@linxin666/dsh-client-ui-task-board 0.2.0 → 0.2.2

package/lib/index.js

@@ -51,19 +51,65 @@ function isValidCron(expr) {
 * can never match (for example `0 0 30 2 *`). The five-year horizon includes
 * a full leap cycle, so a valid February 29 schedule remains reachable from
 * every non-leap year.
+*
+* Walks candidate year/month/day/hour/minute values straight from the parsed
+* field sets instead of scanning every minute: a sparse expression such as
+* `0 0 29 2 *` used to iterate ~1.5M wall-clock minutes before reaching the
+* next leap day. Wall-clock field construction + the final `matches` re-check
+* preserve the old minute scan's DST semantics exactly (nonexistent spring
+* minutes normalize forward and the repeated fall-back hour is never visited).
 */
 function nextRunAtMs(expr, fromMs) {
 	const schedule = parseCron(expr);
 	if (schedule === null) return void 0;
 	if (!hasPossibleCalendarDay(schedule)) return void 0;
 	const from = new Date(fromMs);
-	const scan = new Date(from.getFullYear(), from.getMonth(), from.getDate(), from.getHours(), from.getMinutes() + 1, 0, 0);
 	const limitMs = fromMs + 5 * 366 * 24 * 60 * 60 * 1e3;
-	while (scan.getTime() <= limitMs) {
-		if (matches(schedule, scan)) return scan.getTime();
-		scan.setMinutes(scan.getMinutes() + 1);
+	const sortedMinutes = [...schedule.minutes].sort((a, b) => a - b);
+	const sortedHours = [...schedule.hours].sort((a, b) => a - b);
+	const sortedMonths = [...schedule.months].sort((a, b) => a - b);
+	let year = from.getFullYear();
+	let month = from.getMonth() + 1;
+	let day = from.getDate();
+	let hour = from.getHours();
+	let minute = from.getMinutes() + 1;
+	while (new Date(year, month - 1, 1, 0, 0, 0, 0).getTime() <= limitMs) {
+		for (const candidateMonth of sortedMonths) {
+			if (candidateMonth < month) continue;
+			const daysInMonth = new Date(year, candidateMonth, 0).getDate();
+			const dayStart = candidateMonth === month ? day : 1;
+			for (let candidateDay = dayStart; candidateDay <= daysInMonth; candidateDay += 1) {
+				if (!dayCandidate(schedule, new Date(year, candidateMonth - 1, candidateDay, 0, 0, 0, 0))) continue;
+				const hourStart = candidateMonth === month && candidateDay === day ? hour : 0;
+				for (const candidateHour of sortedHours) {
+					if (candidateHour < hourStart) continue;
+					const minuteStart = candidateMonth === month && candidateDay === day && candidateHour === hour ? minute : 0;
+					for (const candidateMinute of sortedMinutes) {
+						if (candidateMinute < minuteStart) continue;
+						const candidate = new Date(year, candidateMonth - 1, candidateDay, candidateHour, candidateMinute, 0, 0);
+						const time = candidate.getTime();
+						if (time <= fromMs) continue;
+						if (time > limitMs) return void 0;
+						if (matches(schedule, candidate)) return time;
+					}
+				}
+			}
+		}
+		year += 1;
+		month = 1;
+		day = 1;
+		hour = 0;
+		minute = 0;
 	}
 }
+/** Day/weekday OR gate shared by {@link matches} and the candidate scan. */
+function dayCandidate(schedule, date) {
+	const dayMatches = schedule.days.has(date.getDate());
+	const weekdayMatches = schedule.weekdays.has(date.getDay());
+	if (schedule.dayWildcard) return weekdayMatches;
+	if (schedule.weekdayWildcard) return dayMatches;
+	return dayMatches || weekdayMatches;
+}
 /** Reject impossible month/day pairs without spending the multi-year scan. */
 function hasPossibleCalendarDay(schedule) {
 	if (schedule.dayWildcard || !schedule.weekdayWildcard) return true;
@@ -122,11 +168,7 @@ function matches(schedule, date) {
 	if (!schedule.minutes.has(date.getMinutes())) return false;
 	if (!schedule.hours.has(date.getHours())) return false;
 	if (!schedule.months.has(date.getMonth() + 1)) return false;
-	const dayMatches = schedule.days.has(date.getDate());
