@linxin666/dsh-client-ui-task-board 0.1.15 → 0.1.17

package/lib/index.js

@@ -5,7 +5,7 @@ import z from "schemastery";
 const SECTION_ORDER = 200;
 const inject = ["systemPrompt"];
 /** Model-facing announcement: plugin presence, capabilities, and limits. */
-const TASK_BOARD_GUIDANCE = "本机已安装 dsh-task-board 插件（DSH Web GUI 的任务看板）：侧边栏「任务看板」入口；在 dsh-web-ui 插件全家桶仓库（packages/dsh-task-board）统一维护，经聚合包 web-ui-all 一键安装。能力：多列看板管理任务；任务可真实执行（驱动 agent 会话）；任务支持 5 段 cron 定时执行（如 0 23 * * *）；数据存浏览器 localStorage（键 dsh.taskBoard.v1）。限制：定时调度在浏览器端，需 GUI 标签页打开，错过即跳过；执行消耗 API 额度。用户提到「任务看板 / 看板 / 定时任务」时即指本插件，请据此协作。";
+const TASK_BOARD_GUIDANCE = "本机已安装 dsh-task-board 插件（DSH Web GUI 的任务看板）：侧边栏「任务看板」入口；在 dsh-web-ui 插件全家桶仓库（packages/dsh-task-board）统一维护，经聚合包 web-ui-all 一键安装。能力：多列看板管理任务；任务可真实执行（驱动 agent 会话）；任务可钉住执行目标——工作区 / 模式（agent 预设）/ 权限（read-only / workspace-write / danger-full-access），缺省用运行时默认；任务支持 5 段 cron 定时执行（如 0 23 * * *）；数据存浏览器 localStorage（键 dsh.taskBoard.v1）。限制：定时调度在浏览器端，需 GUI 标签页打开，错过即跳过；执行消耗 API 额度。用户提到「任务看板 / 看板 / 定时任务」时即指本插件，请据此协作。";
 /**
 * Settings namespace of the board's announcement capability — the section the
 * web settings surface edits. Spelled here rather than imported: the browser

package/lib/types/client/locales.d.ts

@@ -72,6 +72,20 @@ export declare const zh: {
     'detail.schedule.notScheduled': string;
     'detail.schedule.dueSoon': string;
     'card.scheduled': string;
+    'new.workspace': string;
+    'new.mode': string;
+    'new.permission': string;
+    'exec.workspace.recent': string;
+    'exec.mode.default': string;
+    'exec.mode.defaultSuffix': string;
+    'exec.mode.brokenSuffix': string;
+    'exec.mode.removed': string;
+    'exec.permission.default': string;
+    'exec.permission.read-only': string;
+    'exec.permission.workspace-write': string;
+    'exec.permission.danger-full-access': string;
+    'detail.executionSettings': string;
+    'exec.hint': string;
     'settings.title': string;
     'settings.description': string;
     'settings.enabled': string;

