@linxin666/dsh-client-ui-task-board 0.1.20 → 0.2.1

package/src/index.ts

@@ -1,29 +1,31 @@
 /**
  * Host loader entry for the task-board plugin.
  *
- * Everything the board does is browser work (DOM, localStorage, driving the
- * client runtime's session services over the wire), so the host half's main
- * behavior is a system-prompt section announcing the plugin to every agent.
- * The section registers while this plugin is in the host composition (mount /
- * DSH restart) and disappears when the plugin leaves it (unmount / restart),
- * so agents always know the board exists and how to cooperate with it. The
- * announcement can be turned off through the web settings plugin-configuration
- * surface (`announceToAgent`); the section then disappears live.
+ * The Host owns the v2 ledger, action API, cron scheduler, session runner,
+ * execution reconciliation, and optional idle-sleep inhibitor. The browser is
+ * a same-origin asynchronous view over that service.
  */
 
 import type { Context } from '@deepseek-ai/cordis'
 import { installSettingsSection, settingsNamespace } from '@deepseek-ai/dsh-settings'
 import z from 'schemastery'
 import type {} from '@deepseek-ai/dsh-system-prompt'
+import type {} from '@deepseek-ai/dsh-host-apiproxy'
+import type {} from '@deepseek-ai/dsh-host-webserver'
+import { TaskBoardHostService } from './host-service.ts'
+import { makeTaskBoardRoutes } from './host-routes.ts'
 import { mountOnce } from './mount-once.ts'
 
 /** Order of the announcement section within the tool-guidance band. */
 const SECTION_ORDER = 200
 
-export const inject = ['systemPrompt']
+/** Default environment variable holding the authenticated proxy token. */
+export const DEFAULT_PROXY_TOKEN_ENV = 'DSH_TASK_BOARD_PROXY_TOKEN'
+
+export const inject = ['systemPrompt', 'apiProxy', 'webServer']
 
 /** Model-facing announcement: plugin presence, capabilities, and limits. */
-export const TASK_BOARD_GUIDANCE = '本机已安装 dsh-task-board 插件（DSH Web GUI 的任务看板）：侧边栏「任务看板」入口；在 dsh-web-ui 插件全家桶仓库（packages/dsh-task-board）统一维护，经聚合包 web-ui-all 一键安装。能力：多列看板管理任务；任务可真实执行（驱动 agent 会话）；任务可钉住执行目标——工作区 / 模式（agent 预设）/ 权限（read-only / workspace-write / danger-full-access），缺省用运行时默认；任务支持 5 段 cron 定时执行（如 0 23 * * *）；数据存浏览器 localStorage（键 dsh.taskBoard.v1）。限制：定时调度在浏览器端，需 GUI 标签页打开，错过即跳过；执行消耗 API 额度。用户提到「任务看板 / 看板 / 定时任务」时即指本插件，请据此协作。'
+export const TASK_BOARD_GUIDANCE = '本机已安装 dsh-task-board 插件（DSH Web GUI 的任务看板）：侧边栏「任务看板」入口；在 dsh-web-ui 插件全家桶仓库（packages/dsh-task-board）统一维护，经聚合包 web-ui-all 一键安装。能力：多列看板管理任务；Host 权威账本；关闭浏览器后仍由 Host 执行和结算；任务可钉住工作区、agent 预设和权限；支持 Host 本地时区的 5 段 cron，错过的触发点不补跑；可选且默认关闭的空闲系统睡眠保护允许屏幕熄灭，但不承诺拦截合盖、手动睡眠、休眠、关机或唤醒已睡眠机器。执行消耗 API 额度。用户提到「任务看板 / 看板 / 定时任务」时即指本插件，请据此协作。'
 
 /**
  * Settings namespace of the board's announcement capability — the section the
@@ -42,13 +44,35 @@ export interface Config {
   announceToAgent?: boolean
   /** Master switch for the plugin (browser half + host announcement). */
   enabled?: boolean
+  /** Prevent idle system sleep while sessions run or schedules are armed. */
+  preventIdleSleep?: boolean
+  /** Canonical reverse-proxy Host authorities admitted with a server-side token. */
+  trustedProxyHosts?: string[]
+  /** Environment variable whose value the authenticated proxy injects upstream. */
+  proxyTokenEnv?: string
 }
 
 export const Config: z<Config> = z.object({
   announceToAgent: z.boolean().default(true),
   enabled: z.boolean().default(true),
+  preventIdleSleep: z.boolean().default(false),
+  trustedProxyHosts: z.array(z.string()).default([]),
+  proxyTokenEnv: z.string().min(1).default(DEFAULT_PROXY_TOKEN_ENV),
 })
 
