@linxin666/dsh-client-ui-task-board 0.4.4 → 0.4.5

package/src/client/settings-card.module.css

@@ -36,8 +36,8 @@
   border: 0;
   border-radius: 12px;
   align-items: center;
-  gap: 12px;
-  padding: 14px 16px;
+  gap: 13px;
+  padding: 16px;
   display: flex;
 }
 
@@ -51,8 +51,8 @@
   box-sizing: border-box;
   border-radius: 12px;
   align-items: center;
-  gap: 12px;
-  padding: 14px 16px;
+  gap: 13px;
+  padding: 16px;
   display: flex;
 }
 
@@ -64,6 +64,25 @@
   display: flex;
 }
 
+/* Optional leading plugin mark: a quiet tile that takes the ink color on
+   hover and while the card is open, so the whole row reads as one control. */
+.mark {
+  flex: none;
+  display: grid;
+  place-items: center;
+  width: 34px;
+  height: 34px;
+  border-radius: 10px;
+  background: var(--dsw-alias-bg-module-platform);
+  color: var(--dsw-alias-label-secondary);
+  transition: color 0.16s;
+}
+
+.header:hover .mark,
+.cardOpen .mark {
+  color: var(--dsw-alias-label-primary);
+}
+
 .name {
   color: var(--dsw-alias-label-primary);
   font-size: 15px;
@@ -95,7 +114,13 @@
 .chevron {
   color: var(--dsw-alias-label-tertiary);
   flex: none;
-  transition: transform 0.16s;
+  width: 16px;
+  height: 16px;
+  transition: transform 0.16s, color 0.16s;
+}
+
+.header:hover .chevron {
+  color: var(--dsw-alias-label-secondary);
 }
 
 .chevronOpen {
@@ -406,6 +431,7 @@
 @media (prefers-reduced-motion: reduce) {
   .card,
   .header,
+  .mark,
   .chevron,
   .chevronOpen,
   .discard,

package/src/client/settings-form.ts

@@ -215,6 +215,8 @@ export class CardForm<T> {
   private readonly disposeForm: () => void
   private disposed = false
   private saving = false
+  /** A save asked for while one was in flight; it runs once the first settles (#1754). */
+  private saveQueued = false
   private failed = false
   private failedReason: string | undefined
 
@@ -283,7 +285,7 @@ export class CardForm<T> {
       resetField: (field) => {
         this.stage(field, { text: this.specOf(field).format(this.baseValue(field)), clear: true })
       },
-      save: () => { void this.save() },
+      save: () => { void this.requestSave() },
       discard: () => {
         if (this.staged.size === 0 && !this.failed) return
         this.staged.clear()
@@ -310,6 +312,30 @@ export class CardForm<T> {
    * the user can correct them instead of retyping.
    * @returns settlement after the mutation and the read-back.
    */
+  /**
+   * Run one save, and re-run it once if another was asked for while this one
+   * was still in flight.
+   *
+   * A save is a Host round trip that also drives the profile reconcile, and
+   * the Host runs that write inside one exclusive transaction. Answering a
+   * press that arrives mid-flight by returning immediately dropped the edit
+   * with no explanation, which is the "the save button stops working after a
+   * few rounds" report (#1754). Serializing instead means a save pressed while
+   * another is still settling runs against the settled state - which is what
+   * the operator meant by pressing it again.
+   * @returns settlement after the mutation and the read-back.
+   */
+  async requestSave(): Promise<void> {
+    if (this.saving) {
+      this.saveQueued = true
+      return
+    }
+    await this.save()
+    if (!this.saveQueued) return
+    this.saveQueued = false
+    await this.requestSave()
+  }
+
   async save(): Promise<void> {
     const plan = this.plan()
     const valid = plan.filter((item): item is PlannedWrite & { judge: () => boolean } => item.judge !== undefined)