package/lib/types/client/settings-form.d.ts

@@ -18,6 +18,14 @@ export type FieldWrite = {
 export interface FieldSpec {
     /** Field name inside the namespace section. */
     field: string;
+    /**
+     * Whether the Host treats this field as a secret and redacts its value from
+     * the read-back (role('secret') in the section schema). Redacted secrets are
+     * never compared against the draft on save; the field lands when the scope
+     * reports the write succeeded (its secret-set marker under the bridge), so
+     * a successful secret save is not misreported as failed.
+     */
+    secret?: boolean;
     /** Render a stored value as draft text; the empty string when the section carries none. */
     format: (value: unknown) => string;
     /**
@@ -57,6 +65,12 @@ export interface CardShell {
     saving: boolean;
     /** Whether the last save did not land as staged; cleared by the next edit or save. */
     failed: boolean;
+    /**
+     * The rejection code/message the Host returned for the last failed save,
+     * surfaced next to the generic failure text. Undefined while no save has
+     * failed (or the failure carried no server reason).
+     */
+    failedReason?: string;
 }
 /** The write actions the card's slot entry injects. */
 export interface CardActions {
@@ -69,6 +83,37 @@ export interface CardActions {
     /** Drop every staged edit. */
     discard: () => void;
 }
+/** One durable write a batched settings scope performs. */
+export interface BatchedWrite {
+    /** Field this entry writes. */
+    field: string;
+    /** set stores a value; unset drops the leaf. */
+    op: 'set' | 'unset';
+    /** Value for op set (absent for unset). */
+    value?: unknown;
+}
+/** Per-field outcome of one batched scope write. */
+export interface BatchedFieldResult {
+    /** Field this entry writes. */
+    field: string;
+    /** Whether the Host accepted this field's write (per the read-back view). */
+    landed: boolean;
+}
+/**
+ * Result of a batched scope write. The bridge scope posts every planned write
+ * in one /mutate so the Host validate hook judges baseURL+model together; a
+ * batched refusal fails the whole save rather than per-field.
+ */
+export interface BatchResult {
+    /** Whether the whole mutate was accepted. */
+    ok: boolean;
+    /** Per-field success, in the request order (always present when ok). */
+    fields: BatchedFieldResult[];
+    /** Host rejection code (mutate refused). */
+    code?: string;
+    /** Host rejection message (mutate refused). */
+    message?: string;
+}
 /** Constraints a numeric field's accepted drafts must satisfy, mirroring the host schema. */
 export interface NumberConstraints {
     /** The accepted value must be a whole number. */
@@ -80,6 +125,13 @@ export interface NumberConstraints {
 export declare function numberField(field: string, constraints?: NumberConstraints): FieldSpec;
 /** A free-text field. An empty draft clears the field. */
 export declare function textField(field: string): FieldSpec;
+/**
+ * A free-text field the Host treats as a secret and redacts from the read-back
+ * (role('secret') in the section schema). The card still edits it like text,
+ * but a save never compares the redacted value back and relies on the scope
+ * reporting the write landed.
+ */
+export declare function secretField(field: string): FieldSpec;
 /** A boolean field, edited through true/false draft text. */
 export declare function booleanField(field: string): FieldSpec;
 /** An enumerated string field; only the listed choices are accepted. An empty draft clears the field. */
@@ -99,6 +151,7 @@ export declare class CardForm<T> {
     private readonly listeners;
     private saving;
     private failed;
+    private failedReason;
     /** @param scope - the bound settings scope for this card's namespace. */
     constructor(scope: SettingsScope<T>, specs: FieldSpec[]);
     /** Publish a projection of this form, rebuilt whenever the scope or a draft changes. */
@@ -111,9 +164,18 @@ export declare class CardForm<T> {
     actions(): CardActions;
     /**
      * Write every staged edit, then re-seed from what the Host accepted.
+     *
+     * When the scope carries the optional batch surface (the dsh-web-ui
+     * bridge scope), every planned write rides one mutation so cross-field
+     * validate hooks (baseURL+model) judge the batch as a unit instead of
+     * deadlocking on per-field writes. Otherwise the per-field loop runs.
+     * A field lands only when the Host reports it held the staged value; a
+     * landed field's draft is dropped, a failed one stays staged for the user.
      * @returns settlement after every write and the read-back.
      */
     save(): Promise<void>;
+    /** The scope's batch surface when it supports one; undefined conservatively otherwise. */
+    private batchedScope;
     /**
      * Every staged edit a save would write. An entry whose draft is not a value
      * its field accepts carries no write: the form is still dirty, and the save

