@goodandready/dsh-cron 0.3.9 → 0.3.11

package/README.md

@@ -588,6 +588,8 @@ All endpoints are served by the DSH web server under `/dsh-cron/`. Endpoints are
 | `GET` / `POST` | `/dsh-cron/api/tasks` | External token-guarded surface: list / create-or-update (#54) |
 | `GET` / `DELETE` | `/dsh-cron/api/tasks/:id` | External token-guarded surface: read / delete (#54) |
 | `POST` | `/dsh-cron/api/tasks/:id/run` | External token-guarded surface: force a run (#54) |
+| `POST` | `/dsh-cron/webhook/:id` | Incoming webhook trigger: trigger task with HMAC SHA-256 / Bearer token authentication, debouncing and JSON payload prompt interpolation (#348) |
+| `POST` | `/dsh-cron/api/webhook/:id` | External token-guarded incoming webhook trigger (#348) |
 
 ---
 
@@ -609,7 +611,7 @@ Save LLM tokens and API quotas on watcher tasks by dynamically slowing down exec
 
 ### 🔄 Session Resumption & GUI Session Naming (#346, GH #9, #354, GH #10, Added in v0.3.8, Patched in v0.3.9)
 
-- **HTTP API `sessionTitle` Persistence (v0.3.9, #354, GH #10, PR #11)**: Tasks created or updated via HTTP endpoints (`POST /dsh-cron/tasks` and `POST /dsh-cron/api/tasks`) now reliably forward and persist `sessionTitle` into the task store and runner, mirroring the agent-tool (`cron_create_task`) and PATCH pathways.
+- **HTTP API `sessionTitle` Persistence (v0.3.10, #354, GH #10, PR #11)**: Tasks created or updated via HTTP endpoints (`POST /dsh-cron/tasks` and `POST /dsh-cron/api/tasks`) now reliably forward and persist `sessionTitle` into the task store and runner, mirroring the agent-tool (`cron_create_task`) and PATCH pathways.
 
 - **Universal Host Resumption (`resumeSessionId`)**: DeepSeek Harness host `0.2.0-rc.2+` specifies `readonly resumeSessionId: SessionId` on `agents.resume()`. The runner now passes both `resumeSessionId` and `sessionId`, guaranteeing seamless session resumption across all DSH core versions without falling back to recreating sessions that already exist.
 - **Enhanced Diagnostics on Failure**: When an existing session cannot be resumed, `dsh-cron` logs an actionable warning and, if recreating the session fails, surfaces the underlying resume error in the task run output.
@@ -619,6 +621,27 @@ Save LLM tokens and API quotas on watcher tasks by dynamically slowing down exec
 
 Connect to `GET /dsh-cron/tasks/:id/stream` using Server-Sent Events (SSE) to receive live stdout/stderr chunks and execution completion events with an automatic 500-line ring buffer.
 
+### 🪝 Incoming HTTP Webhook Triggers (#348)
+
+Execute tasks instantaneously on external events via incoming HTTP POST requests with enterprise-grade security and dynamic template interpolation:
+
+- **Authentication & Verification**: Supports HMAC SHA-256 signatures (`x-hub-signature-256` or `x-signature-sha256`) using task-level `webhookSecret`, bearer tokens (`x-dsh-cron-webhook-token`, `Authorization: Bearer <token>`, or `?token=<token>`) against task `webhookToken` or master `apiToken`. Fail-closed security rejects unconfigured webhooks.
+- **Deep JSON Payload Interpolation**: Dynamic prompt variables resolve incoming payload fields using dot notation (`{webhook.body.repository.full_name}`, `{webhook.headers.x_github_event}`, `{webhook.query.ref}`, `{webhook.body}`).
+- **Script Environment Injection**: Script and shell tasks automatically receive the raw request body and headers in `DSH_CRON_WEBHOOK_BODY` and `DSH_CRON_WEBHOOK_HEADERS`.
+- **Anti-Spam Debouncing**: Configurable per-task `webhookDebounceMs` (default 500ms) guarantees protection against webhook storms and burst duplicate executions.
+
+### 🗣️ Multi-Lingual Natural Language Scheduling (#349)
+
+Define schedules naturally in conversation, tool calls, and API inputs in English and Russian without wrestling with cron syntax:
+
+- **Intervals**: `"every 15 minutes"`, `"каждые 30 минут"`, `"every 2 hours"`, `"каждые 4 часа"`.
+- **Daily & Time-of-Day**: `"every day at 9:00"`, `"каждый день в 18:30"`, `"every morning at 8am"`, `"каждый вечер в 21:00"`, `"at midnight"`, `"в полночь"`, `"at noon"`, `"в полдень"`.
+- **Weekdays & Weekends**: `"every weekday at 9:00"`, `"по будням в 10:00"`, `"on weekends at noon"`, `"по выходным в 12:00"`.
+- **Days of the Week**: `"every Monday at 10am"`, `"каждую пятницу в 17:00"`, `"every Tuesday and Thursday at 14:00"`.
+- **Relative One-Shots**: `"in 15 minutes"`, `"через 2 часа"`, `"in 3 days at 10:00"`, `"через 30 минут"`.
+
+The dedicated parser (`lib/nl-schedule.js`) translates expressions into strict Croner expressions or deterministic one-shot execution timestamps seamlessly.
+
 ---
 
