Validate task updates against merged state

Co-authored-by: DanielWalnut <hetaoBackend@users.noreply.github.com>

Author: cursoragent

backend/src/api.ts

@@ -2247,37 +2247,15 @@ async function handlePut(
         origin,
       );
     }
-    const prompt = asString(body["prompt"] ?? task["prompt"]);
-    if (!prompt.trim())
+    const validated = validateTaskInput(ctx, { ...task, ...body });
+    if (validated.response) {
       return jsonResponse(
-        { error: "prompt cannot be empty", field: "prompt" },
-        400,
+        validated.response[0],
+        validated.response[1] ?? 400,
         origin,
       );
-    const workingDir = asString(body["working_dir"] ?? task["working_dir"]);
-    const dirError = ensureWorkingDir(
-      workingDir,
-      `working_dir does not exist: ${workingDir}`,
-    );
-    if (dirError) return jsonResponse(dirError, 400, origin);
-    const scheduleType = asString(
-      body["schedule_type"] ?? task["schedule_type"],
-    );
-    const cronExpr = asString(body["cron_expr"] ?? task["cron_expr"]);
-    if (scheduleType === "cron") {
-      if (!cronExpr.trim())
-        return jsonResponse(
-          { error: "cron_expr required for cron schedule", field: "cron_expr" },
-          400,
-          origin,
-        );
-      if (!cronValid(cronExpr))
-        return jsonResponse(
-          { error: `invalid cron expression: ${cronExpr}`, field: "cron_expr" },
-          400,
-          origin,
-        );
     }
+    const fields = validated.task!;
 
     const updates: Row = {};
     for (const field of [
@@ -2303,9 +2281,12 @@ async function handlePut(
         parseJsonList(body["image_paths"]),
       );
 
-    const newScheduleType = asString(
-      updates["schedule_type"] ?? task["schedule_type"],
-    );
+    if ("prompt" in body) updates["prompt"] = fields.prompt;
+    if ("working_dir" in body) updates["working_dir"] = fields.workingDir;
+    if ("schedule_type" in body) updates["schedule_type"] = fields.scheduleType;
+    if ("agent" in body) updates["agent"] = fields.agent;
+
+    const newScheduleType = fields.scheduleType;
     if (newScheduleType === "immediate") {
       Object.assign(updates, {
         status: "pending",
@@ -2318,28 +2299,19 @@ async function handlePut(
         status: "pending",
         next_run_at: null,
         cron_expr: null,
+        delay_seconds: fields.delaySeconds,
       });
     } else if (newScheduleType === "scheduled_at") {
-      const nextRunAt = body["next_run_at"] ?? task["next_run_at"];
-      if (!nextRunAt)
-        return jsonResponse(
-          {
-            error: "next_run_at required for scheduled_at",
-            field: "next_run_at",
-          },
-          400,
-          origin,
-        );
       Object.assign(updates, {
-        next_run_at: nextRunAt,
+        next_run_at: fields.nextRunAt,
         status: "scheduled",
         cron_expr: null,
         delay_seconds: null,
       });
     } else if (newScheduleType === "cron") {
-      const newCron = asString(updates["cron_expr"] ?? task["cron_expr"]);
       Object.assign(updates, {
-        next_run_at: cronNextIso(newCron),
+        cron_expr: fields.cronExpr,
+        next_run_at: cronNextIso(fields.cronExpr!),
         status: "scheduled",
         delay_seconds: null,
       });

backend/tests/api-handler.test.ts

@@ -1292,6 +1292,97 @@ describe("api handler", () => {
     expect(db.get_all_tasks()).toHaveLength(0);
   });
 
+  test("PUT /api/tasks validates the merged final task without partial updates", async () => {
+    async function createTask(
+      payload: Record<string, unknown>,
+    ): Promise<number> {
+      const created = await json(
+        new Request("http://127.0.0.1:9712/api/tasks", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ prompt: "original", ...payload }),
+        }),
+      );
+      return Number(created.id);
+    }
+
+    const delayedId = await createTask({
+      title: "Delayed",
+      schedule_type: "delayed",
+      delay_seconds: 120,
+      agent: "codex",
+    });
+    const partial = await handleApiRequest(
+      ctx,
+      new Request(`http://127.0.0.1:9712/api/tasks/${delayedId}`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ title: "Renamed" }),
+      }),
+    );
+    expect(partial.status).toBe(200);
+    expect(db.get_task(delayedId)).toMatchObject({
+      title: "Renamed",
+      schedule_type: "delayed",
+      delay_seconds: 120,
+      agent: "codex",
+    });
+
+    for (const [body, field] of [
+      [{ title: "Must not change", schedule_type: "invalid" }, "schedule_type"],
+      [{ title: "Must not change", agent: "invalid" }, "agent"],
+      [{ title: "Must not change", schedule_type: "cron" }, "cron_expr"],
+      [
+        { title: "Must not change", schedule_type: "scheduled_at" },
+        "next_run_at",
+      ],
+    ] as const) {
+      const before = db.get_task(delayedId);
+      const res = await handleApiRequest(
+        ctx,
+        new Request(`http://127.0.0.1:9712/api/tasks/${delayedId}`, {
+          method: "PUT",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(body),
+        }),
+      );
+      expect(res.status).toBe(400);
+      expect(await res.json()).toMatchObject({ field });
+      expect(db.get_task(delayedId)).toEqual(before);
+    }
+
+    const immediateId = await createTask({ title: "Immediate" });
+    const missingDelay = await handleApiRequest(
+      ctx,
+      new Request(`http://127.0.0.1:9712/api/tasks/${immediateId}`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          title: "Must not change",
+          schedule_type: "delayed",
+        }),
+      }),
+    );
+    expect(missingDelay.status).toBe(400);
+    expect(await missingDelay.json()).toMatchObject({ field: "delay_seconds" });
+    expect(db.get_task(immediateId)!["title"]).toBe("Immediate");
+
+    const badDir = await handleApiRequest(
+      ctx,
+      new Request(`http://127.0.0.1:9712/api/tasks/${immediateId}`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          title: "Must not change",
+          working_dir: path.join(tmpDir, "missing-put-dir"),
+        }),
+      }),
+    );
+    expect(badDir.status).toBe(400);
+    expect(await badDir.json()).toMatchObject({ field: "working_dir" });
+    expect(db.get_task(immediateId)!["title"]).toBe("Immediate");
+  });
+
   test("task mutation routes edit, respond, resume, cancel, retry, and remove dependencies", async () => {
     const upstream = await json(
       new Request("http://127.0.0.1:9712/api/tasks", {