-	const weekdayMatches = schedule.weekdays.has(date.getDay());
-	if (schedule.dayWildcard) return weekdayMatches;
-	if (schedule.weekdayWildcard) return dayMatches;
-	return dayMatches || weekdayMatches;
+	return dayCandidate(schedule, date);
 }
 function isDigits(value) {
 	return /^\d+$/.test(value);
@@ -836,7 +878,7 @@ function mergeTask(a, b) {
 		executions: [...byId.values()].sort((x, y) => x.startedAt - y.startedAt)
 	};
 }
-function parseHostTasks(values, now) {
+function parseHostTasks(values) {
 	const rawById = /* @__PURE__ */ new Map();
 	for (const value of values) {
 		if (typeof value !== "object" || value === null) continue;
@@ -868,11 +910,14 @@ var HostTaskLedger = class {
 	lockFd;
 	file;
 	lockFile;
+	/** Small sidecar for the 30 s scheduler heartbeat (lastTickAt only). */
+	schedulerFile;
 	constructor(dir = join(dshHome(), "task-board"), now = Date.now) {
 		this.now = now;
 		mkdirSync(dir, { recursive: true });
 		this.file = join(dir, "ledger-v2.json");
 		this.lockFile = join(dir, "ledger-v2.lock");
+		this.schedulerFile = join(dir, "scheduler-v2.json");
 		this.lockFd = this.acquireLock();
 		try {
 			this.document = this.load(dir);
@@ -885,14 +930,22 @@ var HostTaskLedger = class {
 			throw error;
 		}
 	}
-	state() {
+	/** Revision + scheduler without any task cloning; feeds the SSE event frame. */
+	summary() {
 		const { importedSources: _imports, ...scheduler } = this.document.scheduler;
 		return {
 			revision: this.document.revision,
-			tasks: cloneTasks(this.document.tasks),
 			scheduler: { ...scheduler }
 		};
 	}
+	state() {
+		const { revision, scheduler } = this.summary();
+		return {
+			revision,
+			tasks: cloneTasks(this.document.tasks),
+			scheduler
+		};
+	}
 	subscribe(listener) {
 		this.listeners.add(listener);
 		return () => {
@@ -962,6 +1015,10 @@ var HostTaskLedger = class {
 			...this.document.scheduler,
 			...patch
 		};
+		if (patch.lastTickAt !== void 0 && Object.keys(patch).every((key) => key === "lastTickAt")) {
+			this.writeSchedulerSidecar();
+			return;
+		}
 		this.commit(false);
 	}
 	attachSession(taskId, executionId, sessionId) {
@@ -988,7 +1045,7 @@ var HostTaskLedger = class {
 				const sources = new Set(this.document.scheduler.importedSources ?? []);
 				if (sources.has(action.sourceId)) return { state: this.state() };
 				const invalidScheduleIds = action.tasks.filter((task) => task.schedule !== void 0 && !isValidCron(task.schedule.cron)).map((task) => task.id);
-				const incoming = parseHostTasks(action.tasks, now);
+				const incoming = parseHostTasks(action.tasks);
 				const merged = new Map(this.document.tasks.map((task) => [task.id, task]));
 				for (const task of incoming) merged.set(task.id, merged.has(task.id) ? mergeTask(merged.get(task.id), task) : task);
 				this.document.tasks = [...merged.values()];
@@ -1116,7 +1173,7 @@ var HostTaskLedger = class {
 		try {
 			const parsed = JSON.parse(readFileSync(this.file, "utf8"));
 			if (parsed.schemaVersion !== 2 || !Array.isArray(parsed.tasks)) throw new Error("unsupported ledger schema");
-			const tasks = parseHostTasks(parsed.tasks, this.now());
+			const tasks = parseHostTasks(parsed.tasks);
 			const invalidScheduleIds = parsed.tasks.flatMap((value) => {
 				if (typeof value !== "object" || value === null) return [];
 				const row = value;
@@ -1124,6 +1181,9 @@ var HostTaskLedger = class {
 				const cron = row.schedule.cron;
 				return typeof cron !== "string" || !isValidCron(cron) ? [typeof row.id === "string" ? row.id : "unknown"] : [];
 			});
+			const documentLastTickAt = typeof parsed.scheduler?.lastTickAt === "number" ? parsed.scheduler.lastTickAt : void 0;
+			const sidecarLastTickAt = this.readSchedulerSidecar();