 ## 🧪 Testing & Preflight Verification

package/README.ru.md

@@ -569,6 +569,24 @@ bash deploy.sh verify [exact-version]
 | `GET` / `POST` | `/dsh-cron/api/tasks` | Внешняя поверхность под токеном: список / создание-обновление (#54) |
 | `GET` / `DELETE` | `/dsh-cron/api/tasks/:id` | Внешняя поверхность под токеном: чтение / удаление (#54) |
 | `POST` | `/dsh-cron/api/tasks/:id/run` | Внешняя поверхность под токеном: принудительный запуск (#54) |
+| `POST` | `/dsh-cron/webhook/:id` | Входящий HTTP Webhook: запуск задачи по событию с проверкой HMAC SHA-256 / токена, дебаунсом и подстановкой JSON payload в промпт (#348) |
+| `POST` | `/dsh-cron/api/webhook/:id` | Внешний эндпоинт входящего вебхука под токеном (#348) |
+
+---
+
+### 32. Входящие HTTP Webhook триггеры и естественно-языковой парсер расписаний (v0.3.11, #348, #349)
+
+- **Входящие Webhook триггеры (`/dsh-cron/webhook/:id`)**: Моментальный запуск задач по внешним событиям (GitHub, Gitea, CI/CD, сторонние сервисы).
+  - **Аутентификация и безопасность**: Поддержка HMAC SHA-256 подписи (`x-hub-signature-256`, `x-signature-sha256`) через `webhookSecret`, индивидуальных токенов задачи (`webhookToken`) через `x-dsh-cron-webhook-token`, Bearer или query-параметр, а также мастер-токена `apiToken`. Fail-closed архитектура отклоняет запросы к незащищенным задачам.
+  - **Глубокая интерполяция payload**: Шаблоны `{webhook.body.path.to.key}`, `{webhook.headers.key}`, `{webhook.query.param}` и `{webhook.body}` автоматически раскрываются в промпте задачи.
+  - **Проброс в окружение**: Скриптовым и shell-задачам передаются переменные `DSH_CRON_WEBHOOK_BODY` и `DSH_CRON_WEBHOOK_HEADERS`.
+  - **Дебаунс от штормов**: Настраиваемый `webhookDebounceMs` (по умолчанию 500 мс) защищает от дублирующих всплесков событий.
+- **Естественно-языковой парсер расписаний (`lib/nl-schedule.js`)**: Умное распознавание расписаний на русском и английском языках в чате, туле агента и API:
+  - Интервалы: `"каждые 15 минут"`, `"every 2 hours"`, `"каждые 4 часа"`.
+  - Время суток: `"каждый день в 9:00"`, `"every morning at 8am"`, `"в полночь"`, `"в полдень"`.
+  - Будни и выходные: `"по будням в 10:00"`, `"every weekday at 9:00"`, `"по выходным в 12:00"`, `"on weekends at noon"`.
+  - Дни недели: `"каждую пятницу в 17:00"`, `"every Monday at 10am"`, `"по вторникам и четвергам в 14:00"`.
+  - Относительные отложенные задачи: `"через 15 минут"`, `"in 2 hours"`, `"через 3 дня в 10:00"`.
 
 ---
 

package/README.zh.md

@@ -569,6 +569,8 @@ dsh-cron:
 | `GET` / `POST` | `/dsh-cron/api/tasks` | 令牌保护的外部接口：列表 / 创建或更新（#54） |
 | `GET` / `DELETE` | `/dsh-cron/api/tasks/:id` | 令牌保护的外部接口：读取 / 删除（#54） |
 | `POST` | `/dsh-cron/api/tasks/:id/run` | 令牌保护的外部接口：强制执行（#54） |
+| `POST` | `/dsh-cron/webhook/:id` | 入站 HTTP Webhook 触发器：支持 HMAC SHA-256 / 令牌鉴权、防抖与 JSON 负载提示词变量插值（#348） |
+| `POST` | `/dsh-cron/api/webhook/:id` | 令牌保护的入站 Webhook 外部接口（#348） |
 
