@linxin666/dsh-client-ui-task-board 0.4.2 → 0.4.3

package/src/client/settings-entry-form.ts

@@ -0,0 +1,142 @@
+// Generated by scripts/sync-shared.mjs from shared/client/settings/settings-entry-form.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+// Generated by scripts/sync-shared.mjs from shared/client/settings/settings-entry-form.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Family settings form bound to the profile entry id a Host actually serves.
+ *
+ * Under the 0.1.7 settings model a form is addressed by PROFILE ENTRY ID, while
+ * a family card knows only its own settings namespace. The family binder
+ * (`ctx.get('webUiSettings')`, published by dsh-web-settings) resolves one onto
+ * the other and is the preferred transport; this module is the fallback for a
+ * page that serves no binder — the group plugin is not installed, or its client
+ * half has not applied yet (the aggregate mounts its children in order, and a
+ * child still waiting on its own injects publishes nothing).
+ *
+ * The shared describe mirror is the only local evidence of which row id this
+ * profile serves, but it answers asynchronously: at plugin activation it usually
+ * holds nothing yet. A one-shot guess therefore cannot be right for every
+ * deployment, and the form is bound once per session:
+ *
+ * - binding the bare namespace made every save answer `No configurable plugin
+ *   entry "<namespace>"` on an aggregate install (the namespace is not an entry
+ *   id there), which the card reported as "the deployment did not accept these
+ *   values";
+ * - binding the aggregate row id would break a standalone install, whose row id
+ *   is the namespace or the package's own `ui-*` row.
+ *
+ * So the fallback starts on the most likely row and REBINDS the moment the
+ * mirror names one of this package's rows. Until the mirror answers, the form
+ * reports the binding it holds (usually `loading`), which the card renders as an
+ * unavailable form rather than a doomed one.
+ */
+import type { ConfigForm, ConfigFormSnapshot, ConfigForms } from '@deepseek-ai/dsh-client-ui-settings/client'
+
+/** Options of {@link createServedEntryForm}. */
+export interface ServedEntryFormOptions<T> {
+  /** The shared configuration forms service (`ctx.configForms`). */
+  forms: ConfigForms
+  /**
+   * Profile entry ids this package's rows carry, most likely first: the
+   * aggregate's generated row, the package's own standalone row, then the bare
+   * namespace. The first is the fallback while the mirror has no answer; the
+   * last is the answer when the mirror serves none of them.
+   */
+  entryIds: readonly string[]
+}
+
+/** The snapshot a form reports before the Host has answered with this entry. */
+function pendingSnapshot<T>(): ConfigFormSnapshot<T> {
+  return {
+    status: 'loading',
+    value: undefined,
+    base: undefined,
+    user: undefined,
+    revision: undefined,
+    writable: false,
+    mode: 'host',
+  }
+}
+
+/**
+ * Create a settings form bound to the profile entry id this Host serves, and
+ * rebound whenever the shared describe mirror names a different one of this
+ * package's rows.
+ * @param options - the shared forms service and this package's candidate row ids.
+ * @returns a form delegating to the currently resolved entry's own form.
+ */
+export function createServedEntryForm<T>(options: ServedEntryFormOptions<T>): ConfigForm<T> {
+  const { forms, entryIds } = options
+  const fallbackId = entryIds[0]
+  const namespaceId = entryIds[entryIds.length - 1]
+  const listeners = new Set<() => void>()
+  let boundId: string | undefined
+  let bound: ConfigForm<T> | undefined
+  let offBound: (() => void) | undefined
+  let snapshot: ConfigFormSnapshot<T> = pendingSnapshot<T>()
+
+  /** Republish: the delegated snapshot when one is bound, the pending one otherwise. */
+  const publish = (): void => {
+    if (bound !== undefined) snapshot = bound.getSnapshot()
+    for (const listener of [...listeners]) listener()
+  }
+
+  /**
+   * The entry id the mirror currently justifies. An unanswered or empty mirror
+   * is not evidence of absence, so it keeps the first candidate; a mirror that
+   * answers without any of this package's rows leaves the namespace itself.
+   * @returns the entry id to bind.
+   */
+  const resolve = (): string => {
+    let served: readonly string[] | undefined
+    try {
+      served = forms.describe().getSnapshot().view?.namespaces.map(row => row.ns)
+    } catch {
+      // A mirror that refuses the read is unanswered too, not absent.
+      served = undefined
+    }
+    if (served === undefined || served.length === 0) return fallbackId
+    return entryIds.find(id => served.includes(id)) ?? namespaceId
+  }
+
+  /** Bind (or rebind) the resolved entry's form; a no-op while it is unchanged. */
+  const bind = (): void => {
+    const target = resolve()
+    if (target === boundId) return
+    offBound?.()
+    offBound = undefined
+    let form: ConfigForm<T>
+    try {
+      form = forms.get<T>(target)
+    } catch {
+      // A service that refuses the id stays unbound; the next mirror answer
+      // retries rather than pinning a wrong entry for the session.
+      boundId = undefined
+      return
+    }
+    boundId = target
+    bound = form
+    offBound = form.subscribe(() => { publish() })
+    publish()
+  }
+
+  // The mirror subscription lives for the page: the card owns its form for the
+  // session, and the ConfigForm contract carries no disposer to hang it on. The
+  // callback is cheap (a resolve plus a no-op while the id is unchanged). A
+  // mirror without a subscription seat keeps the initial binding.
+  try {
+    forms.describe().subscribe(() => { bind() })
+  } catch {
+    // A describe face that refuses the subscription: the initial binding stands.
+  }
+  bind()
+
+  return {
+    getSnapshot: () => snapshot,
+    subscribe: (listener) => {
+      listeners.add(listener)
+      return () => { listeners.delete(listener) }
+    },
+    set: (field, value) => bound?.set(field, value) ?? Promise.resolve(false),
+    unset: (field) => bound?.unset(field) ?? Promise.resolve(false),
+    mutate: (ops, expectedRevision) => bound?.mutate(ops, expectedRevision) ?? Promise.resolve(false),
+  }
+}

