@linxin666/dsh-client-ui-task-board 0.3.23 → 0.3.24

package/src/client/plugin-card-seat.ts

@@ -0,0 +1,185 @@
+// Generated by scripts/sync-shared.mjs from shared/client/settings/plugin-card-seat.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Family plugin-card seat.
+ *
+ * A family plugin contributes its settings card to whichever plugin-card seat
+ * the running host actually renders:
+ *
+ * - `web-ui.plugin.item` — the list seat declared by the dsh-web-settings
+ *   group section (this family's own first-level "Web UI plugins" section);
+ * - `settings.plugin.item` — the official keyed seat of the harness's
+ *   `ui-settings-plugins` tab, keyed by the settings namespace the card edits.
+ *
+ * SEAT SELECTION IS NOT A DECLARATION PROBE. The official `ui-settings-plugins`
+ * row belongs to the harness bundle and its `configurable` tab always declares
+ * `settings.plugin.item` before any external plugin's `apply()` runs, so
+ * "is the official seat declared?" answers yes even in the deployment whose
+ * whole point is the family group. Choosing on that probe sends every family
+ * card to the official Plugins tab and leaves the group's own section
+ * permanently empty — the family of reports where the section renders its
+ * heading and zero cards.
+ *
+ * The signal that actually distinguishes the two deployments is whether
+ * dsh-web-settings is loaded: it is the package that owns the group section and
+ * it publishes the `webUiSettings` service during `apply()`, which every
+ * family plugin already reads for its settings scope. Group loaded -> the family
+ * seat; group absent -> the official seat.
+ *
+ * The decision is re-evaluated on every `slots/changed` because the group may
+ * apply after this plugin (the family aggregate orders it first, a profile that
+ * installs the group separately need not): the initial contribution goes to the
+ * official seat, then moves to the family seat the moment the group's section
+ * registers. The entry is disposed before the replacement is registered, so a
+ * card is never in two seats at once.
+ *
+ * The shared tree has no client-SDK dependency, so this module reads its
+ * context through the structural shape below; callers pass the plugin's own
+ * `ctx`.
+ */
+
+/** The family list seat key. */
+export const FAMILY_PLUGIN_CARD_SEAT = 'web-ui.plugin.item'
+
+/** The official keyed plugin-card seat key. */
+export const OFFICIAL_PLUGIN_CARD_SEAT = 'settings.plugin.item'
+
+/** The service dsh-web-settings publishes while it is loaded. */
+export const FAMILY_GROUP_SERVICE = 'webUiSettings'
+
+/** The slot-registry member this helper uses (structurally satisfied by ctx.slots). */
+export interface PluginCardSlots {
+  /** Contribution of one card entry. */
+  register(options: never, component: never): unknown
+}
+
+/** The slice of the client context a card contribution needs. */
+export interface PluginCardContext {
+  slots: PluginCardSlots
+  /** Service lookup; absent on a context double that only models the slots. */
+  get?(name: string): unknown
+  /** Event subscription seat; absent on an event-less test double. */
+  on?(event: string, listener: (...args: never[]) => void): unknown
+}
+
+/** Owner share of a plugin card (both seats supply nothing). */
+export interface SettingsPluginItemOwnerProps {
+  /** Marker field: card owner props are intentionally empty. */
+  children?: never
+}
+
+/** One family plugin's card contribution. */
+export interface PluginCardSeat {
+  /** Settings namespace the card edits (the official seat's dispatch key). */
+  namespace: string
+  /** Family list-seat entry id. */
+  id: string
+  /** Family list-seat sort order. */
+  order?: number
+  /** Family list-seat display label; the official keyed seat carries none. */
+  label?: () => string
+  /** Locale namespace the card renders with. */
+  locale: string
