@linxin666/dsh-client-ui-task-board 0.3.6 → 0.3.10

package/lib/types/host-ledger.d.ts

@@ -1,5 +1,6 @@
 import { type ExecutionRecord, type TaskRecord } from './core/tasks.ts';
 import { type TaskBoardAction, type TaskBoardSchedulerSnapshot } from './protocol.ts';
+import { type TaskPermission } from './core/handover.ts';
 export interface LedgerState {
     revision: number;
     tasks: TaskRecord[];
@@ -47,7 +48,11 @@ export declare class HostTaskLedger {
     readonly lockFile: string;
     /** Small sidecar for the 30 s scheduler heartbeat (lastTickAt only). */
     readonly schedulerFile: string;
-    constructor(dir?: string, now?: () => number);
+    /** Session-default permission the confirmation gate compares against. */
+    readonly sessionDefaultPermission: TaskPermission;
+    constructor(dir?: string, now?: () => number, options?: {
+        sessionDefaultPermission?: TaskPermission;
+    });
     /** Revision + scheduler without any task cloning; feeds the SSE event frame. */
     summary(): {
         revision: number;
@@ -66,7 +71,7 @@ export declare class HostTaskLedger {
     dueSchedules(now: number): DueScheduleReference[];
     subscribe(listener: () => void): () => void;
     dispose(): void;
-    applyRequest(requestId: string, action: TaskBoardAction): {
+    applyRequest(requestId: string, action: TaskBoardAction, initiator?: string): {
         state: LedgerState;
         run?: OpenedRun;
     };
@@ -78,7 +83,17 @@ export declare class HostTaskLedger {
     private apply;
     private repairSchedules;
     private reconcileInterruptedStarts;
+    /**
+     * Field-preserving v2 to v3 migration. v3 adds no fields yet, so the
+     * migration reuses the v3 normalization, but it first proves every task
+     * row is structurally valid: a v2 document that would silently drop or
+     * coerce rows fails loudly instead (no quarantined-empty restart).
+     */
+    private migrateLegacyDocument;
     private load;
+    private normalizeDocument;
+    /** Quarantine an unreadable document and start from an empty ledger. */
+    private recoverCorrupt;
     private syncRecentRequests;
     private readSchedulerSidecar;
     /** Atomic write of the scheduler heartbeat sidecar (0600, tmp + rename + fsync). */

