@linxin666/dsh-client-ui-task-board 0.4.4 → 0.4.5

package/src/index.ts

@@ -19,15 +19,20 @@ import type { ToolDefinition } from '@deepseek-ai/dsh-tools'
 import type { LlmRuntime } from '@deepseek-ai/dsh-llm'
 import { TaskBoardHostService, type HostTimerFace, type TaskBoardTeamDispatcher } from './host-service.ts'
 import { parseTaskDraft, TaskParseError } from './host-ai.ts'
-import { TASK_PERMISSIONS, type TaskPermission } from './core/tasks.ts'
+import { TASK_PERMISSIONS, isTaskPermission, type TaskPermission } from './core/tasks.ts'
 import { DEFAULT_SUBTASK_DEPTH, SUBTASK_DEPTH_MAX, SUBTASK_DEPTH_MIN } from './core/subtask.ts'
 import { DEFAULT_SESSION_PERMISSION } from './core/handover.ts'
-import { buildTaskBoardTools } from './host/agent-tools.ts'
+import { buildTaskBoardTools, TASK_BOARD_TOOL_NAMES } from './host/agent-tools.ts'
+import { PLUGIN_TOOL_SECTION_ORDERS, visibleToolText } from './tool-surface.ts'
 import { makeTaskBoardRoutes } from './host-routes.ts'
+import { TASK_BOARD_SERVICE_NAME, type TaskBoardExtension } from './core/extension.ts'
 import { mountOnce } from './mount-once.ts'
+import { createGoalVerificationGate, type GoalFace } from './host/verification-gate.ts'
+import { normalizeCatalog, type ModelCatalogView, type VerificationSettings } from './core/verification.ts'
+import { probeWorkspaceChanges } from './host/workspace-evidence.ts'
 
-/** Order of the announcement section within the tool-guidance band. */
-const SECTION_ORDER = 200
+/** Order of the announcement section within the shared tool-guidance band. */
+const SECTION_ORDER = PLUGIN_TOOL_SECTION_ORDERS['task-board']
 
 /** Default environment variable holding the authenticated proxy token. */
 export const DEFAULT_PROXY_TOKEN_ENV = 'DSH_TASK_BOARD_PROXY_TOKEN'
@@ -68,9 +73,12 @@ export interface Config {
   /** Environment variable whose value the authenticated proxy injects upstream. */
   proxyTokenEnv?: string
   /**
-   * The deployment's session-default permission. A card whose effective
-   * permission (handover bundle or pin) is above this value requires a human
-   * confirmation before it may run; cron refuses unconfirmed cards.
+   * An explicit baseline for the permission confirmation gate. Left unset, the
+   * board follows the Host's own default permission preset — the value new DSH
+   * sessions start at — and falls back to `read-only` when the deployment
+   * serves no permission catalog. A card whose effective permission (handover
+   * bundle or pin) is above the baseline requires a human confirmation before
+   * it may run; cron refuses unconfirmed cards.
    */
   sessionDefaultPermission?: TaskPermission
   /**
@@ -86,6 +94,31 @@ export interface Config {
    * only team-mode runs use it.
    */
   teamProvider?: string
+  /**
+   * Goal acceptance for executions this board starts (default ON). When on,
+   * update_goal(action: complete) inside a task execution is refused until an
+   * acceptance pass is recorded for that execution: the three coding criteria,
+   * a 0.65 threshold, two rounds per criterion with the A/B slots swapped, and
+   * at most two acceptances per execution — the first failure returns its
+   * findings to the fixing agent, the second ends the cycle. The switch only
+   * affects goal-form executions of the board; plain chat and a task pinned to
+   * goalRun: false are untouched. When a separate third-party verifier also
+   * runs its own automatic acceptance, both judges score independently: this
+   * one gates completion, the other only steers, and no public interface lets
+   * the two share a verdict.
+   */
+  goalVerification?: Volatile<boolean>
+  /**
+   * Judge model for goal acceptance as provider/model. Blank inherits the HOST's
+   * own model catalog default — never the card's pinned execution model.
+   */
+  goalVerificationModel?: Volatile<string>
+  /**
+   * Reasoning effort for the judge. Blank inherits the host default level; an
+   * effort the resolved model does not declare is dropped instead of being
+   * sent, and the fallback to the model's own default is reported.
+   */
+  goalVerificationReasoningEffort?: Volatile<string>
 }
 
 /**
@@ -95,22 +128,57 @@ export interface Config {
 export const DEFAULT_TEAM_PROVIDER = 'spawn'
 