+  /** Business-face factory of the registration. */
+  inject?: () => object
+  /**
+   * The card component. Its props type is the seat's composed shape, which is
+   * chosen at runtime, so the helper takes it erased; the registrant keeps its
+   * own precise typing at the call site.
+   */
+  component: unknown
+}
+
+/**
+ * Whether the family group (dsh-web-settings) is loaded in this page. The
+ * service is the group package's own contract, so the probe cannot be fooled
+ * by a harness release that starts declaring the official seat differently.
+ */
+export function familyGroupLoaded(ctx: PluginCardContext): boolean {
+  const get = ctx.get
+  if (typeof get !== 'function') return false
+  try {
+    return get.call(ctx, FAMILY_GROUP_SERVICE) !== undefined
+  } catch {
+    // A context that refuses the lookup: treat the group as absent, which
+    // falls back to the official seat the harness declares.
+    return false
+  }
+}
+
+/** Report a refused registration instead of leaving the user with no card. */
+function warnRefusedSeat(seat: string, error: unknown): void {
+  try {
+    console.warn(`[dsh-web] plugin card registration into "${seat}" was refused; the card will not render`, error)
+  } catch {
+    // Best-effort console write; a failed warning must not break the plugin.
+  }
+}
+
+/**
+ * Contribute one family plugin card to the seat this host renders, following
+ * the group if it loads later. The entry is disposed and re-registered on a
+ * seat change, never duplicated.
+ * @param ctx - client context (its slot registry decides the seat).
+ * @param seat - the card contribution.
+ */
+export function installPluginCard(ctx: PluginCardContext, seat: PluginCardSeat): void {
+  const slots = ctx.slots
+  const component = seat.component as never
+  const inject = seat.inject as never
+
+  let dispose: (() => void) | undefined
+  let current: string | undefined
+  /**
+   * Re-entrancy latch. The registry emits a change event synchronously from
+   * inside both `register` and the previous entry's disposer, so an unguarded
+   * reconcile would re-enter itself mid-move and register the card twice into
+   * the seat it is leaving ("already has an entry for key ...").
+   */
+  let reconciling = false
+
+  /** Reconcile the contribution with the currently live seat (no-op when unchanged). */
+  const reconcile = (): void => {
+    if (reconciling) return
+    const target = familyGroupLoaded(ctx) ? FAMILY_PLUGIN_CARD_SEAT : OFFICIAL_PLUGIN_CARD_SEAT
+    if (current === target) return
+    reconciling = true
+    const previous = dispose
+    dispose = undefined
+    current = undefined
+    previous?.()
+    try {
+      dispose = slots.register((target === FAMILY_PLUGIN_CARD_SEAT
+        ? {
+          name: FAMILY_PLUGIN_CARD_SEAT,
+          id: seat.id,
+          ...(seat.order === undefined ? {} : { order: seat.order }),
+          ...(seat.label === undefined ? {} : { label: seat.label }),
+          locale: seat.locale,
+          ...(seat.inject === undefined ? {} : { inject }),
+        }
+        : {
+          name: OFFICIAL_PLUGIN_CARD_SEAT,
+          key: seat.namespace,
+          locale: seat.locale,
+          ...(seat.inject === undefined ? {} : { inject }),
+        }) as never, component) as () => void
+      current = target
+    } catch (error) {
+      warnRefusedSeat(target, error)
+    } finally {
+      reconciling = false
+    }
+  }
+
+  if (typeof ctx.on === 'function') {
+    try {
+      ctx.on('slots/changed', () => { reconcile() })
+    } catch {
+      // An event seat that refuses the subscription leaves the initial
+      // decision in place; the card still renders in the seat chosen below.
+    }
+  }
+  // The initial decision: the group, when it is already loaded (the aggregate
+  // order), otherwise the official seat the harness declares.
+  reconcile()
+}