+			const lastTickAt = sidecarLastTickAt === void 0 || documentLastTickAt !== void 0 && documentLastTickAt >= sidecarLastTickAt ? documentLastTickAt : sidecarLastTickAt;
 			return {
 				schemaVersion: 2,
 				revision: Number.isSafeInteger(parsed.revision) && parsed.revision >= 0 ? parsed.revision : 0,
@@ -1131,7 +1191,7 @@ var HostTaskLedger = class {
 				scheduler: {
 					timeZone: timeZone(),
 					ledgerId: typeof parsed.scheduler?.ledgerId === "string" && parsed.scheduler.ledgerId !== "" ? parsed.scheduler.ledgerId : crypto.randomUUID(),
-					...typeof parsed.scheduler?.lastTickAt === "number" ? { lastTickAt: parsed.scheduler.lastTickAt } : {},
+					...lastTickAt === void 0 ? {} : { lastTickAt },
 					...typeof parsed.scheduler?.error === "string" ? { error: parsed.scheduler.error } : {},
 					...invalidScheduleIds.length > 0 ? { error: `invalid cron disabled for task(s): ${invalidScheduleIds.join(", ")}` } : {},
 					...Array.isArray(parsed.scheduler?.importedSources) ? { importedSources: parsed.scheduler.importedSources.filter((x) => typeof x === "string") } : {}
@@ -1167,6 +1227,47 @@ var HostTaskLedger = class {
 			fingerprint: request.fingerprint
 		}));
 	}
+	readSchedulerSidecar() {
+		try {
+			const parsed = JSON.parse(readFileSync(this.schedulerFile, "utf8"));
+			return typeof parsed.lastTickAt === "number" && Number.isFinite(parsed.lastTickAt) ? parsed.lastTickAt : void 0;
+		} catch {
+			return;
+		}
+	}
+	/** Atomic write of the scheduler heartbeat sidecar (0600, tmp + rename + fsync). */
+	writeSchedulerSidecar() {
+		const payload = JSON.stringify({ lastTickAt: this.document.scheduler.lastTickAt });
+		mkdirSync(dirname(this.schedulerFile), { recursive: true });
+		const tmp = `${this.schedulerFile}.tmp-${process.pid}`;
+		let fd;
+		try {
+			fd = openSync(tmp, "w", 384);
+			writeFileSync(fd, payload, { encoding: "utf8" });
+			fsyncSync(fd);
+			closeSync(fd);
+			fd = void 0;
+			try {
+				chmodSync(tmp, 384);
+			} catch {}
+			renameSync(tmp, this.schedulerFile);
+			try {
+				const dirFd = openSync(dirname(this.schedulerFile), "r");
+				try {
+					fsyncSync(dirFd);
+				} finally {
+					closeSync(dirFd);
+				}
+			} catch {}
+		} catch (error) {
+			if (fd !== void 0) closeSync(fd);
+			try {
+				unlinkSync(tmp);
+			} catch {}
+			throw error;
+		}
+		this.notify();
+	}
 	commit(bumpRevision = true) {
 		if (bumpRevision) this.document.revision += 1;
 		mkdirSync(dirname(this.file), { recursive: true });
@@ -1319,16 +1420,28 @@ var HostExecutionRunner = class {
 			const response = await this.api.sessions.list(request({}));
 			return response.result.ok ? {
 				known: true,
-				count: response.result.value.items.filter((item) => item.running).length
+				count: response.result.value.items.filter((item) => item.running).length,
+				items: response.result.value.items
 			} : { known: false };
 		} catch {
 			return { known: false };
 		}
 	}
-	async inspect(sessionId, startedAt = 0) {
-		const sessions = await this.api.sessions.list(request({}));
-		if (!sessions.result.ok) return { outcome: "pending" };
-		const summary = sessions.result.value.items.find((item) => item.sessionId === sessionId);
+	/**
+	* Resolve one execution's outcome. The caller may pass the session list it
+	* already fetched this poll tick; otherwise inspect lists sessions itself.
+	* Sharing the list keeps a poll with E open executions at one list RPC
+	* instead of 1 + E.
+	*/
+	async inspect(sessionId, startedAt = 0, sessions) {
+		let items;
+		if (sessions !== void 0) items = sessions;
+		else {
+			const response = await this.api.sessions.list(request({}));
+			if (!response.result.ok) return { outcome: "pending" };
+			items = response.result.value.items;
+		}
+		const summary = items.find((item) => item.sessionId === sessionId);
 		if (summary === void 0) return {
 			outcome: "cancelled",