 /**
- * The schema is left to inference rather than annotated with `z<Config>`: a
- * volatile field's parsed output is a `Volatile` reference while its accepted
- * input stays the plain value, so the two sides no longer share one shape and
- * the annotation would reject the schema the Host must be given.
+ * Profile-patch shape of {@link Config}: what the Host validates the row's
+ * config against, before the schema turns volatile fields into live references
+ * and applies defaults. Declared separately because the two sides no longer
+ * share one shape, so the schema is annotated `z<ConfigInput, Config>` — the
+ * same split `dsh-git-graph` uses. The annotation is also what keeps the
+ * emitted declaration portable: an unannotated schema holding a nested object
+ * array infers a type that cannot be named without reaching into a transitive
+ * dependency's own types.
  */
-export const Config = z.object({
+export interface ConfigInput {
+  /** Announce the board in the system prompt. */
+  announceToAgent?: boolean
+  /** Master switch for the plugin. */
+  enabled?: boolean
+  /** Prevent idle system sleep while sessions run or schedules are armed. */
+  preventIdleSleep?: boolean
+  /** Canonical reverse-proxy Host authorities. */
+  trustedProxyHosts?: string[]
+  /** Environment variable whose value the authenticated proxy injects. */
+  proxyTokenEnv?: string
+  /** Explicit baseline for the permission confirmation gate; unset follows the Host default. */
+  sessionDefaultPermission?: TaskPermission
+  /** Subtask depth limit, 1..3. */
+  maxSubtaskDepth?: number
+  /** Continuable-subagent provider the Agent Teams service composes a teammate from. */
+  teamProvider?: string
+  /** Goal acceptance switch. */
+  goalVerification?: boolean
+  /** Judge model route for goal acceptance; blank inherits the host default. */
+  goalVerificationModel?: string
+  /** Judge reasoning effort; blank inherits the host default. */
+  goalVerificationReasoningEffort?: string
+}
+
+export const Config: z<ConfigInput, Config> = z.object({
   announceToAgent: z.boolean().default(false).volatile(),
   enabled: z.boolean().default(true).volatile(),
   preventIdleSleep: z.boolean().default(false).volatile(),
   trustedProxyHosts: z.array(z.string()).default([]),
   proxyTokenEnv: z.string().min(1).default(DEFAULT_PROXY_TOKEN_ENV),
-  sessionDefaultPermission: z.union(TASK_PERMISSIONS).default(DEFAULT_SESSION_PERMISSION),
+  sessionDefaultPermission: z.union(TASK_PERMISSIONS),
   maxSubtaskDepth: z.number().min(SUBTASK_DEPTH_MIN).max(SUBTASK_DEPTH_MAX).default(DEFAULT_SUBTASK_DEPTH).volatile(),
   teamProvider: z.string().min(1).default(DEFAULT_TEAM_PROVIDER),
+  goalVerification: z.boolean().default(true).volatile(),
+  goalVerificationModel: z.string().default('').volatile(),
+  goalVerificationReasoningEffort: z.string().default('').volatile(),
 })
 
+/** Schema default for the goal-acceptance switch, re-read for hand-built contexts. */
+export const DEFAULT_GOAL_VERIFICATION = true
+
 declare module '@deepseek-ai/cordis' {
   interface Events {
     /**
@@ -160,6 +228,13 @@ export function resolveProxyAccess(config: Config | undefined, env: NodeJS.Proce
 /** The registry face the agent tools register into. */
 interface AgentToolRegistry {
   register(definition: ToolDefinition): () => void
+  /** Scoped lookup; present on the real registry, absent on a stub that only registers. */
+  get?(name: string, scope?: unknown): unknown
+}
+
+/** The lookup half of a resolved registry, when it exposes one. */
+function lookupOf(registry: AgentToolRegistry | undefined): { get: (name: string, scope?: unknown) => unknown } | undefined {
+  return registry !== undefined && typeof registry.get === 'function' ? { get: registry.get.bind(registry) } : undefined
 }
 
 /**
@@ -203,6 +278,33 @@ export function resolveHostTimers(ctx: Context): HostTimerFace | undefined {
 /** Schema default, re-read for hand-built test contexts (the loader applies them normally). */
 const DEFAULT_ANNOUNCE = false
 
