@linxin666/dsh-client-ui-task-board 0.4.6 → 0.4.7

package/lib/types/core/tasks.d.ts

@@ -325,6 +325,15 @@ export interface TaskRecord {
      * absent falls back to the host default (agent-default-model).
      */
     model?: string;
+    /**
+     * Reasoning effort pinned for that execution route (an adapter-owned id such
+     * as "high"). Absent (or blank) means INHERIT: the session runs at the
+     * model's own default level, exactly as a card written before the field
+     * existed does. The launch sends the value only when the target model's
+     * adapter declares that exact id, so switching a card to a model without
+     * that level never pushes an invalid selection (see core/reasoning-effort.ts).
+     */
+    reasoningEffort?: string;
     /**
      * Whether later executions continue in the previous execution's session
      * (issue #1419) instead of minting a fresh conversation per run. Absent or
@@ -446,6 +455,16 @@ export interface NewTaskInput {
     permission?: TaskPermission;
     /** Optional pinned model for the execution session; absent = host default. */
     model?: string;
+    /** Optional reasoning effort for that model route; empty/absent = the model's own default. */
+    reasoningEffort?: string;
+    /**
+     * Opt in to the deployment's new-card defaults: a target this input leaves
+     * out is filled from the configured default (agent preset, permission, model
+     * and the level bound to that model). Absent means the create stores exactly
+     * what it was given, which is what the extension provider's own create path
+     * and the legacy import rely on.
+     */
+    applyCardDefaults?: boolean;
     /** Reuse the previous execution's session for later runs (issue #1419). */
     reuseSession?: boolean;
     /** Run the subtree as an Agent Team (Team Lead session plus one teammate per direct subtask). */

package/lib/types/core/use-cases/task-create.d.ts

@@ -1,3 +1,4 @@
+import { type CardDefaults } from '../card-defaults.ts';
 import { type NewTaskInput, type TaskRecord } from '../tasks.ts';
 /** Result of a create transition: the new task (when accepted) + the next ledger. */
 export interface CreateTaskResult {
@@ -13,15 +14,19 @@ export interface CreateTaskResult {
  * appended ledger, or the unchanged ledger when the title is blank or the
  * requested parent link is refused.
  *
- * A subtask inherits the execution targets its parent already pins (workspace,
- * agent preset, permission, model) unless the form supplied its own; the
- * parent human permission confirmation travels with an inherited permission,
- * so a subtask of an already-confirmed elevated card is runnable at once.
+ * The execution targets resolve through {@link resolveCardTargets}: what the
+ * caller sent wins, then the parent's own pins, then - only when the caller
+ * opted in with `applyCardDefaults` - the deployment's configured new-card
+ * defaults. Without the flag the resolution sees no defaults at all, which is
+ * exactly the inline parent inheritance this path has always applied. The
+ * workspace is not part of that resolution: a subtask still takes the parent's
+ * workspace, and the defaults never name one.
  * @param tasks - current ledger.
  * @param input - raw user input (title/description/prompt + optional schedule/parent).
  * @param now - clock instant (ms epoch).
  * @param id - minted task id.
  * @param maxSubtaskDepth - deployment subtask depth limit.
  * @param hostTimeZone - zone a rule that stores no zone of its own follows.
+ * @param cardDefaults - the deployment's new-card defaults, read live at creation.
  */
-export declare function applyCreateTask(tasks: readonly TaskRecord[], input: NewTaskInput, now: number, id: string, maxSubtaskDepth?: number, hostTimeZone?: string): CreateTaskResult;
+export declare function applyCreateTask(tasks: readonly TaskRecord[], input: NewTaskInput, now: number, id: string, maxSubtaskDepth?: number, hostTimeZone?: string, cardDefaults?: CardDefaults): CreateTaskResult;

package/lib/types/core/use-cases/task-update.d.ts

@@ -15,7 +15,7 @@ import type { TaskHandoverInput } from '../handover.ts';
  * Editable fields on a task (the update patch surface). `freeze` replaces the
  * continuation-card snapshot (restamping frozenAt); an explicit null clears it.
  */
-export type TaskUpdatePatch = Partial<Pick<TaskRecord, 'title' | 'description' | 'prompt' | 'workspaceId' | 'mode' | 'permission' | 'model' | 'reuseSession' | 'teamRun' | 'goalRun' | 'skipVerification'>> & {
+export type TaskUpdatePatch = Partial<Pick<TaskRecord, 'title' | 'description' | 'prompt' | 'workspaceId' | 'mode' | 'permission' | 'model' | 'reasoningEffort' | 'reuseSession' | 'teamRun' | 'goalRun' | 'skipVerification'>> & {
     freeze?: FreezeSnapshot & {
         redacted?: boolean;
     } | null;

