@linxin666/dsh-client-ui-task-board 0.2.0 → 0.2.1

package/src/host-routes.ts

@@ -60,6 +60,12 @@ function resolveAccess(access: TaskBoardRouteAccess): ResolvedRouteAccess {
   return { trustedProxyHosts, ...(access.proxyToken === undefined ? {} : { proxyToken: access.proxyToken }) }
 }
 
+/**
+ * Browser-signal tripwire, NOT an authority check: a bare curl sends neither
+ * header and is refused, but a curl with a forged Origin passes this too.
+ * The real boundary is the loopback socket + Host + origin-equality checks
+ * in isTrustedTaskBoardRequest below; do not rely on this marker alone.
+ */
 function browserSameOriginMarker(req: IncomingMessage): boolean {
   const site = req.headers['sec-fetch-site']
   return site === 'same-origin' || typeof req.headers.origin === 'string'
@@ -86,7 +92,9 @@ function matchesToken(candidate: string | string[] | undefined, expected: string
 /**
  * Task-board route fence. Direct desktop access uses the repository-wide
  * loopback socket + Host guard and additionally requires a browser same-origin
- * marker, so a bare local curl cannot exercise the agent control plane.
+ * marker: a bare local curl without any browser signal cannot exercise the
+ * agent control plane (a forged Origin does pass the marker — it is a
+ * tripwire, the socket/Host/origin-equality checks carry the authority).
  * Authenticated proxies must be explicitly allowlisted and replace the
  * internal token header after their own authentication step.
  */
@@ -170,8 +178,8 @@ export function makeTaskBoardRoutes(service: TaskBoardHostService, access: TaskB
         connection: 'keep-alive',
       })
       const push = (): void => {
-        const snapshot = service.snapshot()
-        res.write(`data: ${JSON.stringify({ revision: snapshot.revision, scheduler: snapshot.scheduler, power: snapshot.power })}\n\n`)
+        const payload = service.eventPayload()
+        res.write(`data: ${JSON.stringify(payload)}\n\n`)
       }
       const unsubscribe = service.subscribe(push)
       const heartbeat = setInterval(() => { res.write(': ping\n\n') }, HEARTBEAT_MS)

package/src/host-runner.ts

@@ -9,6 +9,12 @@ function failure(error: { code: string; message: string }): Error {
   return new Error(`${error.code}: ${error.message}`)
 }
 
+/** One session-list row, extracted from the sessions.list RPC result. */
+export type SessionSummary = Extract<
+  Awaited<ReturnType<ApiProxy['sessions']['list']>>['result'],
+  { ok: true }
+>['value']['items'][number]
+
 export type ExecutionInspection =
   | { outcome: 'pending' }
   | { outcome: 'succeeded' }
@@ -77,21 +83,33 @@ export class HostExecutionRunner {
     return sessionId
   }
 
-  async listRunning(): Promise<{ known: true; count: number } | { known: false }> {
+  async listRunning(): Promise<{ known: true; count: number; items: SessionSummary[] } | { known: false }> {
     try {
       const response = await this.api.sessions.list(request({}))
       return response.result.ok
-        ? { known: true, count: response.result.value.items.filter(item => item.running).length }
+        ? { known: true, count: response.result.value.items.filter(item => item.running).length, items: response.result.value.items }
         : { known: false }
     } catch {
       return { known: false }
     }
   }
 
-  async inspect(sessionId: string, startedAt = 0): Promise<ExecutionInspection> {
-    const sessions = await this.api.sessions.list(request({}))
-    if (!sessions.result.ok) return { outcome: 'pending' }
-    const summary = sessions.result.value.items.find(item => item.sessionId === sessionId)
+  /**
+   * Resolve one execution's outcome. The caller may pass the session list it
+   * already fetched this poll tick; otherwise inspect lists sessions itself.
+   * Sharing the list keeps a poll with E open executions at one list RPC
+   * instead of 1 + E.
+   */
+  async inspect(sessionId: string, startedAt = 0, sessions?: readonly SessionSummary[]): Promise<ExecutionInspection> {
+    let items: readonly SessionSummary[]
+    if (sessions !== undefined) {
+      items = sessions
+    } else {
+      const response = await this.api.sessions.list(request({}))
+      if (!response.result.ok) return { outcome: 'pending' }
+      items = response.result.value.items
+    }
+    const summary = items.find(item => item.sessionId === sessionId)
     if (summary === undefined) return { outcome: 'cancelled', error: 'execution session no longer exists' }
     if (summary.running) return { outcome: 'pending' }
     const events: Array<{ event: { type: string; seq?: number; time?: number; data: unknown } }> = []