package/src/client/sidebar-entry-core.ts

@@ -16,6 +16,33 @@
  */
 import { subscribeBodyInvalidations } from './body-mutations.ts'
 
+/**
+ * One trailing action button seated at the entry row's right edge (e.g. a
+ * refresh command or a collapse chevron). Rows with actions switch from the
+ * classic single-button structure to a container with a main button plus the
+ * action buttons (nested interactive elements are invalid HTML); rows without
+ * actions keep the classic structure untouched.
+ */
+export interface SidebarEntryAction {
+  /** Stable id stamped as data-dsh-entry-action="<id>" (CSS hooks and tests). */
+  id: string
+  /** Inline icon markup while the row is active (always, when inactiveIcon is unset). */
+  icon: string
+  /**
+   * Optional icon while the row is inactive. Setting it makes the action a
+   * state mirror (a collapse chevron): the core swaps the icon and stamps
+   * aria-expanded on every active-state change. Requires the active bridge.
+   */
+  inactiveIcon?: string
+  /** Localized accessible label (aria-label + title); receives the active state. */
+  label(active: boolean): string
+  /**
+   * Click handler; receives the button so the caller can drive transient
+   * affordances (a refresh cooldown) without a re-render.
+   */
+  onClick(button: HTMLButtonElement): void
+}
+
 /** Per-package configuration for one sidebar entry row. */
 export interface SidebarEntryOptions {
   /** Full attribute name identifying the injected row (idempotency key), e.g. 'data-dsh-ssh-entry'. */
@@ -47,6 +74,12 @@ export interface SidebarEntryOptions {
   refresh?: { subscribe(listener: () => void): () => void }
   /** Click action (open/toggle the owning panel). */
   onToggle(): void
+  /**
+   * Optional trailing action buttons at the row's right edge. Requires the
+   * package CSS to seat entryMain / entryAction; empty keeps the classic
+   * single-button row.
+   */
+  actions?: readonly SidebarEntryAction[]
   /** Family-block position: 'before' inserts ahead of sibling plugin rows, 'after' behind them. */
   position: 'before' | 'after'
   /**
@@ -84,10 +117,12 @@ function newSessionButton(root: HTMLElement): HTMLButtonElement | undefined {
   return undefined
 }
 
-/** Build the entry row (a detached button; insert once the shell is up). */
-function createEntry(options: SidebarEntryOptions): { entry: HTMLButtonElement; applyLabel: () => void } {
-  const entry = document.createElement('button')
-  entry.type = 'button'
+/** Build the entry row (detached; inserted once the shell is up). */
+function createEntry(options: SidebarEntryOptions): { entry: HTMLElement; applyLabel: () => void; setOpen: (open: boolean) => void } {
+  const actions = options.actions ?? []
+  const composite = actions.length > 0
+  const entry = document.createElement(composite ? 'div' : 'button') as HTMLElement
+  if (!composite) (entry as HTMLButtonElement).type = 'button'
   entry.setAttribute(options.rowAttribute, '')
   if (options.plugin !== undefined) {
     entry.setAttribute('data-dsh-plugin', options.plugin)
@@ -99,19 +134,66 @@ function createEntry(options: SidebarEntryOptions): { entry: HTMLButtonElement;
   const iconSpan = document.createElement('span')
   iconSpan.className = options.css['entryIcon'] ?? ''
   iconSpan.innerHTML = options.icon
-  entry.append(iconSpan, labelSpan)
+  // The main hit area: the classic row IS the button; with trailing actions
+  // the row becomes a container and the main area its own button, so the row
+  // never nests interactive elements.
+  const main = composite ? document.createElement('button') : (entry as HTMLButtonElement)
+  if (composite) {
+    main.type = 'button'
+    main.className = options.css['entryMain'] ?? ''
+    main.append(iconSpan, labelSpan)
+    entry.append(main)
+  } else {
+    entry.append(iconSpan, labelSpan)
+  }
+  const actionButtons: { action: SidebarEntryAction; button: HTMLButtonElement }[] = []
+  for (const action of actions) {
+    const button = document.createElement('button')
+    button.type = 'button'
+    button.className = options.css['entryAction'] ?? ''
+    button.setAttribute('data-dsh-entry-action', action.id)
+    button.innerHTML = action.icon
+    button.addEventListener('click', () => { action.onClick(button) })
+    entry.append(button)
+    actionButtons.push({ action, button })
+  }
+  let open = false
+  const applyActions = (): void => {
+    for (const { action, button } of actionButtons) {
+      button.innerHTML = open || action.inactiveIcon === undefined ? action.icon : action.inactiveIcon
+      const text = action.label(open)
+      button.setAttribute('aria-label', text)
+      button.setAttribute('title', text)
+      if (action.inactiveIcon !== undefined) button.setAttribute('aria-expanded', String(open))
+    }
+  }
   const applyLabel = (): void => {
-    entry.setAttribute('aria-label', options.label())
-    if (options.tooltip !== undefined) entry.setAttribute('title', options.tooltip())
+    main.setAttribute('aria-label', options.label())
+    if (options.tooltip !== undefined) main.setAttribute('title', options.tooltip())
     labelSpan.textContent = options.label()
+    applyActions()
   }
   applyLabel()
-  entry.addEventListener('click', options.onToggle)
-  return { entry, applyLabel }
+  main.addEventListener('click', options.onToggle)
+  if (composite) {
+    // The old row was clickable edge to edge; keep the padding between the
+    // main area and the action buttons a toggle target as well.
+    entry.addEventListener('click', (event) => {
+      if (event.target === entry) options.onToggle()
+    })
+  }
+  return {
+    entry,
+    applyLabel,
+    setOpen: (next: boolean) => {
+      open = next
+      applyActions()
+    },
+  }
 }
 