package/lib/types/host-runner.d.ts

@@ -1,13 +1,25 @@
-import type { ApiProxy } from '@deepseek-ai/dsh-host-apiproxy';
+import type { TypertGateway } from '@deepseek-ai/dsh-api-gateway';
+import type { SessionSummary } from '@deepseek-ai/dsh-api-session-controller/types';
 import type { CommandResult } from '@deepseek-ai/dsh-commands/types';
+import type { Workspace } from '@deepseek-ai/dsh-workspace/types';
 import type { TaskRecord } from './core/tasks.ts';
-/** One session-list row, extracted from the sessions.list RPC result. */
-export type SessionSummary = Extract<Awaited<ReturnType<ApiProxy['sessions']['list']>>['result'], {
-    ok: true;
-}>['value']['items'][number];
-type ExecutionSessionId = Extract<Awaited<ReturnType<ApiProxy['sessions']['create']>>['result'], {
-    ok: true;
-}>['value']['sessionId'];
+/** Host services needed to validate a task's workspace before creating a session. */
+export interface TaskBoardWorkspaceRegistry {
+    list(): readonly Workspace[];
+}
+interface GatewayRequest {
+    namespace: string;
+    method: string;
+    args: Record<string, unknown>;
+    signal?: AbortSignal;
+}
+interface SessionGateway {
+    invoke(request: GatewayRequest): Promise<unknown>;
+    stream?(request: GatewayRequest): Promise<AsyncIterable<unknown>>;
+}
+/** One session-list row consumed by task-board reconciliation. */
+export type { SessionSummary };
+type ExecutionSessionId = SessionSummary['sessionId'];
 export interface SessionCommandDispatcher {
     execute(sessionId: ExecutionSessionId, line: string, signal: AbortSignal): Promise<CommandResult | undefined>;
 }
@@ -27,17 +39,31 @@ export declare class SessionLaunchError extends Error {
     readonly sessionId: string;
     constructor(sessionId: string, cause: unknown);
 }
+/**
+ * Compose the execution prompt (issue #6): a continuation card (one carrying
+ * a frozen snapshot) has its instruction mandatorily wrapped in a source
+ * declaration (freeze instant, source session, unreviewed-content warning)
+ * templated by the board, so the picking-up agent stays wary of stored
+ * prompt-instruction injection in card text (adversarial scenario c). The
+ * wrap composes with the T4 handover preamble: the reference preamble comes
+ * first, the provenance wrap then encloses the instruction. Plain tasks (no
+ * freeze) keep the bare handover preamble + prompt.
+ */
+export declare function promptText(task: TaskRecord): string;
 export declare class HostExecutionRunner {
-    private readonly api;
+    private readonly gateway;
     private readonly commands?;
-    /**
-     * Newest scanned event seq per session whose complete backward scan found
-     * no matching turn/end. While a session's newest seq is unchanged a
-     * re-scan cannot change the outcome, so only a one-message probe runs per
-     * poll tick instead of up to 100 history pages.
-     */
+    private readonly workspaceRegistry?;
+    /** Newest scanned event sequence per session with no matching execution end. */
     private readonly scanMemos;
-    constructor(api: ApiProxy, commands?: SessionCommandDispatcher | undefined);
+    private readonly unavailableAttempts;
+    private readonly unavailableBackoffMs;
+    constructor(gateway: SessionGateway | TypertGateway, commands?: SessionCommandDispatcher | undefined, workspaceRegistry?: TaskBoardWorkspaceRegistry | undefined, unavailableRetry?: {
+        attempts?: number;
+        backoffMs?: number;
+    });
+    private invoke;
+    private stream;
     launch(task: TaskRecord): Promise<string>;
     listRunning(): Promise<{
         known: true;
@@ -46,12 +72,6 @@ export declare class HostExecutionRunner {
     } | {
         known: false;
     }>;
-    /**
-     * Resolve one execution's outcome. The caller may pass the session list it
-     * already fetched this poll tick; otherwise inspect lists sessions itself.
-     * Sharing the list keeps a poll with E open executions at one list RPC
-     * instead of 1 + E.
-     */
+    /** Resolve an execution outcome from the session list and bounded history pages. */
     inspect(sessionId: string, startedAt?: number, sessions?: readonly SessionSummary[]): Promise<ExecutionInspection>;
 }
-export {};

package/lib/types/host-service.d.ts

@@ -1,8 +1,9 @@
-import type { ApiProxy } from '@deepseek-ai/dsh-host-apiproxy';
+import type { TypertGateway } from '@deepseek-ai/dsh-api-gateway';
 import { HostTaskLedger } from './host-ledger.ts';
-import { HostExecutionRunner, type SessionCommandDispatcher } from './host-runner.ts';
+import { HostExecutionRunner, type SessionCommandDispatcher, type TaskBoardWorkspaceRegistry } from './host-runner.ts';
 import { PowerInhibitor } from './power-inhibitor.ts';
-import type { TaskBoardAction, TaskBoardEventPayload, TaskBoardSnapshot } from './protocol.ts';
+import { type TaskBoardAction, type TaskBoardEventPayload, type TaskBoardSnapshot } from './protocol.ts';
+import type { TaskPermission } from './core/handover.ts';
 export declare class TaskBoardHostService {
     readonly ledger: HostTaskLedger;
     readonly runner: HostExecutionRunner;
@@ -17,11 +18,13 @@ export declare class TaskBoardHostService {
     private preventIdleSleep;
     private lastPowerJson;
     private readonly now;
-    constructor(api: ApiProxy, options?: {
+    constructor(gateway: TypertGateway, options?: {
         ledger?: HostTaskLedger;
         power?: PowerInhibitor;
         now?: () => number;
         commandDispatcher?: SessionCommandDispatcher;
+        workspaceRegistry?: TaskBoardWorkspaceRegistry;
+        sessionDefaultPermission?: TaskPermission;
     });
     start(): void;
     setConfiguration(active: boolean, preventIdleSleep: boolean): void;
@@ -29,7 +32,7 @@ export declare class TaskBoardHostService {
     /** SSE frame payload; deliberately skips the tasks deep-clone of {@link snapshot}. */
     eventPayload(): TaskBoardEventPayload;
     subscribe(listener: () => void): () => void;
-    apply(requestId: string, action: TaskBoardAction): TaskBoardSnapshot;
+    apply(requestId: string, action: TaskBoardAction, initiator?: string): TaskBoardSnapshot;
     dispose(): void;
     private launch;
     private pollSessions;

