v0.14.5

Security fix

Fixes #6: sandbox-confined sessions could create cron jobs that executed with host privileges, through agent access overrides, command tasks, or delivery commands.

• Mutating cron tools now require effective danger-full-access sandbox permissions and never approval. Restricted, Auto, unresolved, and unavailable permissions fail closed.
• Manual jobs carry authorization bound to their exact spec, with checks before dispatch and delivery, including after waiting for execution capacity.
• Command and delivery processes use an explicit environment allowlist. Additional variable names must be granted by the operator through commandEnv.
• Explicit agent access setup errors stop the run before prompt submission.
• HTTP write endpoints require an independent operator token, preventing loopback HTTP from bypassing tool authorization.

Upgrade requirements

• Existing manual jobs are quarantined until reviewed and saved again. Job specs and history are retained. Review task, access, cwd, and delivery, then use Edit → Save. Enable and Run now cannot bypass this check.
• Web writes require webControlToken: configure a random secret of at least 32 characters in protected host configuration. The UI prompts for it and keeps it only in memory. Unset/short tokens disable web writes. Never share it with a restricted agent; use HTTPS for remote access.
• Cron remains host administration: this release does not add sandboxed cron execution for restricted sessions. Config-declared and plugin-registered jobs remain trusted host declarations.
• Scripts that relied on inherited application credentials must explicitly configure required environment variable names in commandEnv.

See README / README.zh-CN.md for the full security boundary and migration details.

Compatibility and validation

• Includes declared dsh 0.2.0-rc.2 compatibility.
• All 109 tests passed, including security, migration/restart, environment filtering, and browser token flow regressions.
• Authorization schema round-trip and module imports checked against installed dsh 0.2 host packages.

Install

dsh plugin --profile web add https://github.com/squirrel20/dsh-cron/releases/download/v0.14.5/dsh-cron.tgz

The npm package named dsh-cron is unrelated. Install this GitHub Release asset or use the Plugin Market.

v0.14.3

Fix

• The sidebar Cron Jobs section no longer disappears on dsh 0.1.7 (#5, reported by @gychen-NJU). 0.1.7 renamed the primitives icon exports (IconPlusOutline16 → IconPlusOutlineRegular, …); the unresolved icons made React throw #130 and the host dropped the whole sidebar.footer.action entry.
• Icons now resolve through a fallback table: Icon<Name>Regular first, the legacy Icon<Name><Size> second, an empty glyph last. The same bundle works on 0.1.5 and 0.1.7, and a future rename costs an icon rather than the section.

Compatibility

• Peer range widened to ^0.1.1-rc.2 || ^0.1.5-rc.2 || ^0.1.7-rc.2.

v0.14.2

Fix

• A run's Session is now a plain durable Session (no origin: "subagent" header), so a finished agent run's conversation can be reopened from its run row instead of failing with session/agent-busy (#2, #4 by @ai-chase).
• The overlay's openSession re-pulls the host session list once when a settled run's id is no longer listed, then retries; ids that stay unknown fall back to the run-detail page.

Behaviour changes (accepted trade-offs)

• Run Sessions now appear in the workspace sidebar; high-frequency jobs accumulate entries.
• The host no longer refuses prompts to a running run's Session; a message typed mid-run joins the unattended run and may surface in its summary.
• Run Sessions persisted by earlier versions keep the old header and stay unopenable.

v0.14.1

v0.14.1 — dsh 0.1.5 compatibility

• Session format V3: run summaries read events via session.eventAt(seq) (the events array is gone in dsh ≥ 0.1.5); older hosts keep working.
• Path-safe session ids: cron-<slug>-<uuid> — dsh ≥ 0.1.5 keys the session projection cache by session id and rejects non-ASCII names; non-ASCII job names no longer log per-record key … is not path-safe on every run.
• Peer dependency ranges accept ^0.1.5-rc.2.