+/** Resolve proxy access without ever placing the token value in plugin config. */
+export function resolveProxyAccess(config: Config | undefined, env: NodeJS.ProcessEnv = process.env): { trustedProxyHosts: string[]; proxyToken?: string } {
+  const trustedProxyHosts = config?.trustedProxyHosts ?? []
+  if (trustedProxyHosts.length === 0) return { trustedProxyHosts }
+  const proxyTokenEnv = config?.proxyTokenEnv ?? DEFAULT_PROXY_TOKEN_ENV
+  if (proxyTokenEnv.trim() === '') throw new Error('task-board: proxyTokenEnv must not be empty')
+  const proxyToken = env[proxyTokenEnv]
+  if (proxyToken === undefined || proxyToken === '') {
+    throw new Error(`task-board: trustedProxyHosts requires a non-empty ${proxyTokenEnv} environment variable`)
+  }
+  return { trustedProxyHosts, proxyToken }
+}
+
 /** Schema default, re-read for hand-built test contexts (the loader applies them normally). */
 const DEFAULT_ANNOUNCE = true
 
@@ -63,6 +87,23 @@ const DEFAULT_ANNOUNCE = true
 export const apply = mountOnce('@linxin666/dsh-client-ui-task-board', applyImpl)
 
 function applyImpl(ctx: Context, config?: Config): void {
+  const host = new TaskBoardHostService(ctx.apiProxy)
+  host.setConfiguration(config?.enabled ?? true, config?.preventIdleSleep ?? false)
+  host.start()
+  ctx.effect(() => {
+    const disposers: Array<() => void> = []
+    try {
+      for (const route of makeTaskBoardRoutes(host, resolveProxyAccess(config))) disposers.push(ctx.webServer.register(route))
+    } catch (error) {
+      for (const dispose of disposers) dispose()
+      host.dispose()
+      throw error
+    }
+    return () => {
+      for (const dispose of disposers) dispose()
+      host.dispose()
+    }
+  }, 'task-board: host ledger, scheduler, and routes')
   // The live source the announcement reads: the settings section once the web
   // settings surface is served, the composition entry otherwise
   // (installSettingsSection swaps it when the namespace registers).
@@ -77,7 +118,9 @@ function applyImpl(ctx: Context, config?: Config): void {
       disposeSection()
       disposeSection = undefined
     }
-    if ((current().enabled ?? true) === false) return
+    const active = current().enabled ?? true
+    host.setConfiguration(active, current().preventIdleSleep ?? false)
+    if (!active) return
     if ((current().announceToAgent ?? DEFAULT_ANNOUNCE) === false) return
     disposeSection = ctx.systemPrompt.section({
       name: 'plugin:task-board',

package/src/loopback.ts

@@ -0,0 +1,63 @@
+// Generated by scripts/sync-shared.mjs from shared/host/loopback.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Loopback trust fence shared by the host route families: socket address,
+ * Host header, and browser same-origin markers. Packages receive this file as
+ * a generated copy via scripts/sync-shared.mjs; edit the shared source and
+ * re-run the sync instead of editing a copy.
+ *
+ * Semantics: RFC 5735 IPv4 127/8, ::1, IPv4-mapped ::ffff:127/8 (matching the
+ * remote-web-ui gate), localhost hostnames, plus the browser same-origin
+ * markers (sec-fetch-site and Origin) for the request-level fence.
+ * @module dsh-web-ui-shared/host/loopback
+ */
+
+import type { IncomingMessage } from 'node:http'
+
+/** IPv4 127/8 predicate (four decimal octets, first == 127). */
+export function isIPv4Loopback(v4: string): boolean {
+  const parts = v4.split('.')
+  return parts.length === 4
+    && parts[0] === '127'
+    && parts.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255)
+}
+
+/** Whether a socket remote address names the loopback range (127/8, ::1, IPv4-mapped). */
+export function isLoopbackAddress(address: string | undefined): boolean {
+  if (address === undefined) return false
+  const normalized = address.toLowerCase()
+  if (normalized === '::1') return true
+  if (normalized.startsWith('::ffff:')) return isIPv4Loopback(normalized.slice('::ffff:'.length))
+  return isIPv4Loopback(normalized)
+}
+
+/** Whether a normalized URL hostname names the loopback authority (localhost, [::1], 127/8). */
+export function isLoopbackHostname(hostname: string): boolean {
+  if (hostname === 'localhost' || hostname === '[::1]') return true
+  return isIPv4Loopback(hostname)
+}
+
+/**
+ * Request-level trust fence: a loopback socket address AND a loopback Host
+ * header, plus browser same-origin markers. The socket address is
+ * authoritative; X-Forwarded-For is never trusted.
+ */
+export function isLoopbackRequest(request: IncomingMessage): boolean {
+  if (!isLoopbackAddress(request.socket.remoteAddress)) return false
+  const host = request.headers.host
+  if (typeof host !== 'string') return false
+  let hostUrl: URL
+  try {
+    hostUrl = new URL('http://' + host)
+  } catch {
+    return false
+  }
+  if (!isLoopbackHostname(hostUrl.hostname)) return false
+  if (request.headers['sec-fetch-site'] === 'cross-site') return false
+  const origin = request.headers.origin
+  if (origin === undefined) return true
+  try {
+    return new URL(origin).host === hostUrl.host
+  } catch {
+    return false
+  }
+}

