
+      const cardOk = registerIntoMount(ctx, 'settings.plugin.item', {
+        name: 'settings.plugin.item',
+        key: NS,
+        locale: NS,
+        inject: () => ({ ctx, toggle }),
+      }, SettingsCardWithBoundary);
+      if (!cardOk) {
+        console.warn('[dsh-cron] settings.plugin.item slot unavailable — settings card not registered');
+      }
+
+      const chipOk = registerIntoMount(ctx, 'conversation.session.header.utilities', {
+        name: 'conversation.session.header.utilities',
+        id: PLUGIN_ID + '.chip',
+        order: 27,
+        locale: NS,
+        inject: () => ({ ctx, toggle }),
+      }, CronChip);
+      const cardSlot = cardOk ? 'settings.plugin.item' : undefined;
+      const chipSlot = chipOk ? 'conversation.session.header.utilities' : undefined;
+
+      function CronChip(props) {
+        const chipT = props.t || translate;
+        return React.createElement('button', {
+          type: 'button',
+          style: { background: 'none', border: 'none', color: 'var(--dsw-alias-label-secondary, #999)', cursor: 'pointer', padding: '4px', display: 'inline-flex', alignItems: 'center' },
+          title: T_KEY(chipT, 'chip.title'),
+          'aria-label': T_KEY(chipT, 'chip.title'),
+          onClick: () => toggle.toggle(),
+          dangerouslySetInnerHTML: { __html: ICON_TIMER }
+        });
+      }
+
+      ctx.effect(() => {
+        const off = [
+          mountSidebarEntry(toggle, translate('sidebar.label')),
+          mountSidebarJobs(toggle, translate('sidebar.jobsTitle'), (taskId) => { pendingTaskHighlight = taskId; }),
+          mountCronScreen(ctx, toggle)
+        ];
+        return () => { for (const dispose of off) dispose(); stopStyleSelfHeal(); };
+      }, 'dsh-cron: client overlay');
+
+      exports.slots = { card: cardSlot, chip: chipSlot };
+    }
+
+    module.exports = { apply, inject: ['slots', 'locale'] };
+    return module.exports;
+  }
+})