package/src/core/controller.ts

@@ -62,6 +62,21 @@ function currentOf(sessions: SessionsControllerFace | undefined): string | undef
   return sessions?.current()
 }
 
+/** Stable id shared by the board's sidebar panel row and its main-slot page. */
+export const TASK_BOARD_PANEL_ID = 'task-board'
+
+/**
+ * The layout's panel-navigation face. The board no longer owns the center
+ * column at the DOM level: selecting the panel is the layout's business, and
+ * this is the one call that asks for it (null returns to the conversation).
+ * Optional, so a composition without the layout service keeps the board's
+ * pure state transitions testable.
+ */
+export interface PanelNavigationFace {
+  /** Select the board panel, or null to hand the column back to the conversation. */
+  select(panelId: string | null): void
+}
+
 /** Controller dependencies (all swappable in tests). */
 export interface ControllerDeps {
   store: TaskStore
@@ -72,6 +87,8 @@ export interface ControllerDeps {
   uuid?: () => string
   /** Host-authoritative transport; absent keeps the legacy in-memory test path. */
   transport?: TaskBoardTransport
+  /** Layout panel selection; absent keeps the board state-only (tests, shell-less hosts). */
+  panel?: PanelNavigationFace
 }
 
 /**
@@ -253,15 +270,31 @@ export class BoardController {
 
   // --- view state -------------------------------------------------------------
 
+  /**
+   * Show the board. The layout owns which panel the center column renders, so
+   * the state flip and the panel selection travel together here; a composition
+   * with no layout face (tests, a shell-less host) still flips the state.
+   *
+   * The selection is requested AFTER the snapshot flips so a subscriber
+   * rendering against `boardOpen` never observes "open" while the shell still
+   * shows the conversation.
+   */
   openBoard(): void {
     if (this.boardOpen) return
     this.boardOpen = true
     this.notify()
+    this.selectPanel(TASK_BOARD_PANEL_ID)
   }
 
