@linxin666/dsh-client-ui-task-board 0.4.4 → 0.4.5

package/src/core/handover.ts

@@ -40,7 +40,11 @@ export const HANDOVER_MAX_TOTAL_BYTES = 8 * 1024
 /** Per target-id (workspace/preset) byte cap. */
 export const HANDOVER_MAX_TARGET_BYTES = 256
 
-/** The board's notion of the deployment session-default permission (fail-safe default). */
+/**
+ * Fail-safe baseline for the confirmation gate: what it falls back to when the
+ * deployment pins no baseline of its own and the Host's default permission
+ * preset cannot be read. Every elevation above it stays gated.
+ */
 export const DEFAULT_SESSION_PERMISSION: TaskPermission = 'read-only'
 
 /** Permission elevation rank (higher = more authority). */
@@ -105,6 +109,17 @@ export function exceedsSessionDefault(permission: TaskPermission | undefined, se
   return (PERMISSION_RANK.get(permission) ?? -1) > (PERMISSION_RANK.get(sessionDefault) ?? -1)
 }
 
+/**
+ * Whether a session running at `holder` already carries `permission`: the
+ * permission is absent, or its rank does not exceed the holder's. A teammate
+ * inherits the Lead session's permission and cannot be narrowed below it, so a
+ * subtask's own pin is carried by a team run exactly when this holds, and a pin
+ * it does not carry would be silently dropped instead.
+ */
+export function permissionCarriedBy(holder: TaskPermission, permission: TaskPermission | undefined): boolean {
+  return !exceedsSessionDefault(permission, holder)
+}
+
 /**
  * The confirmation-gate predicate: an elevated permission without a human
  * confirmation stamp. Manual run/rerun and cron must refuse such a card.

package/src/core/issue-form.ts

@@ -0,0 +1,19 @@
+/**
+ * Issue-form vocabulary the card excerpt recognizes.
+ *
+ * Issue forms from an issue tracker (and the zh templates this family's repositories use)
+ * write the same section headings and empty-field placeholders on every issue.
+ * The patterns are data about those forms, not UI copy, so they live in the
+ * shared core rather than in a locale dictionary; the browser half imports them.
+ *
+ * @module @linxin666/dsh-client-ui-task-board/core/issue-form
+ */
+
+/** Section headings whose body is the issue's own summary (zh and en forms). */
+export const SUMMARY_HEADING = /^(?:摘要|概要|概述|简介|描述|问题描述|问题|现象|summary|description|overview|problem|what happened)$/i
+
+/** Values an issue form writes for an empty field. */
+export const EMPTY_FIELD = /^(?:_?no response_?|n\/a|none|无|暂无)$/i
+
+/** A trailing colon (ASCII or full-width) after a heading. */
+export const HEADING_COLON = /[:\uFF1A]\s*$/

package/src/core/store.ts

@@ -15,6 +15,8 @@ import { isExecutionOutcome } from './subtask.ts'
 import type { TaskHandover } from './handover.ts'
 import { sanitizeFreezeSnapshot } from './freeze-snapshot.ts'
 import { sanitizeHandover } from './handover.ts'
+import { normalizeTaskIntegrations } from './extension.ts'
+import { normalizeVerification } from './verification.ts'
 