package/lib/commands.js

@@ -0,0 +1,200 @@
+/**
+ * dsh-commands registration for /cron slash commands (#388).
+ */
+
+import { GlobalBudgetManager } from './global-budgets.js';
+
+export function formatTaskList(tasks = []) {
+  if (!tasks.length) {
+    return 'No scheduled tasks configured. Create one in the Cron panel or via cron tool.';
+  }
+  const lines = [
+    `Cron Tasks (${tasks.length} total):`,
+    '',
+  ];
+  for (const t of tasks) {
+    const statusIcon = t.paused || t.status === 'paused' ? '[PAUSED]' : (t.status === 'completed' ? '[DONE]' : '[ACTIVE]');
+    const nextStr = t.nextRunAt ? new Date(t.nextRunAt).toISOString().replace('T', ' ').slice(0, 16) : 'none';
+    const scheduleStr = t.scheduleText || t.schedule || 'manual';
+    lines.push(`  ${statusIcon} ${t.id} · "${t.title}"`);
+    lines.push(`       Schedule: ${scheduleStr} · Next: ${nextStr} · Type: ${t.type || 'llm'}`);
+  }
+  return lines.join('\n');
+}
+
+export function formatSchedulerStatus(store, scheduler) {
+  const allTasks = store?.list ? store.list() : [];
+  const activeCount = allTasks.filter((t) => !t.paused && t.status !== 'paused' && t.status !== 'completed').length;
+  const pausedCount = allTasks.filter((t) => t.paused || t.status === 'paused').length;
+  const runningCount = typeof scheduler?.runningCount === 'function' ? scheduler.runningCount() : (scheduler?.running?.size || 0);
+  const queueDepth = Array.isArray(scheduler?.queue) ? scheduler.queue.length : 0;
+  const maxConcurrent = scheduler?.maxConcurrent ?? 2;
+
+  const budgetMgr = new GlobalBudgetManager();
+  const usage24h = budgetMgr.calculateUsage(store, { windowMs: 86400000 });
+  const settings = store?.getSettings?.() || {};
+  const dailyLimit = Number(settings.globalDailyCostLimitUsd) || 0;
+  const budgetStr = dailyLimit > 0
+    ? `$${usage24h.totalCostUsd.toFixed(4)} / $${dailyLimit.toFixed(2)}`
+    : `$${usage24h.totalCostUsd.toFixed(4)} (unlimited)`;
+
+  const lines = [
+    '=== Cron Scheduler Status ===',
+    `Active Tasks:       ${activeCount} (Paused: ${pausedCount}, Total: ${allTasks.length})`,
+    `Currently Running:  ${runningCount} / ${maxConcurrent} max concurrent`,
+    `Queue Depth:        ${queueDepth}`,
+    `24h Expenditure:    ${budgetStr} (${usage24h.runCount} runs, ${usage24h.totalTokens} tokens)`,
+    `Timezone:           ${scheduler?.defaultTimezone || 'Server Local'}`,
+  ];
+
+  if (runningCount > 0 && scheduler?.running) {
+    lines.push('', 'Active Runs:');
+    for (const [id, runInfo] of scheduler.running.entries()) {
+      const task = store?.get?.(id);
+      const elapsedSec = runInfo?.startedAt ? Math.round((Date.now() - runInfo.startedAt) / 1000) : 0;
+      lines.push(`  - ${task ? task.title : id} (${id}) running for ${elapsedSec}s`);
+    }
+  }
+
+  return lines.join('\n');
+}
+
+export async function executeCronCommand(store, scheduler, rawInput = '') {
+  const args = String(rawInput || '').trim().split(/\s+/).filter(Boolean);
+  const subcmd = (args[0] || 'list').toLowerCase();
+  const targetId = args[1];
+
+  switch (subcmd) {
+    case 'list':
+    case 'ls': {
+      const tasks = store.list ? store.list() : [];
+      return formatTaskList(tasks);
+    }
+
+    case 'status':
+    case 'stat': {
+      return formatSchedulerStatus(store, scheduler);
+    }
+
+    case 'run':
+    case 'trigger': {
+      if (!targetId) {
+        return 'Error: Task ID is required. Example: /cron run <task-id>';
+      }
+      const task = store.get ? store.get(targetId) : null;
+      if (!task) {
+        return `Error: Task "${targetId}" not found. Run "/cron list" to view available task IDs.`;
+      }
+      if (typeof scheduler?.triggerManualRun === 'function') {
+        scheduler.triggerManualRun(task.id);
+      } else if (typeof scheduler?.runNow === 'function') {
+        await scheduler.runNow(task.id);
+      } else {