 /** Re-insert the entry after the New Session row (before the browser region). */
-function placeEntry(root: HTMLElement, entry: HTMLButtonElement, options: SidebarEntryOptions): boolean {
+function placeEntry(root: HTMLElement, entry: HTMLElement, options: SidebarEntryOptions): boolean {
   const button = newSessionButton(root)
   if (button === undefined) return false
   if (entry.parentElement !== root) {
@@ -149,7 +231,7 @@ export function mountSidebarEntry(options: SidebarEntryOptions): () => void {
   if (typeof document !== 'undefined' && document.querySelector(options.rowSelector) !== null) {
     return () => {}
   }
-  const { entry, applyLabel } = createEntry(options)
+  const { entry, applyLabel, setOpen } = createEntry(options)
   let root: HTMLElement | undefined
   let placed = false
   let unsubscribeRefresh: (() => void) | undefined
@@ -217,8 +299,10 @@ export function mountSidebarEntry(options: SidebarEntryOptions): () => void {
   // row permanently highlighted — delete the attribute instead.
   const unsubscribeActive = options.active === undefined ? undefined : (() => {
     const syncActive = (): void => {
-      if (options.active!.isOpen()) entry.dataset.active = 'true'
+      const open = options.active!.isOpen()
+      if (open) entry.dataset.active = 'true'
       else delete entry.dataset.active
+      setOpen(open)
     }
     const unsubscribe = options.active.subscribe(syncActive)
     syncActive()

package/src/core/session-reuse.ts

@@ -3,14 +3,16 @@
  * previous execution's conversation. Pure, so the fail-closed conditions stay
  * unit-testable without a gateway.
  */
-import type { TaskRecord } from './tasks.ts'
+import type { ExecutionRecord, TaskRecord } from './tasks.ts'
 
 /**
  * Pick the session a new execution of this task may continue in, or undefined
  * to mint a fresh conversation. Reuse requires ALL of:
  * - the task opted in (`reuseSession === true`);
- * - the task's newest execution carries a session id and has settled (an open
- *   execution would have made the ledger refuse the run in the first place);
+ * - the task's newest SETTLED execution carries a session id (issue #1587: the
+ *   launch path calls this after `startExecution` appended this run's own open
+ *   record, so reading the array tail always found an unsettled row and reuse
+ *   never happened);
  * - the roster is known and that session is present and idle.
  *
  * An unknown roster (session/list unavailable) never reuses: minting a fresh
@@ -25,7 +27,14 @@ export function reusableSessionId(
   idleSessionIds: ReadonlySet<string> | undefined,
 ): string | undefined {
   if (task.reuseSession !== true || idleSessionIds === undefined) return undefined
-  const last = task.executions[task.executions.length - 1]
-  if (last === undefined || last.sessionId === undefined || last.endedAt === undefined) return undefined
+  let last: ExecutionRecord | undefined
+  for (let index = task.executions.length - 1; index >= 0; index -= 1) {
+    const candidate = task.executions[index]
+    if (candidate.sessionId !== undefined && candidate.endedAt !== undefined) {
+      last = candidate
+      break
+    }
+  }
+  if (last === undefined || last.sessionId === undefined) return undefined
   return idleSessionIds.has(last.sessionId) ? last.sessionId : undefined
 }

package/src/host-ledger.ts

@@ -134,6 +134,11 @@ export function processIsAlive(pid: number): boolean {
 }
 
 const PROCESS_PROBE_TIMEOUT_MS = 3000
+/**
+ * The CIM fallback pays a WMI cold start, so it gets a wider budget than the
+ * direct `Get-Process` read it backs up.
+ */
+const CIM_PROBE_TIMEOUT_MS = 8000
 
 let ownStartTime: number | undefined
 let ownStartTimeResolved = false
@@ -161,6 +166,59 @@ function linuxStartTimeMs(pid: number): number | undefined {
   }
 }
 
