@linxin666/dsh-client-ui-task-board 0.2.8 → 0.3.0

package/src/host-routes.ts

@@ -2,6 +2,7 @@ import { timingSafeEqual } from 'node:crypto'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import type { WebRoute } from '@deepseek-ai/dsh-host-webserver'
 import type { TaskBoardHostService } from './host-service.ts'
+import { writeJson } from './http.ts'
 import { isLoopbackAddress, isLoopbackRequest } from './loopback.ts'
 import { parseActionEnvelope, TASK_BOARD_API_PREFIX } from './protocol.ts'
 
@@ -23,11 +24,6 @@ interface ResolvedRouteAccess {
   proxyToken?: string
 }
 
-function json(res: ServerResponse, status: number, body: unknown): void {
-  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
-  res.end(JSON.stringify(body))
-}
-
 function parseAuthority(authority: string): { canonical: string; url: URL } | undefined {
   if (authority.trim() !== authority) return undefined
   const match = authority.startsWith('[')
@@ -127,38 +123,38 @@ export function makeTaskBoardRoutes(service: TaskBoardHostService, access: TaskB
   const resolvedAccess = resolveAccess(access)
   const guard = (req: IncomingMessage, res: ServerResponse): boolean => {
     if (isTrustedTaskBoardRequest(req, resolvedAccess)) return true
-    json(res, 403, { ok: false, error: 'forbidden' })
+    writeJson(res, 403, { ok: false, error: 'forbidden' }, { 'cache-control': 'no-store' })
     return false
   }
   const state: WebRoute = {
     kind: 'exact',
     path: `${TASK_BOARD_API_PREFIX}/state`,
     handler: (req, res): void => {
-      if (req.method !== 'GET') return json(res, 405, { ok: false, error: 'method-not-allowed' })
+      if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'method-not-allowed' }, { 'cache-control': 'no-store' })
       if (!guard(req, res)) return
-      json(res, 200, service.snapshot())
+      writeJson(res, 200, service.snapshot(), { 'cache-control': 'no-store' })
     },
   }
   const action: WebRoute = {
     kind: 'exact',
     path: `${TASK_BOARD_API_PREFIX}/action`,
     handler: async (req, res): Promise<void> => {
-      if (req.method !== 'POST') return json(res, 405, { ok: false, error: 'method-not-allowed' })
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'method-not-allowed' }, { 'cache-control': 'no-store' })
       if (!guard(req, res)) return
       if (!(req.headers['content-type'] ?? '').toLowerCase().startsWith('application/json')) {
-        return json(res, 415, { ok: false, error: 'json-required' })
+        return writeJson(res, 415, { ok: false, error: 'json-required' }, { 'cache-control': 'no-store' })
       }
       try {
         const body = await readBody(req)
         const parsed = parseActionEnvelope(body.value)
-        if (parsed === undefined) return json(res, 400, { ok: false, error: 'invalid-action' })
+        if (parsed === undefined) return writeJson(res, 400, { ok: false, error: 'invalid-action' }, { 'cache-control': 'no-store' })
         if (parsed.action.kind !== 'import' && Buffer.byteLength(body.raw) > ACTION_LIMIT) {
-          return json(res, 413, { ok: false, error: 'body-too-large' })
+          return writeJson(res, 413, { ok: false, error: 'body-too-large' }, { 'cache-control': 'no-store' })
         }
-        json(res, 200, service.apply(parsed.requestId, parsed.action))
+        writeJson(res, 200, service.apply(parsed.requestId, parsed.action), { 'cache-control': 'no-store' })
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error)
-        json(res, message === 'body-too-large' ? 413 : 400, { ok: false, error: message })
+        writeJson(res, message === 'body-too-large' ? 413 : 400, { ok: false, error: message }, { 'cache-control': 'no-store' })
       }
     },
   }