 /** Persistence seam for the task ledger. */
 export interface TaskStore {
@@ -67,8 +69,11 @@ function isTaskRecordShape(value: unknown): value is Omit<TaskRecord, 'status'>
   if (record.workspaceId !== undefined && typeof record.workspaceId !== 'string') return false
   if (record.mode !== undefined && typeof record.mode !== 'string') return false
   if (record.permission !== undefined && typeof record.permission !== 'string') return false
+  if (record.integrations !== undefined && (typeof record.integrations !== 'object' || record.integrations === null || Array.isArray(record.integrations))) return false
+  if (record.hidden !== undefined && typeof record.hidden !== 'boolean') return false
   if (record.reuseSession !== undefined && typeof record.reuseSession !== 'boolean') return false
   if (record.goalRun !== undefined && typeof record.goalRun !== 'boolean') return false
+  if (record.skipVerification !== undefined && typeof record.skipVerification !== 'boolean') return false
   if (!Array.isArray(record.executions)) return false
   for (const execution of record.executions) {
     if (typeof execution !== 'object' || execution === null) return false
@@ -82,6 +87,9 @@ function isTaskRecordShape(value: unknown): value is Omit<TaskRecord, 'status'>
     if (entry.initiatedBy !== undefined && typeof entry.initiatedBy !== 'string') return false
     if (entry.frozenBy !== undefined && typeof entry.frozenBy !== 'string') return false
     if (entry.frozenAt !== undefined && typeof entry.frozenAt !== 'number') return false
+    // The acceptance block is repaired like every other optional field: an
+    // unusable one is dropped, which can only make the board MORE strict.
+    if (entry.verification !== undefined && normalizeVerification(entry.verification) === undefined) return false
   }
   return true
 }
@@ -199,6 +207,9 @@ export function parseLedger(raw: string | null): TaskRecord[] {
       runGroupId: normalizeTargetId(execution.runGroupId),
       ownResult: isExecutionOutcome(execution.ownResult) ? execution.ownResult : undefined,
       ownError: typeof execution.ownError === 'string' ? execution.ownError : undefined,
+      // A malformed acceptance block is dropped rather than dropping the
+      // execution record: the board then treats that run as unverified.
+      verification: normalizeVerification(execution.verification),
     }))
     // Execution targets are normalized like the schedule: blank strings
     // clear the pin and unknown permission strings from a future version
@@ -211,6 +222,9 @@ export function parseLedger(raw: string | null): TaskRecord[] {
     // The goal opt-in is stored only when it is OFF: absent means the default
     // (start each run with /goal), so a hand-edited true normalizes back to it.
     task.goalRun = row.goalRun === false ? false : undefined
+    // The acceptance opt-out is stored only when it is ON: absent inherits the
+    // board-wide switch, so a hand-edited false normalizes back to inherit.
+    task.skipVerification = row.skipVerification === true ? true : undefined
     task.freeze = normalizeFreeze(row.freeze)
     task.handover = normalizeHandover(row.handover)
     // Tags are repaired field by field like the schedule: a malformed entry is
@@ -218,6 +232,8 @@ export function parseLedger(raw: string | null): TaskRecord[] {
     // dropping the task row.
     task.tags = normalizeTags(row.tags)
     task.permissionConfirmedAt = typeof row.permissionConfirmedAt === 'number' && Number.isFinite(row.permissionConfirmedAt) ? row.permissionConfirmedAt : undefined
+    task.integrations = normalizeTaskIntegrations(row.integrations)
+    task.hidden = row.hidden === true ? true : undefined
     tasks.push(task)
   }
   return tasks

package/src/core/tasks.ts

@@ -5,7 +5,9 @@
  * unit-testable in isolation.
  */
 import type { FreezeSnapshot } from './freeze-snapshot.ts'
+import type { ExecutionVerification } from './verification.ts'
 import type { TaskHandover, TaskHandoverInput } from './handover.ts'
+import { normalizeTaskIntegrations, type TaskBoardExtensionPayload } from './extension.ts'
 
 /** Task lifecycle status, one per kanban column. */
 export type TaskStatus = 'backlog' | 'todo' | 'running' | 'done' | 'failed'
@@ -55,6 +57,14 @@ export interface ExecutionRecord {
   ownResult?: ExecutionOutcome
   /** Human failure text that arrived with {@link ownResult}. */
   ownError?: string
+  /**
+   * Goal acceptance state of this execution (task-board goal verification).
+   * Fixed when the execution starts and never rewritten from later settings:
+   * the contract is frozen here, the attempts accrue here, and the settlement
+   * rule reads the pass record here. Absent on an execution that started
+   * before the feature existed, which keeps it on the historical verdict.
+   */
+  verification?: ExecutionVerification
 }
 