+/** The subset of the official permission-preset service the board reads. */
+interface PermissionPresetsFace {
+  catalog(): { defaultPreset?: unknown }
+}
+
+/**
+ * The Host's own default permission preset, mapped into the board's vocabulary.
+ *
+ * This is the value new DSH sessions start at (the deployment's `permission`
+ * settings row), so a board that follows it treats an ordinary card exactly as
+ * the Host would. Absent when the deployment serves no permission catalog, or
+ * its default is a current-session identity (`auto`) that names no fixed
+ * sandbox mode; the caller then keeps the fail-safe baseline.
+ * @param ctx - the plugin context.
+ * @returns the Host default as a board permission, or undefined when unreadable.
+ */
+export function resolveHostDefaultPermission(ctx: Context): TaskPermission | undefined {
+  try {
+    const presets = ctx.get('permissionPresets') as PermissionPresetsFace | undefined
+    if (presets === undefined || typeof presets.catalog !== 'function') return undefined
+    const preset = presets.catalog()?.defaultPreset
+    return isTaskPermission(preset) ? preset : undefined
+  } catch {
+    return undefined
+  }
+}
+
 /**
  * How long one teammate may take to reach its durable active or failed edge.
  * Agent Teams provisioning normally resolves in seconds; the bound exists so a
@@ -317,11 +419,35 @@ function applyImpl(ctx: Context, config?: Config): void {
   const preventIdleSleep = (): boolean => readConfigField(config?.preventIdleSleep, false)
   /** Current subtask depth limit (read live: the settings card edits it in place). */
   const maxSubtaskDepth = (): number => readConfigField(config?.maxSubtaskDepth, DEFAULT_SUBTASK_DEPTH)
+  /**
+   * The baseline the permission confirmation gate judges against: the row's own
+   * `sessionDefaultPermission` when the deployment pins one, otherwise the Host's
+   * default preset. Read per call through the ledger, so a Host Settings change
+   * reaches the running board without remounting the row; the fail-safe default
+   * still applies when no catalog is available.
+   */
+  const sessionDefaultPermission = (): TaskPermission =>
+    config?.sessionDefaultPermission ?? resolveHostDefaultPermission(ctx) ?? DEFAULT_SESSION_PERMISSION
 
+  /** Live acceptance settings the contract of each new execution freezes. */
+  const verificationSettings = (): VerificationSettings => ({
+    enabled: readConfigField(config?.goalVerification, DEFAULT_GOAL_VERIFICATION),
+    model: readConfigField(config?.goalVerificationModel, ''),
+    reasoningEffort: readConfigField(config?.goalVerificationReasoningEffort, ''),
+  })
+  // The catalog reader needs the service, and the service needs the reader;
+  // the reader only runs after start(), so a late holder is enough.
+  let hostForCatalog: TaskBoardHostService | undefined
+  const verificationCatalog = async (): Promise<ModelCatalogView | undefined> => {
+    const runner = hostForCatalog?.runner
+    return runner === undefined ? undefined : normalizeCatalog(await runner.modelCatalog())
+  }
   const host = new TaskBoardHostService(ctx.typertGateway, {
     workspaceRegistry: ctx.workspaceRegistry,
-    sessionDefaultPermission: config?.sessionDefaultPermission ?? DEFAULT_SESSION_PERMISSION,
+    sessionDefaultPermission,
     maxSubtaskDepth: maxSubtaskDepth(),
+    verificationSettings,
+    verificationCatalog,
     timers: resolveHostTimers(ctx),
     team: buildTeamDispatcher(ctx, config?.teamProvider ?? DEFAULT_TEAM_PROVIDER),
     commandDispatcher: {
@@ -332,22 +458,41 @@ function applyImpl(ctx: Context, config?: Config): void {
       },
     },
   })
+  hostForCatalog = host
   // Configuration before start(): a disabled row must not take the first
   // scheduler tick, which would roll schedules the board is not running.
   host.setConfiguration(enabled(), preventIdleSleep())
   host.start()
 