 ---
 

package/lib/api-task-webhook.js

@@ -0,0 +1,247 @@
+/**
+ * lib/api-task-webhook.js — Incoming HTTP Webhook Triggers (#348).
+ *
+ * Implements POST /dsh-cron/webhook/:taskId and POST /dsh-cron/api/webhook/:taskId.
+ * Authenticates via HMAC SHA-256 signature (GitHub/Stripe style), per-task token,
+ * or master apiToken, applies debouncing, parses JSON/text payload, and triggers
+ * the task with variable interpolation.
+ */
+
+import crypto from 'node:crypto';
+import { logger } from './logger.js';
+import { sendJson } from './http-utils.js';
+
+const MAX_WEBHOOK_BYTES = 512 * 1024; // 512 KiB limit
+const NOT_ALLOWED = { ok: false, error: 'Method not allowed' };
+const lastWebhookRuns = new Map();
+
+/**
+ * Constant-time string/buffer comparison.
+ */
+export function safeCompare(a, b) {
+  if (!a || !b) return false;
+  const bufA = Buffer.from(String(a), 'utf8');
+  const bufB = Buffer.from(String(b), 'utf8');
+  if (bufA.length !== bufB.length) return false;
+  return crypto.timingSafeEqual(bufA, bufB);
+}
+
+/**
+ * Verify HMAC SHA-256 signature from headers.
+ * Supports x-hub-signature-256 (sha256=...), x-signature-256, or x-dsh-cron-signature.
+ */
+export function verifyHmacSignature(rawBuffer, secret, signatureHeader) {
+  if (!secret || !signatureHeader) return false;
+  const expectedHex = crypto.createHmac('sha256', secret).update(rawBuffer).digest('hex');
+  const provided = String(signatureHeader).replace(/^sha256=/i, '').trim();
+  return safeCompare(expectedHex, provided);
+}
+
+/**
+ * Verify token from header, Bearer auth, or query param.
+ */
+export function verifyToken(expectedToken, req, url) {
+  if (!expectedToken) return false;
+  const headers = req.headers || {};
+  const headerToken = headers['x-dsh-cron-webhook-token'] || headers['x-webhook-token'];
+  const authHeader = headers['authorization'];
+  let bearerToken = '';
+  if (authHeader && /^Bearer\s+/i.test(authHeader)) {
+    bearerToken = authHeader.replace(/^Bearer\s+/i, '').trim();
+  }
+  const queryToken = url?.searchParams?.get('token');
+  const candidate = headerToken || bearerToken || queryToken;
+  if (!candidate) return false;
+  return safeCompare(expectedToken, candidate);
+}
+
+/**
+ * Read request body with raw Buffer preserved for signature verification.
+ */
+export function readRawBody(req, limit = MAX_WEBHOOK_BYTES) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let bytes = 0;
+    let settled = false;
+
+    const fail = (err) => {
+      if (settled) return;
+      settled = true;
+      reject(err);
+    };
+
+    req.on('data', (chunk) => {
+      if (settled) return;
+      const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      bytes += buf.length;
+      if (bytes > limit) {
+        fail(Object.assign(new Error('Webhook payload exceeds 512 KiB limit'), { statusCode: 413 }));
+        req.destroy();
+        return;
+      }
+      chunks.push(buf);
+    });
+
+    req.on('end', () => {
+      if (settled) return;
+      settled = true;
+      const raw = chunks.length ? Buffer.concat(chunks) : Buffer.alloc(0);
+      let parsed = null;
+      const text = raw.toString('utf8').trim();
+      if (text) {
+        try {
+          parsed = JSON.parse(text);
+        } catch {
+          parsed = text;
+        }
+      } else {
+        parsed = {};
+      }
+      resolve({ raw, parsed });
+    });
+
+    req.on('error', (err) => {
+      fail(Object.assign(err, { statusCode: 400 }));
+    });
+  });
+}
+
+/**
+ * Handle incoming webhook request for a task.
+ */
+export async function handleTaskWebhookRoute({ store, scheduler, req, res, taskId: explicitTaskId }) {
+  if (req.method !== 'POST') {
+    sendJson(res, 405, NOT_ALLOWED);
+    return;
+  }
+
+  const url = new URL(req.url, 'http://127.0.0.1');
+  let taskId = explicitTaskId;
+  if (!taskId) {
+    const parts = url.pathname.split('/').filter(Boolean);
+    // /dsh-cron/webhook/:taskId or /dsh-cron/api/webhook/:taskId
+    const webhookIdx = parts.indexOf('webhook');
+    if (webhookIdx !== -1 && parts[webhookIdx + 1]) {
+      taskId = parts[webhookIdx + 1];
+    }
+  }
+
+  if (!taskId) {
+    sendJson(res, 400, { ok: false, error: 'Task ID is required in webhook URL path' });
+    return;
+  }
+
+  const task = store.get(taskId);
+  if (!task) {
+    sendJson(res, 404, { ok: false, error: `Task "${taskId}" not found` });
+    return;
+  }
+
+  if (task.status !== 'active') {
+    sendJson(res, 400, { ok: false, error: `Task "${taskId}" is not active (current status: ${task.status})` });
+    return;
+  }
+
+  const isEnabled = Boolean(
+    task.webhookEnabled ||
+    (task.webhookTrigger && task.webhookTrigger.enabled)
+  );
+  if (!isEnabled) {
+    logger.warn(`[dsh-cron] Webhook received for task "${taskId}" but webhooks are not enabled for this task`);
+    sendJson(res, 403, { ok: false, error: `Webhooks are not enabled for task "${taskId}"` });
+    return;
+  }
+
+  // Read raw body
+  let bodyData;
+  try {
+    bodyData = await readRawBody(req);
+  } catch (err) {
+    sendJson(res, err.statusCode || 400, { ok: false, error: err.message });
+    return;
+  }
+
+  const { raw, parsed } = bodyData;
+  const headers = req.headers || {};
+  const settings = typeof store.getSettings === 'function' ? store.getSettings() : {};
+
+  // Authentication check (fail-closed)
+  const taskSecret = task.webhookSecret || (task.webhookTrigger && task.webhookTrigger.secret);
+  const taskToken = task.webhookToken || (task.webhookTrigger && task.webhookTrigger.token);
+  const masterToken = settings.apiToken;
+
+  let authenticated = false;
+
+  if (taskSecret) {
+    const sigHeader = headers['x-hub-signature-256'] || headers['x-signature-256'] || headers['x-dsh-cron-signature'];
+    if (sigHeader && verifyHmacSignature(raw, taskSecret, sigHeader)) {
+      authenticated = true;
+    } else {
+      logger.warn(`[dsh-cron] Invalid HMAC signature for webhook task "${taskId}"`);
+      sendJson(res, 401, { ok: false, error: 'Invalid HMAC signature' });
+      return;
+    }
+  } else if (taskToken) {
+    if (verifyToken(taskToken, req, url)) {
+      authenticated = true;
+    } else {
+      logger.warn(`[dsh-cron] Invalid webhook token for task "${taskId}"`);
+      sendJson(res, 401, { ok: false, error: 'Invalid webhook token' });
+      return;
+    }
+  } else if (masterToken) {
+    if (verifyToken(masterToken, req, url)) {
+      authenticated = true;
+    } else {
+      logger.warn(`[dsh-cron] Invalid API token for webhook task "${taskId}"`);
+      sendJson(res, 401, { ok: false, error: 'Unauthorized: missing or invalid token' });
+      return;
+    }
+  } else {
+    logger.warn(`[dsh-cron] Webhook task "${taskId}" rejected: no secret or token configured (fail-closed)`);
+    sendJson(res, 403, { ok: false, error: 'Webhook secret or token must be configured for security' });
+    return;
+  }
+
+  // Debounce check
+  const debounceMs = Math.max(0, Number(task.webhookDebounceMs || (task.webhookTrigger && task.webhookTrigger.debounceMs) || 0));
+  if (debounceMs > 0) {
+    const now = Date.now();
+    const last = lastWebhookRuns.get(taskId) || 0;
+    if (now - last < debounceMs) {
+      logger.info(`[dsh-cron] Webhook for task "${taskId}" debounced (${now - last}ms < ${debounceMs}ms)`);
+      sendJson(res, 200, { ok: true, debounced: true, message: `Webhook debounced (${debounceMs}ms cooldown)` });
+      return;
+    }
+    lastWebhookRuns.set(taskId, now);
+  } else {
+    lastWebhookRuns.set(taskId, Date.now());
+  }
+
+  const query = Object.fromEntries(url.searchParams.entries());
+  const webhookPayload = {
+    body: parsed,
+    raw: raw.toString('utf8'),
+    headers,
+    query,
+  };
+
+  logger.info(`[dsh-cron] Webhook accepted for task "${taskId}", triggering execution`);
+
+  try {
+    const runPromise = scheduler.triggerManualRun(taskId, {
+      webhook: webhookPayload,
+      triggeredBy: 'webhook',
+    });
+
+    sendJson(res, 200, {
+      ok: true,
+      triggered: true,
+      taskId,
+      message: `Webhook received and task "${task.title}" triggered`,
+    });
+  } catch (runErr) {
+    logger.error(`[dsh-cron] Failed to trigger task "${taskId}" from webhook: ${runErr.message}`);
+    sendJson(res, 500, { ok: false, error: `Failed to trigger task: ${runErr.message}` });
+  }
+}

package/lib/api.js

@@ -1,3 +1,4 @@
+import { handleTaskWebhookRoute } from './api-task-webhook.js';
 import { rollbackPromptVersion, sanitizePromptHistory } from './prompt-evolver.js';
 import { sanitizeAdaptiveConfig } from './adaptive.js';
 import { logStreamer } from './log-streamer.js';
@@ -83,6 +84,10 @@ export function createCronApiHandler(store, scheduler, collection) {
         await handleTelegramWebhook({ store, scheduler, req, res });
         return;
       }
+      if (scope === 'webhook' && id) {
+        await handleTaskWebhookRoute({ store, scheduler, req, res, taskId: id });
+        return;
+      }
 