package/lib/types/core/controller.d.ts

@@ -16,6 +16,7 @@
 import { ExecutionService } from './execution.ts';
 import type { TaskStore } from './store.ts';
 import { type NewTaskInput, type TaskRecord, type TaskStatus } from './tasks.ts';
+import { type TaskUpdatePatch } from './use-cases/task-update.ts';
 /** The sessions face the controller needs for navigation awareness. */
 export interface SessionsControllerFace {
     list: {
@@ -39,11 +40,33 @@ export interface ControllerDeps {
     /** Debounce (ms) for session-list-changed reconciles; defaults to 350. */
     reconcileDebounceMs?: number;
 }
+/** One workspace option the execution-target pickers offer. */
+export interface ExecutionWorkspaceOption {
+    workspaceId: string;
+    /** Display label (workspace title; the wiring falls back to the path). */
+    title: string;
+}
+/** One agent-preset option the execution-target pickers offer. */
+export interface ExecutionPresetOption {
+    id: string;
+    name?: string;
+    description?: string;
+    /** Why this preset cannot compose a session; the pickers disable it. */
+    broken?: string;
+    isDefault: boolean;
+}
+/** The execution-target option sets the UI feeds into the controller. */
+export interface ExecutionOptionsSnapshot {
+    workspaces: readonly ExecutionWorkspaceOption[];
+    presets: readonly ExecutionPresetOption[];
+}
 /** Immutable controller snapshot for UI subscriptions. */
 export interface ControllerSnapshot {
     tasks: readonly TaskRecord[];
     boardOpen: boolean;
     selectedTaskId: string | undefined;
+    /** Picker option sets (workspace list + agent-preset roster). */
+    executionOptions: ExecutionOptionsSnapshot;
 }
 /** The selected task (resolved from the ledger), or undefined. */
 export declare function selectedTaskOf(snapshot: ControllerSnapshot): TaskRecord | undefined;
@@ -56,6 +79,7 @@ export declare class BoardController {
     private tasks;
     private boardOpen;
     private selectedTaskId;
+    private executionOptions;
     private listeners;
     private disposers;
     private readonly now;
@@ -74,7 +98,12 @@ export declare class BoardController {
     openTask(id: string): void;
     closeTask(): void;
     createTask(input: NewTaskInput): TaskRecord | undefined;
-    updateTask(id: string, patch: Partial<Pick<TaskRecord, 'title' | 'description' | 'prompt'>>): void;
+    updateTask(id: string, patch: TaskUpdatePatch): void;
+    /**
+     * Replace (a part of) the picker option sets the UI feeds (workspace list
+     * and agent-preset roster come from the runtime, not the ledger).
+     */
+    setExecutionOptions(patch: Partial<ExecutionOptionsSnapshot>): void;
     moveTask(id: string, status: TaskStatus): void;
     deleteTask(id: string): void;
     /**

package/lib/types/core/execution.d.ts

@@ -14,22 +14,40 @@
  * so tests drive it with plain fakes.
  */
 import type { ExecutionRecord, TaskRecord } from './tasks.ts';
+/** One list-row summary the execution service reads (the narrow slice of a SessionSummary). */
+export interface ExecutionSessionSummary {
+    running: boolean;
+    completed?: boolean;
+    /** Empty-log bit: the preset can only be recomposed while the session is blank. */
+    blank?: boolean;
+    /** The preset the session currently runs (absent on deployments without presets). */
+    agentPreset?: string;
+}
 /** The narrow sessions face the service needs. */
 export interface SessionsExecutionFace {
     list: {
         getSnapshot(): {
             /** Baseline arrival lifecycle — 'pending' until the host list has loaded. */
             phase: 'pending' | 'ready';
-            byId: Record<string, {
-                running: boolean;
-                completed?: boolean;
-            }>;
+            byId: Record<string, ExecutionSessionSummary>;
         };
         subscribe(fn: () => void): () => void;
     };
     binding(id: string): {
         session: SessionDriver;
     } | undefined;
+    /** Record a host-confirmed preset switch so the list label moves immediately. */
+    noteAgentPreset?(sessionId: string, agentPreset: string): void;
+}
+/** The narrow agent-preset wire face the service needs (`agentPreset.select`). */
+export interface PresetsExecutionFace {
+    /** Recompose a blank session's agent from a preset. */
+    select(sessionId: string, agentPreset: string): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        error: unknown;
+    }>;
 }
 /** The narrow workspaces face the service needs. */
 export interface WorkspacesExecutionFace {
@@ -63,6 +81,18 @@ export interface SessionDriver {
         ok: false;
         error: unknown;
     }>;
+    /**
+     * Admit one slash-command line against the session's agent (the
+     * `/permission <id>` mechanism). `matched` reports whether a command
+     * claimed the line.
+     */
+    command(line: string): Promise<{
+        ok: true;
+        matched: boolean;
+    } | {
+        ok: false;
+        error: unknown;
+    }>;
     getSnapshot(): {
         running: boolean;
         lastAgentError: string | null;
@@ -74,6 +104,8 @@ export interface SessionDriver {
 export interface ExecutionEnvironment {
     sessions: SessionsExecutionFace;
     workspaces: WorkspacesExecutionFace;
+    /** Agent-preset wire face; absent on deployments without preset support. */
+    presets?: PresetsExecutionFace;
     /** Raw-history reader for failure detection of never-opened sessions. */
     history?: HistoryExecutionFace;
 }
@@ -104,6 +136,19 @@ export declare class ExecutionService {
     /** @param env - the runtime faces (real or fake). */
     constructor(env: ExecutionEnvironment);
     run(task: TaskRecord, execution: ExecutionRecord, onEvent: (event: ExecutionEvent) => void): Promise<void>;
+    /**
+     * Recompose the execution session's agent from the task-pinned preset.
+     * No-op when the task pins none or the session already runs it; fails the
+     * run when the session is no longer blank, the preset face is missing, or
+     * the wire refuses.
+     */
+    private applyMode;
+    /**
+     * Apply the task-pinned permission preset through the `/permission <id>`
+     * slash command. No-op when the task pins none; fails the run when the
+     * admission is rejected or no command claimed the line.
+     */
+    private applyPermission;
     /**
      * Inspect a reloaded/background task that was left 'running' and emit a
      * settled event when its session already finished.