package/lib/types/index.d.ts

@@ -6,7 +6,9 @@
  * a same-origin asynchronous view over that service.
  */
 import type { Context } from '@deepseek-ai/cordis';
+import type { SettingsNamespace } from '@deepseek-ai/dsh-settings';
 import z from 'schemastery';
+import { type TaskPermission } from './core/tasks.ts';
 /** Default environment variable holding the authenticated proxy token. */
 export declare const DEFAULT_PROXY_TOKEN_ENV = "DSH_TASK_BOARD_PROXY_TOKEN";
 export declare const inject: string[];
@@ -17,7 +19,7 @@ export declare const TASK_BOARD_GUIDANCE = "\u672C\u673A\u5DF2\u5B89\u88C5 dsh-t
  * web settings surface edits. Spelled here rather than imported: the browser
  * half spells the same value and must not depend on a Host package.
  */
-export declare const TASK_BOARD_SETTINGS_NAMESPACE: import("@deepseek-ai/dsh-settings").SettingsNamespace;
+export declare const TASK_BOARD_SETTINGS_NAMESPACE: SettingsNamespace;
 /** Plugin config, validated by the same-named schemastery schema. */
 export interface Config {
     /**
@@ -34,6 +36,12 @@ export interface Config {
     trustedProxyHosts?: string[];
     /** Environment variable whose value the authenticated proxy injects upstream. */
     proxyTokenEnv?: string;
+    /**
+     * The deployment's session-default permission. A card whose effective
+     * permission (handover bundle or pin) is above this value requires a human
+     * confirmation before it may run; cron refuses unconfirmed cards.
+     */
+    sessionDefaultPermission?: TaskPermission;
 }
 export declare const Config: z<Config>;
 /** Resolve proxy access without ever placing the token value in plugin config. */

package/lib/types/protocol.d.ts

@@ -1,6 +1,8 @@
 import type { TaskUpdatePatch } from './core/use-cases/task-update.ts';
-import { type NewTaskInput, type TaskRecord, type TaskStatus } from './core/tasks.ts';
-export declare const TASK_BOARD_SCHEMA_VERSION: 2;
+import { type NewTaskInput, type TaskPermission, type TaskRecord, type TaskStatus } from './core/tasks.ts';
+export declare const TASK_BOARD_SCHEMA_VERSION: 3;
+/** Ledger documents written before v3; loaded once and migrated on startup. */
+export declare const TASK_BOARD_LEGACY_SCHEMA_VERSION: 2;
 export declare const TASK_BOARD_API_PREFIX = "/api/task-board";
 export type PowerPhase = 'disabled' | 'idle' | 'acquiring' | 'active' | 'error' | 'unsupported';
 export interface TaskBoardPowerSnapshot {
@@ -25,6 +27,8 @@ export interface TaskBoardSnapshot {
     tasks: TaskRecord[];
     scheduler: TaskBoardSchedulerSnapshot;
     power: TaskBoardPowerSnapshot;
+    /** Session-default permission the confirmation gate compares against. */
+    sessionDefaultPermission?: TaskPermission;
 }
 /** SSE event frame: revision/scheduler/power only, never the task list. */
 export interface TaskBoardEventPayload {
@@ -70,9 +74,18 @@ export type TaskBoardAction = {
 } | {
     kind: 'rerun';
     taskId: string;
+} | {
+    kind: 'confirm-permission';
+    taskId: string;
 };
 export interface TaskBoardActionEnvelope {
     requestId: string;
     action: TaskBoardAction;
+    /**
+     * Session id of the DSH session issuing the action, for the execution audit
+     * trail (issue #6). Client-asserted, not a trust boundary; parsed only as a
+     * bounded non-empty string and recorded on opened executions / freeze stamps.
+     */
+    initiator?: string;
 }
 export declare function parseActionEnvelope(value: unknown): TaskBoardActionEnvelope | undefined;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-client-ui-task-board",
   "description": "Host-authoritative task board for the DSH Web GUI with real session execution, Host cron scheduling, and optional cross-platform idle-sleep protection; mounted without DSH source changes.",
-  "version": "0.3.6",
+  "version": "0.3.10",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -23,16 +23,19 @@
   },
   "dsh": {
     "engines": {
-      "dsh": ">=0.1.1-rc.1"
+      "dsh": ">=0.1.2-alpha.1"
     },
     "bundle": {
       "patch": "./cordis.patch.yml"
     },
     "client": {
       "inject": [
-        "@deepseek-ai/dsh-client-runtime",
         "@deepseek-ai/dsh-client-connection",
-        "@deepseek-ai/dsh-client-ui-settings"
+        "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-ui-renderer",
+        "@deepseek-ai/dsh-api-session-controller",
+        "@deepseek-ai/dsh-api-workspace-controller",
+        "@deepseek-ai/dsh-api-remotes"
       ],
       "platform": "web"
     }
@@ -44,21 +47,27 @@
     "schemastery": "^3.18.0"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-agent": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-connection": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-locale": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-runtime": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-commands": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-host-apiproxy": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-settings": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-system-prompt": "^0.1.1-rc.2",
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-agent": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-agent-presets": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-api-gateway": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-api-remotes": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-workspace": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-api-session-controller": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-api-workspace-controller": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-connection": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-locale": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-store": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-commands": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-settings": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "^0.1.2-alpha.2",
+    "@types/node": "^22.20.0",
     "@types/react": "~18.3.1",
     "@types/react-dom": "^18.3.5",
-    "@types/node": "^22.20.0",
     "jsdom": "^25.0.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",