package/src/core/controller.ts

@@ -12,13 +12,14 @@
  * owns only the orchestration seam (state, persistence, notify, navigation).
  */
 import type { TaskStore } from './store.ts'
-import { withStatus, type NewTaskInput, type TaskRecord, type TaskStatus } from './tasks.ts'
+import { hasOpenExecution, withStatus, type NewTaskInput, type TaskRecord, type TaskStatus } from './tasks.ts'
 import { applyArchiveTask, applyRestoreTask } from './use-cases/task-archive.ts'
 import { applyCreateTask } from './use-cases/task-create.ts'
 import { applyDeleteTask } from './use-cases/task-delete.ts'
 import { applyScheduleNextRun as applyScheduleRollForward, applySetSchedule } from './use-cases/task-schedule.ts'
 import { resolveHostTimeZone } from './schedule.ts'
 import { applySetParent } from './use-cases/task-parent.ts'
+import { applyDeleteTag, applyRenameTag } from './use-cases/task-tag.ts'
 import { applyUpdateTask, type TaskUpdatePatch } from './use-cases/task-update.ts'
 import { DEFAULT_SUBTASK_DEPTH } from './subtask.ts'
 import type {
@@ -28,6 +29,10 @@ import type {
   TaskBoardParseRequest,
   TaskBoardSnapshot,
 } from '../protocol.ts'
+import type {
+  TaskBoardExtensionActionRequest,
+  TaskBoardVisibilityPredicate,
+} from './extension.ts'
 
 export interface TaskBoardTransport {
   bootstrap(legacy: readonly TaskRecord[]): Promise<TaskBoardSnapshot>
@@ -136,7 +141,7 @@ export interface ExecutionOptionsSnapshot {
  * (revision/scheduler/power); a full snapshot also carries the deployment
  * constants the UI reads (session default permission, subtask depth).
  */
-export type HostMirror = Pick<TaskBoardSnapshot, 'revision' | 'scheduler' | 'power' | 'sessionDefaultPermission' | 'maxSubtaskDepth' | 'teamRunAvailable'>
+export type HostMirror = Pick<TaskBoardSnapshot, 'revision' | 'scheduler' | 'power' | 'sessionDefaultPermission' | 'maxSubtaskDepth' | 'teamRunAvailable' | 'extensions'>
 
 /** Immutable controller snapshot for UI subscriptions. */
 export interface ControllerSnapshot {
@@ -154,6 +159,15 @@ export interface ControllerSnapshot {
   canParseTask?: boolean
   transportError?: string
   host?: HostMirror
+  /**
+   * Provider card-visibility predicates, in registration order. A task shows
+   * only while every predicate accepts it; providers hide their own off-board
+   * cards here instead of the board hard-coding a provider rule. Optional so a
+   * hand-built snapshot (tests, a shell-less composition) defaults to visible.
+   */
+  visibility?: readonly TaskBoardVisibilityPredicate[]
+  /** Read-only summaries published by running extensions, keyed by extension id. */
+  extensions?: Readonly<Record<string, unknown>>
 }
 
 /** The selected task (resolved from the ledger), or undefined. */
@@ -201,6 +215,8 @@ export class BoardController {
   private readonly taskQueues = new Map<string, Promise<void>>()
   private transportError: string | undefined
   private hostState: HostMirror | undefined
+  /** Provider visibility predicates (immutable array; replaced on change). */
+  private visibility: readonly TaskBoardVisibilityPredicate[] = []
   private remoteSubscribed = false
   private remoteInitialization: Promise<boolean> | undefined
 
@@ -251,9 +267,42 @@ export class BoardController {
       ...(typeof this.deps.transport?.parseDraft === 'function' ? { canParseTask: true } : {}),
       ...(this.transportError === undefined ? {} : { transportError: this.transportError }),
       ...(this.hostState === undefined ? {} : { host: this.hostState }),
+      visibility: this.visibility,
+      ...(this.hostState?.extensions === undefined ? {} : { extensions: this.hostState.extensions }),
+    }
+  }
+
+  /**
+   * Register one card-visibility predicate. The returned disposer removes it;
+   * both changes notify subscribers so the board re-renders.
+   */
+  registerVisibility(predicate: TaskBoardVisibilityPredicate): () => void {
+    this.visibility = [...this.visibility, predicate]
+    this.notify()
+    return () => {
+      const next = this.visibility.filter(candidate => candidate !== predicate)
+      if (next.length === this.visibility.length) return
+      this.visibility = next
+      this.notify()
     }
   }
 