package/lib/types/core/store.d.ts

@@ -1,4 +1,4 @@
-import type { TaskRecord } from './tasks.ts';
+import { type TaskRecord } from './tasks.ts';
 /** Persistence seam for the task ledger. */
 export interface TaskStore {
     /** Read the persisted ledger (empty when nothing is stored yet). */

package/lib/types/core/tasks.d.ts

@@ -60,12 +60,39 @@ export interface TaskRecord {
     executions: ExecutionRecord[];
     /** Optional scheduled-run rule (absent on tasks without a schedule). */
     schedule?: ScheduleRule;
+    /**
+     * Workspace the execution must run in (a workspace-list id); absent means
+     * the recent-workspace fallback at execution time.
+     */
+    workspaceId?: string;
+    /**
+     * Agent preset the execution session must be composed from (an
+     * `agentPreset.list` id); absent means the deployment default.
+     */
+    mode?: string;
+    /**
+     * Permission preset applied to the execution session through the
+     * `/permission <id>` slash command; absent leaves the session default.
+     */
+    permission?: TaskPermission;
 }
+/** Permission presets a task may pin on its execution session (the `/permission <id>` ids). */
+export declare const TASK_PERMISSIONS: readonly ["read-only", "workspace-write", "danger-full-access"];
+/** One permission preset id. */
+export type TaskPermission = typeof TASK_PERMISSIONS[number];
+/** Whether an unknown value is a known permission preset id. */
+export declare function isTaskPermission(value: unknown): value is TaskPermission;
 /** Input for creating a task. */
 export interface NewTaskInput {
     title: string;
     description: string;
     prompt: string;
+    /** Workspace the execution must run in; empty/absent = the recent workspace. */
+    workspaceId?: string;
+    /** Agent preset the execution session must be composed from; empty/absent = deployment default. */
+    mode?: string;
+    /** Permission preset applied to the execution session; absent = session default. */
+    permission?: TaskPermission;
 }
 /** The five kanban columns, in display order. */
 export declare const COLUMNS: readonly {

package/lib/types/core/use-cases/task-update.d.ts

@@ -1,11 +1,16 @@
 /**
  * Update-task use case: apply an editable-field patch (title/description/
- * prompt) with a fresh updatedAt. Pure ledger transition (no persistence or
- * notify — the controller orchestrates those).
+ * prompt plus the execution targets workspaceId/mode/permission) with a
+ * fresh updatedAt. Pure ledger transition (no persistence or notify — the
+ * controller orchestrates those).
+ *
+ * An explicit `undefined` in the patch clears the field (the task falls
+ * back to the runtime default); an unknown permission string is ignored so
+ * stale UI can never persist a value the execution service rejects.
  */
-import type { TaskRecord } from '../tasks.ts';
+import { type TaskRecord } from '../tasks.ts';
 /** Editable fields on a task (the update patch surface). */
-export type TaskUpdatePatch = Partial<Pick<TaskRecord, 'title' | 'description' | 'prompt'>>;
+export type TaskUpdatePatch = Partial<Pick<TaskRecord, 'title' | 'description' | 'prompt' | 'workspaceId' | 'mode' | 'permission'>>;
 /**
  * Apply an update across the ledger. Tasks that do not match the id are left
  * untouched; the matched task receives the patch plus a fresh updatedAt.