package/src/client/TaskBoardSettingsCard.tsx

@@ -5,7 +5,8 @@
  */
 
 import type { InjectFace, PropsLocale, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'
-import type { SettingsScope, SnapshotStore } from '@deepseek-ai/dsh-client-runtime/client'
+import type { SnapshotStore } from '@deepseek-ai/dsh-client-store'
+import type { SettingsScope } from '@deepseek-ai/dsh-client-ui-settings/client'
 import { useEffect, useState } from 'react'
 import type { TaskBoardPowerSnapshot } from '../protocol.ts'
 import { PluginSettingsCard, BooleanField } from './PluginSettingsCard.tsx'

package/src/client/board/NewTaskModal.tsx

@@ -5,6 +5,7 @@
 import { useEffect, useState } from 'react'
 import type { BoardController } from '../../core/controller.ts'
 import { isValidCron, nextRunAtMs } from '../../core/schedule.ts'
+import { parseFreezeRequest } from '../../core/freeze-snapshot.ts'
 import { TASK_PERMISSIONS, type TaskPermission } from '../../core/tasks.ts'
 import { t, type TaskBoardKey } from '../locales.ts'
 import { SCHEDULE_PRESETS } from '../schedule-presets.ts'
@@ -22,6 +23,9 @@ export function NewTaskModal({ controller, onClose }: { controller: BoardControl
   const [scheduleEnabled, setScheduleEnabled] = useState(false)
   const [scheduleCron, setScheduleCron] = useState('')
   const [scheduleError, setScheduleError] = useState<string | undefined>(undefined)
+  const [freezeText, setFreezeText] = useState('')
+  const [freezeError, setFreezeError] = useState<string | undefined>(undefined)
+  const [handoverText, setHandoverText] = useState('')
   const [error, setError] = useState<string | undefined>(undefined)
   const [pending, setPending] = useState(false)
   const [options, setOptions] = useState(controller.getSnapshot().executionOptions)
@@ -41,11 +45,34 @@ export function NewTaskModal({ controller, onClose }: { controller: BoardControl
         return
       }
     }
+    // Optional continuation-card snapshot: parse the freeze block through the
+    // T2 gate (structure + redaction + taint + size); a malformed block stops
+    // submission with the parser's error instead of creating a plain task.
+    let freeze: Parameters<typeof controller.createTaskConfirmed>[0]['freeze'] = undefined
+    if (freezeText.trim() !== '') {
+      const parsed = parseFreezeRequest(freezeText)
+      if (!parsed.ok) {
+        setFreezeError(parsed.error.message)
+        return
+      }
+      freeze = { ...parsed.snapshot, ...(parsed.warnings.includes('redacted') ? { redacted: true } : {}) }
+    }
+    // Optional handover bundle: non-empty reference lines attach the picked
+    // triplet (workspace/mode/permission above) plus the references.
+    const references = handoverText.split('\n').map(line => line.trim()).filter(line => line !== '')
+    const handover = references.length === 0 ? undefined : {
+      references,
+      workspaceId: workspaceId === '' ? undefined : workspaceId,
+      mode: mode === '' ? undefined : mode,
+      permission: permission === '' ? undefined : permission as TaskPermission,
+    }
     setPending(true)
     const task = await controller.createTaskConfirmed({
       title,
       description,
       prompt,
+      freeze,
+      handover,
       workspaceId: workspaceId === '' ? undefined : workspaceId,
       mode: mode === '' ? undefined : mode,
       permission: permission === '' ? undefined : permission as TaskPermission,
@@ -83,6 +110,31 @@ export function NewTaskModal({ controller, onClose }: { controller: BoardControl
         onPromptChange={setPrompt}
       />
 