       if ((scope === 'heartbeat' || scope === 'heartbeat-ping') && id) {
         handleHeartbeatPing({ store, req, res, taskId: id });
@@ -640,6 +645,18 @@ function mergeExecutionFields(current, body, parsed) {
     targetSessionId: body.targetSessionId !== undefined ? String(body.targetSessionId).trim() : (current ? (current.targetSessionId || '') : ''),
     targetSessionReset: body.targetSessionReset !== undefined ? String(body.targetSessionReset).trim() : (current ? (current.targetSessionReset || 'never') : 'never'),
     sessionTitle: body.sessionTitle !== undefined ? String(body.sessionTitle).trim() : (current ? (current.sessionTitle || '') : ''),
+    webhookEnabled: body.webhookEnabled !== undefined
+      ? Boolean(body.webhookEnabled)
+      : (body.webhookTrigger?.enabled !== undefined ? Boolean(body.webhookTrigger.enabled) : (current ? Boolean(current.webhookEnabled || current.webhookTrigger?.enabled) : false)),
+    webhookToken: body.webhookToken !== undefined
+      ? String(body.webhookToken).trim()
+      : (body.webhookTrigger?.token ? String(body.webhookTrigger.token).trim() : (current ? (current.webhookToken || current.webhookTrigger?.token || '') : '')),
+    webhookSecret: body.webhookSecret !== undefined
+      ? String(body.webhookSecret).trim()
+      : (body.webhookTrigger?.secret ? String(body.webhookTrigger.secret).trim() : (current ? (current.webhookSecret || current.webhookTrigger?.secret || '') : '')),
+    webhookDebounceMs: body.webhookDebounceMs !== undefined
+      ? (Number(body.webhookDebounceMs) || 0)
+      : (body.webhookTrigger?.debounceMs !== undefined ? (Number(body.webhookTrigger.debounceMs) || 0) : (current ? (Number(current.webhookDebounceMs || current.webhookTrigger?.debounceMs) || 0) : 0)),
     onSuccess: body.onSuccess !== undefined ? String(body.onSuccess).trim() : (current ? (current.onSuccess || '') : ''),
     onFailure: body.onFailure !== undefined ? String(body.onFailure).trim() : (current ? (current.onFailure || '') : ''),
     heartbeatIntervalSeconds: body.heartbeatIntervalSeconds !== undefined ? Number(body.heartbeatIntervalSeconds) : (current ? (Number(current.heartbeatIntervalSeconds) || 0) : 0),
@@ -665,6 +682,10 @@ function mergeExecutionFields(current, body, parsed) {
  */
 export async function handleExternalTaskRequest({ store, scheduler, req, res, url, apiToken }) {
   const parts = url.pathname.split('/').filter(Boolean); // dsh-cron, api, [tasks|heartbeat|schedule], :id?, :action?
+  if (parts[2] === 'webhook' && parts[3]) {
+    await handleTaskWebhookRoute({ store, scheduler, req, res, taskId: parts[3] });
+    return;
+  }
   if (parts[2] === 'heartbeat' && parts[3]) {
     handleHeartbeatPing({ store, req, res, taskId: parts[3], apiToken });
     return;

package/lib/cron-tool.js

@@ -64,7 +64,7 @@ export const cronToolParameters = {
   },
   schedule: {
     type: 'string',
-    description: 'Schedule expression: cron ("0 9 * * *"), shorthand ("@daily", "@every 30m"), interval ("every 2h"), or one-shot ("in 30m", "at: 2026-09-05T15:00:00Z")',
+    description: 'Schedule expression: natural language ("every day at 9am", "every weekday at 10am", "in 2 hours", Russian phrases supported), cron ("0 9 * * *"), shorthand ("@daily"), interval ("every 2h"), or one-shot ("in 30m")',
   },
   prompt: {
     type: 'string',

package/lib/http-utils.js

@@ -224,6 +224,12 @@ export function redactTaskSecrets(task) {
   if (clone.httpBody) {
     clone.httpBody = REDACTED_SECRET;
   }
+  if (clone.webhookToken) {
+    clone.webhookToken = REDACTED_SECRET;
+  }
+  if (clone.webhookSecret) {
+    clone.webhookSecret = REDACTED_SECRET;
+  }
 
   return clone;
 }
@@ -285,5 +291,11 @@ export function restoreTaskSecrets(incoming, current) {
     restored.httpBody = current.httpBody;
   }
 
+  if (restored.webhookToken === REDACTED_SECRET && current.webhookToken !== undefined) {
+    restored.webhookToken = current.webhookToken;
+  }
+  if (restored.webhookSecret === REDACTED_SECRET && current.webhookSecret !== undefined) {
+    restored.webhookSecret = current.webhookSecret;
+  }
   return restored;
 }