+/** Runs one PowerShell script and returns its trimmed stdout. */
+export type PowerShellProbe = (script: string, timeoutMs: number) => string | undefined
+
+/** Default probe: one hidden, profile-free PowerShell process per script. */
+const runPowerShellProbe: PowerShellProbe = (script, timeoutMs) => {
+  const probe = spawnSync('powershell', ['-NoProfile', '-NonInteractive', '-Command', script], {
+    timeout: timeoutMs,
+    windowsHide: true,
+  })
+  if (probe.status !== 0 || probe.stdout.length === 0) return undefined
+  return probe.stdout.toString('utf8').trim()
+}
+
+/** The epoch-millisecond reading a probe printed, or undefined when unusable. */
+function parseProbeEpochMs(raw: string | undefined): number | undefined {
+  if (raw === undefined || raw.trim() === '') return undefined
+  const started = Number(raw.trim())
+  return Number.isFinite(started) ? started : undefined
+}
+
+/** Start time through Get-Process: precise, but empty for protected processes. */
+function getProcessStartScript(pid: number): string {
+  return '[DateTimeOffset]::FromFileTime((Get-Process -Id ' + String(pid)
+    + ' -ErrorAction SilentlyContinue).StartTime.ToUniversalTime().ToFileTime()).ToUnixTimeMilliseconds()'
+}
+
+/** Start time through Win32_Process: readable for System/svchost too. */
+function cimStartScript(pid: number): string {
+  return '$p=Get-CimInstance Win32_Process -Filter "ProcessId=' + String(pid)
+    + '" -ErrorAction SilentlyContinue;if($p -ne $null){[DateTimeOffset]::FromFileTime($p.CreationDate.ToUniversalTime().ToFileTime()).ToUnixTimeMilliseconds()}'
+}
+
+/**
+ * Windows start time (Unix epoch ms) of a live process.
+ *
+ * `Get-Process` is the precise first choice, but an unprivileged caller cannot
+ * read `.StartTime` for a protected process (System, svchost): the property is
+ * empty, so the probe returns nothing. Without a fallback, a crash leftover
+ * lock whose PID was reused by such a process could never be proven stale and
+ * blocked every startup until the lock was deleted by hand (issue #1629).
+ * Win32_Process through CIM reports the same CreationDate for those processes
+ * at the same millisecond precision, so it is the second identity source. The
+ * probe is injectable so the fallback chain is testable off Windows.
+ */
+export function win32StartTimeMs(pid: number, probe: PowerShellProbe = runPowerShellProbe): number | undefined {
+  // The pid is interpolated into a PowerShell script, so it must be a plain
+  // positive integer before any probe runs.
+  if (!Number.isSafeInteger(pid) || pid <= 0) return undefined
+  const direct = parseProbeEpochMs(probe(getProcessStartScript(pid), PROCESS_PROBE_TIMEOUT_MS))
+  if (direct !== undefined) return direct
+  return parseProbeEpochMs(probe(cimStartScript(pid), CIM_PROBE_TIMEOUT_MS))
+}
+
 /**
  * Best-effort start time (Unix epoch ms) of a live process. Used to prove
  * whether the ledger lock really belongs to the PID recorded in it, so a
@@ -170,17 +228,7 @@ function linuxStartTimeMs(pid: number): number | undefined {
  */
 function processStartTimeMs(pid: number): number | undefined {
   if (process.platform === 'linux') return linuxStartTimeMs(pid)
-  if (process.platform === 'win32') {
-    const probe = spawnSync(
-      'powershell',
-      ['-NoProfile', '-NonInteractive', '-Command',
-        '[DateTimeOffset]::FromFileTime((Get-Process -Id ' + String(pid) + ' -ErrorAction SilentlyContinue).StartTime.ToUniversalTime().ToFileTime()).ToUnixTimeMilliseconds()'],
-      { timeout: PROCESS_PROBE_TIMEOUT_MS, windowsHide: true },
-    )
-    if (probe.status !== 0 || probe.stdout.length === 0) return undefined
-    const started = Number(probe.stdout.toString('utf8').trim())
-    return Number.isFinite(started) ? started : undefined
-  }
+  if (process.platform === 'win32') return win32StartTimeMs(pid)
   // Other POSIX (macOS...): ps lstart with a forced English locale, falling
   // back to the elapsed-seconds column when lstart cannot be parsed.
   const env = { ...process.env, LC_ALL: 'C' }