+  /**
+   * Return the center column to the conversation. The layout's own selection is
+   * the source of truth for what the column renders, so this asks for the
+   * conversation explicitly rather than only clearing local state.
+   */
   closeBoard(): void {
     this.boardOpen = false
     this.notify()
+    this.selectPanel(null)
   }
 
   toggleBoard(): void {
@@ -269,6 +302,30 @@ export class BoardController {
     else this.openBoard()
   }
 
+  /**
+   * Reflect a panel selection that came from OUTSIDE this controller (the user
+   * clicked another sidebar row, or the layout dropped the panel id). Keeps
+   * `boardOpen` aligned with what the column actually shows without asking the
+   * layout to select anything back.
+   * @param panelId - the layout's current panel id, or null for the conversation.
+   */
+  syncPanelSelection(panelId: string | null): void {
+    const open = panelId === TASK_BOARD_PANEL_ID
+    if (open === this.boardOpen) return
+    this.boardOpen = open
+    this.notify()
+  }
+
+  /** Ask the layout to select a panel; a shell that serves no layout face is a no-op. */
+  private selectPanel(panelId: string | null): void {
+    try {
+      this.deps.panel?.select(panelId)
+    } catch {
+      // The layout service throws by contract before its root entry mounts;
+      // the state flip above already stands, and the next selection retries.
+    }
+  }
+
   /**
    * Switch between the kanban columns and the archive view. Leaving the
    * archive view with an archived task still selected closes the selection —
@@ -547,8 +604,8 @@ export class BoardController {
    * (background navigation, the Host runner creating and selecting a fresh
    * execution session, settlement, other plugins), so closing on `current`
    * changes would evict the board without the user asking. The board closes
-   * only on explicit user navigation: a sidebar session/workspace row click
-   * (board-mount onClickSidebarRow) or the board's own actions
+   * only on explicit user navigation: selecting another panel (the layout owns
+   * selection, and `syncPanelSelection` follows it) or the board's own actions
    * (openSession / close). Keeping the hook preserves the subscription
    * contract for future listeners.
    */

package/src/host-ledger.ts

@@ -516,6 +516,26 @@ export class HostTaskLedger {
     return count
   }
 
+  /**
+   * The earliest armed `nextRunAt` strictly after the supplied Host time, or
+   * undefined when no schedule is armed in the future. This is the instant the
+   * Host arms its native timer at, so the board wakes exactly when work is due
+   * instead of polling a fixed heartbeat.
+   * @param now - current Host time in ms epoch.
+   * @returns the nearest future trigger, or undefined when none is armed.
+   */
+  nextArmedRunAt(now: number): number | undefined {
+    let nearest: number | undefined
+    for (const task of this.document.tasks) {
+      if (task.archivedAt !== undefined) continue
+      const schedule = task.schedule
+      if (schedule === undefined || !schedule.enabled || schedule.nextRunAt === undefined) continue
+      if (schedule.nextRunAt <= now) continue
+      if (nearest === undefined || schedule.nextRunAt < nearest) nearest = schedule.nextRunAt
+    }
+    return nearest
+  }
+
   /** Return value-only references for schedules due at the supplied Host time. */
   dueSchedules(now: number): DueScheduleReference[] {
     const due: DueScheduleReference[] = []

package/src/host-routes.ts

@@ -73,15 +73,51 @@ function resolveAccess(access: TaskBoardRouteAccess): ResolvedRouteAccess {
   return { trustedProxyHosts, ...(access.proxyToken === undefined ? {} : { proxyToken: access.proxyToken }) }
 }
 