 			error: "execution session no longer exists"
@@ -1688,6 +1801,7 @@ var TaskBoardHostService = class {
 	tickInFlight = false;
 	active = true;
 	preventIdleSleep = false;
+	lastPowerJson = "";
 	now;
 	constructor(api, options = {}) {
 		this.ledger = options.ledger ?? new HostTaskLedger();
@@ -1699,6 +1813,9 @@ var TaskBoardHostService = class {
 			this.emit();
 		});
 		this.power.subscribe(() => {
+			const json = JSON.stringify(this.power.snapshot());
+			if (json === this.lastPowerJson) return;
+			this.lastPowerJson = json;
 			this.emit();
 		});
 	}
@@ -1743,6 +1860,15 @@ var TaskBoardHostService = class {
 			power: this.power.snapshot()
 		};
 	}
+	/** SSE frame payload; deliberately skips the tasks deep-clone of {@link snapshot}. */
+	eventPayload() {
+		const { revision, scheduler } = this.ledger.summary();
+		return {
+			revision,
+			scheduler,
+			power: this.power.snapshot()
+		};
+	}
 	subscribe(listener) {
 		this.listeners.add(listener);
 		return () => {
@@ -1787,14 +1913,14 @@ var TaskBoardHostService = class {
 			armedSchedules: this.armedSchedules(),
 			sessionStateKnown: running.known
 		});
-		if (running.known) await this.reconcileExecutions();
-		this.emit();
+		if (running.known) await this.reconcileExecutions(running.items);
 	}
-	async reconcileExecutions() {
+	/** Reuse the session list this poll already fetched: one list RPC per tick, not 1 + E. */
+	async reconcileExecutions(sessions) {
 		for (const task of this.ledger.state().tasks) for (const execution of task.executions) {
 			if (execution.sessionId === void 0 || execution.endedAt !== void 0) continue;
 			try {
-				const result = await this.runner.inspect(execution.sessionId, execution.startedAt);
+				const result = await this.runner.inspect(execution.sessionId, execution.startedAt, sessions);
 				if (result.outcome === "pending") continue;
 				this.ledger.settle(task.id, execution.id, result.outcome, "error" in result ? result.error : void 0);
 			} catch {}
@@ -1950,6 +2076,12 @@ function resolveAccess(access) {
 		...access.proxyToken === void 0 ? {} : { proxyToken: access.proxyToken }
 	};
 }
+/**
+* Browser-signal tripwire, NOT an authority check: a bare curl sends neither
+* header and is refused, but a curl with a forged Origin passes this too.
+* The real boundary is the loopback socket + Host + origin-equality checks
+* in isTrustedTaskBoardRequest below; do not rely on this marker alone.
+*/
 function browserSameOriginMarker(req) {
 	return req.headers["sec-fetch-site"] === "same-origin" || typeof req.headers.origin === "string";
 }
@@ -1972,7 +2104,9 @@ function matchesToken(candidate, expected) {
 /**
 * Task-board route fence. Direct desktop access uses the repository-wide
 * loopback socket + Host guard and additionally requires a browser same-origin
-* marker, so a bare local curl cannot exercise the agent control plane.
+* marker: a bare local curl without any browser signal cannot exercise the
+* agent control plane (a forged Origin does pass the marker — it is a
+* tripwire, the socket/Host/origin-equality checks carry the authority).
 * Authenticated proxies must be explicitly allowlisted and replace the
 * internal token header after their own authentication step.
 */
@@ -2075,12 +2209,8 @@ function makeTaskBoardRoutes(service, access = {}) {
 					connection: "keep-alive"
 				});
 				const push = () => {
-					const snapshot = service.snapshot();
-					res.write(`data: ${JSON.stringify({
-						revision: snapshot.revision,
-						scheduler: snapshot.scheduler,
-						power: snapshot.power
-					})}\n\n`);
+					const payload = service.eventPayload();
+					res.write(`data: ${JSON.stringify(payload)}\n\n`);
 				};
 				const unsubscribe = service.subscribe(push);
 				const heartbeat = setInterval(() => {