package/lib/nl-schedule.js

@@ -0,0 +1,338 @@
+import { Cron } from 'croner';
+
+function pad(n) {
+  return String(n).padStart(2, '0');
+}
+
+/**
+ * Parse time string into { hour, minute }.
+ * Supports:
+ * - "9:00", "09:30", "18:45"
+ * - "9am", "9:30am", "6pm", "11:15pm"
+ * - "9 утра", "2 дня", "6 вечера", "11 вечера", "1 ночи"
+ * - Plain hour "9", "14"
+ */
+export function parseTimeString(raw) {
+  if (!raw || typeof raw !== 'string') return null;
+  const str = raw.trim().toLowerCase();
+
+  // 1. English 12h: "9am", "9:30am", "6pm", "6:15pm"
+  const ampmMatch = str.match(/^(\d{1,2})(?::(\d{2}))?\s*(am|pm)$/);
+  if (ampmMatch) {
+    let hour = parseInt(ampmMatch[1], 10);
+    const minute = ampmMatch[2] ? parseInt(ampmMatch[2], 10) : 0;
+    const isPm = ampmMatch[3] === 'pm';
+    if (hour < 1 || hour > 12 || minute < 0 || minute > 59) return null;
+    if (isPm && hour !== 12) hour += 12;
+    if (!isPm && hour === 12) hour = 0;
+    return { hour, minute };
+  }
+
+  // 2. Russian qualifiers: "9 утра", "2 дня", "6 вечера", "11 вечера", "1 ночи"
+  const ruMatch = str.match(/^(\d{1,2})(?::(\d{2}))?\s*(утра|дня|вечера|ночи)$/);
+  if (ruMatch) {
+    let hour = parseInt(ruMatch[1], 10);
+    const minute = ruMatch[2] ? parseInt(ruMatch[2], 10) : 0;
+    const period = ruMatch[3];
+    if (minute < 0 || minute > 59) return null;
+    if (period === 'вечера' && hour < 12) hour += 12;
+    if (period === 'дня' && hour >= 1 && hour <= 11) hour += 12;
+    if (period === 'ночи' && hour === 12) hour = 0;
+    if (hour < 0 || hour > 23) return null;
+    return { hour, minute };
+  }
+
+  // 3. 24h format: "14:30", "09:00", "9:00"
+  const colonMatch = str.match(/^(\d{1,2}):(\d{2})$/);
+  if (colonMatch) {
+    const hour = parseInt(colonMatch[1], 10);
+    const minute = parseInt(colonMatch[2], 10);
+    if (hour < 0 || hour > 23 || minute < 0 || minute > 59) return null;
+    return { hour, minute };
+  }
+
+  // 4. Plain hour: "9", "14", "22"
+  const plainMatch = str.match(/^(\d{1,2})$/);
+  if (plainMatch) {
+    const hour = parseInt(plainMatch[1], 10);
+    if (hour >= 0 && hour <= 23) {
+      return { hour, minute: 0 };
+    }
+  }
+
+  return null;
+}
+
+const DAY_OF_WEEK_MAP = {
+  // Sunday (0)
+  'воскресенье': 0, 'воскресеньям': 0, 'воскресенья': 0, 'вс': 0,
+  'sunday': 0, 'sundays': 0, 'sun': 0,
+  // Monday (1)
+  'понедельник': 1, 'понедельникам': 1, 'пн': 1,
+  'monday': 1, 'mondays': 1, 'mon': 1,
+  // Tuesday (2)
+  'вторник': 2, 'вторникам': 2, 'вт': 2,
+  'tuesday': 2, 'tuesdays': 2, 'tue': 2,
+  // Wednesday (3)
+  'среда': 3, 'среду': 3, 'средам': 3, 'ср': 3,
+  'wednesday': 3, 'wednesdays': 3, 'wed': 3,
+  // Thursday (4)
+  'четверг': 4, 'четвергам': 4, 'чт': 4,
+  'thursday': 4, 'thursdays': 4, 'thu': 4,
+  // Friday (5)
+  'пятница': 5, 'пятницу': 5, 'пятницам': 5, 'пт': 5,
+  'friday': 5, 'fridays': 5, 'fri': 5,
+  // Saturday (6)
+  'суббота': 6, 'субботу': 6, 'субботам': 6, 'сб': 6,
+  'saturday': 6, 'saturdays': 6, 'sat': 6,
+};
+
+const DAY_NAMES_EN = ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday'];
+
+function withNextRun(res) {
+  if (res && res.cronPattern && !res.nextRun) {
+    try {
+      const job = new Cron(res.cronPattern, { sloppyRanges: true });
+      const next = job.nextRun();
+      res.nextRun = next ? next.getTime() : null;
+    } catch {
+      // ignore
+    }
+  }
+  return res;
+}
+
+/**
+ * Deterministically parse natural language schedule expression.
+ * Returns parsed schedule object compatible with parseScheduleExpression or null.
+ */
+export function parseNaturalSchedule(input) {
+  if (!input || typeof input !== 'string') return null;
+  const raw = input.trim();
+  if (!raw) return null;
+
+  // Normalize: lower case, single spaces, strip surrounding punctuation
+  const s = raw.toLowerCase()
+    .replace(/[.,;!]+$/, '')
+    .replace(/\s+/g, ' ')
+    .trim();
+
+  // A. Relative delay in Russian: "через 15 минут", "через 2 часа"
+  const delayMatch = s.match(/^через\s+(\d+)\s*(секунд[ыа]?|сек|s|минут[ы]?|мин|m|часа?|часов|h|дней|дня|день|d)$/);
+  if (delayMatch) {
+    const num = parseInt(delayMatch[1], 10);
+    const u = delayMatch[2];
+    let unit = 'm';
+    if (u.startsWith('сек') || u === 's') unit = 's';
+    else if (u.startsWith('час') || u === 'h') unit = 'h';
+    else if (u.startsWith('дн') || u === 'день' || u === 'd') unit = 'd';
+    let delayMs = num * 60 * 1000;
+    let unitText = `${num} min`;
+    if (unit === 's') { delayMs = num * 1000; unitText = `${num} sec`; }
+    else if (unit === 'h') { delayMs = num * 3600 * 1000; unitText = `${num} h`; }
+    else if (unit === 'd') { delayMs = num * 86400 * 1000; unitText = `${num} d`; }
+    const targetMs = Date.now() + delayMs;
+    return {
+      cronPattern: null,
+      isOneShot: true,
+      targetTimestamp: targetMs,
+      humanText: `One-shot in ${unitText} (at ${new Date(targetMs).toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' })})`,
+      nextRun: targetMs,
+      isNatural: true,
+    };
+  }
+
+  // B. Periodic intervals in Russian: "каждые 15 минут", "каждые 2 часа", "каждые полчаса"
+  if (s === 'каждые полчаса' || s === 'каждые пол-часа' || s === 'every half hour') {
+    return withNextRun({
+      cronPattern: '*/30 * * * *',
+      humanText: 'Every 30 minutes',
+      isInterval: true,
+      isNatural: true,
+    });
+  }
+
+  const intervalRu = s.match(/^кажды[еяй]\s+(\d+)\s*(минут[ы]?|мин|часа?|часов|дней|дня|день)$/);
+  if (intervalRu) {
+    const num = parseInt(intervalRu[1], 10);
+    const u = intervalRu[2];
+    if (u.startsWith('мин')) {
+      if (num < 1) return null;
+      if (num < 60) {
+        return withNextRun({
+          cronPattern: `*/${num} * * * *`,
+          humanText: `Every ${num} minutes`,
+          isInterval: true,
+          isNatural: true,
+        });
+      }
+    } else if (u.startsWith('час')) {
+      if (num >= 1 && num < 24) {
+        return withNextRun({
+          cronPattern: `0 */${num} * * *`,
+          humanText: `Every ${num} hours`,
+          isInterval: true,
+          isNatural: true,
+        });
+      }
+    } else if (u.startsWith('дн') || u === 'день') {
+      if (num >= 1 && num <= 31) {
+        return withNextRun({
+          cronPattern: `0 0 */${num} * *`,
+          humanText: `Every ${num} days`,
+          isInterval: true,
+          isNatural: true,
+        });
+      }
+    }
+  }
+
+  // C. Hourly / Midnight / Noon
+  if (s === 'каждый час' || s === 'в начале каждого часа' || s === 'в начале часа' || s === 'every hour' || s === 'hourly') {
+    return withNextRun({
+      cronPattern: '0 * * * *',
+      humanText: 'Every hour',
+      isNatural: true,
+    });
+  }
+  if (s === 'в полночь' || s === 'at midnight' || s === 'midnight') {
+    return withNextRun({
+      cronPattern: '0 0 * * *',
+      humanText: 'Every day at 00:00',
+      isNatural: true,
+    });
+  }
+  if (s === 'в полдень' || s === 'at noon' || s === 'noon') {
+    return withNextRun({
+      cronPattern: '0 12 * * *',
+      humanText: 'Every day at 12:00',
+      isNatural: true,
+    });
+  }
+
+  // D. Daily at specific time:
+  const dailyMatch = s.match(/^(?:каждый\s+день|ежедневно|every\s+day|daily)\s+(?:в|at)\s+(.+)$/);
+  if (dailyMatch) {
+    const t = parseTimeString(dailyMatch[1]);
+    if (t) {
+      return withNextRun({
+        cronPattern: `${t.minute} ${t.hour} * * *`,
+        humanText: `Every day at ${pad(t.hour)}:${pad(t.minute)}`,
+        isNatural: true,
+      });
+    }
+  }
+  // Reverse: "в 9:00 каждый день", "at 9am daily"
+  const dailyRevMatch = s.match(/^(?:в|at)\s+(.+?)\s+(?:каждый\s+день|ежедневно|every\s+day|daily)$/);
+  if (dailyRevMatch) {
+    const t = parseTimeString(dailyRevMatch[1]);
+    if (t) {
+      return withNextRun({
+        cronPattern: `${t.minute} ${t.hour} * * *`,
+        humanText: `Every day at ${pad(t.hour)}:${pad(t.minute)}`,
+        isNatural: true,
+      });
+    }
+  }
+
+  // E. Weekdays at specific time:
+  const weekdayMatch = s.match(/^(?:по\s+будням|в\s+будние(?:\s+дни)?|с\s+понедельника\s+по\s+пятницу|every\s+weekday|weekdays|on\s+weekdays|mon-fri)\s+(?:в|at)\s+(.+)$/);
+  if (weekdayMatch) {
+    const t = parseTimeString(weekdayMatch[1]);
+    if (t) {
+      return withNextRun({
+        cronPattern: `${t.minute} ${t.hour} * * 1-5`,
+        humanText: `Weekdays at ${pad(t.hour)}:${pad(t.minute)}`,
+        isNatural: true,
+      });
+    }
+  }
+  // Reverse: "в 10:00 по будням"
+  const weekdayRevMatch = s.match(/^(?:в|at)\s+(.+?)\s+(?:по\s+будням|в\s+будние(?:\s+дни)?|every\s+weekday|weekdays)$/);
+  if (weekdayRevMatch) {
+    const t = parseTimeString(weekdayRevMatch[1]);
+    if (t) {
+      return withNextRun({
+        cronPattern: `${t.minute} ${t.hour} * * 1-5`,
+        humanText: `Weekdays at ${pad(t.hour)}:${pad(t.minute)}`,
+        isNatural: true,
+      });
+    }
+  }
+
+  // F. Weekends at specific time:
+  const weekendMatch = s.match(/^(?:по\s+выходным|в\s+выходные(?:\s+дни)?|по\s+субботам\s+и\s+воскресеньям|every\s+weekend|weekends|on\s+weekends)\s+(?:в|at)\s+(.+)$/);
+  if (weekendMatch) {
+    const t = parseTimeString(weekendMatch[1]);
+    if (t) {
+      return withNextRun({
+        cronPattern: `${t.minute} ${t.hour} * * 0,6`,
+        humanText: `Weekends at ${pad(t.hour)}:${pad(t.minute)}`,
+        isNatural: true,
+      });
+    }
+  }
+
+  // G. Specific day of week:
+  const dowMatch = s.match(/^(?:по\s+|кажд(?:ый|ую|ое)\s+|every\s+|on\s+)?(понедельник(?:ам)?|вторник(?:ам)?|сред[ау]|средам|четверг(?:ам)?|пятниц[ау]|пятницам|суббот[ау]|субботам|воскресень[ея]|воскресеньям|monday|mondays|tuesday|tuesdays|wednesday|wednesdays|thursday|thursdays|friday|fridays|saturday|saturdays|sunday|sundays)\s+(?:в|at)\s+(.+)$/);
+  if (dowMatch) {
+    const dayWord = dowMatch[1];
+    const dow = DAY_OF_WEEK_MAP[dayWord];
+    if (dow !== undefined) {
+      const t = parseTimeString(dowMatch[2]);
+      if (t) {
+        return withNextRun({
+          cronPattern: `${t.minute} ${t.hour} * * ${dow}`,
+          humanText: `${DAY_NAMES_EN[dow]}s at ${pad(t.hour)}:${pad(t.minute)}`,
+          isNatural: true,
+        });
+      }
+    }
+  }
+
+  // H. Monthly on specific day of month:
+  const monthlyRu = s.match(/^(?:каждое\s+(\d+)\s+число|(\d+)\s+числа\s+каждого\s+месяца)\s+(?:в|at)\s+(.+)$/);
+  if (monthlyRu) {
+    const day = parseInt(monthlyRu[1] || monthlyRu[2], 10);
+    if (day >= 1 && day <= 31) {
+      const t = parseTimeString(monthlyRu[3]);
+      if (t) {
+        return withNextRun({
+          cronPattern: `${t.minute} ${t.hour} ${day} * *`,
+          humanText: `Day ${day} of every month at ${pad(t.hour)}:${pad(t.minute)}`,
+          isNatural: true,
+        });
+      }
+    }
+  }
+
+  const monthlyEn = s.match(/^(?:on\s+the\s+(\d+)(?:st|nd|rd|th)?\s+of\s+every\s+month|every\s+month\s+on\s+the\s+(\d+)(?:st|nd|rd|th)?)\s+at\s+(.+)$/);
+  if (monthlyEn) {
+    const day = parseInt(monthlyEn[1] || monthlyEn[2], 10);
+    if (day >= 1 && day <= 31) {
+      const t = parseTimeString(monthlyEn[3]);
+      if (t) {
+        return withNextRun({
+          cronPattern: `${t.minute} ${t.hour} ${day} * *`,
+          humanText: `Day ${day} of every month at ${pad(t.hour)}:${pad(t.minute)}`,
+          isNatural: true,
+        });
+      }
+    }
+  }
+
+  // I. Standalone day of week without time (defaults to 09:00):
+  const standaloneDow = s.match(/^(?:по\s+|кажд(?:ый|ую|ое)\s+|every\s+|on\s+)(понедельник(?:ам)?|вторник(?:ам)?|сред[ау]|средам|четверг(?:ам)?|пятниц[ау]|пятницам|суббот[ау]|субботам|воскресень[ея]|воскресеньям|monday|mondays|tuesday|tuesdays|wednesday|wednesdays|thursday|thursdays|friday|fridays|saturday|saturdays|sunday|sundays)$/);
+  if (standaloneDow) {
+    const dow = DAY_OF_WEEK_MAP[standaloneDow[1]];
+    if (dow !== undefined) {
+      return withNextRun({
+        cronPattern: `0 9 * * ${dow}`,
+        humanText: `${DAY_NAMES_EN[dow]}s at 09:00`,
+        isNatural: true,
+      });
+    }
+  }
+
+  return null;
+}