 /**
@@ -295,6 +305,20 @@ export interface TaskRecord {
    * turn. A session whose `/goal` command is refused still runs the prompt.
    */
   goalRun?: boolean
+  /**
+   * Run this task's goal executions WITHOUT the board's acceptance gate.
+   *
+   * Absent means INHERIT: the execution's applicability is decided by the
+   * board-wide `goalVerification` switch frozen at start, exactly as a card
+   * that never touched this option behaves. Only an explicit `true` opts the
+   * card out, and the execution records `applicability: 'disabled'` so the
+   * report says plainly that nothing certified this run.
+   *
+   * The opt-out is per execution, not per run: flipping it never rewrites the
+   * verdict rule of an execution already open, and a rerun or a scheduled
+   * occurrence reads the card's current value when it freezes its contract.
+   */
+  skipVerification?: boolean
   /**
    * Frozen context snapshot for a continuation card; absent on plain tasks.
    * Sanitized before it enters the ledger (redaction, slash-command taint,
@@ -326,6 +350,20 @@ export interface TaskRecord {
    * absent means on-board.
    */
   archivedAt?: number
+  /**
+   * Opaque external-provider metadata, keyed by extension id; optional and
+   * additive so existing tasks require no ledger migration. The board stores
+   * and forwards it without interpreting the keys — each provider owns the
+   * shape and validation of its own entry.
+   */
+  integrations?: Record<string, TaskBoardExtensionPayload>
+  /**
+   * Whether the card is held off the board: it exists in the ledger (and its
+   * execution history is intact) but no column ever renders it. Providers
+   * create hidden cards for work they materialize but do not want displayed;
+   * absent means on-board.
+   */
+  hidden?: boolean
 }
 
 /**
@@ -359,7 +397,7 @@ export interface NewTaskInput {
    * inherits the parent's unset execution targets.
    */
   parentId?: string
-  /** Workspace the execution must run in; empty/absent = the recent workspace. */
+  /** Workspace the execution must run in; empty/absent = the creating session's workspace for a root task, else the recent workspace at execution time. */
   workspaceId?: string
   /** Agent preset the execution session must be composed from; empty/absent = deployment default. */
   mode?: string
@@ -376,6 +414,11 @@ export interface NewTaskInput {
    * default (goal run); an explicit false requests a single plain turn.
    */
   goalRun?: boolean
+  /**
+   * Run this task's goal executions without the acceptance gate; absent
+   * inherits the board-wide `goalVerification` switch.
+   */
+  skipVerification?: boolean
   /**
    * Optional scheduled-run rule requested at creation time (the new-task
    * dialog): an enable flag, a 5-field cron expression, and the IANA zone its
@@ -398,6 +441,12 @@ export interface NewTaskInput {
    * ahead of the execution prompt; a bare name changes nothing at run time.
    */
   tags?: TaskTag[]
+  /** Opaque external-provider metadata keyed by extension id. */
+  integrations?: Record<string, TaskBoardExtensionPayload>
+  /** Column the created card opens in; absent means the board default (todo). */
+  status?: TaskStatus
+  /** Create the card off-board (held in the ledger, never rendered). */
+  hidden?: boolean
 }
 
 /** The five kanban columns, in display order. */
@@ -409,8 +458,20 @@ export const COLUMNS: readonly { status: TaskStatus; label: string }[] = [
   { status: 'failed', label: '已失败' },
 ]
 
-/** Statuses a user may move a card to manually (execution states are owned by the runner). */
-export const MANUAL_STATUSES: readonly TaskStatus[] = ['backlog', 'todo']
+/**
+ * Statuses a card may be moved to by hand: every column. The board UI and the
+ * agent tool surface share this one list, so no column can be manual on one
+ * surface and locked on the other.
+ *
+ * The column is a board statement, not a claim about a run. A hand-written
+ * `done`/`failed` declares that the work finished (or failed) outside a
+ * Host-run execution — human hands, an external system — and a hand-written
+ * `running` says the work is under way without a tracked session. None of them
+ * creates an {@link ExecutionRecord}, which is what keeps a declaration
+ * distinguishable from a recorded outcome in the card's execution history; the
+ * next settled run overwrites the column with the real one.
+ */
+export const MANUAL_STATUSES: readonly TaskStatus[] = ['backlog', 'todo', 'running', 'done', 'failed']
 