package/lib/types/client/PluginSettingsCard.d.ts

@@ -88,6 +88,27 @@ export declare function ValueField(props: FieldProps & {
     /** Placeholder shown while the draft is empty. */
     placeholder?: string;
 }): import("react").JSX.Element;
+interface SelectOption {
+    value: string;
+    label: string;
+}
+/**
+ * The shared dual-mode select control. While an appearance skin is active it
+ * renders the legacy native `<select>` untouched, so element-level skin
+ * selectors keep working; under the default appearance it renders a
+ * self-drawn `role="listbox"` popup whose open/close is transition-animated.
+ * Staged cards reach it through BooleanField/ChoiceField; immediate-apply
+ * editors (the side-card prefs) bind it directly through onEdit.
+ * 双模式下拉框：皮肤激活时用原生 select，默认外观用自绘动画弹层。
+ */
+export declare function SelectField(props: {
+    id: string;
+    options: ReadonlyArray<SelectOption>;
+    value: string;
+    disabled: boolean;
+    invalid: boolean;
+    onEdit: (text: string) => void;
+}): import("react").JSX.Element;
 /** A staged boolean field: 继承 / 开 / 关. */
 export declare function BooleanField(props: FieldProps & {
     /** Copy for the inherit option. */
@@ -107,3 +128,4 @@ export declare function ChoiceField(props: FieldProps & {
         label: string;
     }>;
 }): import("react").JSX.Element;
+export {};

package/lib/types/client/TaskBoardSettingsCard.d.ts

@@ -1,7 +1,7 @@
 /**
  * Task-board settings for availability, agent announcement, and optional Host
- * idle-sleep protection. Registers into the `settings.plugin.item` slot the
- * plugin-configuration section renders, bound to the `task-board` namespace.
+ * idle-sleep protection. Registers into the `web-ui.plugin.item` child slot
+ * the Web UI plugin group renders, bound to the `task-board` namespace.
  */
 import type { InjectFace, PropsLocale, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots';
 import type { SettingsScope, SnapshotStore } from '@deepseek-ai/dsh-client-runtime/client';

package/lib/types/client/host-api.d.ts

@@ -1,10 +1,10 @@
 import type { TaskRecord } from '../core/tasks.ts';
-import { type TaskBoardAction, type TaskBoardSnapshot } from '../protocol.ts';
+import { type TaskBoardAction, type TaskBoardEventPayload, type TaskBoardSnapshot } from '../protocol.ts';
 export interface TaskBoardHostTransport {
     bootstrap(legacy: readonly TaskRecord[]): Promise<TaskBoardSnapshot>;
     state(): Promise<TaskBoardSnapshot>;
     action(action: TaskBoardAction): Promise<TaskBoardSnapshot>;
-    subscribe(listener: () => void): () => void;
+    subscribe(listener: (event?: TaskBoardEventPayload) => void): () => void;
 }
 export declare class HttpTaskBoardHostTransport implements TaskBoardHostTransport {
     private readonly storage;
@@ -14,5 +14,5 @@ export declare class HttpTaskBoardHostTransport implements TaskBoardHostTranspor
     action(action: TaskBoardAction): Promise<TaskBoardSnapshot>;
     private post;
     private request;
-    subscribe(listener: () => void): () => void;
+    subscribe(listener: (event?: TaskBoardEventPayload) => void): () => void;
 }