package/lib/prompt-interpolation.js

@@ -14,6 +14,36 @@ function formatTime(d) {
   return `${hours}:${minutes}:${seconds}`;
 }
 
+/**
+ * Safely extract nested property from object by path.
+ * Supports dot and array bracket notation: "alerts[0].labels.container" or "issue.title".
+ */
+export function getNestedValue(obj, path) {
+  if (!obj || typeof obj !== 'object' || !path) return undefined;
+  // If property exists directly (e.g. headers with dashes like "x-github-event")
+  if (Object.prototype.hasOwnProperty.call(obj, path)) {
+    return obj[path];
+  }
+  // Try lowercase lookup for headers
+  const lowerPath = path.toLowerCase();
+  for (const [k, v] of Object.entries(obj)) {
+    if (k.toLowerCase() === lowerPath) return v;
+  }
+
+  const normalized = path.replace(/\[(\w+)\]/g, '.$1');
+  const parts = normalized.split('.');
+  let current = obj;
+  for (const p of parts) {
+    if (current == null) return undefined;
+    if (typeof current === 'object' && Object.prototype.hasOwnProperty.call(current, p)) {
+      current = current[p];
+    } else {
+      return undefined;
+    }
+  }
+  return current;
+}
+
 /**
  * Build dictionary of prompt interpolation variables for a task and run options.
  */
@@ -73,6 +103,16 @@ export function buildPromptContext(task = {}, options = {}) {
     'task_title': task.title || '',
   };
 