+  // External providers. The board publishes its registration service so any
+  // provider package can resolve it and admit itself; the board itself knows
+  // no provider vocabulary. A capture-only test context implements no service
+  // registry and the board still serves its own surfaces.
+  if (typeof (ctx as { provide?: unknown }).provide === 'function') {
+    ctx.provide(TASK_BOARD_SERVICE_NAME, {
+      registerExtension: (extension: TaskBoardExtension) => host.registerExtension(extension),
+      isExtensionEnabled: (extensionId: string) => host.extensions.isActive(extensionId),
+    })
+  }
+
   // Agent tools: the same Host ledger the browser drives, so any session can
   // list, create, link, run and settle board work. Registration follows the
   // master switch (a disabled board answers no tool call), and the mount
-  // effect below owns the disposers.
+  // effect below owns the disposers. Provider tools register through the
+  // extension registry, which follows the same gate and rebinds when the tool
+  // registry appears late.
   let disposeTools: (() => void) | undefined
   const setToolsEnabled = (active: boolean): void => {
     if (!active) {
+      // Releasing is the whole job on the way down. Rebinding the extension
+      // registry here would re-register every provider tool, and the teardown
+      // path runs this while the fiber is already unloading, so each of those
+      // re-registrations is a request the host can only refuse.
       disposeTools?.()
       disposeTools = undefined
       return
     }
+    host.extensions.setToolRegistry(() => resolveToolRegistry(ctx))
     if (disposeTools !== undefined) return
     const registry = resolveToolRegistry(ctx)
     if (registry === undefined) return
@@ -364,6 +509,9 @@ function applyImpl(ctx: Context, config?: Config): void {
   if (typeof scopedInject === 'function') {
     scopedInject.call(ctx, ['tools'], () => {
       setToolsEnabled(enabled())
+      // The extension registry follows the same rebinding: a registry that
+      // appears (or is replaced) after a provider started adopts its tools.
+      host.extensions.setToolRegistry(() => resolveToolRegistry(ctx))
       // Cordis unloads and re-runs this callback when the injected service's
       // provider fiber changes, and the old registry dies with its provider.
       // Releasing the guard here is what lets the callback register into the
@@ -378,6 +526,42 @@ function applyImpl(ctx: Context, config?: Config): void {
   ctx.effect(() => {
     const disposers: Array<() => void> = []
     try {
+      // The goal acceptance gate: the OFFICIAL tool pre-execution lifecycle,
+      // installed before the tool body runs, so a completion claim cannot take
+      // effect without a matching acceptance pass record.
+      const gate = createGoalVerificationGate({
+        ledger: host.ledger,
+        llm: () => resolveLlmRuntime(ctx),
+        goals: () => {
+          try {
+            return ctx.get('goals') as GoalFace | undefined
+          } catch {
+            return undefined
+          }
+        },
+        // The host's own observation of what a turn changed on disk, when this
+        // deployment records it; the acceptance degrades to the trajectory alone
+        // when it does not.
+        workspaceChanges: () => probeWorkspaceChanges(ctx),
+        logger: {
+          warn: (message: string, ...rest: unknown[]) => {
+            const logger = (ctx as { logger?: { warn?: (...args: unknown[]) => void } }).logger
+            if (typeof logger?.warn === 'function') logger.warn(message, ...rest)
+            else console.warn(message, ...rest)
+          },
+        },
+      })
+      // A capture-only context may implement no listener registry (it returns
+      // no disposer), so the handle is pushed only when it really is one.
+      const offGate = ctx.on('tools/pre-execute', async (exec, next) => {
+        const decision = await gate({ name: exec.name, arguments: exec.arguments, agent: exec.agent, signal: exec.signal })
+        return decision ?? next()
+      })
+      if (typeof offGate === 'function') disposers.push(offGate)
+      else if (typeof (offGate as { dispose?: unknown } | undefined)?.dispose === 'function') {
+        const handle = offGate as { dispose(): void }
+        disposers.push(() => { handle.dispose() })
+      }
       const routes = makeTaskBoardRoutes(host, resolveProxyAccess(config), {
         parseTask: async (request, signal) => {
           const llm = resolveLlmRuntime(ctx)
@@ -426,7 +610,11 @@ function applyImpl(ctx: Context, config?: Config): void {
     disposeSection = ctx.systemPrompt.section({
       name: 'plugin:task-board',
       order: SECTION_ORDER,
-      text: TASK_BOARD_GUIDANCE,
+      // The announcement names the task_board_* tools, so it renders only while
+      // at least one of them is reachable: a runtime that serves no tool
+      // registry, or a restriction that withholds them, must not leave guidance
+      // telling the model to call tools this session cannot see.
+      text: visibleToolText(lookupOf(resolveToolRegistry(ctx)), TASK_BOARD_TOOL_NAMES, TASK_BOARD_GUIDANCE),
     })
   }
 

package/src/protocol.ts

@@ -1,18 +1,33 @@
 import type { TaskUpdatePatch } from './core/use-cases/task-update.ts'
-import { isTaskPermission, isTaskStatus, isTaskTagList, type NewTaskInput, type TaskPermission, type TaskRecord, type TaskStatus } from './core/tasks.ts'
+import { TAG_NAME_MAX_LENGTH, isTaskPermission, isTaskStatus, isTaskTagList, type NewTaskInput, type TaskPermission, type TaskRecord, type TaskStatus } from './core/tasks.ts'
 import { parseLedger } from './core/store.ts'
 import { isValidTimeZone } from './core/schedule.ts'
 import { sanitizeFreezeSnapshot, type FreezeSnapshot } from './core/freeze-snapshot.ts'
 import { sanitizeHandover, type TaskHandoverInput } from './core/handover.ts'
+import { isTaskBoardExtensionPayload, normalizeTaskIntegrations, type TaskBoardExtensionPayload } from './core/extension.ts'
+import { normalizeVerification, type ModelCatalogView, type VerificationContract, type VerificationSettings } from './core/verification.ts'
 