+        return 'Error: Scheduler does not support manual run triggering.';
+      }
+      return `Triggered manual execution for task "${task.title}" (${task.id}).`;
+    }
+
+    case 'pause': {
+      if (!targetId) {
+        return 'Error: Task ID is required. Example: /cron pause <task-id>';
+      }
+      const task = store.get ? store.get(targetId) : null;
+      if (!task) {
+        return `Error: Task "${targetId}" not found. Run "/cron list" to view available task IDs.`;
+      }
+      if (typeof scheduler?.pauseTask === 'function') {
+        scheduler.pauseTask(task.id);
+      } else if (store?.update) {
+        store.update(task.id, { paused: true, status: 'paused' });
+      }
+      return `Task "${task.title}" (${task.id}) is now paused.`;
+    }
+
+    case 'resume': {
+      if (!targetId) {
+        return 'Error: Task ID is required. Example: /cron resume <task-id>';
+      }
+      const task = store.get ? store.get(targetId) : null;
+      if (!task) {
+        return `Error: Task "${targetId}" not found. Run "/cron list" to view available task IDs.`;
+      }
+      if (typeof scheduler?.resumeTask === 'function') {
+        scheduler.resumeTask(task.id);
+      } else if (store?.update) {
+        store.update(task.id, { paused: false, status: 'active' });
+      }
+      return `Task "${task.title}" (${task.id}) has been resumed.`;
+    }
+
+    case 'help':
+    default: {
+      return [
+        'Cron Automation Commands:',
+        '  /cron list          - List all scheduled tasks with next execution time',
+        '  /cron status        - View scheduler queue, active runs, and 24h spend',
+        '  /cron run <id>      - Manually trigger an immediate run for a task',
+        '  /cron pause <id>    - Pause scheduled executions for a task',
+        '  /cron resume <id>   - Resume scheduled executions for a task',
+      ].join('\n');
+    }
+  }
+}
+
+export function registerCommands(ctx, { store, scheduler }) {
+  if (typeof ctx?.inject !== 'function') return;
+  ctx.inject(['commands'], (cmdCtx) => {
+    let commandsService;
+    try {
+      commandsService = cmdCtx?.commands || cmdCtx?.get?.('commands');
+    } catch {
+      commandsService = undefined;
+    }
+    if (!commandsService || typeof commandsService.register !== 'function') return;
+
+    const commandHandler = async (invocation) => {
+      try {
+        const rawArgs = typeof invocation === 'string'
+          ? invocation
+          : (invocation?.rawArgs || invocation?.input || '');
+        const text = await executeCronCommand(store, scheduler, rawArgs);
+        return {
+          kind: 'text',
+          text,
+          toString() { return text; },
+        };
+      } catch (err) {
+        const errText = `Cron command error: ${err?.message || err}`;
+        return {
+          kind: 'error',
+          text: errText,
+          toString() { return errText; },
+        };
+      }
+    };
+
+    const commandExecute = async (rawArgs, invocation = null) => {
+      const res = await commandHandler(invocation || rawArgs);
+      return res.text;
+    };
+
+    try {
+      const unregister = commandsService.register({
+        definitionId: '@goodandready/dsh-cron',
+        name: 'cron',
+        description: 'Manage scheduled tasks and background automation (/cron [list|status|run <id>|pause <id>|resume <id>])',
+        input: { hint: '[list|status|run <id>|pause <id>|resume <id>]' },
+        handler: commandHandler,
+        execute: commandExecute,
+      });
+
+      if (typeof ctx.effect === 'function') {
+        ctx.effect(() => () => {
+          try { unregister?.(); } catch { /* explicit cleanup fallback */ }
+        }, 'dsh-cron: slash command');
+      }
+    } catch (err) {
+      ctx?.logger?.warn?.('[dsh-cron] Could not register /cron slash command: ' + (err?.message || err));
+    }
+  });
+}