package/lib/types/client/sidebar-entry-core.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Shared sidebar entry injection core.
+ *
+ * dsh's sidebar shell exposes no slot an external plugin can register into,
+ * so the entry row is injected between the shell's New Session button and the
+ * workspace browser. The injection self-heals: a MutationObserver watches the
+ * sidebar root and re-inserts the row whenever a React re-render displaces it
+ * (re-insertion happens in the same frame, before paint, so no flicker).
+ *
+ * The row is plain DOM (no React tree) so it can never disturb the shell's
+ * reconciliation; the view it toggles is a separate root owned by the caller.
+ *
+ * Packages receive this file as a generated copy via scripts/sync-shared.mjs;
+ * edit the shared source and re-run the sync instead of editing a copy.
+ */
+/** Per-package configuration for one sidebar entry row. */
+export interface SidebarEntryOptions {
+    /** Full attribute name identifying the injected row (idempotency key), e.g. 'data-dsh-ssh-entry'. */
+    rowAttribute: string;
+    /** CSS selector matching the injected row, e.g. '[data-dsh-ssh-entry]'. */
+    rowSelector: string;
+    /**
+     * L2 semantic-attribute plugin id (issue #506, enum table:
+     * skins/skin-center/contracts/semantic-attrs-v1.md). When set, the row also
+     * outputs data-dsh-plugin="<id>" and data-dsh-part="sidebar-entry"; unset
+     * leaves the row without semantic attributes.
+     */
+    plugin?: string;
+    /** Inline icon markup (matches the shell's 16px nav-icon look). */
+    icon: string;
+    /** CSS module class names for the row and its two spans (entry / entryIcon / entryLabel). */
+    css: Record<string, string>;
+    /** Localized row label (aria-label + visible text). */
+    label(): string;
+    /** Optional localized tooltip (title attribute). */
+    tooltip?(): string;
+    /** Click action (open/toggle the owning panel). */
+    onToggle(): void;
+    /** Family-block position: 'before' inserts ahead of sibling plugin rows, 'after' behind them. */
+    position: 'before' | 'after';
+    /**
+     * Selectors of the sibling plugin entry rows this package orders against
+     * (its own row included — the placement guard excludes a row that is
+     * already inside the root). Each package passes the same list it used
+     * before the consolidation so the rendered order stays stable.
+     */
+    familySelectors: readonly string[];
+    /** Optional active-state bridge; highlights the row while the panel is open. */
+    active?: {
+        subscribe(listener: () => void): () => void;
+        isOpen(): boolean;
+    };
+}
+/**
+ * Mount the sidebar entry, waiting for the shell to render and self-healing
+ * on later React re-renders.
+ * @param options - the row's attribute/icon/copy/action/ordering configuration.
+ * @returns disposer removing the entry and its observers.
+ */
+export declare function mountSidebarEntry(options: SidebarEntryOptions): () => void;

package/lib/types/client/sidebar-entry.d.ts

@@ -1,17 +1,15 @@
 /**
- * Sidebar entry injection.
+ * Sidebar entry injection — package-specific wiring over the shared core.
  *
  * dsh's sidebar shell exposes no slot an external plugin can register into
  * (`sidebar.workspaces` / `sidebar.settings` are single-occupant and already
- * taken), so — following the skin precedent of DOM-level extension — the
- * entry row is injected between the shell's New Session button and the
- * workspace browser. The injection self-heals: a MutationObserver watches the
- * sidebar root and re-inserts the row whenever a React re-render displaces it
- * (re-insertion happens in the same frame, before paint, so no flicker).
- *
- * The row is plain DOM (no React tree) so it can never disturb the shell's
- * reconciliation; the board view it toggles is a separate React root mounted
- * in the center column (see board-mount.ts).
+ * taken), so the entry row is injected between the shell's New Session button
+ * and the workspace browser. The DOM injection / self-healing / idempotency
+ * logic lives exactly once in shared/client/sidebar-entry-core.ts (synced
+ * copy); this wrapper supplies the task-board icon, copy, CSS module, and the
+ * board toggle. The row is plain DOM (no React tree); the board view it
+ * toggles is a separate React root mounted in the center column
+ * (see board-mount.ts).
  */
 import type { BoardController } from '../core/controller.ts';
 /** Stable data attribute identifying the injected entry row. */