+  // Webhook context (#348)
+  if (options.webhook && typeof options.webhook === 'object') {
+    ctx.__webhook = options.webhook;
+    if (options.webhook.body !== undefined) {
+      ctx['webhook.body'] = typeof options.webhook.body === 'object'
+        ? JSON.stringify(options.webhook.body)
+        : String(options.webhook.body);
+    }
+  }
+
   // DAG / Fan-In predecessor outputs (#328)
   if (options.prevOutputs && typeof options.prevOutputs === 'object') {
     for (const [k, v] of Object.entries(options.prevOutputs)) {
@@ -90,14 +130,17 @@ export function buildPromptContext(task = {}, options = {}) {
 
 /**
  * Replace {{var}} or {var} placeholders with values from context.
- * Supports dot notation like {{prev.output}} and bracket notation like {{prevOutputs['step1']}}.
+ * Supports dot notation like {{prev.output}}, bracket notation like {{prevOutputs['step1']}},
+ * and nested webhook properties like {{webhook.body.alerts[0].labels.container}} (#348).
  */
 export function interpolateTaskPrompt(text, context = {}) {
   if (typeof text !== 'string') return text;
   if (!text) return '';
 
-  // 1. Bracket notation: {{prevOutputs['step1']}} or {prevOutputs['step1']} or with double quotes
-  let result = text.replace(/\{\{?prevOutputs\[['"]([^'"]+)['"]\]\}?\}/g, (match, stepId) => {
+  let result = text;
+
+  // 1. Bracket notation for DAG: {{prevOutputs['step1']}} or {prevOutputs['step1']}
+  result = result.replace(/\{\{?prevOutputs\[['"]([^'"]+)['"]\]\}?\}/g, (match, stepId) => {
     const key = `prevOutputs.${stepId}`;
     if (Object.prototype.hasOwnProperty.call(context, key)) {
       return context[key];
@@ -105,7 +148,21 @@ export function interpolateTaskPrompt(text, context = {}) {
     return match;
   });
 
-  // 2. Standard {{var}} and {var}
+  // 2. Webhook payload interpolation (#348): {webhook.body.path}, {webhook.headers.key}, {webhook.query.param}
+  if (context.__webhook && typeof context.__webhook === 'object') {
+    result = result.replace(/\{\{?webhook\.(body|headers|query)(?:\.([a-zA-Z0-9_.\[\]-]+))?\}?\}/g, (match, source, path) => {
+      const srcObj = context.__webhook[source];
+      if (!path) {
+        if (srcObj === undefined) return '';
+        return typeof srcObj === 'object' ? JSON.stringify(srcObj) : String(srcObj);
+      }
+      const val = getNestedValue(srcObj, path);
+      if (val === undefined) return '';
+      return typeof val === 'object' ? JSON.stringify(val) : String(val);
+    });
+  }
+
+  // 3. Standard {{var}} and {var}
   result = result.replace(/\{\{([a-zA-Z0-9_.]+)\}\}/g, (match, varName) => {
     if (Object.prototype.hasOwnProperty.call(context, varName)) {
       const val = context[varName];
@@ -143,5 +200,20 @@ export function resolveTaskForExecution(task, options = {}) {
   if (typeof resolved.url === 'string') {
     resolved.url = interpolateTaskPrompt(resolved.url, context);
   }
+
+  // Expose webhook payload in process environment for scripts (#348)
+  if (options.webhook && typeof options.webhook === 'object') {
+    const env = { ...(resolved.env || {}) };
+    if (options.webhook.body !== undefined) {
+      env.DSH_CRON_WEBHOOK_BODY = typeof options.webhook.body === 'object'
+        ? JSON.stringify(options.webhook.body)
+        : String(options.webhook.body);
+    }
+    if (options.webhook.headers !== undefined) {
+      env.DSH_CRON_WEBHOOK_HEADERS = JSON.stringify(options.webhook.headers);
+    }
+    resolved.env = env;
+  }
+
   return resolved;
 }

package/lib/routes.js

@@ -1,3 +1,4 @@
+import { handleTaskWebhookRoute } from './api-task-webhook.js';
 import { calculateCostHeatmap } from './timeline.js';
 import { buildAnalyticsDigest, formatDigestMarkdown, sendAnalyticsDigest } from './analytics-digest.js';
 import { listVerifiedRecipes } from './recipes-catalog.js';
@@ -35,6 +36,13 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
     handler: createCronApiHandler(store, scheduler, null)
   }), 'dsh-cron: /telegram[...]');
 
+  // Incoming HTTP Webhook triggers (#348)
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'prefix',
+    path: '/dsh-cron/webhook',
+    handler: (req, res) => handleTaskWebhookRoute({ store, scheduler, req, res })
+  }), 'dsh-cron: /webhook[...]');
+
   ctx.effect(() => ctx.webServer.register({
     kind: 'prefix',
     path: '/dsh-cron/heartbeat-ping',

package/lib/scheduler.js

@@ -2,6 +2,7 @@ import { logger } from './logger.js';
 import { bestEffort } from './best-effort.js';
 import { Cron } from 'croner';
 import { FileSystemWatcherManager } from './watcher.js';
+import { parseNaturalSchedule } from './nl-schedule.js';
 
 const MAX_TIMEOUT_MS = 2147483647; // 2^31 - 1 ms (~24.85 days)
 import {
@@ -31,6 +32,7 @@ import {
 } from './scheduler-lifecycle.js';
 