package/lib/types/index.d.ts

@@ -14,7 +14,7 @@ import type { Context } from '@deepseek-ai/cordis';
 import z from 'schemastery';
 export declare const inject: string[];
 /** Model-facing announcement: plugin presence, capabilities, and limits. */
-export declare const TASK_BOARD_GUIDANCE = "\u672C\u673A\u5DF2\u5B89\u88C5 dsh-task-board \u63D2\u4EF6\uFF08DSH Web GUI \u7684\u4EFB\u52A1\u770B\u677F\uFF09\uFF1A\u4FA7\u8FB9\u680F\u300C\u4EFB\u52A1\u770B\u677F\u300D\u5165\u53E3\uFF1B\u5728 dsh-web-ui \u63D2\u4EF6\u5168\u5BB6\u6876\u4ED3\u5E93\uFF08packages/dsh-task-board\uFF09\u7EDF\u4E00\u7EF4\u62A4\uFF0C\u7ECF\u805A\u5408\u5305 web-ui-all \u4E00\u952E\u5B89\u88C5\u3002\u80FD\u529B\uFF1A\u591A\u5217\u770B\u677F\u7BA1\u7406\u4EFB\u52A1\uFF1B\u4EFB\u52A1\u53EF\u771F\u5B9E\u6267\u884C\uFF08\u9A71\u52A8 agent \u4F1A\u8BDD\uFF09\uFF1B\u4EFB\u52A1\u652F\u6301 5 \u6BB5 cron \u5B9A\u65F6\u6267\u884C\uFF08\u5982 0 23 * * *\uFF09\uFF1B\u6570\u636E\u5B58\u6D4F\u89C8\u5668 localStorage\uFF08\u952E dsh.taskBoard.v1\uFF09\u3002\u9650\u5236\uFF1A\u5B9A\u65F6\u8C03\u5EA6\u5728\u6D4F\u89C8\u5668\u7AEF\uFF0C\u9700 GUI \u6807\u7B7E\u9875\u6253\u5F00\uFF0C\u9519\u8FC7\u5373\u8DF3\u8FC7\uFF1B\u6267\u884C\u6D88\u8017 API \u989D\u5EA6\u3002\u7528\u6237\u63D0\u5230\u300C\u4EFB\u52A1\u770B\u677F / \u770B\u677F / \u5B9A\u65F6\u4EFB\u52A1\u300D\u65F6\u5373\u6307\u672C\u63D2\u4EF6\uFF0C\u8BF7\u636E\u6B64\u534F\u4F5C\u3002";
+export declare const TASK_BOARD_GUIDANCE = "\u672C\u673A\u5DF2\u5B89\u88C5 dsh-task-board \u63D2\u4EF6\uFF08DSH Web GUI \u7684\u4EFB\u52A1\u770B\u677F\uFF09\uFF1A\u4FA7\u8FB9\u680F\u300C\u4EFB\u52A1\u770B\u677F\u300D\u5165\u53E3\uFF1B\u5728 dsh-web-ui \u63D2\u4EF6\u5168\u5BB6\u6876\u4ED3\u5E93\uFF08packages/dsh-task-board\uFF09\u7EDF\u4E00\u7EF4\u62A4\uFF0C\u7ECF\u805A\u5408\u5305 web-ui-all \u4E00\u952E\u5B89\u88C5\u3002\u80FD\u529B\uFF1A\u591A\u5217\u770B\u677F\u7BA1\u7406\u4EFB\u52A1\uFF1B\u4EFB\u52A1\u53EF\u771F\u5B9E\u6267\u884C\uFF08\u9A71\u52A8 agent \u4F1A\u8BDD\uFF09\uFF1B\u4EFB\u52A1\u53EF\u9489\u4F4F\u6267\u884C\u76EE\u6807\u2014\u2014\u5DE5\u4F5C\u533A / \u6A21\u5F0F\uFF08agent \u9884\u8BBE\uFF09/ \u6743\u9650\uFF08read-only / workspace-write / danger-full-access\uFF09\uFF0C\u7F3A\u7701\u7528\u8FD0\u884C\u65F6\u9ED8\u8BA4\uFF1B\u4EFB\u52A1\u652F\u6301 5 \u6BB5 cron \u5B9A\u65F6\u6267\u884C\uFF08\u5982 0 23 * * *\uFF09\uFF1B\u6570\u636E\u5B58\u6D4F\u89C8\u5668 localStorage\uFF08\u952E dsh.taskBoard.v1\uFF09\u3002\u9650\u5236\uFF1A\u5B9A\u65F6\u8C03\u5EA6\u5728\u6D4F\u89C8\u5668\u7AEF\uFF0C\u9700 GUI \u6807\u7B7E\u9875\u6253\u5F00\uFF0C\u9519\u8FC7\u5373\u8DF3\u8FC7\uFF1B\u6267\u884C\u6D88\u8017 API \u989D\u5EA6\u3002\u7528\u6237\u63D0\u5230\u300C\u4EFB\u52A1\u770B\u677F / \u770B\u677F / \u5B9A\u65F6\u4EFB\u52A1\u300D\u65F6\u5373\u6307\u672C\u63D2\u4EF6\uFF0C\u8BF7\u636E\u6B64\u534F\u4F5C\u3002";
 /**
  * Settings namespace of the board's announcement capability — the section the
  * web settings surface edits. Spelled here rather than imported: the browser