package/src/host-service.ts

@@ -1,7 +1,6 @@
 import type { ApiProxy } from '@deepseek-ai/dsh-host-apiproxy'
 import { nextRunAtMs } from './core/schedule.ts'
-import type { TaskRecord } from './core/tasks.ts'
-import { HostTaskLedger, type OpenedRun } from './host-ledger.ts'
+import { HostTaskLedger, type OpenedRun, type OpenExecutionReference } from './host-ledger.ts'
 import { HostExecutionRunner, SessionLaunchError, type SessionCommandDispatcher, type SessionSummary } from './host-runner.ts'
 import { PowerInhibitor } from './power-inhibitor.ts'
 import type { TaskBoardAction, TaskBoardEventPayload, TaskBoardSnapshot } from './protocol.ts'
@@ -136,31 +135,43 @@ export class TaskBoardHostService {
 
   private async pollSessions(): Promise<void> {
     if (this.disposed) return
-    if (!this.active && !this.hasOpenExecutions()) return
+    if (!this.active && this.ledger.runtimeView().openExecutions.length === 0) return
     const running = await this.runner.listRunning()
     const previous = this.power.snapshot()
+    if (!running.known) {
+      this.power.updateReasons({
+        runningSessions: previous.runningSessions,
+        armedSchedules: this.ledger.armedScheduleCount(),
+        sessionStateKnown: false,
+      })
+      return
+    }
+    // Read after the RPC so executions attached while it was in flight are
+    // included in this pass, matching the former full-state snapshot timing.
+    const runtime = this.ledger.runtimeView()
     this.power.updateReasons({
-      runningSessions: running.known ? running.count : previous.runningSessions,
-      armedSchedules: this.armedSchedules(),
-      sessionStateKnown: running.known,
+      runningSessions: running.count,
+      armedSchedules: runtime.armedSchedules,
+      sessionStateKnown: true,
     })
     // No unconditional emit here: real changes already emit through the
     // ledger subscription (settles) and the gated power listener above.
-    if (running.known) await this.reconcileExecutions(running.items)
+    await this.reconcileExecutions(running.items, runtime.openExecutions)
   }
 
   /** Reuse the session list this poll already fetched: one list RPC per tick, not 1 + E. */
-  private async reconcileExecutions(sessions: readonly SessionSummary[]): Promise<void> {
-    for (const task of this.ledger.state().tasks) {
-      for (const execution of task.executions) {
-        if (execution.sessionId === undefined || execution.endedAt !== undefined) continue
-        try {
-          const result = await this.runner.inspect(execution.sessionId, execution.startedAt, sessions)
-          if (result.outcome === 'pending') continue
-          this.ledger.settle(task.id, execution.id, result.outcome, 'error' in result ? result.error : undefined)
-        } catch {
-          // A transient inspection failure never settles a running execution.
-        }
+  private async reconcileExecutions(
+    sessions: readonly SessionSummary[],
+    executions: readonly OpenExecutionReference[],
+  ): Promise<void> {
+    for (const execution of executions) {
+      if (execution.sessionId === undefined) continue
+      try {
+        const result = await this.runner.inspect(execution.sessionId, execution.startedAt, sessions)
+        if (result.outcome === 'pending') continue
+        this.ledger.settle(execution.taskId, execution.executionId, result.outcome, 'error' in result ? result.error : undefined)
+      } catch {
+        // A transient inspection failure never settles a running execution.
       }
     }
   }
@@ -175,22 +186,15 @@ export class TaskBoardHostService {
       this.ledger.skipMissed(now)
       return
     }
-    for (const task of this.ledger.state().tasks) {
-      if (task.archivedAt !== undefined) continue
-      const schedule = task.schedule
-      if (schedule === undefined || !schedule.enabled || schedule.nextRunAt === undefined || schedule.nextRunAt > now) continue
+    for (const schedule of this.ledger.dueSchedules(now)) {
       const next = nextRunAtMs(schedule.cron, schedule.nextRunAt)
-      const opened = this.ledger.openScheduled(task.id, next, now)
+      const opened = this.ledger.openScheduled(schedule.taskId, next, now)
       if (opened !== undefined) this.scheduleLaunch(opened)
     }
   }
 