+        <label className={css.field}>
+          <span className={css.fieldLabel}>{t('new.freeze')}</span>
+          <textarea
+            className={css.input}
+            rows={4}
+            value={freezeText}
+            placeholder={t('new.freezePlaceholder')}
+            spellCheck={false}
+            onChange={event => { setFreezeText(event.target.value); setFreezeError(undefined) }}
+          />
+        </label>
+        {freezeError !== undefined && <p className={css.formError}>{freezeError}</p>}
+
+        <label className={css.field}>
+          <span className={css.fieldLabel}>{t('new.handover')}</span>
+          <textarea
+            className={css.input}
+            rows={3}
+            value={handoverText}
+            placeholder={t('new.handoverPlaceholder')}
+            spellCheck={false}
+            onChange={event => { setHandoverText(event.target.value) }}
+          />
+        </label>
+
         <label className={css.field}>
           <span className={css.fieldLabel}>{t('new.workspace')}</span>
           <select

package/src/client/board/TaskBoard.tsx

@@ -13,11 +13,13 @@ import { STATUS_KEY } from './status-key.ts'
 import { TaskCard } from './TaskCard.tsx'
 import { TaskDetail } from './TaskDetail.tsx'
 
-/** Case-insensitive title/description match. */
-function matchesFilter(task: TaskRecord, filter: string): boolean {
+/** Case-insensitive title/description/freeze-snapshot match. */
+export function matchesFilter(task: TaskRecord, filter: string): boolean {
   if (filter.trim() === '') return true
   const needle = filter.trim().toLowerCase()
-  return task.title.toLowerCase().includes(needle) || task.description.toLowerCase().includes(needle)
+  const haystacks = [task.title, task.description]
+  if (task.freeze !== undefined) haystacks.push(task.freeze.goal, task.freeze.progress, task.freeze.next)
+  return haystacks.some(text => text.toLowerCase().includes(needle))
 }
 
 /**

package/src/client/board/TaskCard.tsx

@@ -62,6 +62,9 @@ function TaskCardInner({ task, pending, timeZone, onClick }: { task: TaskRecord;
       {task.description !== '' && <span className={css.cardExcerpt}>{task.description}</span>}
       <span className={css.cardMeta}>
         <span className={css.cardTime}>{t('board.updated')} {formatTime(task.updatedAt)}</span>
+        {task.freeze !== undefined && (
+          <span className={css.cardSchedule} title={task.freeze.goal}>{t('card.frozen')}</span>
+        )}
         {!archived && task.schedule?.enabled === true && (
           <span
             className={css.cardSchedule}