+  /**
+   * Deliver one provider action through the board's same-origin channel. A
+   * board without a Host transport (the legacy in-memory path) refuses it.
+   */
+  async dispatchExtension(request: TaskBoardExtensionActionRequest): Promise<boolean> {
+    if (this.deps.transport === undefined) return false
+    const action: TaskBoardAction = {
+      kind: 'extension-action',
+      extensionId: request.extensionId,
+      action: request.action,
+      ...(request.taskId === undefined ? {} : { taskId: request.taskId }),
+      ...(request.payload === undefined ? {} : { payload: request.payload }),
+    }
+    return await this.commitRemote(action, request.taskId)
+  }
+
   subscribe(fn: () => void): () => void {
     this.listeners.add(fn)
     return () => { this.listeners.delete(fn) }
@@ -507,6 +556,44 @@ export class BoardController {
     return true
   }
 
+  /**
+   * Rename one label across the whole ledger; a name already in use merges the
+   * two labels. Host-backed: the ledger owns the transition and confirms it, so
+   * the board's label row reflects whether the Host accepted the edit.
+   * @returns true when the edit was accepted by the authority.
+   */
+  async renameTag(from: string, to: string): Promise<boolean> {
+    if (this.deps.transport !== undefined) {
+      return await this.commitRemote({ kind: 'rename-tag', from, to })
+    }
+    const result = applyRenameTag(this.tasks, from, to, this.now())
+    if (result.error !== undefined) return false
+    if (result.changed) {
+      this.tasks = [...result.tasks]
+      this.persistAndNotify()
+    }
+    return true
+  }
+
+  /**
+   * Remove one label from every task that carries it, board and archive alike —
+   * the board's label row is drawn from the whole ledger, so a label left on an
+   * archived card would come straight back.
+   * @returns true when the edit was accepted by the authority.
+   */
+  async deleteTag(name: string): Promise<boolean> {
+    if (this.deps.transport !== undefined) {
+      return await this.commitRemote({ kind: 'delete-tag', name })
+    }
+    const result = applyDeleteTag(this.tasks, name, this.now())
+    if (result.error !== undefined) return false
+    if (result.changed) {
+      this.tasks = [...result.tasks]
+      this.persistAndNotify()
+    }
+    return true
+  }
+
   // --- scheduling ---------------------------------------------------------------
 
   /**
@@ -572,7 +659,9 @@ export class BoardController {
    */
   async runTask(id: string): Promise<boolean> {
     const task = this.tasks.find(candidate => candidate.id === id)
-    if (task === undefined || task.archivedAt !== undefined || task.status === 'running') return false
+    // Only an open execution blocks a second launch; the 'running' column is a
+    // board statement and a card parked there by hand still runs on request.
+    if (task === undefined || task.archivedAt !== undefined || hasOpenExecution(task)) return false
     if (this.deps.transport === undefined) return false
     return await this.commitRemote({ kind: 'run', taskId: id }, id, currentOf(this.deps.sessions))
   }
@@ -724,6 +813,7 @@ export class BoardController {
     const sessionDefaultPermission = snapshot.sessionDefaultPermission ?? this.hostState?.sessionDefaultPermission
     const maxSubtaskDepth = snapshot.maxSubtaskDepth ?? this.hostState?.maxSubtaskDepth
     const teamRunAvailable = snapshot.teamRunAvailable ?? this.hostState?.teamRunAvailable
+    const extensions = snapshot.extensions ?? this.hostState?.extensions
     return {
       revision: snapshot.revision,
       scheduler: snapshot.scheduler,
@@ -731,6 +821,7 @@ export class BoardController {
       ...(sessionDefaultPermission === undefined ? {} : { sessionDefaultPermission }),
       ...(maxSubtaskDepth === undefined ? {} : { maxSubtaskDepth }),
       ...(teamRunAvailable === undefined ? {} : { teamRunAvailable }),
+      ...(extensions === undefined ? {} : { extensions }),
     }
   }
 