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-client-ui-task-board",
   "description": "Task board for the dsh web GUI: a sidebar entry plus a multi-column kanban view with local persistence, task details, and real execution through dsh sessions (session.prompt). Hot-pluggable — mounted via ~/.dsh/cordis.patch.yml + a profile node_modules symlink, no dsh source changes.",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/client/PluginSettingsCard.tsx

@@ -138,7 +138,13 @@ export function PluginSettingsCard<TKey extends string = string>(props: PluginSe
             {!state.writable ? <p className={css.readOnly} role="status">{props.t('settings.readOnly')}</p> : null}
             {props.children}
             <div className={css.footer}>
-              {state.failed ? <p className={css.failed} role="status">{props.t('settings.saveFailed')}</p> : null}
+              {state.failed
+                ? (
+                  <p className={css.failed} role="status">
+                    {props.t('settings.saveFailed')}{state.failedReason ? ' - ' + state.failedReason : ''}
+                  </p>
+                )
+                : null}
               <button
                 type="button"
                 className={css.discard}

package/src/client/board/NewTaskModal.tsx

@@ -2,9 +2,10 @@
  * New-task modal: title + description + the prompt that execution will send.
  * Creates through the controller (which persists immediately).
  */
-import { useState } from 'react'
+import { useEffect, useState } from 'react'
 import type { BoardController } from '../../core/controller.ts'
-import { t } from '../locales.ts'
+import { TASK_PERMISSIONS, type TaskPermission } from '../../core/tasks.ts'
+import { t, type TaskBoardKey } from '../locales.ts'
 import css from '../board.module.css'
 
 /** New-task form overlay. */
@@ -12,10 +13,28 @@ export function NewTaskModal({ controller, onClose }: { controller: BoardControl
   const [title, setTitle] = useState('')
   const [description, setDescription] = useState('')
   const [prompt, setPrompt] = useState('')
+  const [workspaceId, setWorkspaceId] = useState('')
+  const [mode, setMode] = useState('')
+  const [permission, setPermission] = useState('')
   const [error, setError] = useState<string | undefined>(undefined)
+  const [options, setOptions] = useState(controller.getSnapshot().executionOptions)
+
+  // The workspace list and preset roster arrive from the runtime after mount;
+  // follow them so the pickers never freeze on an empty snapshot.
+  useEffect(
+    () => controller.subscribe(() => setOptions(controller.getSnapshot().executionOptions)),
+    [controller],
+  )
 
   const submit = (): void => {
-    const task = controller.createTask({ title, description, prompt })
+    const task = controller.createTask({
+      title,
+      description,
+      prompt,
+      workspaceId: workspaceId === '' ? undefined : workspaceId,
+      mode: mode === '' ? undefined : mode,
+      permission: permission === '' ? undefined : permission as TaskPermission,
+    })
     if (task === undefined) {
       setError(t('new.required'))
       return
@@ -66,6 +85,52 @@ export function NewTaskModal({ controller, onClose }: { controller: BoardControl
           />
         </label>
 