   private armedSchedules(): number {
-    return this.ledger.state().tasks.filter((task: TaskRecord) => task.archivedAt === undefined && task.schedule?.enabled === true).length
-  }
-
-  private hasOpenExecutions(): boolean {
-    return this.ledger.state().tasks.some(task => task.executions.some(execution => execution.endedAt === undefined))
+    return this.ledger.armedScheduleCount()
   }
 
   private scheduleLaunch(opened: OpenedRun): void {

package/src/http.ts

@@ -0,0 +1,105 @@
+// Generated by scripts/sync-shared.mjs from shared/host/http.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Shared JSON body/response helpers for the host route families: one strict
+ * bounded body reader, one lenient bounded body reader, one JSON object
+ * narrow, and one JSON writer. Previously these were copy-pasted across the
+ * package route files (routes.ts, update-routes.ts, mobile-api.ts, and each
+ * family's route module) with drifting contracts: body caps ranging 4 KiB to
+ * 1 MiB and four distinct overflow behaviors (reject, undefined, null, throw).
+ *
+ * Packages receive this file as a generated copy via scripts/sync-shared.mjs;
+ * edit this shared source and re-run the sync instead of editing a copy.
+ * Consumer code is migrated onto it in follow-up waves; no call site changes
+ * belong in the same change as its introduction.
+ * @module dsh-web-ui-shared/host/http
+ */
+
+import type { IncomingMessage, OutgoingHttpHeaders, ServerResponse } from 'node:http'
+
+/** Default body cap for readJsonBody: 64 KiB. */
+const DEFAULT_JSON_BODY_MAX_BYTES = 64 * 1024
+
+/** Family-default JSON response headers; callers may append or override. */
+const JSON_HEADERS = {
+  'content-type': 'application/json; charset=utf-8',
+  'referrer-policy': 'no-referrer',
+} satisfies OutgoingHttpHeaders
+
+/**
+ * Strict bounded body reader: parse a request body of at most maxBytes as
+ * JSON.
+ * @throws 'body too large' past the cap, or the JSON.parse error for an
+ *   invalid or empty payload.
+ */
+export async function readBoundedJson(req: IncomingMessage, maxBytes: number): Promise<unknown> {
+  const chunks: Buffer[] = []
+  let size = 0
+  for await (const chunk of req) {
+    const buffer = chunk as Buffer
+    size += buffer.length
+    if (size > maxBytes) throw new Error('body too large')
+    chunks.push(buffer)
+  }
+  return JSON.parse(Buffer.concat(chunks).toString('utf8'))
+}
+
+/**
+ * Lenient bounded body reader: parse a request body as JSON, or null on an
+ * empty body, invalid JSON, or a body past maxBytes (default 64 KiB).
+ * Overflow destroys the request instead of draining the remainder (no drain
+ * call, matching the current repo-wide behavior); callers must not keep
+ * reading the request afterwards. With objectOnly, non-JSON-object payloads
+ * also yield null.
+ */
+export async function readJsonBody(
+  req: IncomingMessage,
+  opts: { maxBytes?: number; objectOnly?: boolean } = {},
+): Promise<unknown | null> {
+  const maxBytes = opts.maxBytes ?? DEFAULT_JSON_BODY_MAX_BYTES
+  const chunks: Buffer[] = []
+  let size = 0
+  for await (const chunk of req) {
+    const buffer = chunk as Buffer
+    size += buffer.length
+    if (size > maxBytes) {
+      req.destroy()
+      return null
+    }
+    chunks.push(buffer)
+  }
+  const text = Buffer.concat(chunks).toString('utf8')
+  if (text === '') return null
+  try {
+    const parsed: unknown = JSON.parse(text)
+    if (opts.objectOnly && !isJsonObject(parsed)) return null
+    return parsed
+  } catch {
+    return null
+  }
+}
+
+/** Whether a value is a JSON object: typeof object, not null, not an array. */
+function isJsonObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+/** Narrow a value to a JSON object, or undefined when it is not one. */
+export function asJsonObject(value: unknown): Record<string, unknown> | undefined {
+  return isJsonObject(value) ? value : undefined
+}
+
+/**
+ * Write one JSON response. Default headers are the family defaults
+ * (content-type and referrer-policy); caller headers are appended or
+ * override them.
+ */
+export function writeJson(
+  res: ServerResponse,
+  status: number,
+  body: unknown,
+  headers: OutgoingHttpHeaders = {},
+): void {
+  const payload = JSON.stringify(body)
+  res.writeHead(status, { ...JSON_HEADERS, ...headers })
+  res.end(payload)
+}