 /** Freeze payload carried by create/update actions after the gate (redacted in place). */
 type FreezePayload = FreezeSnapshot & { redacted?: boolean; frozenBy?: string }
 
-export const TASK_BOARD_SCHEMA_VERSION = 4 as const
-/** Ledger documents written before v4; loaded once and migrated on startup. */
-export const TASK_BOARD_LEGACY_SCHEMA_VERSION = 3 as const
-/** Ledger documents written before v3; migrated through the v3 normalization too. */
-export const TASK_BOARD_OLDER_SCHEMA_VERSION = 2 as const
+export const TASK_BOARD_SCHEMA_VERSION = 5 as const
+/** Ledger documents written before v5; loaded once and migrated on startup. */
+export const TASK_BOARD_LEGACY_SCHEMA_VERSION = 4 as const
+/** Ledger documents written before v4; migrated through the v4 normalization too. */
+export const TASK_BOARD_OLDER_SCHEMA_VERSION = 3 as const
+/** Ledger documents written before v3; migrated through every later normalization too. */
+export const TASK_BOARD_OLDEST_SCHEMA_VERSION = 2 as const
+/**
+ * Every older generation the loader migrates in place. v5 only ADDS the
+ * per-execution acceptance block, so the migration is the normalization pass
+ * that re-validates each row; a document from any listed generation upgrades
+ * losslessly.
+ */
+export const TASK_BOARD_MIGRATABLE_SCHEMA_VERSIONS: readonly number[] = [
+  TASK_BOARD_LEGACY_SCHEMA_VERSION,
+  TASK_BOARD_OLDER_SCHEMA_VERSION,
+  TASK_BOARD_OLDEST_SCHEMA_VERSION,
+]
 export const TASK_BOARD_API_PREFIX = '/api/task-board'
 
 export type PowerPhase = 'disabled' | 'idle' | 'acquiring' | 'active' | 'error' | 'unsupported'
@@ -53,6 +68,25 @@ export interface TaskBoardSnapshot {
    * into team execution (Team Lead session plus one teammate per subtask).
    */
   teamRunAvailable?: boolean
+  /**
+   * Read-only summaries published by running extensions, keyed by extension id.
+   * The board forwards them verbatim; it never interprets their shape.
+   */
+  extensions?: Record<string, unknown>
+}
+
+/**
+ * Body of `GET {TASK_BOARD_API_PREFIX}/verification`: the acceptance settings the
+ * card edits, the contract they resolve to right now, and the host model catalog
+ * the model and reasoning choices come from. Served through the same loopback /
+ * authenticated-proxy guard as the rest of the board API, and it carries no
+ * credential material — model routes and level ids only.
+ */
+export interface TaskBoardVerificationOptions {
+  settings: VerificationSettings
+  /** The RESOLVED contract, so the card can show what the next execution freezes. */
+  contract: VerificationContract
+  catalog: ModelCatalogView
 }
 
 /** SSE event frame: revision/scheduler/power only, never the task list. */
@@ -110,6 +144,10 @@ export type TaskBoardAction =
   | { kind: 'rerun'; taskId: string }
   | { kind: 'confirm-permission'; taskId: string }
   | { kind: 'set-parent'; taskId: string; parentId: string | null }
+  /** Ledger-wide label management; see core/use-cases/task-tag.ts. */
+  | { kind: 'rename-tag'; from: string; to: string }
+  | { kind: 'delete-tag'; name: string }
+  | { kind: 'extension-action'; extensionId: string; action: string; taskId?: string; payload?: TaskBoardExtensionPayload }
 