+/**
+ * Harness browser-auth cookie prefix (dsh-client-connection): the
+ * authority-bound signed cookie the Host mints in exchange for its launch
+ * token. dsh-web's remote channel redeems that token before re-issuing paired
+ * traffic to 127.0.0.1 (packages/dsh-remote-web-ui/src/inner-auth.ts), and the
+ * official DSH Desktop shell keeps its own copy from the same exchange and
+ * attaches it to every request it forwards for the dsh-app://app/ page. The
+ * two constants describe one fact and move together.
+ */
+const BROWSER_AUTH_COOKIE_PREFIX = 'dsh-auth-'
+
+/**
+ * Whether a Cookie header carries the Host's browser-auth credential. Only an
+ * application on this machine can hold it: the desktop shell never lets it
+ * reach the page's cookie jar, and SameSite=Strict keeps a cross-site page
+ * from attaching it.
+ * @param header - the raw Cookie header value.
+ */
+function carriesBrowserAuthCookie(header: string | undefined): boolean {
+  if (header === undefined) return false
+  return header.split(';').some(segment => segment.trim().startsWith(BROWSER_AUTH_COOKIE_PREFIX))
+}
+
 /**
  * Browser-signal tripwire, NOT an authority check: a bare curl sends neither
  * header and is refused, but a curl with a forged Origin passes this too.
  * The real boundary is the loopback socket + Host + origin-equality checks
  * in isTrustedTaskBoardRequest below; do not rely on this marker alone.
+ *
+ * A first-party client that presents NEITHER header must still pass. The DSH
+ * Desktop shell serves the Web GUI from dsh-app://app/ and forwards that
+ * page's Host requests itself, deleting origin and sec-fetch-site on the
+ * way (dsh-desktop-host's forwardWebRequest), so the panel's own fetch
+ * arrives marker-less and every route behind this guard answered 403 - which
+ * the panel renders as its board.hostError.unauthorized message. The shell
+ * does attach the Host's browser-auth cookie, redeemed from the Host's launch
+ * URL at startup and deliberately withheld from the page. That credential,
+ * not a header the shell strips, is the browser signal of an application on
+ * this machine; a marker-less, credential-less request stays refused.
  */
 function browserSameOriginMarker(req: IncomingMessage): boolean {
   const site = req.headers['sec-fetch-site']
-  return site === 'same-origin' || typeof req.headers.origin === 'string'
+  if (site === 'same-origin') return true
+  if (typeof req.headers.origin === 'string') return true
+  return carriesBrowserAuthCookie(req.headers.cookie)
 }
 
 function sameAuthority(req: IncomingMessage, host: URL): boolean {

package/src/host-service.ts

@@ -38,20 +38,62 @@ export interface TaskBoardTeamDispatcher {
   spawn(input: TeamSpawnInput): Promise<TeamSpawnResult>
 }
 
+/** Session-roster poll cadence — the one recurring Host timer this service still holds. */
 const SESSION_POLL_MS = 5_000
-const SCHEDULE_TICK_MS = 30_000
-const RESUME_GAP_MS = SCHEDULE_TICK_MS + 15_000
+/**
+ * How late an armed schedule fire may be before it counts as a resume rather
+ * than a normal occurrence. The schedule timer is armed AT the next due
+ * instant, so landing this far past its target means the Host was suspended,
+ * the process throttled, or the wall clock jumped forward — the same condition
+ * the old fixed 30 s heartbeat detected through its own gap threshold.
+ */
+const RECOVERY_TOLERANCE_MS = 60_000
+/** Largest delay a Node timer represents without clamping; longer targets re-arm in segments. */
+const MAX_TIMER_DELAY_MS = 2_147_483_647
+
+/**
+ * Actions that can move an armed trigger. Only these re-arm the native timer;
+ * an unrelated card edit leaves the pending fire untouched.
+ */
+const SCHEDULE_WRITE_ACTIONS: ReadonlySet<TaskBoardAction['kind']> = new Set(['set-schedule', 'delete', 'archive'])
+
+/**
+ * The native timer face the Host arms through. The cordis `timer` service
+ * (dsh-base's own `cordis-plugin-timer` row) provides it: its handles are
+ * registered on the owning fiber, so unloading the board clears every armed
+ * timer without this service tracking handles by hand. A composition that
+ * serves no timer service falls back to the process globals.
+ */
+export interface HostTimerFace {
+  timeout(callback: () => void, delay: number): () => void
+  interval(callback: () => void, delay: number): () => void
+}
+
+/** Process-global fallback used when the deployment serves no cordis timer service. */
+const PROCESS_TIMERS: HostTimerFace = {
+  timeout(callback: () => void, delay: number): () => void {
+    const handle = setTimeout(callback, delay)
+    return () => { clearTimeout(handle) }
+  },
+  interval(callback: () => void, delay: number): () => void {
+    const handle = setInterval(callback, delay)
+    return () => { clearInterval(handle) }
+  },
+}
 