package/lib/types/core/execution.d.ts

@@ -1,197 +0,0 @@
-/**
- * Execution service: runs a task through dsh's real session machinery.
- *
- * The board's "run" button must make dsh actually work, not fake a status:
- * the service connects a real session (workspace blank-session reuse or
- * `session.create` on the host via the workspaces service), renames it to
- * the task title, sends the task prompt with `session.prompt`, and then
- * watches the session's conversation snapshot until its turn settles. The
- * task board controller consumes {@link ExecutionEvent}s to move the card
- * running → done/failed and to keep the execution record.
- *
- * Deliberately framework-free: the runtime faces are declared structurally
- * (a narrow slice of the real `ctx.sessions` / `ctx.workspaces` contracts)
- * so tests drive it with plain fakes.
- */
-import type { ExecutionRecord, TaskRecord } from './tasks.ts';
-/** One list-row summary the execution service reads (the narrow slice of a SessionSummary). */
-export interface ExecutionSessionSummary {
-    running: boolean;
-    completed?: boolean;
-    /** Empty-log bit: the preset can only be recomposed while the session is blank. */
-    blank?: boolean;
-    /** The preset the session currently runs (absent on deployments without presets). */
-    agentPreset?: string;
-}
-/** The narrow sessions face the service needs. */
-export interface SessionsExecutionFace {
-    list: {
-        getSnapshot(): {
-            /** Baseline arrival lifecycle — 'pending' until the host list has loaded. */
-            phase: 'pending' | 'ready';
-            byId: Record<string, ExecutionSessionSummary>;
-        };
-        subscribe(fn: () => void): () => void;
-    };
-    binding(id: string): {
-        session: SessionDriver;
-    } | undefined;
-    /** Record a host-confirmed preset switch so the list label moves immediately. */
-    noteAgentPreset?(sessionId: string, agentPreset: string): void;
-}
-/** The narrow agent-preset wire face the service needs (`agentPreset.select`). */
-export interface PresetsExecutionFace {
-    /** Recompose a blank session's agent from a preset. */
-    select(sessionId: string, agentPreset: string): Promise<{
-        ok: true;
-    } | {
-        ok: false;
-        error: unknown;
-    }>;
-}
-/** The narrow workspaces face the service needs. */
-export interface WorkspacesExecutionFace {
-    list: {
-        getSnapshot(): {
-            items: readonly {
-                workspaceId: string;
-            }[];
-            recentWorkspaceId: string | undefined;
-        };
-    };
-    connectWorkspace(workspaceId: string): Promise<string>;
-}
-/** One raw session-history event narrowed to the failure signal reconcile needs. */
-export interface ExecutionHistoryEvent {
-    type: string;
-    data?: unknown;
-}
-/** Optional raw-history face used to detect failures of never-opened sessions. */
-export interface HistoryExecutionFace {
-    loadTail(sessionId: string): Promise<{
-        events: readonly ExecutionHistoryEvent[];
-    } | undefined>;
-}
-/** The behavior verbs the service invokes on an execution session. */
-export interface SessionDriver {
-    rename(title: string): Promise<unknown>;
-    prompt(content: readonly unknown[], mode: 'queue'): Promise<{
-        ok: true;
-    } | {
-        ok: false;
-        error: unknown;
-    }>;
-    /**
-     * Admit one slash-command line against the session's agent (the
-     * `/permission <id>` mechanism). `matched` reports whether a command
-     * claimed the line.
-     */
-    command(line: string): Promise<{
-        ok: true;
-        matched: boolean;
-    } | {
-        ok: false;
-        error: unknown;
-    }>;
-    getSnapshot(): {
-        running: boolean;
-        lastAgentError: string | null;
-        turnEnds: ReadonlyMap<number, number>;
-    };
-    subscribe(fn: () => void): () => void;
-}
-/** Everything the service needs from the runtime. */
-export interface ExecutionEnvironment {
-    sessions: SessionsExecutionFace;
-    workspaces: WorkspacesExecutionFace;