package/lib/durable-journal.js

@@ -1,188 +1 @@
-import { createHash, randomUUID } from 'node:crypto';
-
-/**
- * States for durable task execution lifecycle (#317)
- */
-export const JOURNAL_STATES = {
-  QUEUED: 'queued',
-  RUNNING: 'running',
-  COMPLETED: 'completed',
-  FAILED: 'failed',
-  CANCELLED: 'cancelled',
-  UNCERTAIN: 'uncertain',
-};
-
-export class DurableJournal {
-  constructor(store) {
-    this.store = store;
-  }
-
-  /**
-   * Generates a deterministic idempotency key for a task run
-   */
-  generateIdempotencyKey(taskId, scheduleTick) {
-    const raw = `${taskId}:${scheduleTick || Date.now()}`;
-    return 'idem_' + createHash('sha256').update(raw).digest('hex').slice(0, 24);
-  }
-
-  /**
-   * Checks whether a run with this idempotency key was already completed
-   */
-  isIdempotencyKeyExecuted(taskId, idempotencyKey) {
-    if (!idempotencyKey) return null;
-    const history = this.store.getHistory(taskId) || [];
-    return history.find(
-      (r) => r.idempotencyKey === idempotencyKey &&
-             (r.status === JOURNAL_STATES.COMPLETED || r.status === 'success')
-    ) || null;
-  }
-
-  /**
-   * Pre-allocates a durable run entry before execution starts (#317)
-   */
-  createRunRecord(taskId, { idempotencyKey, chainRunId, trigger = 'scheduler', scheduleTick } = {}) {
-    const runId = 'run_' + randomUUID().replace(/-/g, '').slice(0, 16);
-    const key = idempotencyKey || this.generateIdempotencyKey(taskId, scheduleTick);
-
-    const record = {
-      id: runId,
-      taskId,
-      at: Date.now(),
-      status: JOURNAL_STATES.QUEUED,
-      trigger,
-      idempotencyKey: key,
-      chainRunId: chainRunId || null,
-      stages: [
-        { name: 'queue', status: 'success', startedAt: Date.now(), finishedAt: Date.now() },
-        { name: 'preflight', status: 'pending' },
-        { name: 'execution', status: 'pending' },
-        { name: 'validation', status: 'pending' },
-        { name: 'delivery', status: 'pending' },
-      ],
-      stoppedReason: null,
-      createdAt: Date.now(),
-    };
-
-    // Record initial queued entry into history/store
-    this.store.recordRun(taskId, record);
-    return record;
-  }
-
-  /**
-   * Transitions a run record to a new state and updates history entry
-   */
-  transition(taskId, runId, toState, metadata = {}) {
-    const runs = this.store.history.get(taskId) || [];
-    const index = runs.findIndex((r) => r.id === runId);
-    if (index === -1) return null;
-
-    const existing = runs[index];
-    const updated = {
-      ...existing,
-      ...metadata,
-      status: toState,
-      updatedAt: Date.now(),
-    };
-
-    if (
-      toState === JOURNAL_STATES.COMPLETED ||
-      toState === JOURNAL_STATES.FAILED ||
-      toState === JOURNAL_STATES.CANCELLED ||
-      toState === JOURNAL_STATES.UNCERTAIN
-    ) {
-      updated.finishedAt = Date.now();
-      if (updated.startedAt && !updated.durationMs) {
-        updated.durationMs = updated.finishedAt - updated.startedAt;
-      }
-    }
-
-    runs[index] = updated;
-    this.store.history.set(taskId, runs);
-    this.store.scheduleSave(50);
-    return updated;
-  }
-
-  /**
-   * Recovers uncompleted / in-flight runs on daemon restart (#317)
-   */
-  recoverPendingRuns(scheduler) {
-    const tasks = this.store.list();
-    const recovered = { uncertain: [], requeued: [] };
-
-    for (const task of tasks) {
-      const history = this.store.history.get(task.id) || [];
-      let historyChanged = false;
-
-      for (let i = 0; i < history.length; i++) {
-        const run = history[i];
-        if (run.status === JOURNAL_STATES.RUNNING) {
-          // Crash during execution -> transition to UNCERTAIN to prevent blind rerun
-          history[i] = {
-            ...run,
-            status: JOURNAL_STATES.UNCERTAIN,
-            stoppedReason: 'interrupted_by_restart',
-            uncertainAt: Date.now(),
-          };
-          historyChanged = true;
-          recovered.uncertain.push({ taskId: task.id, runId: run.id });
-        } else if (run.status === JOURNAL_STATES.QUEUED) {
-          // Queued run that didn't start yet: if task is still active and recent (<1 hour), re-enqueue
-          const ageMs = Date.now() - (run.createdAt || run.at);
-          if (task.status === 'active' && ageMs < 3600000 && scheduler && typeof scheduler.runTask === 'function') {
-            scheduler.queue = scheduler.queue || [];
-            if (!scheduler.queue.includes(task.id)) {
-              scheduler.queue.push(task.id);
-              recovered.requeued.push({ taskId: task.id, runId: run.id });
-            }
-          } else {
-            // Expired or cancelled queued run
-            history[i] = {
-              ...run,
-              status: JOURNAL_STATES.CANCELLED,
-              stoppedReason: 'Queued run expired or cancelled across restart',
-            };
-            historyChanged = true;
-          }
-        }
-      }
-
-      if (historyChanged) {
-        this.store.scheduleSave(50);
-      }
-    }
-
-    return recovered;
-  }
-
-  /**
-   * Manually resolves an uncertain run record (#317)
-   */
-  resolveUncertain(taskId, runId, { decision, note, resolvedBy = 'user' } = {}) {
-    const runs = this.store.history.get(taskId) || [];
-    const index = runs.findIndex((r) => r.id === runId);
-    if (index === -1) return { ok: false, error: 'Run not found' };
-
-    const run = runs[index];
-    if (run.status !== JOURNAL_STATES.UNCERTAIN) {
-      return { ok: false, error: `Run is in status "${run.status}", not uncertain` };
-    }
-
-    let nextStatus = JOURNAL_STATES.FAILED;
-    if (decision === 'completed' || decision === 'mark_completed') nextStatus = JOURNAL_STATES.COMPLETED;
-    else if (decision === 'failed' || decision === 'mark_failed') nextStatus = JOURNAL_STATES.FAILED;
-    else if (decision === 'cancel' || decision === 'cancelled') nextStatus = JOURNAL_STATES.CANCELLED;
-
-    const resolved = {
-      ...run,
-      status: nextStatus,
-      stoppedReason: `Uncertain run resolved by ${resolvedBy}: ${note || decision}`,
-      resolvedBy,
-      resolvedAt: Date.now(),
-    };
-
-    runs[index] = resolved;
-    this.store.history.set(taskId, runs);
-    this.store.scheduleSave(50);
-    return { ok: true, run: resolved };
-  }
-}
+export * from './store/durable-journal.js';