package/lib/types/core/controller.d.ts

@@ -16,12 +16,12 @@ import type { ExecutionService } from './execution.ts';
 import type { TaskStore } from './store.ts';
 import { type NewTaskInput, type TaskRecord, type TaskStatus } from './tasks.ts';
 import { type TaskUpdatePatch } from './use-cases/task-update.ts';
-import type { TaskBoardAction, TaskBoardSnapshot } from '../protocol.ts';
+import type { TaskBoardAction, TaskBoardEventPayload, TaskBoardSnapshot } from '../protocol.ts';
 export interface TaskBoardTransport {
     bootstrap(legacy: readonly TaskRecord[]): Promise<TaskBoardSnapshot>;
     state(): Promise<TaskBoardSnapshot>;
     action(action: TaskBoardAction): Promise<TaskBoardSnapshot>;
-    subscribe(listener: () => void): () => void;
+    subscribe(listener: (event?: TaskBoardEventPayload) => void): () => void;
 }
 /** The sessions face the controller needs for navigation awareness. */
 export interface SessionsControllerFace {
@@ -209,6 +209,13 @@ export declare class BoardController {
     private performRemote;
     private initializeRemote;
     private doInitializeRemote;
+    /**
+     * SSE frames carry revision/scheduler/power. When the revision matches the
+     * one already applied, apply the frame's scheduler/power in place and skip
+     * the full /state fetch; otherwise the 5 s heartbeat would re-clone and
+     * re-serialize the whole ledger per tab even while nothing changes.
+     */
+    private onRemoteEvent;
     private refreshRemote;
     private acceptRemote;
     private notify;

package/lib/types/core/schedule.d.ts

@@ -38,5 +38,12 @@ export declare function isValidCron(expr: string): boolean;
  * can never match (for example `0 0 30 2 *`). The five-year horizon includes
  * a full leap cycle, so a valid February 29 schedule remains reachable from
  * every non-leap year.
+ *
+ * Walks candidate year/month/day/hour/minute values straight from the parsed
+ * field sets instead of scanning every minute: a sparse expression such as
+ * `0 0 29 2 *` used to iterate ~1.5M wall-clock minutes before reaching the
+ * next leap day. Wall-clock field construction + the final `matches` re-check
+ * preserve the old minute scan's DST semantics exactly (nonexistent spring
+ * minutes normalize forward and the repeated fall-back hour is never visited).
  */
 export declare function nextRunAtMs(expr: string, fromMs: number): number | undefined;

package/lib/types/host-ledger.d.ts

@@ -18,7 +18,14 @@ export declare class HostTaskLedger {
     private lockFd;
     readonly file: string;
     readonly lockFile: string;
+    /** Small sidecar for the 30 s scheduler heartbeat (lastTickAt only). */
+    readonly schedulerFile: string;
     constructor(dir?: string, now?: () => number);
+    /** Revision + scheduler without any task cloning; feeds the SSE event frame. */
+    summary(): {
+        revision: number;
+        scheduler: TaskBoardSchedulerSnapshot;
+    };
     state(): LedgerState;
     subscribe(listener: () => void): () => void;
     dispose(): void;
@@ -36,6 +43,9 @@ export declare class HostTaskLedger {
     private reconcileInterruptedStarts;
     private load;
     private syncRecentRequests;
+    private readSchedulerSidecar;
+    /** Atomic write of the scheduler heartbeat sidecar (0600, tmp + rename + fsync). */
+    private writeSchedulerSidecar;
     private commit;
     private notify;
     private acquireLock;