package/src/client/board/TaskDetail.tsx

@@ -9,6 +9,7 @@ import type { BoardController } from '../../core/controller.ts'
 import { isValidCron } from '../../core/schedule.ts'
 import { MANUAL_STATUSES, TASK_PERMISSIONS, type ExecutionRecord, type TaskPermission, type TaskRecord } from '../../core/tasks.ts'
 import { canEditTaskContent } from '../../core/use-cases/task-update.ts'
+import { requiresPermissionConfirmation } from '../../core/handover.ts'
 import { t, type TaskBoardKey } from '../locales.ts'
 import { SCHEDULE_PRESETS } from '../schedule-presets.ts'
 import css from '../board.module.css'
@@ -36,6 +37,11 @@ function ExecutionRow({ execution, timeZone, onOpen }: { execution: ExecutionRec
         {t('detail.executionStarted')} {formatTime(execution.startedAt, timeZone)}
         {execution.endedAt !== undefined && ` · ${t('detail.executionEnded')} ${formatTime(execution.endedAt, timeZone)}`}
       </span>
+      {execution.initiatedBy !== undefined && (
+        <span className={css.executionTimes} title={execution.initiatedBy}>
+          {t('detail.execution.initiator', { session: execution.initiatedBy })}
+        </span>
+      )}
       {execution.sessionId !== undefined && (
         <button
           type="button"
@@ -248,6 +254,7 @@ export function TaskDetail({ controller, task }: { controller: BoardController;
   const pending = snapshot.pendingTaskIds.includes(current.id)
   const transportError = snapshot.transportError
   const timeZone = snapshot.host?.scheduler.timeZone
+  const permissionPending = requiresPermissionConfirmation(current, snapshot.host?.sessionDefaultPermission)
 
   return (
     <div className={css.modalBackdrop} onMouseDown={event => { if (event.target === event.currentTarget) controller.closeTask() }}>
@@ -281,6 +288,53 @@ export function TaskDetail({ controller, task }: { controller: BoardController;
             <p className={css.detailText}>{current.description !== '' ? current.description : '—'}</p>
           </section>
 
+          {current.freeze !== undefined && (
+            <section className={css.detailSection} data-dsh-part="freeze">
+              <h4>{t('detail.freeze')}</h4>
+              {current.freeze.redacted === true && <p className={css.formError}>{t('detail.freeze.redacted')}</p>}
+              <p className={css.detailText}><strong>{t('detail.freeze.goal')}</strong></p>
+              <pre className={css.promptBlock}>{current.freeze.goal}</pre>
+              <p className={css.detailText}><strong>{t('detail.freeze.progress')}</strong></p>
+              <pre className={css.promptBlock}>{current.freeze.progress}</pre>
+              <p className={css.detailText}><strong>{t('detail.freeze.next')}</strong></p>
+              <pre className={css.promptBlock}>{current.freeze.next}</pre>
+              <p className={css.detailMeta}>{t('detail.freeze.frozenAt', { time: formatHostTimestamp(current.freeze.frozenAt, timeZone) })}</p>
+              {current.freeze.frozenBy !== undefined && (
+                <p className={css.detailMeta}>{t('detail.freeze.frozenBy', { session: current.freeze.frozenBy })}</p>
+              )}
+            </section>
+          )}
+
+          {current.handover !== undefined && (
+            <section className={css.detailSection} data-dsh-part="handover">
+              <h4>{t('detail.handover')}</h4>
+              <p className={css.detailText}>
+                {t('new.workspace')}: {current.handover.workspaceId ?? t('exec.workspace.recent')}
+                {' · '}{t('new.mode')}: {current.handover.mode ?? t('exec.mode.default')}
+                {' · '}{t('new.permission')}: {current.handover.permission === undefined ? t('exec.permission.default') : t(`exec.permission.${current.handover.permission}` as TaskBoardKey)}
+              </p>
+              <p className={css.detailText}><strong>{t('detail.handover.references')}</strong></p>
+              <ul className={css.executionList}>
+                {current.handover.references.map(reference => (
+                  <li key={reference} className={css.executionRow}><code>{reference}</code></li>
+                ))}
+              </ul>
+              <p className={css.detailMeta}>{t('detail.handover.bundledAt', { time: formatHostTimestamp(current.handover.bundledAt, timeZone) })}</p>
+            </section>
+          )}
+
+          {permissionPending && (
+            <section className={css.detailSection} data-dsh-part="permission-gate">
+              <p className={css.formError}>{t('detail.permissionPending', { permission: t(`exec.permission.${current.handover?.permission ?? current.permission}` as TaskBoardKey) })}</p>
+              <button type="button" className={css.primaryButton} disabled={pending} onClick={() => { void controller.confirmPermission(current.id) }}>
+                {t('detail.permissionConfirm')}
+              </button>
+            </section>
+          )}
+          {current.permissionConfirmedAt !== undefined && (
+            <p className={css.detailMeta}>{t('detail.permissionConfirmed', { time: formatHostTimestamp(current.permissionConfirmedAt, timeZone) })}</p>
+          )}
+
           <section className={css.detailSection}>
             <h4>{t('detail.prompt')}</h4>
             <pre className={css.promptBlock}>{current.prompt !== '' ? current.prompt : current.title}</pre>