v0.14.1 — 兼容 dsh 0.1.5

• 会话格式 V3：运行摘要改经 session.eventAt(seq) 读事件（dsh ≥ 0.1.5 不再暴露 events 数组）；旧宿主仍可用。
• 路径安全的会话 id：cron-<slug>-<uuid>，dsh ≥ 0.1.5 按会话 id 落投影缓存、拒绝非 ASCII；中文作业名不再每次运行都报 per-record key … is not path-safe。
• peer 依赖范围接受 ^0.1.5-rc.2。

---

Also carries the unreleased v0.14.0 changes (plugin-registered jobs via ctx.cron.registerJob and callback tasks); no GitHub Release was cut for 0.14.0. / 同时包含未单独发布的 v0.14.0（插件注册作业 ctx.cron.registerJob 与 callback 任务）。

v0.13.0

插件模式注册定时作业：ctx.cron.registerJob；卸载保留历史成 orphan 行；domain 加 plugin 表但不升 version

v0.12.1

修复：打开会话时关闭 command 运行详情页

v0.12.0

自 v0.9.8 以来累积四个版本（0.9.9 / 0.10.x / 0.11.0 从未单独发布）。

0.12.0 — 运行并发默认不再设上限

maxConcurrentRuns 由 1 改为 0（不限）。此前宿主上所有作业严格串行，撞在同一分钟到期的作业只能依次排队，彼此毫无关系也要互等；作业自身的重叠早已由 policy.overlap 管辖，这层全局闸门是多余的第二重约束。又因为 run 记录是在获取闸门之前就写成 running 的，排队未开跑的作业还会伪装成"运行中"。

现在 Gate 持有 Infinity 槽位、acquire 恒穿透；仍想给宿主压总负载的，把 maxConcurrentRuns 设成正数即可，行为与旧版一致。

0.11.0 — 定时任务区视图选项

区块标题的视图菜单可选排序方式：智能（运行中→失败→按下次触发）/ 名称 / 下次执行 / 最近执行。

0.10.1 — command 运行输出实时流

command 类运行的 stdout/stderr 边跑边推到运行详情页，不必等运行结束。

0.10.0 — command 运行详情页

command 运行的详情从行内展开改为在中央区域打开完整详情页，与 agent 运行打开会话回放的动线一致。

0.9.9 — 作业描述字段

description 可选字段，界面与会话内创建均可填写。

作业名放宽为任意语种

JOB_NAME_RE 由 ^[a-z][a-z0-9-]*$ 放宽为任意语种字母/数字加 - _，中文作业名可用。会话目录识别（GC）同步放宽，否则 cron-<中文名>-<uuid> 目录不被认领而永久堆积。

v0.9.8

作业弹窗触发预设分段改版（含 0.9.3–0.9.8 累计变更）。

触发预设（0.9.4–0.9.7）

• 触发区从 cron/周期/一次性 三段改为 每小时 / 每天 / 工作日 / 每周 / 自定义 五档预设，常用调度免写 cron；原三种形态收进自定义档。
• 预设编译为普通 cron 形态（M * * * *、M H * * *、M H * * 1-5、M H * * DOW），编辑时 deriveTrigger 反推回对应档位，认不出的表达式落自定义档。
• 时区输入移除：新建静默取浏览器当前时区（兜底 Asia/Shanghai），编辑沿用作业原时区。
• 窄内容输入改固定宽度；分钟/超时/重叠时/错过时统一 104px。

弹窗布局（0.9.3）

• routine 式布局改版：prompt 编辑器附带模式/权限/模型工具条与工作目录行；删除 framing 提示行。

文档（0.9.8）

• cron-create skill 补充预设可读回的 cron 形态建议与时区行为说明；两份 README 同步预设交互描述，新建作业截图更新。

v0.9.2

恢复侧边栏状态点高亮：job 行与运行行按最近一次结果着色（绿=成功、黄=中止/替换、红=失败、蓝=运行中）；仅「已禁用」和「从未运行」保持灰显。回退 0.8.x 中的整体灰显改动。

v0.9.0

会话内创建/删除 cron 作业：新增 cron_create / cron_delete 工具（与网页创建对话框共用 manual 表通道），以及 cron-create 运行时 skill（注册进 host skill 层，/cron-create 或模型自动触发，覆盖收集→确认→创建→验证→撤销全流程与完整 spec 词汇）。