package/src/core/extension.ts

@@ -0,0 +1,376 @@
+/**
+ * The task board's external provider extension contract.
+ *
+ * This module is the single source of truth for how another plugin adds a
+ * provider surface to the task board: the cordis service name both halves
+ * publish, the API version they negotiate, the child seats a provider renders
+ * into, the host capability face a provider implements against, and the client
+ * capability face the board's browser half provides. It is framework-free and
+ * shared by the host and browser programs; the only imported SDK type is
+ * type-only, so the browser bundle never pulls a value out of an SDK package.
+ *
+ * @module dsh-task-board/core/extension
+ */
+import type { ToolDefinition } from '@deepseek-ai/dsh-tools'
+import type { ExecutionOutcome, TaskRecord, TaskStatus } from './tasks.ts'
+
+/** Cordis service name the host and browser halves each publish. */
+export const TASK_BOARD_SERVICE_NAME = 'taskBoard'
+
+/**
+ * Contract version of {@link TASK_BOARD_SERVICE_NAME}. A provider declares the
+ * version it was built against; the board refuses (visibly) any other version
+ * instead of guessing at a stale shape.
+ */
+export const TASK_BOARD_API_VERSION = 1
+
+/** Child seat a provider registers its task-detail section into. */
+export const TASK_BOARD_DETAIL_SECTION = 'task-board.detail.section'
+/** Child seat a provider registers its settings section into. */
+export const TASK_BOARD_SETTINGS_SECTION = 'task-board.settings.section'
+/** Child seat a provider registers its card decoration into. */
+export const TASK_BOARD_CARD_DECORATION = 'task-board.card.decoration'
+
+/** Every child seat the board declares for extensions, in render order. */
+export const TASK_BOARD_EXTENSION_SEATS: readonly string[] = [
+  TASK_BOARD_DETAIL_SECTION,
+  TASK_BOARD_SETTINGS_SECTION,
+  TASK_BOARD_CARD_DECORATION,
+]
+
+/**
+ * Largest accepted extension payload, in bytes of its JSON serialization. One
+ * integration entry — and one action payload — may carry schema the board does
+ * not interpret, but never enough of it to bloat the ledger or the action
+ * channel.
+ */
+export const TASK_BOARD_PAYLOAD_LIMIT_BYTES = 64 * 1024
+
+/** Depth beyond which a payload is refused instead of walked. */
+const PAYLOAD_DEPTH_LIMIT = 64
+
+/** One opaque provider payload the board stores and forwards without interpreting. */
+export type TaskBoardExtensionPayload = Record<string, unknown>
+
+/** Whether a value is a plain JSON value (no undefined, function, symbol, bigint or cycle). */
+function isJsonValue(value: unknown, depth: number): boolean {
+  if (depth > PAYLOAD_DEPTH_LIMIT) return false
+  if (value === null) return true
+  switch (typeof value) {
+    case 'string':
+    case 'boolean':
+      return true
+    case 'number':
+      return Number.isFinite(value)
+    // A provider's in-memory metadata legitimately clears a field by setting it
+    // to undefined; JSON serialization drops such a key, so the persisted
+    // payload is still pure JSON.
+    case 'undefined':
+      return true
+    case 'object':
+      break
+    default:
+      return false
+  }
+  if (Array.isArray(value)) return value.every(item => isJsonValue(item, depth + 1))
+  const prototype = Object.getPrototypeOf(value)
+  if (prototype !== Object.prototype && prototype !== null) return false
+  return Object.values(value as Record<string, unknown>).every(item => isJsonValue(item, depth + 1))
+}
+
+/**
+ * Validate one extension payload: a pure JSON object whose serialization fits
+ * {@link TASK_BOARD_PAYLOAD_LIMIT_BYTES}. Arrays, primitives and non-plain
+ * objects are refused; the board never interprets the keys.
+ * @param value - candidate payload.
+ * @returns whether the value is an acceptable opaque payload.
+ */
+export function isTaskBoardExtensionPayload(value: unknown): value is TaskBoardExtensionPayload {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false
+  if (!isJsonValue(value, 0)) return false