package/src/power-inhibitor.ts

@@ -0,0 +1,321 @@
+import { spawn as nodeSpawn, spawnSync as nodeSpawnSync, type ChildProcess, type SpawnSyncReturns } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { win32 } from 'node:path'
+import type { PowerPhase, TaskBoardPowerSnapshot } from './protocol.ts'
+
+const RETRY_DELAYS = [1_000, 2_000, 5_000, 10_000, 30_000] as const
+const DARWIN_STABLE_MS = 30_000
+
+const WINDOWS_HELPER = String.raw`
+$source = @'
+using System;
+using System.Runtime.InteropServices;
+public static class DshExecutionState {
+  [DllImport("kernel32.dll", SetLastError = true)]
+  public static extern uint SetThreadExecutionState(uint flags);
+}
+'@
+Add-Type -TypeDefinition $source
+$continuous = [Convert]::ToUInt32('80000000', 16)
+$systemRequired = [uint32]0x00000001
+try {
+  $result = [DshExecutionState]::SetThreadExecutionState($continuous -bor $systemRequired)
+  if ($result -eq 0) { throw 'SetThreadExecutionState failed' }
+  [Console]::Out.WriteLine('READY')
+  [Console]::Out.Flush()
+  while ([Console]::In.ReadLine() -ne $null) { }
+} finally {
+  [void][DshExecutionState]::SetThreadExecutionState($continuous)
+}
+`
+
+const LINUX_HELPER = String.raw`
+process.stdout.write('READY\n')
+process.stdin.resume()
+`
+
+const LINUX_INHIBIT_PATHS = ['/usr/bin/systemd-inhibit', '/bin/systemd-inhibit'] as const
+
+export interface PowerReasons {
+  runningSessions: number
+  armedSchedules: number
+  sessionStateKnown: boolean
+}
+
+export interface SpawnOptions {
+  shell: false
+  windowsHide: boolean
+  stdio: ['pipe', 'pipe', 'pipe'] | ['ignore', 'ignore', 'ignore']
+}
+
+export type SpawnLike = (file: string, args: readonly string[], options: SpawnOptions) => ChildProcess
+export type SpawnSyncLike = (
+  file: string,
+  args: readonly string[],
+  options: { stdio: 'ignore'; timeout: number; windowsHide: boolean },
+) => Pick<SpawnSyncReturns<Buffer>, 'status' | 'error'>
+
+export interface PowerInhibitorOptions {
+  platform?: NodeJS.Platform
+  pid?: number
+  env?: NodeJS.ProcessEnv
+  spawn?: SpawnLike
+  spawnSync?: SpawnSyncLike
+  exists?: typeof existsSync
+  execPath?: string
+  setTimeout?: typeof globalThis.setTimeout
+  clearTimeout?: typeof globalThis.clearTimeout
+}
+
+export class PowerInhibitor {
+  private readonly listeners = new Set<() => void>()
+  private enabled = false
+  private reasons: PowerReasons = { runningSessions: 0, armedSchedules: 0, sessionStateKnown: false }
+  private phase: PowerPhase = 'disabled'
+  private child: ChildProcess | undefined
+  private retry: ReturnType<typeof setTimeout> | undefined
+  private retryReset: ReturnType<typeof setTimeout> | undefined
+  private retryIndex = 0
+  private lastError: string | undefined
+  private stopping = false
+  private readonly platform: NodeJS.Platform
+  private readonly pid: number
+  private readonly env: NodeJS.ProcessEnv
+  private readonly spawn: SpawnLike
+  private readonly spawnSync: SpawnSyncLike
+  private readonly exists: typeof existsSync
+  private readonly execPath: string
+  private readonly timer: typeof globalThis.setTimeout
+  private readonly clearTimer: typeof globalThis.clearTimeout
+  private linuxProbe: { executable?: string; available: boolean } | undefined
+
+  constructor(options: PowerInhibitorOptions = {}) {
+    this.platform = options.platform ?? process.platform
+    this.pid = options.pid ?? process.pid
+    this.env = options.env ?? process.env
+    this.spawn = options.spawn ?? ((file, args, spawnOptions) => nodeSpawn(file, [...args], spawnOptions))
+    this.spawnSync = options.spawnSync ?? ((file, args, spawnOptions) => nodeSpawnSync(file, [...args], spawnOptions))