 /** Statuses the runner may move a card to from 'running'. */
 export const RUNNER_SETTLE_STATUSES: readonly TaskStatus[] = ['done', 'failed']
@@ -425,9 +486,35 @@ export function isTaskStatus(value: unknown): value is TaskStatus {
   return typeof value === 'string' && (ALL_STATUSES as readonly string[]).includes(value)
 }
 
-/** Whether a manual move target is allowed from the given status. */
+/**
+ * Whether the manual move `from` -> `to` is a legal *column* change: any
+ * column, and never the one the card already shows.
+ *
+ * Whether the card may be moved at all is a separate question. The lock an
+ * executing card carries belongs to its open execution, never to the column
+ * text, so it is {@link canMoveTask} — not this predicate — that expresses it.
+ */
 export function canMoveManually(from: TaskStatus, to: TaskStatus): boolean {
-  return from !== 'running' && (MANUAL_STATUSES as readonly TaskStatus[]).includes(to)
+  return from !== to && (MANUAL_STATUSES as readonly TaskStatus[]).includes(to)
+}
+
+/**
+ * Whether the board may move `task` to `to` by hand: the card is on-board,
+ * holds no open execution, and the target is a legal column change. The ledger,
+ * the detail view's status buttons and the board's drop handler all decide
+ * through this one predicate, so no two surfaces can disagree about a card.
+ */
+export function canMoveTask(task: TaskRecord, to: TaskStatus): boolean {
+  return task.archivedAt === undefined && !hasOpenExecution(task) && canMoveManually(task.status, to)
+}
+
+/**
+ * Whether the task still has an execution the runner has not settled. This —
+ * not the `running` column — is what "the runner owns this card" means: a card
+ * parked in `running` by hand has no session and stays fully movable.
+ */
+export function hasOpenExecution(task: TaskRecord): boolean {
+  return task.executions.some(execution => execution.endedAt === undefined)
 }
 
 /** Normalize one optional execution-target string: trim; blank collapses to undefined. */
@@ -457,13 +544,14 @@ export function freezeOf(
 /** Create a task from user input. */
 export function createTask(input: NewTaskInput, now: number, id: string): TaskRecord {
   const tags = normalizeTags(input.tags)
+  const integrations = normalizeTaskIntegrations(input.integrations)
   return {
     id,
     title: input.title.trim(),
     description: input.description.trim(),
     prompt: input.prompt.trim(),
     parentId: normalizeTargetId(input.parentId),
-    status: 'todo',
+    status: input.status ?? 'todo',
     createdAt: now,
     updatedAt: now,
     executions: [],
@@ -477,9 +565,15 @@ export function createTask(input: NewTaskInput, now: number, id: string): TaskRe
     // touched the option (and every card written before the field existed)
     // keeps starting its runs with /goal.
     goalRun: input.goalRun === false ? false : undefined,
+    // Default OFF: only an explicit true is stored, so a card that never
+    // touched the option inherits the board-wide acceptance switch exactly as
+    // every card written before the field existed does.
+    skipVerification: input.skipVerification === true ? true : undefined,
     ...(input.freeze === undefined ? {} : { freeze: freezeOf(input.freeze, now) }),
     ...(input.handover === undefined ? {} : { handover: { ...input.handover, bundledAt: now } }),
     ...(tags === undefined ? {} : { tags }),
+    ...(integrations === undefined ? {} : { integrations }),
+    ...(input.hidden === true ? { hidden: true } : {}),
   }
 }
 