 export class TaskBoardHostService {
   readonly ledger: HostTaskLedger
   readonly runner: HostExecutionRunner
   readonly power: PowerInhibitor
   private readonly listeners = new Set<() => void>()
-  private timers: Array<ReturnType<typeof setInterval>> = []
-  private lastScheduleTick: number | undefined
+  /** The one recurring timer: the session-roster poll. */
+  private pollTimer: (() => void) | undefined
+  /** The armed schedule timer, if a trigger is pending. */
+  private scheduleTimer: (() => void) | undefined
+  /** The instant the armed schedule timer targets (ms epoch), for resume detection. */
+  private scheduleTarget: number | undefined
   private disposed = false
   private pollInFlight = false
-  private tickInFlight = false
   private active = true
   /**
    * Ids the last roster poll saw as present and idle; undefined while the
@@ -62,6 +104,7 @@ export class TaskBoardHostService {
   private idleSessionIds: ReadonlySet<string> | undefined
   private preventIdleSleep = false
   private readonly team: TaskBoardTeamDispatcher | undefined
+  private readonly timers: HostTimerFace
   private lastPowerJson = ''
   private readonly now: () => number
 
@@ -74,6 +117,7 @@ export class TaskBoardHostService {
     sessionDefaultPermission?: TaskPermission
     maxSubtaskDepth?: number
     team?: TaskBoardTeamDispatcher
+    timers?: HostTimerFace
   } = {}) {
     this.ledger = options.ledger ?? new HostTaskLedger(undefined, undefined, {
       sessionDefaultPermission: options.sessionDefaultPermission,
@@ -81,6 +125,7 @@ export class TaskBoardHostService {
     })
     this.runner = new HostExecutionRunner(gateway, options.commandDispatcher, options.workspaceRegistry)
     this.team = options.team
+    this.timers = options.timers ?? PROCESS_TIMERS
     this.power = options.power ?? new PowerInhibitor()
     this.now = options.now ?? Date.now
     installStreamErrorGuards()
@@ -100,12 +145,15 @@ export class TaskBoardHostService {
   }
 
   start(): void {
-    if (this.disposed || this.timers.length > 0) return
+    if (this.disposed || this.pollTimer !== undefined) return
     this.syncPowerReasons()
-    this.timers.push(setInterval(() => { this.schedulePoll() }, SESSION_POLL_MS))
-    this.timers.push(setInterval(() => { this.scheduleTick(false) }, SCHEDULE_TICK_MS))
+    this.pollTimer = this.timers.interval(() => { this.schedulePoll() }, SESSION_POLL_MS)
     this.schedulePoll()
-    this.scheduleTick(true)
+    // Boot is a recovery point: an occurrence armed while the Host was down is
+    // not replayed, and each schedule rolls to its next future target. A
+    // schedule the Board should have served while running is then armed
+    // normally by the timer below.
+    this.recoverSchedule()
   }
 