+    this.exists = options.exists ?? existsSync
+    this.execPath = options.execPath ?? process.execPath
+    this.timer = options.setTimeout ?? globalThis.setTimeout
+    this.clearTimer = options.clearTimeout ?? globalThis.clearTimeout
+  }
+
+  setEnabled(enabled: boolean): void {
+    this.enabled = enabled
+    this.sync()
+    this.emit()
+  }
+
+  updateReasons(reasons: PowerReasons): void {
+    this.reasons = reasons
+    this.sync()
+    this.emit()
+  }
+
+  subscribe(listener: () => void): () => void {
+    this.listeners.add(listener)
+    return () => { this.listeners.delete(listener) }
+  }
+
+  snapshot(): TaskBoardPowerSnapshot {
+    return {
+      platform: this.platform,
+      phase: this.phase,
+      enabled: this.enabled,
+      ...this.reasons,
+      ...(this.lastError === undefined ? {} : { lastError: this.lastError }),
+    }
+  }
+
+  dispose(): void {
+    this.enabled = false
+    this.release()
+    this.phase = 'disabled'
+    this.emit()
+    this.listeners.clear()
+  }
+
+  private desired(): boolean {
+    return this.enabled && (!this.reasons.sessionStateKnown || this.reasons.runningSessions > 0 || this.reasons.armedSchedules > 0)
+  }
+
+  private sync(): void {
+    if (!this.enabled) {
+      this.release()
+      this.phase = 'disabled'
+      return
+    }
+    if (this.platform !== 'darwin' && this.platform !== 'win32' && this.platform !== 'linux') {
+      this.release()
+      this.phase = 'unsupported'
+      return
+    }
+    if (this.platform === 'linux' && this.linuxSystemdInhibit() === undefined) {
+      this.release()
+      this.phase = 'unsupported'
+      return
+    }
+    if (!this.desired()) {
+      this.release()
+      this.phase = 'idle'
+      return
+    }
+    if (this.child === undefined && this.retry === undefined) this.acquire()
+  }
+
+  private acquire(): void {
+    this.phase = 'acquiring'
+    this.emit()
+    this.stopping = false
+    try {
+      const child = this.spawnCommand()
+      this.child = child
+      let ready = false
+      let stderr = ''
+      if (this.platform === 'darwin') {
+        child.once('spawn', () => {
+          ready = true
+          this.markReady(child)
+        })
+      }
+      child.stdout?.on('data', (chunk: Buffer) => {
+        if (!ready && chunk.toString('utf8').includes('READY')) {
+          ready = true
+          this.markReady(child)
+        }
+      })
+      child.stderr?.on('data', (chunk: Buffer) => {
+        stderr = `${stderr}${chunk.toString('utf8')}`.slice(-2_000)
+      })
+      child.on('error', error => { this.fail(error, child) })
+      child.on('exit', (code, signal) => {
+        if (this.child !== child) return
+        this.child = undefined
+        if (this.stopping || !this.desired()) return
+        const detail = stderr.trim()
+        this.fail(new Error(`power helper exited (${String(code ?? signal ?? 'unknown')})${detail === '' ? '' : `: ${detail}`}`))
+      })
+    } catch (error) {
+      this.fail(error)
+    }
+  }
+
+  private markReady(child: ChildProcess): void {
+    if (this.child !== child || !this.desired()) return
+    this.phase = 'active'
+    if (this.platform === 'darwin') {
+      this.retryReset = this.timer(() => {
+        this.retryReset = undefined
+        if (this.child === child && this.desired()) this.retryIndex = 0
+      }, DARWIN_STABLE_MS)
+    } else {
+      this.retryIndex = 0
+    }
+    this.lastError = undefined
+    this.emit()
+  }
+
+  private fail(error: unknown, source?: ChildProcess): void {