-    /** Agent-preset wire face; absent on deployments without preset support. */
-    presets?: PresetsExecutionFace;
-    /** Raw-history reader for failure detection of never-opened sessions. */
-    history?: HistoryExecutionFace;
-}
-/** Outcome events the service emits to the controller. */
-export type ExecutionEvent = {
-    kind: 'started';
-    taskId: string;
-    executionId: string;
-    sessionId: string;
-} | {
-    kind: 'settled';
-    taskId: string;
-    executionId: string;
-    outcome: 'succeeded' | 'failed' | 'cancelled';
-    error?: string;
-};
-/**
- * Run one task to completion (or to a settled failure).
- *
- * @param task - the task being executed.
- * @param execution - the freshly opened execution record (id + start time).
- * @param onEvent - callback for started/settled events.
- * @returns resolves when the run settles (or fails to start); never rejects —
- *   every failure path is reported as a settled event.
- */
-export declare class ExecutionService {
-    private readonly env;
-    /**
-     * In-flight preset switches keyed by `sessionId\u0000mode`. The session
-     * list mirror can lag behind a just-applied switch, so concurrent runs
-     * against one blank session would otherwise each issue the same select
-     * RPC (an amplified storm); sharing one in-flight call keeps the wire to
-     * a single request. The settled entry is forgotten so a later run can
-     * switch again.
-     */
-    private readonly presetSwitches;
-    /** @param env - the runtime faces (real or fake). */
-    constructor(env: ExecutionEnvironment);
-    run(task: TaskRecord, execution: ExecutionRecord, onEvent: (event: ExecutionEvent) => void): Promise<void>;
-    /**
-     * Recompose the execution session's agent from the task-pinned preset.
-     * No-op when the task pins none or the session already runs it; fails the
-     * run when the session is no longer blank, the preset face is missing, or
-     * the wire refuses.
-     */
-    private applyMode;
-    /**
-     * One in-flight `select` per (session, preset): concurrent runs against
-     * the same blank session share the same wire call instead of each issuing
-     * a duplicate RPC. The entry is removed once the call settles, so a later
-     * run (after a shared failure, say) issues a fresh switch.
-     */
-    private switchPreset;
-    /**
-     * Apply the task-pinned permission preset through the `/permission <id>`
-     * slash command. No-op when the task pins none; fails the run when the
-     * admission is rejected or no command claimed the line.
-     */
-    private applyPermission;
-    /**
-     * Inspect a reloaded/background task that was left 'running' and emit a
-     * settled event when its session already finished.
-     *
-     * A session that was never opened keeps a cold conversation snapshot (the
-     * runtime only maintains the window for the staged/current session), so the
-     * settled outcome is decided by the strongest available signal, in order:
-     * 1. the list summary — missing session → cancelled; still running → pending;
-     * 2. a warm conversation snapshot → `lastAgentError` decides failed/succeeded;
-     * 3. the raw history tail (when a history face is wired) — a `turn/end`
-     *    error reason proves failure;
-     * 4. otherwise a finished session counts as succeeded.
-     *
-     * @param task - a task whose latest execution has no endedAt.
-     * @returns a settled event when the session state proves completion, else undefined.
-     */
-    reconcile(task: TaskRecord): Promise<ExecutionEvent | undefined>;
-    /** Best-effort failure probe over the raw history tail (false when unavailable). */
-    private historyShowsFailure;
-    private connectSession;
-    private driverOf;
-    private sendPrompt;
-    /**
-     * Subscribe to the execution session and settle the run once the accepted
-     * turn completes (turn counter advanced past the acceptance baseline and
-     * the session is no longer running). Never settles while the session is
-     * still running; unsubscribes on settle.
-     */
-    private watchForSettlement;
-}