package/lib/external-api.js

@@ -1,74 +1 @@
-/**
- * External REST surface under /dsh-cron/api/* (#54, ADR-0001).
- *
- * Everything a browser panel needs stays on the local, cross-origin-protected
- * routes; this prefix exists for CI and host-side automation, so it is the only
- * surface guarded by a bearer token. The token lives in the plugin settings as
- * a masked value: an unconfigured token disables the surface (503) instead of
- * leaving it open, and a wrong token is answered with 401.
- *
- * The operations themselves are shared with the panel routes (lib/api.js), so
- * the confirmation gate for code-executing tasks and the config-owned refusals
- * apply here exactly as they do over HTTP from the UI.
- */
-
-import { timingSafeEqual } from 'node:crypto';
-import { sendJson } from './http-utils.js';
-import { handleExternalTaskRequest } from './api.js';
-
-/** Settings key that holds the bearer token. */
-export const API_TOKEN_SETTING_KEY = 'apiToken';
-
-/** Route prefix owned by this surface. */
-export const EXTERNAL_API_PREFIX = '/dsh-cron/api';
-
-/**
- * Constant-time token comparison. Length is compared first because
- * timingSafeEqual throws on buffers of different sizes; a length mismatch is
- * not a secret worth hiding for a fixed-length token.
- */
-export function tokenMatches(expected, provided) {
-  if (!expected || !provided) return false;
-  const a = Buffer.from(String(expected), 'utf8');
-  const b = Buffer.from(String(provided), 'utf8');
-  if (a.length !== b.length) return false;
-  return timingSafeEqual(a, b);
-}
-
-/** Bearer token of a request, or an empty string when there is none. */
-export function readBearerToken(req) {
-  const header = String((req.headers && req.headers.authorization) || '');
-  const match = header.match(/^Bearer\s+(.+)$/i);
-  return match ? match[1].trim() : '';
-}
-
-/**
- * Guard the external prefix, then hand the request to the shared task
- * operations. `getToken` is read per request so a settings change applies
- * without a restart.
- */
-export function createExternalApiHandler({ store, scheduler, getToken }) {
-  return async function handleExternalApi(req, res) {
-    const expected = typeof getToken === 'function' ? getToken() : '';
-    if (!expected) {
-      sendJson(res, 503, {
-        ok: false,
-        error: 'External API is disabled: set the "' + API_TOKEN_SETTING_KEY + '" setting to enable it',
-      });
-      return;
-    }
-    if (!tokenMatches(expected, readBearerToken(req))) {
-      sendJson(res, 401, { ok: false, error: 'Unauthorized' });
-      return;
-    }
-    const url = new URL(req.url, 'http://127.0.0.1');
-    // `url` must be inside the try: a malformed body (an unparseable schedule,
-    // for example) surfaces as a thrown error from the shared handlers, and an
-    // unhandled rejection here would answer nothing at all.
-    try {
-      await handleExternalTaskRequest({ store, scheduler, req, res, url, apiToken: expected });
-    } catch (err) {
-      sendJson(res, (err && err.statusCode) || 500, { ok: false, error: (err && err.message) || String(err) });
-    }
-  };
-}
+export * from './routes/external-api.js';

package/lib/index.js

@@ -1,3 +1,6 @@
+import { applyTuiSettings, buildTuiSection } from './tui-settings.js';
+import { registerCommands, executeCronCommand } from './commands.js';
+export { applyTuiSettings, buildTuiSection, registerCommands, executeCronCommand };
 import {
   TaskSchema,
   validateTaskRecord,
@@ -376,6 +379,20 @@ export function apply(ctx, rawConfig) {
   }), 'dsh-cron: /settings');
 
   // 2. Tools: unified background automation runner (Issue #196: 9 tools -> 1)
+    // TUI settings section (#387)
+  applyTuiSettings(ctx, {
+    store,
+    scheduler,
+    live: () => ({
+      ...unwrapConfig(getContextConfig(ctx, rawConfig)),
+      ...activeVolatileConfig,
+      ...store.getSettings(),
+    }),
+  });
+
+  // Slash commands (#388)
+  registerCommands(ctx, { store, scheduler });
+
   ctx.tools.register(defineTool({
     name: 'cron',
     description: 'Background automation runner for DSH: isolated agent runs, script/node/python/http/ssh/docker runtimes, cost guard, notifications, heartbeats. For simple reminders in the current chat, use the built-in schedule_create tool instead. Actions: create, list, get, update, pause, resume, run, delete.',