+    if (source !== undefined && this.child !== source) return
+    this.clearRetryReset()
+    this.lastError = error instanceof Error ? error.message : String(error)
+    this.phase = 'error'
+    this.emit()
+    const child = this.child
+    this.child = undefined
+    child?.stdin?.end()
+    child?.kill()
+    if (!this.desired() || this.retry !== undefined) return
+    const delay = RETRY_DELAYS[Math.min(this.retryIndex, RETRY_DELAYS.length - 1)]
+    this.retryIndex += 1
+    this.retry = this.timer(() => {
+      this.retry = undefined
+      if (this.desired()) this.acquire()
+    }, delay)
+  }
+
+  private release(): void {
+    this.clearRetryReset()
+    if (this.retry !== undefined) {
+      this.clearTimer(this.retry)
+      this.retry = undefined
+    }
+    this.lastError = undefined
+    const child = this.child
+    this.child = undefined
+    if (child === undefined) return
+    this.stopping = true
+    if (this.platform === 'win32' || this.platform === 'linux') {
+      child.stdin?.end()
+      const force = this.timer(() => { if (child.exitCode === null) child.kill() }, 1_000)
+      child.once('exit', () => { this.clearTimer(force) })
+    } else {
+      child.kill('SIGTERM')
+    }
+  }
+
+  private clearRetryReset(): void {
+    if (this.retryReset === undefined) return
+    this.clearTimer(this.retryReset)
+    this.retryReset = undefined
+  }
+
+  private windowsPowerShell(): string {
+    const root = this.env.SystemRoot
+    if (root === undefined || root.trim() === '') throw new Error('SystemRoot is unavailable')
+    if (!win32.isAbsolute(root)) throw new Error('SystemRoot is not an absolute path')
+    return win32.join(root, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe')
+  }
+
+  private linuxSystemdInhibit(): string | undefined {
+    if (this.linuxProbe !== undefined) return this.linuxProbe.available ? this.linuxProbe.executable : undefined
+    const executable = LINUX_INHIBIT_PATHS.find(path => this.exists(path))
+    if (executable === undefined) {
+      this.linuxProbe = { available: false }
+      return undefined
+    }
+    const probe = this.spawnSync(executable, ['--list', '--no-pager'], {
+      stdio: 'ignore',
+      timeout: 2_000,
+      windowsHide: true,
+    })
+    this.linuxProbe = { executable, available: probe.status === 0 && probe.error === undefined }
+    return this.linuxProbe.available ? executable : undefined
+  }
+
+  private spawnCommand(): ChildProcess {
+    if (this.platform === 'darwin') {
+      return this.spawn('/usr/bin/caffeinate', ['-i', '-w', String(this.pid)], {
+        shell: false,
+        windowsHide: false,
+        stdio: ['ignore', 'ignore', 'ignore'],
+      })
+    }
+    if (this.platform === 'linux') {
+      const executable = this.linuxSystemdInhibit()
+      if (executable === undefined) throw new Error('systemd-inhibit is unavailable')
+      return this.spawn(executable, [
+        '--what=idle',
+        '--who=DeepSeek Harness task board',
+        '--why=DSH sessions are running or schedules are armed',
+        '--mode=block',
+        '--',
+        this.execPath,
+        '-e',
+        LINUX_HELPER,
+      ], { shell: false, windowsHide: false, stdio: ['pipe', 'pipe', 'pipe'] })
+    }
+    return this.spawn(this.windowsPowerShell(), ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', WINDOWS_HELPER], {
+      shell: false,
+      windowsHide: true,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    })
+  }
+
+  private emit(): void {
+    for (const listener of [...this.listeners]) listener()
+  }
+}
+
+export { LINUX_HELPER, LINUX_INHIBIT_PATHS, WINDOWS_HELPER }