package/src/client/board-mount.tsx

@@ -15,6 +15,7 @@
 import { createRoot, type Root } from 'react-dom/client'
 import type { BoardController } from '../core/controller.ts'
 import { TaskBoard } from './board/TaskBoard.tsx'
+import type { LocaleRefreshSource } from './sidebar-entry.ts'
 import css from './board.module.css'
 
 /** The injected board container (kept in the DOM, hidden when inactive). */
@@ -37,11 +38,19 @@ function conversationColumn(): HTMLElement | undefined {
  * Mount the board React tree into the center column and bind its visibility
  * to the controller's boardOpen state.
  * @param controller - the board controller driving the view.
+ * @param locale - locale-change source; when given, re-renders a mounted board
+ *   on a Language switch.
  * @returns disposer unmounting the tree and restoring the column.
  */
-export function mountBoard(controller: BoardController): () => void {
+export function mountBoard(controller: BoardController, locale?: LocaleRefreshSource): () => void {
   let root: Root | undefined
   let container: HTMLDivElement | undefined
+  let unsubscribeLocale: (() => void) | undefined
+  try {
+    unsubscribeLocale = locale?.subscribe(() => {
+      if (root !== undefined) root.render(<TaskBoard controller={controller} />)
+    })
+  } catch { /* locale service absent: the board follows its next natural re-render */ }
 
   const ensure = (): void => {
     if (container !== undefined) {
@@ -106,6 +115,7 @@ export function mountBoard(controller: BoardController): () => void {
     document.removeEventListener(ACTIVATE_EVENT, onOtherActivate)
     waitObserver.disconnect()
     unsubscribe()
+    unsubscribeLocale?.()
     document.documentElement.removeAttribute(ACTIVE_ATTR)
     root?.unmount()
     root = undefined

package/src/client/host-api.ts

@@ -25,7 +25,7 @@ async function readJson<T>(response: Response): Promise<T> {
 export interface TaskBoardHostTransport {
   bootstrap(legacy: readonly TaskRecord[]): Promise<TaskBoardSnapshot>
   state(): Promise<TaskBoardSnapshot>
-  action(action: TaskBoardAction): Promise<TaskBoardSnapshot>
+  action(action: TaskBoardAction, initiator?: string): Promise<TaskBoardSnapshot>
   subscribe(listener: (event?: TaskBoardEventPayload) => void): () => void
 }
 
@@ -57,12 +57,12 @@ export class HttpTaskBoardHostTransport implements TaskBoardHostTransport {
     return await this.request(`${TASK_BOARD_API_PREFIX}/state`, { cache: 'no-store' })
   }
 
-  async action(action: TaskBoardAction): Promise<TaskBoardSnapshot> {
-    return await this.post(uuid(), action)
+  async action(action: TaskBoardAction, initiator?: string): Promise<TaskBoardSnapshot> {
+    return await this.post(uuid(), action, initiator)
   }
 
-  private async post(requestId: string, action: TaskBoardAction): Promise<TaskBoardSnapshot> {
-    const envelope: TaskBoardActionEnvelope = { requestId, action }
+  private async post(requestId: string, action: TaskBoardAction, initiator?: string): Promise<TaskBoardSnapshot> {
+    const envelope: TaskBoardActionEnvelope = { requestId, action, ...(initiator === undefined || initiator === '' ? {} : { initiator }) }
     return await this.request(`${TASK_BOARD_API_PREFIX}/action`, {
       method: 'POST',
       headers: { 'content-type': 'application/json' },