 export interface TaskBoardActionEnvelope {
   requestId: string
@@ -154,6 +192,7 @@ function validImportedKnownFields(value: Record<string, unknown>): boolean {
   // must carry a well-formed list or none at all, so a hand-edited export
   // cannot smuggle a malformed tag past the gate.
   if (value.tags !== undefined && !isTaskTagList(value.tags)) return false
+  if (value.integrations !== undefined && normalizeTaskIntegrations(value.integrations) === undefined) return false
   if (value.schedule !== undefined) {
     const schedule = record(value.schedule)
     if (schedule === undefined || typeof schedule.enabled !== 'boolean' || typeof schedule.cron !== 'string') return false
@@ -172,6 +211,10 @@ function validImportedKnownFields(value: Record<string, unknown>): boolean {
       if (execution.initiatedBy !== undefined && typeof execution.initiatedBy !== 'string') return false
       if (execution.frozenBy !== undefined && typeof execution.frozenBy !== 'string') return false
       if (execution.frozenAt !== undefined && typeof execution.frozenAt !== 'number') return false
+      // A well-formed acceptance block may be imported for inspection, but the
+      // import path DROPS it (see importedTask): a fabricated pass record must
+      // never let an imported execution settle as verified.
+      if (execution.verification !== undefined && normalizeVerification(execution.verification) === undefined) return false
     }
   }
   return true
@@ -200,6 +243,8 @@ function importedTask(value: unknown): TaskRecord | undefined {
       ...(execution.initiatedBy === undefined ? {} : { initiatedBy: execution.initiatedBy }),
       ...(execution.frozenAt === undefined ? {} : { frozenAt: execution.frozenAt }),
       ...(execution.frozenBy === undefined ? {} : { frozenBy: execution.frozenBy }),
+      // 安全门（对抗场景 d）：验收报告是 Host 的判定，不接受 import 携带——
+      // 一条伪造的通过记录会让导入的执行被当成已验收。
     })),
     ...(task.schedule === undefined ? {} : {
       schedule: {
@@ -218,10 +263,16 @@ function importedTask(value: unknown): TaskRecord | undefined {
     ...(task.permission === undefined ? {} : { permission: task.permission }),
     ...(task.reuseSession === undefined ? {} : { reuseSession: task.reuseSession }),
     ...(task.goalRun === undefined ? {} : { goalRun: task.goalRun }),
+    // The per-card acceptance opt-out rides the import like the /goal opt-in:
+    // it is a user-chosen execution preference on their own board, not a
+    // verdict. The per-execution `verification` block is still stripped below, so
+    // no imported card can arrive already accepted.
+    ...(task.skipVerification === undefined ? {} : { skipVerification: task.skipVerification }),
     ...(task.archivedAt === undefined ? {} : { archivedAt: task.archivedAt }),
     ...(task.freeze === undefined ? {} : { freeze: task.freeze }),
     ...(task.handover === undefined ? {} : { handover: task.handover }),
     ...(task.tags === undefined ? {} : { tags: task.tags }),
+    ...(task.integrations === undefined ? {} : { integrations: task.integrations }),
     // 安全门（对抗场景 b）：import 不是人工确认动作，确认戳一律剥除——
     // 高于会话默认权限的绑定经 import 进入后必须重新武装 confirm-permission 门。
   }
@@ -255,15 +306,17 @@ function handoverPayload(value: unknown): TaskHandoverInput | undefined {
 
 function createInput(value: unknown): value is NewTaskInput {
   const input = record(value)
-  if (input === undefined || !exactKeys(input, ['title', 'description', 'prompt', 'parentId', 'workspaceId', 'mode', 'permission', 'schedule', 'freeze', 'handover', 'model', 'reuseSession', 'teamRun', 'goalRun', 'tags'])) return false
+  if (input === undefined || !exactKeys(input, ['title', 'description', 'prompt', 'parentId', 'workspaceId', 'mode', 'permission', 'schedule', 'freeze', 'handover', 'model', 'reuseSession', 'teamRun', 'goalRun', 'skipVerification', 'tags', 'integrations'])) return false
   if (input.parentId !== undefined && (typeof input.parentId !== 'string' || input.parentId.trim() === '')) return false
   if (typeof input.title !== 'string' || typeof input.description !== 'string' || typeof input.prompt !== 'string') return false
   if (!optionalString(input.workspaceId) || !optionalString(input.mode) || !optionalString(input.model)) return false
   if (input.reuseSession !== undefined && typeof input.reuseSession !== 'boolean') return false
   if (input.teamRun !== undefined && typeof input.teamRun !== 'boolean') return false
   if (input.goalRun !== undefined && typeof input.goalRun !== 'boolean') return false
+  if (input.skipVerification !== undefined && typeof input.skipVerification !== 'boolean') return false
   if (input.permission !== undefined && !isTaskPermission(input.permission)) return false
   if (input.tags !== undefined && !isTaskTagList(input.tags)) return false
+  if (input.integrations !== undefined && normalizeTaskIntegrations(input.integrations) === undefined) return false
   if (input.freeze !== undefined && freezePayload(input.freeze) === undefined) return false
   if (input.handover !== undefined && handoverPayload(input.handover) === undefined) return false
   if (input.schedule !== undefined) {
@@ -278,13 +331,16 @@ function createInput(value: unknown): value is NewTaskInput {
 