+  try {
+    return new TextEncoder().encode(JSON.stringify(value)).length <= TASK_BOARD_PAYLOAD_LIMIT_BYTES
+  } catch {
+    return false
+  }
+}
+
+/** Byte length of a value's JSON serialization, or undefined when it does not serialize. */
+export function taskBoardPayloadBytes(value: unknown): number | undefined {
+  try {
+    return new TextEncoder().encode(JSON.stringify(value)).length
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Normalize a task's whole integrations container: a plain JSON object whose
+ * values are each an opaque provider payload within the size limit. A malformed
+ * container normalizes to undefined (the field is dropped), and one malformed
+ * entry is dropped alone so a single bad provider can never take a card — or
+ * another provider's data — with it.
+ * @param value - candidate container from the wire, the ledger, or a create input.
+ * @returns the cleaned container, or undefined when nothing usable remains.
+ */
+export function normalizeTaskIntegrations(value: unknown): Record<string, TaskBoardExtensionPayload> | undefined {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) return undefined
+  const prototype = Object.getPrototypeOf(value)
+  if (prototype !== Object.prototype && prototype !== null) return undefined
+  const result: Record<string, TaskBoardExtensionPayload> = {}
+  for (const [key, entry] of Object.entries(value as Record<string, unknown>)) {
+    if (key === '') continue
+    if (!isTaskBoardExtensionPayload(entry)) continue
+    result[key] = entry
+  }
+  return Object.keys(result).length === 0 ? undefined : result
+}
+
+/** One action a provider dispatches over the board's same-origin channel. */
+export interface TaskBoardExtensionActionRequest {
+  /** Id of the extension the action belongs to. */
+  extensionId: string
+  /** Provider-owned action name, routed back to that extension's handleAction. */
+  action: string
+  /** Task the action targets, when it targets one. */
+  taskId?: string
+  /** Opaque provider payload, bounded like every other extension payload. */
+  payload?: TaskBoardExtensionPayload
+}
+
+/**
+ * Deliver one extension action through the board's same-origin action channel.
+ * The extension never opens an HTTP surface of its own.
+ */
+export type TaskBoardExtensionDispatch = (request: TaskBoardExtensionActionRequest) => Promise<boolean>
+
+/** Draft one provider creates a task from. */
+export interface TaskBoardTaskDraft {
+  title: string
+  description: string
+  prompt: string
+  /** Column the created card opens in; absent means the board default (todo). */
+  status?: TaskStatus
+  /** Parent card id, when the provider materializes a subtask. */
+  parentId?: string
+  /**
+   * Workspace the execution must run in. Absent leaves the board's own
+   * inheritance rules in charge (the creating session's workspace for a root
+   * card, else the recent workspace at execution time), so a provider that has
+   * no reason to know better pins nothing.
+   */
+  workspaceId?: string
+}
+
+/** Options of {@link TaskBoardTasksFace.create}. */
+export interface TaskBoardCreateOptions {
+  /** Opaque payload stored under the creating extension's id. */
+  payload?: TaskBoardExtensionPayload
+  /** Create the card off-board: it exists in the ledger but is never shown on the board. */
+  hidden?: boolean
+}
+
+/** One task linked to an extension, with that extension's own payload. */
+export interface TaskBoardLinkedTask {
+  task: TaskRecord
+  payload: TaskBoardExtensionPayload
+}
+
+/** Task reads and writes the board grants an extension. */
+export interface TaskBoardTasksFace {
+  /** Every task in the ledger, most recent mutation last. */
+  list(): readonly TaskRecord[]
+  /** One task by id, or undefined. */
+  get(taskId: string): TaskRecord | undefined
+  /**
+   * Create a task through the board's own creation gate; the payload lands
+   * under the creating extension's id. Throws on a refused draft.
+   */