package/lib/types/host-routes.d.ts

@@ -15,7 +15,9 @@ interface ResolvedRouteAccess {
 /**
  * Task-board route fence. Direct desktop access uses the repository-wide
  * loopback socket + Host guard and additionally requires a browser same-origin
- * marker, so a bare local curl cannot exercise the agent control plane.
+ * marker: a bare local curl without any browser signal cannot exercise the
+ * agent control plane (a forged Origin does pass the marker — it is a
+ * tripwire, the socket/Host/origin-equality checks carry the authority).
  * Authenticated proxies must be explicitly allowlisted and replace the
  * internal token header after their own authentication step.
  */

package/lib/types/host-runner.d.ts

@@ -1,5 +1,9 @@
 import type { ApiProxy } from '@deepseek-ai/dsh-host-apiproxy';
 import type { TaskRecord } from './core/tasks.ts';
+/** One session-list row, extracted from the sessions.list RPC result. */
+export type SessionSummary = Extract<Awaited<ReturnType<ApiProxy['sessions']['list']>>['result'], {
+    ok: true;
+}>['value']['items'][number];
 export type ExecutionInspection = {
     outcome: 'pending';
 } | {
@@ -23,8 +27,15 @@ export declare class HostExecutionRunner {
     listRunning(): Promise<{
         known: true;
         count: number;
+        items: SessionSummary[];
     } | {
         known: false;
     }>;
-    inspect(sessionId: string, startedAt?: number): Promise<ExecutionInspection>;
+    /**
+     * Resolve one execution's outcome. The caller may pass the session list it
+     * already fetched this poll tick; otherwise inspect lists sessions itself.
+     * Sharing the list keeps a poll with E open executions at one list RPC
+     * instead of 1 + E.
+     */
+    inspect(sessionId: string, startedAt?: number, sessions?: readonly SessionSummary[]): Promise<ExecutionInspection>;
 }

package/lib/types/host-service.d.ts

@@ -2,7 +2,7 @@ import type { ApiProxy } from '@deepseek-ai/dsh-host-apiproxy';
 import { HostTaskLedger } from './host-ledger.ts';
 import { HostExecutionRunner } from './host-runner.ts';
 import { PowerInhibitor } from './power-inhibitor.ts';
-import type { TaskBoardAction, TaskBoardSnapshot } from './protocol.ts';
+import type { TaskBoardAction, TaskBoardEventPayload, TaskBoardSnapshot } from './protocol.ts';
 export declare class TaskBoardHostService {
     readonly ledger: HostTaskLedger;
     readonly runner: HostExecutionRunner;
@@ -15,6 +15,7 @@ export declare class TaskBoardHostService {
     private tickInFlight;
     private active;
     private preventIdleSleep;
+    private lastPowerJson;
     private readonly now;
     constructor(api: ApiProxy, options?: {
         ledger?: HostTaskLedger;
@@ -24,11 +25,14 @@ export declare class TaskBoardHostService {
     start(): void;
     setConfiguration(active: boolean, preventIdleSleep: boolean): void;
     snapshot(): TaskBoardSnapshot;
+    /** SSE frame payload; deliberately skips the tasks deep-clone of {@link snapshot}. */
+    eventPayload(): TaskBoardEventPayload;
     subscribe(listener: () => void): () => void;
     apply(requestId: string, action: TaskBoardAction): TaskBoardSnapshot;
     dispose(): void;
     private launch;
     private pollSessions;
+    /** Reuse the session list this poll already fetched: one list RPC per tick, not 1 + E. */
     private reconcileExecutions;
     private tickSchedule;
     private armedSchedules;

package/lib/types/protocol.d.ts

@@ -26,6 +26,12 @@ export interface TaskBoardSnapshot {
     scheduler: TaskBoardSchedulerSnapshot;
     power: TaskBoardPowerSnapshot;
 }
+/** SSE event frame: revision/scheduler/power only, never the task list. */
+export interface TaskBoardEventPayload {
+    revision: number;
+    scheduler: TaskBoardSchedulerSnapshot;
+    power: TaskBoardPowerSnapshot;
+}
 export type TaskBoardAction = {
     kind: 'import';
     sourceId: string;