package/src/host-service.ts

@@ -2,9 +2,9 @@ import type { ApiProxy } from '@deepseek-ai/dsh-host-apiproxy'
 import { nextRunAtMs } from './core/schedule.ts'
 import type { TaskRecord } from './core/tasks.ts'
 import { HostTaskLedger, type OpenedRun } from './host-ledger.ts'
-import { HostExecutionRunner, SessionLaunchError } from './host-runner.ts'
+import { HostExecutionRunner, SessionLaunchError, type SessionSummary } from './host-runner.ts'
 import { PowerInhibitor } from './power-inhibitor.ts'
-import type { TaskBoardAction, TaskBoardSnapshot } from './protocol.ts'
+import type { TaskBoardAction, TaskBoardEventPayload, TaskBoardSnapshot } from './protocol.ts'
 
 const SESSION_POLL_MS = 5_000
 const SCHEDULE_TICK_MS = 30_000
@@ -22,6 +22,7 @@ export class TaskBoardHostService {
   private tickInFlight = false
   private active = true
   private preventIdleSleep = false
+  private lastPowerJson = ''
   private readonly now: () => number
 
   constructor(api: ApiProxy, options: { ledger?: HostTaskLedger; power?: PowerInhibitor; now?: () => number } = {}) {
@@ -33,7 +34,15 @@ export class TaskBoardHostService {
       this.syncPowerReasons()
       this.emit()
     })
-    this.power.subscribe(() => { this.emit() })
+    this.power.subscribe(() => {
+      // updateReasons emits on every poll tick even when nothing changed;
+      // gate on the actual snapshot so the 5 s heartbeat does not push an
+      // empty SSE frame per tab forever.
+      const json = JSON.stringify(this.power.snapshot())
+      if (json === this.lastPowerJson) return
+      this.lastPowerJson = json
+      this.emit()
+    })
   }
 
   start(): void {
@@ -76,6 +85,12 @@ export class TaskBoardHostService {
     }
   }
 
+  /** SSE frame payload; deliberately skips the tasks deep-clone of {@link snapshot}. */
+  eventPayload(): TaskBoardEventPayload {
+    const { revision, scheduler } = this.ledger.summary()
+    return { revision, scheduler, power: this.power.snapshot() }
+  }
+
   subscribe(listener: () => void): () => void {
     this.listeners.add(listener)
     return () => { this.listeners.delete(listener) }
@@ -124,16 +139,18 @@ export class TaskBoardHostService {
       armedSchedules: this.armedSchedules(),
       sessionStateKnown: running.known,
     })
-    if (running.known) await this.reconcileExecutions()
-    this.emit()
+    // No unconditional emit here: real changes already emit through the
+    // ledger subscription (settles) and the gated power listener above.
+    if (running.known) await this.reconcileExecutions(running.items)
   }
 
-  private async reconcileExecutions(): Promise<void> {
+  /** Reuse the session list this poll already fetched: one list RPC per tick, not 1 + E. */
+  private async reconcileExecutions(sessions: readonly SessionSummary[]): Promise<void> {
     for (const task of this.ledger.state().tasks) {
       for (const execution of task.executions) {
         if (execution.sessionId === undefined || execution.endedAt !== undefined) continue
         try {
-          const result = await this.runner.inspect(execution.sessionId, execution.startedAt)
+          const result = await this.runner.inspect(execution.sessionId, execution.startedAt, sessions)
           if (result.outcome === 'pending') continue
           this.ledger.settle(task.id, execution.id, result.outcome, 'error' in result ? result.error : undefined)
         } catch {

package/src/protocol.ts

@@ -33,6 +33,13 @@ export interface TaskBoardSnapshot {
   power: TaskBoardPowerSnapshot
 }
 
+/** SSE event frame: revision/scheduler/power only, never the task list. */
+export interface TaskBoardEventPayload {
+  revision: number
+  scheduler: TaskBoardSchedulerSnapshot
+  power: TaskBoardPowerSnapshot
+}
+
 export type TaskBoardAction =
   | { kind: 'import'; sourceId: string; tasks: TaskRecord[] }
   | { kind: 'create'; id: string; input: NewTaskInput }