+        <label className={css.field}>
+          <span className={css.fieldLabel}>{t('new.workspace')}</span>
+          <select
+            className={css.select}
+            value={workspaceId}
+            onChange={event => { setWorkspaceId(event.target.value) }}
+          >
+            <option value="">{t('exec.workspace.recent')}</option>
+            {options.workspaces.map(workspace => (
+              <option key={workspace.workspaceId} value={workspace.workspaceId}>{workspace.title}</option>
+            ))}
+          </select>
+        </label>
+
+        <label className={css.field}>
+          <span className={css.fieldLabel}>{t('new.mode')}</span>
+          <select
+            className={css.select}
+            value={mode}
+            onChange={event => { setMode(event.target.value) }}
+          >
+            <option value="">{t('exec.mode.default')}</option>
+            {options.presets.map(preset => (
+              <option key={preset.id} value={preset.id} disabled={preset.broken !== undefined}>
+                {preset.name ?? preset.id}
+                {preset.isDefault ? t('exec.mode.defaultSuffix') : ''}
+                {preset.broken !== undefined ? t('exec.mode.brokenSuffix') : ''}
+              </option>
+            ))}
+          </select>
+        </label>
+
+        <label className={css.field}>
+          <span className={css.fieldLabel}>{t('new.permission')}</span>
+          <select
+            className={css.select}
+            value={permission}
+            onChange={event => { setPermission(event.target.value) }}
+          >
+            <option value="">{t('exec.permission.default')}</option>
+            {TASK_PERMISSIONS.map(id => (
+              <option key={id} value={id}>{t(`exec.permission.${id}` as TaskBoardKey)}</option>
+            ))}
+          </select>
+        </label>
+
         {error !== undefined && <p className={css.formError}>{error}</p>}
 
         <footer className={css.modalFooter}>

package/src/client/board/TaskDetail.tsx

@@ -7,7 +7,7 @@
 import { useEffect, useState } from 'react'
 import type { BoardController } from '../../core/controller.ts'
 import { isValidCron } from '../../core/schedule.ts'
-import { MANUAL_STATUSES, type ExecutionRecord, type TaskRecord, type TaskStatus } from '../../core/tasks.ts'
+import { MANUAL_STATUSES, TASK_PERMISSIONS, type ExecutionRecord, type TaskPermission, type TaskRecord, type TaskStatus } from '../../core/tasks.ts'
 import { t, type TaskBoardKey } from '../locales.ts'
 import css from '../board.module.css'
 import { ConfirmDialog } from './ConfirmDialog.tsx'
@@ -66,6 +66,74 @@ const SCHEDULE_PRESETS: ReadonlyArray<{ cron: string; label: TaskBoardKey }> = [
   { cron: '0 9 * * 1', label: 'detail.schedule.preset.weeklyMon9' },
 ]
 