 function updatePatch(value: unknown): boolean {
   const patch = record(value)
-  if (patch === undefined || !exactKeys(patch, ['title', 'description', 'prompt', 'workspaceId', 'mode', 'permission', 'freeze', 'handover', 'model', 'reuseSession', 'teamRun', 'goalRun', 'tags'])) return false
+  if (patch === undefined || !exactKeys(patch, ['title', 'description', 'prompt', 'workspaceId', 'mode', 'permission', 'freeze', 'handover', 'model', 'reuseSession', 'teamRun', 'goalRun', 'skipVerification', 'tags'])) return false
   // null (or false) clears the reuse opt-in; only a real boolean is accepted.
   if (patch.reuseSession !== undefined && patch.reuseSession !== null && typeof patch.reuseSession !== 'boolean') return false
   if (patch.teamRun !== undefined && patch.teamRun !== null && typeof patch.teamRun !== 'boolean') return false
   // The goal opt-in is tri-state: null/true return the card to its default
   // (goal run), false pins a single plain turn.
   if (patch.goalRun !== undefined && patch.goalRun !== null && typeof patch.goalRun !== 'boolean') return false
+  // The acceptance opt-out is the mirror tri-state: null/false return the card
+  // to inheriting the board-wide switch, true pins it out of the gate.
+  if (patch.skipVerification !== undefined && patch.skipVerification !== null && typeof patch.skipVerification !== 'boolean') return false
   for (const key of ['title', 'description', 'prompt', 'workspaceId', 'mode', 'model'] as const) {
     if (!optionalString(patch[key])) return false
   }
@@ -297,6 +353,15 @@ function updatePatch(value: unknown): boolean {
   return patch.handover === undefined || patch.handover === null || handoverPayload(patch.handover) !== undefined
 }
 
+/**
+ * A label name on the wire: a non-empty trimmed string within the tag cap. The
+ * trim/merge/duplicate rules belong to the use case; this gate only keeps a
+ * malformed name off the ledger.
+ */
+function isTagName(value: unknown): value is string {
+  return typeof value === 'string' && value.trim() !== '' && value.trim().length <= TAG_NAME_MAX_LENGTH
+}
+
 function schedulePatch(value: unknown): boolean {
   const patch = record(value)
   return patch !== undefined
@@ -368,6 +433,16 @@ function parseEnvelopeAction(value: unknown): TaskBoardActionEnvelope | undefine
       if (parentId !== null && (typeof parentId !== 'string' || parentId.trim() === '')) return undefined
       return { requestId: envelope.requestId, action: { kind: 'set-parent', taskId, parentId } }
     }
+    case 'rename-tag': {
+      if (!exactKeys(action, ['kind', 'from', 'to'])) return undefined
+      if (!isTagName(action.from) || !isTagName(action.to)) return undefined
+      return { requestId: envelope.requestId, action: { kind: 'rename-tag', from: action.from, to: action.to } }
+    }
+    case 'delete-tag': {
+      if (!exactKeys(action, ['kind', 'name'])) return undefined
+      if (!isTagName(action.name)) return undefined
+      return { requestId: envelope.requestId, action: { kind: 'delete-tag', name: action.name } }
+    }
     case 'set-schedule':
       if (!exactKeys(action, ['kind', 'taskId', 'patch'])) return undefined
       return taskId !== undefined && schedulePatch(action.patch)
@@ -378,6 +453,25 @@ function parseEnvelopeAction(value: unknown): TaskBoardActionEnvelope | undefine
       return taskId !== undefined && isTaskStatus(action.status)
         ? { requestId: envelope.requestId, action: action as unknown as Extract<TaskBoardAction, { kind: 'move' }> }
         : undefined
+    case 'extension-action': {
+      // Structural gate only: whether the id names a registered, enabled
+      // extension is decided by the host registry, which owns that state.
+      if (!exactKeys(action, ['kind', 'extensionId', 'action', 'taskId', 'payload'])) return undefined
+      if (typeof action.extensionId !== 'string' || action.extensionId.trim() === '' || action.extensionId.length > 128) return undefined
+      if (typeof action.action !== 'string' || action.action.trim() === '' || action.action.length > 128) return undefined
+      if (action.taskId !== undefined && (typeof action.taskId !== 'string' || action.taskId === '')) return undefined
+      if (action.payload !== undefined && !isTaskBoardExtensionPayload(action.payload)) return undefined
+      return {
+        requestId: envelope.requestId,
+        action: {
+          kind: 'extension-action',
+          extensionId: action.extensionId,
+          action: action.action,
+          ...(action.taskId === undefined ? {} : { taskId: action.taskId }),
+          ...(action.payload === undefined ? {} : { payload: action.payload }),
+        },
+      }
+    }
     case 'confirm-permission':
     case 'delete':
     case 'archive':