package/src/core/use-cases/task-parent.ts

@@ -49,8 +49,9 @@ export function applySetParent(
   if (task.archivedAt !== undefined) return { tasks, applied: false, error: 'archived task is read-only' }
   // A task with an open execution may be a participant of a running cascade.
   // Moving it would break that group's parent walk and leave the parent card
-  // in the running column forever, so the link is frozen until it settles.
-  if (task.status === 'running' || task.executions.some(execution => execution.endedAt === undefined)) {
+  // in the running column forever, so the link is frozen until it settles. The
+  // lock is the open execution: a card parked in 'running' by hand links freely.
+  if (task.executions.some(execution => execution.endedAt === undefined)) {
     return { tasks, applied: false, error: 'running task cannot be re-parented' }
   }
   const check = checkParentLink(tasks, id, parentId, normalizeSubtaskDepth(maxSubtaskDepth))

package/src/core/use-cases/task-tag.ts

@@ -0,0 +1,110 @@
+/**
+ * Label-management use cases (issue: labels could not be cleaned up).
+ *
+ * A label lives on every task that carries it, so renaming or removing one is a
+ * ledger-wide edit, not a task edit: the board's label row is the union of the
+ * labels in use, and without these two transitions a label created by an
+ * afternoon experiment stayed on the board forever.
+ *
+ * Both transitions are pure ledger rewrites (no persistence, no notify — the
+ * controller and the Host ledger orchestrate those), and both are idempotent:
+ * a label that no task carries changes nothing and reports no error for the
+ * delete path (the desired end state already holds), while a rename from an
+ * unknown label is refused so a stale tab cannot silently do nothing.
+ *
+ * Renaming onto a name that is already in use MERGES the two: a task carrying
+ * both keeps the row it already had (with its execution hint) and loses the
+ * duplicate, which is the only reading that cannot lose a hint the user typed.
+ */
+
+import { TAG_NAME_MAX_LENGTH, collectKnownTags, normalizeTags, type TaskRecord, type TaskTag } from '../tasks.ts'
+
+/** Outcome of one ledger-wide label edit. */
+export interface TagEditResult {
+  /** The ledger after the edit, or the input unchanged when nothing applied. */
+  tasks: readonly TaskRecord[]
+  /** Whether any task actually changed (drives whether the caller persists). */
+  changed: boolean
+  /** Refusal reason; the ledger is unchanged when set. */
+  error?: string
+}
+
+/** Trim a label name the way creation does. */
+function normalizeName(value: string): string {
+  return value.trim()
+}
+
+/** Whether any task in the ledger carries this label. */
+function carries(tasks: readonly TaskRecord[], name: string): boolean {
+  return collectKnownTags(tasks).some(tag => tag.name === name)
+}
+
+/**
+ * Rename one label everywhere, merging into an existing label of the target
+ * name. Every touched task gets a fresh updatedAt; untouched tasks keep theirs.
+ * @param tasks - current ledger.
+ * @param from - the label to rename.
+ * @param to - the new name (an existing name merges the two labels).
+ * @param now - clock instant (ms epoch).
+ * @returns the rewritten ledger, or a refusal.
+ */
+export function applyRenameTag(
+  tasks: readonly TaskRecord[],
+  from: string,
+  to: string,
+  now: number,
+): TagEditResult {
+  const source = normalizeName(from)
+  const target = normalizeName(to)
+  if (source === '') return { tasks, changed: false, error: 'a label name is required' }
+  if (target === '') return { tasks, changed: false, error: 'a label name is required' }
+  if (target.length > TAG_NAME_MAX_LENGTH) return { tasks, changed: false, error: 'label name is too long' }
+  if (source === target) return { tasks, changed: false }
+  if (!carries(tasks, source)) return { tasks, changed: false, error: 'label not found' }
+  let changed = false
+  const next = tasks.map(task => {
+    const tags = task.tags
+    if (tags === undefined || !tags.some(tag => tag.name === source)) return task
+    changed = true
+    // A task that already carried BOTH names keeps the target's own row — the
+    // target is the label that survives, so its execution hint stays the one
+    // that applies. A task carrying only the source keeps that row's hint under
+    // the new name.
+    const hasTarget = tags.some(tag => tag.name === target)
+    const merged: TaskTag[] = []
+    for (const tag of tags) {
+      if (hasTarget && tag.name === source) continue
+      const name = tag.name === source ? target : tag.name
+      if (merged.some(entry => entry.name === name)) continue
+      merged.push(name === tag.name ? tag : { ...tag, name })
+    }
+    return { ...task, tags: normalizeTags(merged), updatedAt: now }
+  })
+  return { tasks: changed ? next : tasks, changed }
+}
+
+/**
+ * Remove one label from every task that carries it. Archived cards are included:
+ * the board's label row draws from the whole ledger, so a label left on an
+ * archived card would come straight back into the filter.
+ * @param tasks - current ledger.
+ * @param name - the label to remove.
+ * @param now - clock instant (ms epoch).
+ * @returns the rewritten ledger.
+ */
+export function applyDeleteTag(
+  tasks: readonly TaskRecord[],
+  name: string,
+  now: number,
+): TagEditResult {
+  const target = normalizeName(name)
+  if (target === '') return { tasks, changed: false, error: 'a label name is required' }
+  let changed = false
+  const next = tasks.map(task => {
+    const tags = task.tags
+    if (tags === undefined || !tags.some(tag => tag.name === target)) return task
+    changed = true
+    return { ...task, tags: normalizeTags(tags.filter(tag => tag.name !== target)), updatedAt: now }
+  })
+  return { tasks: changed ? next : tasks, changed }
+}