+  create(draft: TaskBoardTaskDraft, options?: TaskBoardCreateOptions): TaskRecord
+  /**
+   * Patch a task's content. Reuses the board's own content gate: a task that
+   * has started executing keeps its recorded title/description/prompt.
+   * Throws when the card is frozen.
+   */
+  patchContent(taskId: string, patch: { title?: string; description?: string; prompt?: string }): void
+  /**
+   * Move a task through the board's existing status gates (running lock,
+   * permission confirmation gate). Throws on refusal.
+   */
+  setStatus(taskId: string, status: TaskStatus, initiator?: string): void
+  /** Every task carrying this extension's payload. */
+  linked(): readonly TaskBoardLinkedTask[]
+}
+
+/** Storage face for one extension's own payload on a task. */
+export interface TaskBoardIntegrationFace {
+  /** Read this extension's payload, or undefined when the task carries none. */
+  read(taskId: string): TaskBoardExtensionPayload | undefined
+  /**
+   * Shallow-merge this extension's payload into the task: the given keys
+   * replace the stored ones, and a key explicitly set to undefined clears it.
+   * The board stores the result opaquely; a non-JSON or oversized payload is
+   * refused.
+   */
+  write(taskId: string, payload: TaskBoardExtensionPayload): void
+}
+
+/** Status-change notification. */
+export interface TaskBoardStatusChangedEvent {
+  taskId: string
+  status: TaskStatus
+  previous: TaskStatus
+  initiator?: string
+}
+
+/** Execution-settlement notification. */
+export interface TaskBoardExecutionSettledEvent {
+  taskId: string
+  executionId: string
+  outcome: ExecutionOutcome
+  error?: string
+}
+
+/** Task-deletion notification. */
+export interface TaskBoardTaskDeletedEvent {
+  taskId: string
+}
+
+/**
+ * Event subscriptions an extension registers for. Every callback runs isolated:
+ * a throw is logged and never interrupts the board's own execution path.
+ */
+export interface TaskBoardEventFace {
+  onStatusChanged(callback: (event: TaskBoardStatusChangedEvent) => void): () => void
+  onExecutionSettled(callback: (event: TaskBoardExecutionSettledEvent) => void): () => void
+  onTaskDeleted(callback: (event: TaskBoardTaskDeletedEvent) => void): () => void
+}
+
+/**
+ * Host capability face handed to one extension while it is started. The face
+ * lives for the extension's enabled lifetime; the board revokes it by calling
+ * the extension's stop().
+ */
+export interface TaskBoardExtensionHost {
+  tasks: TaskBoardTasksFace
+  integration: TaskBoardIntegrationFace
+  events: TaskBoardEventFace
+  /**
+   * Publish this extension's read-only summary; it lands in the snapshot's
+   * extensions[id] for the extension's browser half to render.
+   */
+  publish(summary: TaskBoardExtensionPayload): void
+  /** Register one model-visible tool; the returned disposer unregisters it. */
+  registerTool(definition: ToolDefinition): () => void
+}
+
+/** One external provider contributed to the task board. */
+export interface TaskBoardExtension {
+  /** Stable extension id; also the key of this extension's integration payload. */
+  readonly id: string
+  /** Contract version this extension was built against. */
+  readonly apiVersion: number
+  /** Volatile per-extension switch; absent means enabled. Read at use time. */
+  enabled?(): boolean
+  /** Acquire the capability face and start any provider-side work. */
+  start?(host: TaskBoardExtensionHost): void
+  /** Release provider-side work. Never clears stored data. */
+  stop?(): void
+  /** Route one dispatched action; the returned value goes back to the dispatcher. */
+  handleAction?(request: TaskBoardExtensionActionRequest): unknown | Promise<unknown>
+}
+
+/** Board mirror an extension's browser half observes. */
+export interface TaskBoardClientMirror {
+  /** Whether the board's master switch currently runs the extension faces. */
+  enabled: boolean
+  /** Tasks the board currently holds. */
+  tasks: readonly TaskRecord[]