+/** The execution-target editor: workspace / mode / permission pickers. */
+function ExecutionSettingsSection({ controller, task }: { controller: BoardController; task: TaskRecord }) {
+  const [options, setOptions] = useState(controller.getSnapshot().executionOptions)
+  useEffect(
+    () => controller.subscribe(() => setOptions(controller.getSnapshot().executionOptions)),
+    [controller],
+  )
+  const workspaceId = task.workspaceId ?? ''
+  const mode = task.mode ?? ''
+  const permission = task.permission ?? ''
+  // A pinned target may disappear from the runtime (workspace deleted,
+  // preset removed); keep it selectable as a stale row instead of silently
+  // dropping it, so the user sees exactly what the task will ask for.
+  const workspaceKnown = workspaceId === '' || options.workspaces.some(item => item.workspaceId === workspaceId)
+  const modeKnown = mode === '' || options.presets.some(item => item.id === mode)
+  return (
+    <section className={css.detailSection}>
+      <h4>{t('detail.executionSettings')}</h4>
+      <p className={css.detailText}>{t('exec.hint')}</p>
+      <label className={css.field}>
+        <span className={css.fieldLabel}>{t('new.workspace')}</span>
+        <select
+          className={css.select}
+          value={workspaceId}
+          onChange={event => { controller.updateTask(task.id, { workspaceId: event.target.value }) }}
+        >
+          <option value="">{t('exec.workspace.recent')}</option>
+          {!workspaceKnown && <option value={workspaceId}>{workspaceId}{t('exec.mode.removed')}</option>}
+          {options.workspaces.map(workspace => (
+            <option key={workspace.workspaceId} value={workspace.workspaceId}>{workspace.title}</option>
+          ))}
+        </select>
+      </label>
+      <label className={css.field}>
+        <span className={css.fieldLabel}>{t('new.mode')}</span>
+        <select
+          className={css.select}
+          value={mode}
+          onChange={event => { controller.updateTask(task.id, { mode: event.target.value }) }}
+        >
+          <option value="">{t('exec.mode.default')}</option>
+          {!modeKnown && <option value={mode}>{mode}{t('exec.mode.removed')}</option>}
+          {options.presets.map(preset => (
+            <option key={preset.id} value={preset.id} disabled={preset.broken !== undefined}>
+              {preset.name ?? preset.id}
+              {preset.isDefault ? t('exec.mode.defaultSuffix') : ''}
+              {preset.broken !== undefined ? t('exec.mode.brokenSuffix') : ''}
+            </option>
+          ))}
+        </select>
+      </label>
+      <label className={css.field}>
+        <span className={css.fieldLabel}>{t('new.permission')}</span>
+        <select
+          className={css.select}
+          value={permission}
+          onChange={event => { controller.updateTask(task.id, { permission: event.target.value === '' ? undefined : event.target.value as TaskPermission }) }}
+        >
+          <option value="">{t('exec.permission.default')}</option>
+          {TASK_PERMISSIONS.map(id => (
+            <option key={id} value={id}>{t(`exec.permission.${id}` as TaskBoardKey)}</option>
+          ))}
+        </select>
+      </label>
+    </section>
+  )
+}
+
 /** The scheduled-runs editor: enable toggle, cron input + presets, next-run info. */
 function ScheduleSection({ controller, task }: { controller: BoardController; task: TaskRecord }) {
   const schedule = task.schedule
@@ -203,6 +271,8 @@ export function TaskDetail({ controller, task }: { controller: BoardController;
             <pre className={css.promptBlock}>{current.prompt !== '' ? current.prompt : current.title}</pre>
           </section>
 
+          <ExecutionSettingsSection controller={controller} task={current} />
+
           <ScheduleSection controller={controller} task={current} />
 
           <section className={css.detailSection}>

package/src/client/board.module.css

@@ -512,6 +512,18 @@ html[data-dsh-taskboard-active]:not([data-dsh-ssh-active]) [class*='centerCol']
   border-color: var(--dsw-alias-state-business-primary);
 }
 
+.select {
+  padding: 7px 10px;
+  font-size: 13px;
+  color: var(--dsw-alias-label-primary);
+  background: var(--dsw-specific-input-major);
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 8px;
+  outline: none;
+  font-family: inherit;
+  max-width: 100%;
+}
+
 .input::placeholder {
   color: var(--dsw-alias-label-tertiary);
 }
@@ -775,6 +787,7 @@ html[data-dsh-taskboard-active]:not([data-dsh-ssh-active]) [class*='centerCol']
 .linkButton:focus-visible,
 .search:focus-visible,
 .input:focus-visible,
+.select:focus-visible,
 .schedulePreset:focus-visible,
 .scheduleToggle input:focus-visible {
   outline: 2px solid var(--dsw-alias-state-business-primary);
@@ -790,6 +803,7 @@ html[data-dsh-taskboard-active]:not([data-dsh-ssh-active]) [class*='centerCol']
 .linkButton,
 .search,
 .input,
+.select,
 .schedulePreset,
 .scheduleToggle input {
   transition: background-color 120ms ease, color 120ms ease, border-color 120ms ease, outline-color 120ms ease, box-shadow 120ms ease, transform 120ms ease;
@@ -834,6 +848,7 @@ html[data-dsh-taskboard-active]:not([data-dsh-ssh-active]) [class*='centerCol']
 
 /* --- search box focus (border tint + themed ring above) --- */
 .search:focus,
+.select:focus,
 .schedulePreset:focus {
   border-color: var(--dsw-alias-state-business-primary);
 }
@@ -855,6 +870,7 @@ html[data-dsh-taskboard-active]:not([data-dsh-ssh-active]) [class*='centerCol']
   .linkButton,
   .search,
   .input,
+  .select,
   .schedulePreset,
   .scheduleToggle input {
     transition: none;