   setConfiguration(active: boolean, preventIdleSleep: boolean): void {
@@ -123,7 +171,11 @@ export class TaskBoardHostService {
     this.power.setEnabled(active && preventIdleSleep)
     if (resumed) {
       this.schedulePoll()
-      this.scheduleTick(true)
+      this.recoverSchedule()
+    } else if (!active) {
+      // A disabled board holds no timer: its schedules must not fire while the
+      // master switch is off.
+      this.clearScheduleTimer()
     }
     this.emit()
   }
@@ -164,6 +216,10 @@ export class TaskBoardHostService {
     }
     const result = this.ledger.applyRequest(requestId, action, initiator)
     if (result.runs !== undefined) this.dispatchRuns(result.runs)
+    // A committed schedule write (create / update / toggle / delete) moves the
+    // nearest trigger; re-arm on every action so a newly enabled schedule fires
+    // at its own instant without waiting for the previous target to elapse.
+    if (SCHEDULE_WRITE_ACTIONS.has(action.kind)) this.refreshSchedule()
     return {
       schemaVersion: TASK_BOARD_SCHEMA_VERSION,
       revision: result.state.revision,
@@ -175,7 +231,9 @@ export class TaskBoardHostService {
 
   dispose(): void {
     this.disposed = true
-    for (const timer of this.timers.splice(0)) clearInterval(timer)
+    this.clearScheduleTimer()
+    this.pollTimer?.()
+    this.pollTimer = undefined
     this.power.dispose()
     this.ledger.dispose()
     this.listeners.clear()
@@ -293,20 +351,72 @@ export class TaskBoardHostService {
     }
   }
 
-  private async tickSchedule(first: boolean): Promise<void> {
+  /** Drop the armed schedule timer and forget its target. */
+  private clearScheduleTimer(): void {
+    this.scheduleTimer?.()
+    this.scheduleTimer = undefined
+    this.scheduleTarget = undefined
+  }
+
+  /**
+   * Boot / resume recovery: skip every occurrence that came due while the
+   * board was not running and roll each schedule to its next future target,
+   * then arm the timer for the nearest one. Rendering the occurrence is
+   * deliberately not attempted: the ACL of a card that fired hours ago is
+   * stale, and the board's own recovery contract is "missed triggers are
+   * skipped, never replayed".
+   */
+  private recoverSchedule(): void {
+    if (this.disposed) return
+    this.clearScheduleTimer()
+    const now = this.now()
+    this.ledger.setScheduler({ lastTickAt: now })
+    this.ledger.skipMissed(now)
+    this.armSchedule()
+  }
+
+  /**
+   * Arm the native timer at the nearest armed future trigger. One timer serves
+   * every schedule: the ledger's next target is the only instant the Host has
+   * to wake for. A target beyond the platform's timer ceiling re-arms in
+   * segments, and a target already past (the wall clock jumped, or the process
+   * was suspended) is handled immediately as a recovery.
+   */
+  private armSchedule(): void {
+    if (this.disposed || !this.active) return
+    this.clearScheduleTimer()
+    const target = this.ledger.nextArmedRunAt(this.now())
+    if (target === undefined) return
+    this.scheduleTarget = target
+    const delay = Math.max(0, Math.min(target - this.now(), MAX_TIMER_DELAY_MS))
+    this.scheduleTimer = this.timers.timeout(() => {
+      this.scheduleTimer = undefined
+      this.onScheduleFire(target)
+    }, delay)
+  }
+
+  /**
+   * One armed target became due. A fire landing well past its target is a
+   * resume (suspend, throttle, forward clock jump) rather than a normal
+   * occurrence, so it takes the recovery path instead of launching a run for a
+   * long-stale instant.
+   */
+  private onScheduleFire(target: number): void {
     if (this.disposed || !this.active) return
     const now = this.now()
-    const recovered = first || (this.lastScheduleTick !== undefined && now - this.lastScheduleTick > RESUME_GAP_MS)
-    this.lastScheduleTick = now
+    this.scheduleTarget = undefined
     this.ledger.setScheduler({ lastTickAt: now })
-    if (recovered) {
-      this.ledger.skipMissed(now)
+    if (now - target > RECOVERY_TOLERANCE_MS) {
+      this.recoverSchedule()
       return
     }
     for (const schedule of this.ledger.dueSchedules(now)) {
       const next = nextRunAtMs(schedule.cron, schedule.nextRunAt)
       this.dispatchRuns(this.ledger.openScheduled(schedule.taskId, next, now))
     }
+    // The launched run (or the rolled-forward target) moved every due schedule,
+    // so the next nearest target has to be recomputed from the ledger.
+    this.armSchedule()
   }
 
   private armedSchedules(): number {
@@ -344,12 +454,18 @@ export class TaskBoardHostService {
     }).finally(() => { this.pollInFlight = false })
   }
 