package/src/tool-surface.ts

@@ -0,0 +1,95 @@
+// Generated by scripts/sync-shared.mjs from shared/host/tool-surface.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Family-shared tool-surface conventions for the packages that register
+ * model-facing tools.
+ *
+ * One home for the prompt-section placement and the visibility gate this
+ * family previously restated per package.
+ *
+ * Modelled on the official tool packages:
+ * - `@deepseek-ai/dsh-tool-subagent` renders its section through
+ *   `tools.get(name, context.scope) === undefined ? '' : text`, so guidance
+ *   disappears together with a restricted tool.
+ * - 21 of the 22 official tool packages register their tools GLOBALLY and gate
+ *   them with a setting, not per agent. Only the Agent Teams tool package —
+ *   whose tools belong to one membership — installs into each `agent.ctx`.
+ *   This family follows the majority: registration stays global so the
+ *   registry's per-scope `restrict()` mask (which filters inherited global
+ *   tools and REJECTS scope-local names) can still withhold these tools.
+ *
+ * Structural types only: this copy lands in packages that do not all depend on
+ * the same SDK service packages.
+ */
+
+/**
+ * Prompt-section order for each package's tool guidance.
+ *
+ * These sit in the family band between the deployment persona and the SDK's
+ * `PLAN_POLICY` (500). Values are owned here rather than written per package so
+ * the host plugins whose guidance shares one prompt cannot drift into an
+ * accidental tie.
+ */
+export const PLUGIN_TOOL_SECTION_ORDERS = {
+  ssh: 150,
+  'task-board': 200,
+} as const
+
+/** One plugin id keyed by {@link PLUGIN_TOOL_SECTION_ORDERS}. */
+export type PluginToolSectionId = keyof typeof PLUGIN_TOOL_SECTION_ORDERS
+
+/**
+ * Order of an external provider extension's own guidance section, right after
+ * the band of the plugin it extends.
+ *
+ * An extension names itself, not the plugin it plugs into, so its order stays
+ * out of {@link PLUGIN_TOOL_SECTION_ORDERS}: every package's copy of this module
+ * then carries no provider id. The slot still has one owner and cannot collide
+ * with a host plugin's band.
+ */
+export const EXTENSION_TOOL_SECTION_ORDER = 210
+
+/**
+ * The scoped tool lookup a section provider needs: the registry read for one
+ * assembly's scope. Matches `ctx.tools.get(name, scope)`.
+ */
+export interface ScopedToolLookup {
+  get(name: string, scope?: unknown): unknown
+}
+
+/** One assembly context carrying the scope the section is rendered for. */
+export interface SectionScopeContext {
+  scope?: unknown
+}
+
+/**
+ * Build a section provider that renders \`text\` only while at least one of
+ * \`toolNames\` is visible to the rendering scope.
+ *
+ * The native convention: a tool that a restriction, a preset, or a missing
+ * registry removed must not leave guidance behind telling the model to call it.
+ * An unreadable registry renders the text unchanged — guidance that outlives a
+ * momentary read failure is recoverable; guidance for a tool that is gone is
+ * not.
+ * @param tools - the scoped tool registry, when the deployment serves one.
+ * @param toolNames - registered names the guidance describes.
+ * @param text - the guidance rendered while they are reachable.
+ * @returns the section text provider.
+ */
+export function visibleToolText(
+  tools: ScopedToolLookup | undefined,
+  toolNames: readonly string[],
+  text: string,
+): (context: SectionScopeContext) => string {
+  if (tools === undefined) return () => text
+  return (context: SectionScopeContext) => {
+    for (const name of toolNames) {
+      try {
+        if (tools.get(name, context.scope) !== undefined) return text
+      } catch {
+        // A refused lookup is not proof the tool is gone; keep the guidance.
+        return text
+      }
+    }
+    return ''
+  }
+}