 export {
+  parseNaturalSchedule,
   executePreflight,
   AGENT_TASK_TYPES,
   addUsage,
@@ -212,25 +214,35 @@ function parseIntervalExpression(str) {
  * @-shorthands (#15) and the friendly aliases, including the Russian input
  * aliases. Russian keywords are accepted input, not display strings.
  */
+function makeAliasResult(cronPattern, humanText) {
+  try {
+    const job = new Cron(cronPattern, { sloppyRanges: true });
+    const next = job.nextRun();
+    return { cronPattern, humanText, nextRun: next ? next.getTime() : null };
+  } catch {
+    return { cronPattern, humanText };
+  }
+}
+
 function parseAliasExpression(str) {
   const lower = str.toLowerCase();
-  if (lower === '@hourly') return { cronPattern: '0 * * * *', humanText: 'Every hour' };
-  if (lower === '@daily' || lower === '@midnight') return { cronPattern: '0 0 * * *', humanText: 'Every day at 00:00' };
-  if (lower === '@weekly') return { cronPattern: '0 0 * * 0', humanText: 'Every week on Sunday at 00:00' };
-  if (lower === '@monthly') return { cronPattern: '0 0 1 * *', humanText: 'Every month on the 1st at 00:00' };
-  if (lower === '@yearly' || lower === '@annually') return { cronPattern: '0 0 1 1 *', humanText: 'Every year on Jan 1 at 00:00' };
+  if (lower === '@hourly') return makeAliasResult('0 * * * *', 'Every hour');
+  if (lower === '@daily' || lower === '@midnight') return makeAliasResult('0 0 * * *', 'Every day at 00:00');
+  if (lower === '@weekly') return makeAliasResult('0 0 * * 0', 'Every week on Sunday at 00:00');
+  if (lower === '@monthly') return makeAliasResult('0 0 1 * *', 'Every month on the 1st at 00:00');
+  if (lower === '@yearly' || lower === '@annually') return makeAliasResult('0 0 1 1 *', 'Every year on Jan 1 at 00:00');
   const everyAlias = str.match(/^@every\s+(\d+)\s*(sec|seconds?|m|min|minutes?|h|hr|hours?|d|days?)$/i);
   if (everyAlias) {
     return parseIntervalExpression(`every ${everyAlias[1]} ${everyAlias[2]}`);
   }
   if (lower === 'daily' || lower === 'каждый день') {
-    return { cronPattern: '0 9 * * *', humanText: 'Every day at 09:00' };
+    return makeAliasResult('0 9 * * *', 'Every day at 09:00');
   }
   if (lower === 'weekdays' || lower === 'в будние дни' || lower === 'по будням') {
-    return { cronPattern: '0 9 * * 1-5', humanText: 'Weekdays at 09:00' };
+    return makeAliasResult('0 9 * * 1-5', 'Weekdays at 09:00');
   }
   if (lower === 'hourly' || lower === 'каждый час') {
-    return { cronPattern: '0 * * * *', humanText: 'Every hour' };
+    return makeAliasResult('0 * * * *', 'Every hour');
   }
   return null;
 }
@@ -261,6 +273,7 @@ export function parseScheduleExpression(input) {
     || parseRelativeOneShot(str)
     || parseIntervalExpression(str)
     || parseAliasExpression(str)
+    || parseNaturalSchedule(str)
     || parseCronExpression(str);
 }
 

package/lib/store.js

@@ -629,6 +629,12 @@ export class TaskStore {
       targetSessionId: task.targetSessionId !== undefined ? String(task.targetSessionId).trim() : (prev.targetSessionId || ''),
       targetSessionReset: task.targetSessionReset !== undefined ? String(task.targetSessionReset).trim() : (prev.targetSessionReset || 'never'),
       sessionTitle: task.sessionTitle !== undefined ? String(task.sessionTitle).trim() : (prev.sessionTitle || ''),
+      webhookEnabled: task.webhookEnabled !== undefined
+        ? Boolean(task.webhookEnabled)
+        : (prev.webhookEnabled !== undefined ? Boolean(prev.webhookEnabled) : Boolean(task.webhookTrigger?.enabled || prev.webhookTrigger?.enabled || false)),
+      webhookToken: task.webhookToken !== undefined ? String(task.webhookToken).trim() : (prev.webhookToken || (task.webhookTrigger?.token ? String(task.webhookTrigger.token).trim() : '')),
+      webhookSecret: task.webhookSecret !== undefined ? String(task.webhookSecret).trim() : (prev.webhookSecret || (task.webhookTrigger?.secret ? String(task.webhookTrigger.secret).trim() : '')),
+      webhookDebounceMs: task.webhookDebounceMs !== undefined ? Number(task.webhookDebounceMs) : (prev.webhookDebounceMs !== undefined ? Number(prev.webhookDebounceMs) : (Number(task.webhookTrigger?.debounceMs || prev.webhookTrigger?.debounceMs) || 0)),
       totalTokens: task.totalTokens !== undefined ? Number(task.totalTokens) : (prev.totalTokens || 0),
       totalCostUsd: task.totalCostUsd !== undefined ? Number(task.totalCostUsd) : (prev.totalCostUsd || 0),
       createdAt: prev.createdAt || task.createdAt || now,

package/lib/task-create.js

@@ -49,6 +49,10 @@ export function executeCreateTask(store, scheduler, args) {
     targetSessionId: args.targetSessionId ? String(args.targetSessionId).trim() : '',
     targetSessionReset: args.targetSessionReset ? String(args.targetSessionReset).trim() : 'never',
     sessionTitle: args.sessionTitle ? String(args.sessionTitle).trim() : '',
+    webhookEnabled: args.webhookEnabled !== undefined ? Boolean(args.webhookEnabled) : (args.webhookTrigger?.enabled !== undefined ? Boolean(args.webhookTrigger.enabled) : false),
+    webhookToken: args.webhookToken ? String(args.webhookToken).trim() : (args.webhookTrigger?.token ? String(args.webhookTrigger.token).trim() : undefined),
+    webhookSecret: args.webhookSecret ? String(args.webhookSecret).trim() : (args.webhookTrigger?.secret ? String(args.webhookTrigger.secret).trim() : undefined),
+    webhookDebounceMs: args.webhookDebounceMs !== undefined ? Number(args.webhookDebounceMs) : (args.webhookTrigger?.debounceMs !== undefined ? Number(args.webhookTrigger.debounceMs) : undefined),
     onSuccess: args.onSuccess ? String(args.onSuccess).trim() : '',
     onFailure: args.onFailure ? String(args.onFailure).trim() : '',
     dependsOn: args.dependsOn !== undefined ? sanitizeDependsOn(args.dependsOn) : undefined,

package/lib/task-patch.js

@@ -91,6 +91,18 @@ export function buildTaskPatch(current, body) {
       return { ok: false, error: err.message };
     }
   }
+  if (patch.webhookEnabled !== undefined) {
+    patch.webhookEnabled = Boolean(patch.webhookEnabled);
+  }
+  if (patch.webhookToken !== undefined) {
+    patch.webhookToken = String(patch.webhookToken).trim();
+  }
+  if (patch.webhookSecret !== undefined) {
+    patch.webhookSecret = String(patch.webhookSecret).trim();
+  }
+  if (patch.webhookDebounceMs !== undefined) {
+    patch.webhookDebounceMs = Math.max(0, Number(patch.webhookDebounceMs) || 0);
+  }
   if (patch.requireApproval !== undefined) {
     patch.requireApproval = Boolean(patch.requireApproval);
   }

package/lib/task-transfer.js

@@ -34,6 +34,11 @@ export const PATCHABLE_TASK_FIELDS = [
   'targetSessionId',
   'targetSessionReset',
   'sessionTitle',
+  'webhookEnabled',
+  'webhookToken',
+  'webhookSecret',
+  'webhookDebounceMs',
+  'webhookTrigger',
   'env',
   'cwd',
   'workspaceId',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cron",
-  "version": "0.3.9",
+  "version": "0.3.11",
   "description": "Background automation runner for DSH: isolated agent runs, script/HTTP/SSH/Docker runtimes, cost guard, notifications, heartbeats.",
   "type": "module",
   "main": "lib/index.js",