package/src/core/use-cases/task-update.ts

@@ -16,7 +16,7 @@ import type { TaskHandoverInput } from '../handover.ts'
  * Editable fields on a task (the update patch surface). `freeze` replaces the
  * continuation-card snapshot (restamping frozenAt); an explicit null clears it.
  */
-export type TaskUpdatePatch = Partial<Pick<TaskRecord, 'title' | 'description' | 'prompt' | 'workspaceId' | 'mode' | 'permission' | 'model' | 'reuseSession' | 'teamRun' | 'goalRun'>> & {
+export type TaskUpdatePatch = Partial<Pick<TaskRecord, 'title' | 'description' | 'prompt' | 'workspaceId' | 'mode' | 'permission' | 'model' | 'reuseSession' | 'teamRun' | 'goalRun' | 'skipVerification'>> & {
   freeze?: FreezeSnapshot & { redacted?: boolean } | null
   /** Replaces the handover bundle (restamping bundledAt); an explicit null clears it. */
   handover?: TaskHandoverInput | null
@@ -43,11 +43,13 @@ export function hasContentPatch(patch: TaskUpdatePatch): boolean {
 
 /**
  * Whether a task's content may still be edited: the task must be on-board
- * (not archived) and must never have started executing. Fail-closed: a
- * running, settled, or cancelled-before-launch task keeps its content fixed.
+ * (not archived) and must never have started executing. Fail-closed: a task
+ * with any execution record — running, settled, or cancelled before launch —
+ * keeps its content fixed. The run, not the column, is the trigger: a card
+ * parked in 'running' by hand has nothing recorded yet and stays editable.
  */
 export function canEditTaskContent(task: TaskRecord): boolean {
-  return task.archivedAt === undefined && task.status !== 'running' && task.executions.length === 0
+  return task.archivedAt === undefined && task.executions.length === 0
 }
 
 /** Keep an unknown permission string from entering the ledger. */
@@ -111,6 +113,10 @@ export function applyUpdateTask(
     // The /goal opt-in is default-ON: true (or an explicit null) returns the
     // card to the default and stores nothing, only false pins a plain turn.
     if ('goalRun' in patch) next.goalRun = patch.goalRun === false ? false : undefined
+    // The acceptance opt-out is the mirror image: default OFF, so only true
+    // pins a card out of the gate; false (or an explicit null) returns it to
+    // inheriting the board-wide switch and stores nothing.
+    if ('skipVerification' in patch) next.skipVerification = patch.skipVerification === true ? true : undefined
     if (workspaceId !== undefined || 'workspaceId' in patch) next.workspaceId = workspaceId
     if (mode !== undefined || 'mode' in patch) next.mode = mode
     if (permission !== undefined || 'permission' in patch) next.permission = permission