+  /** Published extension summaries, keyed by extension id (opaque to the board). */
+  extensions: Readonly<Record<string, unknown>>
+}
+
+/** Whether a task should be shown on the board; false hides it. */
+export type TaskBoardVisibilityPredicate = (task: TaskRecord) => boolean
+
+/**
+ * Client capability face the board's browser half provides. A provider's
+ * browser half resolves it from the shared cordis service name; it never
+ * value-imports the board package.
+ */
+export interface TaskBoardClientFace {
+  /** Deliver one action through the board's same-origin action channel. */
+  dispatch(request: TaskBoardExtensionActionRequest): Promise<boolean>
+  /** Register one card visibility predicate; the returned disposer removes it. */
+  registerVisibility(predicate: TaskBoardVisibilityPredicate): () => void
+  /** Subscribe to the board mirror. */
+  subscribe(callback: (mirror: TaskBoardClientMirror) => void): () => void
+  /** Read the current board mirror. */
+  snapshot(): TaskBoardClientMirror
+}
+
+/** Owner props of the task-detail seat. */
+export interface TaskBoardDetailSectionProps {
+  task: TaskRecord
+  dispatch: TaskBoardExtensionDispatch
+}
+
+/** Owner props of the settings seat. */
+export interface TaskBoardSettingsSectionProps {
+  dispatch: TaskBoardExtensionDispatch
+}
+
+/** Owner props of the card-decoration seat. */
+export interface TaskBoardCardDecorationProps {
+  task: TaskRecord
+}
+
+/**
+ * Host-half service face published under {@link TASK_BOARD_SERVICE_NAME}. A
+ * provider package's host half resolves this from the shared cordis service
+ * and registers its extension; the board's ledger never crosses this boundary.
+ */
+export interface TaskBoardHostFace {
+  /**
+   * Admit one provider extension. Idempotent by extension id; the returned
+   * disposer releases it without clearing stored data.
+   */
+  registerExtension(extension: TaskBoardExtension): () => void
+  /** Whether the board currently runs a given extension (board x extension). */
+  isExtensionEnabled(extensionId: string): boolean
+}
+
+declare module '@deepseek-ai/cordis' {
+  interface Context {
+    /**
+     * The board's extension service. The host half publishes
+     * {@link TaskBoardHostFace}; the browser half publishes
+     * {@link TaskBoardClientFace} under the same name. The two halves never run
+     * in one process, so the browser half resolves its face through
+     * {@link resolveTaskBoardClientFace} and this shared declaration names the
+     * host face that registration-side consumers type against.
+     */
+    taskBoard: TaskBoardHostFace
+  }
+}
+
+/** The narrow context seat {@link resolveTaskBoardClientFace} needs. */
+export interface TaskBoardClientContextSeat {
+  get(name: string): unknown
+}
+
+/**
+ * Resolve the browser half's client capability face by service name. Returns
+ * undefined when the board is not loaded or the service is not served, so a
+ * provider's browser half can degrade instead of throwing.
+ * @param ctx - client context.
+ * @returns the client face, or undefined.
+ */
+export function resolveTaskBoardClientFace(ctx: TaskBoardClientContextSeat): TaskBoardClientFace | undefined {
+  try {
+    const face = ctx.get(TASK_BOARD_SERVICE_NAME) as TaskBoardClientFace | undefined
+    return face !== undefined && typeof (face as { dispatch?: unknown }).dispatch === 'function' ? face : undefined
+  } catch {
+    return undefined
+  }
+}

package/src/core/freeze-snapshot.ts

@@ -48,8 +48,8 @@ const SECTION_NAMES: Record<SectionKey, string> = {
 /**
  * Sensitive patterns, each matched globally over every field body:
  * PEM private key blocks (whole block collapses to one marker), Bearer
- * credentials, OpenAI sk-, GitHub ghp_, GitLab glpat-, Slack xox* tokens,
- * and AWS access key ids.
+ * credentials, OpenAI sk-, `ghp_`-shaped provider tokens, GitLab glpat-,
+ * Slack xox* tokens, and AWS access key ids.
  */
 const SENSITIVE_PATTERNS: RegExp[] = [
   /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,