-  private scheduleTick(first: boolean): void {
-    if (this.tickInFlight || this.disposed) return
-    this.tickInFlight = true
-    void this.tickSchedule(first).catch(error => {
-      safeConsoleError('[dsh-task-board] scheduler tick failed', error)
-    }).finally(() => { this.tickInFlight = false })
+  /**
+   * Re-arm from the ledger's current targets. Callers that just changed a
+   * schedule (the host routes, the agent tools) invoke this after the write
+   * commits, so a new or edited trigger arms without waiting for the next fire.
+   */
+  refreshSchedule(): void {
+    if (this.disposed) return
+    if (!this.active) {
+      this.clearScheduleTimer()
+      return
+    }
+    this.armSchedule()
   }
 
   private syncPowerReasons(): void {

package/src/index.ts

@@ -17,7 +17,7 @@ import type {} from '@deepseek-ai/dsh-host-webserver'
 import type {} from '@deepseek-ai/dsh-tools'
 import type { ToolDefinition } from '@deepseek-ai/dsh-tools'
 import type { LlmRuntime } from '@deepseek-ai/dsh-llm'
-import { TaskBoardHostService, type TaskBoardTeamDispatcher } from './host-service.ts'
+import { TaskBoardHostService, type HostTimerFace, type TaskBoardTeamDispatcher } from './host-service.ts'
 import { parseTaskDraft, TaskParseError } from './host-ai.ts'
 import { TASK_PERMISSIONS, type TaskPermission } from './core/tasks.ts'
 import { DEFAULT_SUBTASK_DEPTH, SUBTASK_DEPTH_MAX, SUBTASK_DEPTH_MIN } from './core/subtask.ts'
@@ -179,6 +179,27 @@ export function resolveToolRegistry(ctx: Context): AgentToolRegistry | undefined
   }
 }
 
+/**
+ * Resolve the native cordis timer service (dsh-base's own `cordis-plugin-timer`
+ * row). The board arms its schedule through it so unloading the row clears
+ * every pending timer with the owning fiber, instead of the row tracking raw
+ * process handles by hand. A composition that serves no timer service keeps
+ * working on the process globals.
+ * @param ctx - the plugin context.
+ * @returns the timer face, or undefined when this deployment serves none.
+ */
+export function resolveHostTimers(ctx: Context): HostTimerFace | undefined {
+  try {
+    const timer = ctx.get('timer') as Partial<HostTimerFace> | undefined
+    if (timer === undefined) return undefined
+    return typeof timer.timeout === 'function' && typeof timer.interval === 'function'
+      ? { timeout: timer.timeout.bind(timer), interval: timer.interval.bind(timer) }
+      : undefined
+  } catch {
+    return undefined
+  }
+}
+
 /** Schema default, re-read for hand-built test contexts (the loader applies them normally). */
 const DEFAULT_ANNOUNCE = false
 
@@ -301,6 +322,7 @@ function applyImpl(ctx: Context, config?: Config): void {
     workspaceRegistry: ctx.workspaceRegistry,
     sessionDefaultPermission: config?.sessionDefaultPermission ?? DEFAULT_SESSION_PERMISSION,
     maxSubtaskDepth: maxSubtaskDepth(),
+    timers: resolveHostTimers(ctx),
     team: buildTeamDispatcher(ctx, config?.teamProvider ?? DEFAULT_TEAM_PROVIDER),
     commandDispatcher: {
       async execute(sessionId, line, signal) {