package/lib/types/host/launch-admission.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Admission control for the session-creating half of a run.
+ *
+ * One board action can open a whole subtree, and a team run hands every member
+ * of it to the Lead at once. Both paths used to fire every launch in the same
+ * tick, so the Host asked DSH for N sessions at once — the burst the repository's
+ * measured guidance caps at three heavy implementation subagents
+ * (docs/multi-agent-resources.md), with no mechanism enforcing it.
+ *
+ * The queue is SERVICE-wide, not per run group: the pressure it bounds is the
+ * machine's (the Host process's memory and the swap it drives), and two run
+ * groups opened from two tabs share one Host. Admission is round-robin across
+ * run groups — FIFO inside a group, so a group's first run (the Lead, which
+ * carries the run shape and the teammate namespace) always starts before its
+ * members — so a large subtree cannot starve a run opened after it, and no
+ * entry can be starved.
+ *
+ * The width is read through a live callback, so a settings edit takes effect on
+ * the next admission without remounting anything.
+ *
+ * @module dsh-task-board/host/launch-admission
+ */
+/** One launch the queue has not started yet. */
+export interface QueuedLaunch {
+    /** Run group this launch belongs to; the unit of round-robin fairness. */
+    readonly groupId: string;
+    /**
+     * Perform the launch. The slot is held until this promise settles, which
+     * makes "in flight" mean "still creating and prompting its session".
+     * A rejection is swallowed here so one broken launch can never wedge the
+     * slot; the caller owns reporting.
+     */
+    start(): Promise<void>;
+    /**
+     * Called by {@link LaunchAdmissionQueue.drain} for a launch that never
+     * started, so the caller can take its execution out of the running column.
+     */
+    abandon(): void;
+}
+export declare class LaunchAdmissionQueue {
+    private readonly width;
+    /** Waiting launches per run group, in arrival order. */
+    private readonly waiting;
+    /** Run groups in round-robin order. */
+    private rotation;
+    /** Slot holders of the launches in flight, one per admitted launch. */
+    private readonly inFlight;
+    /** Highest number of launches in flight at once; observability and tests. */
+    peakInFlight: number;
+    /**
+     * @param width - live admission width (already normalized by the caller).
+     */
+    constructor(width: () => number);
+    /** Launches the queue has not admitted yet. */
+    get pendingCount(): number;
+    /** Launches currently holding a slot. */
+    get inFlightCount(): number;
+    /** Admit one launch, immediately if a slot is free. */
+    enqueue(launch: QueuedLaunch): void;
+    /**
+     * Abandon every waiting launch: the queue is being torn down, so an entry
+     * that never started can never start. Launches already in flight are left
+     * alone — their session may already exist, and the callers that own them
+     * settle them through the normal path.
+     * @returns the abandoned launches, in abandonment order.
+     */
+    drain(): QueuedLaunch[];
+    private pump;
+    /** The next launch by round-robin across groups and FIFO inside one. */
+    private takeNext;
+    private admit;
+}

package/lib/types/host-ledger.d.ts

@@ -1,4 +1,5 @@
 import { type ExecutionOutcome, type ExecutionRecord, type ScheduleMode, type TaskRecord } from './core/tasks.ts';
+import type { CardDefaults } from './core/card-defaults.ts';
 import { type TaskBoardAction, type TaskBoardSchedulerSnapshot } from './protocol.ts';
 import { type ExecutionVerification } from './core/verification.ts';
 import { type TaskPermission } from './core/handover.ts';
@@ -125,9 +126,12 @@ export declare class HostTaskLedger {
      * instead of remounting the row.
      */
     private depthLimit;
+    /** Live reader of the deployment's new-card defaults (a volatile config read). */
+    private readonly cardDefaults;
     constructor(dir?: string, now?: () => number, options?: {
         sessionDefaultPermission?: TaskPermission | (() => TaskPermission);
         maxSubtaskDepth?: number;
+        cardDefaults?: () => CardDefaults;
     });
     /** Current subtask depth limit (1..3). */
     get maxSubtaskDepth(): number;
@@ -259,10 +263,11 @@ export declare class HostTaskLedger {
     /** Whether a task or any of its subtasks still has an open execution. */
     private subtreeHasOpenExecution;
     /**
-     * Open one execution per cascade participant (the requested task and its
-     * on-board descendants, within the depth limit) under a single run group, and
-     * commit the ledger once. The returned runs are ordered root-first, so the
-     * Host launches the parent before its subtasks.
+     * Open one execution per cascade participant that still has work (the
+     * requested task and its on-board descendants, within the depth limit) under
+     * a single run group, and commit the ledger once. A descendant in 'done' is
+     * not a participant ({@link joinsCascadeRun}). The returned runs are ordered
+     * root-first, so the Host launches the parent before its subtasks.
      * @param root - the task the user ran.
      * @param now - clock instant (ms epoch).
      * @param initiator - the DSH session that asked for the run (audit only).

package/lib/types/host-runner.d.ts

@@ -1,7 +1,9 @@
-import type { TypertGateway } from '@deepseek-ai/dsh-api-gateway';
+import { Context } from '@deepseek-ai/cordis';
+import type { InvokeRemoteRequest, TypertGateway } from '@deepseek-ai/dsh-api-gateway';
 import type { SessionSummary } from '@deepseek-ai/dsh-api-session-controller/types';
 import type { CommandResult } from '@deepseek-ai/dsh-commands/types';
 import type { Workspace } from '@deepseek-ai/dsh-workspace/types';
+import type { ModelCatalogView } from './core/verification.ts';
 import type { TaskRecord } from './core/tasks.ts';
 /**
  * Host services needed to validate a task's workspace before creating a
@@ -10,12 +12,47 @@ import type { TaskRecord } from './core/tasks.ts';
 export interface TaskBoardWorkspaceRegistry {
     list(): readonly Workspace[];
 }
+/**
+ * The peer every gateway request names: derived from the public
+ * `InvokeRemoteRequest` type so this package needs no direct dependency on
+ * `@deepseek-ai/dsh-typert-protocol` for the shape.
+ */
+export type GatewayPeer = InvokeRemoteRequest['peer'];
 interface GatewayRequest {
     namespace: string;
     method: string;
     args: Record<string, unknown>;
+    peer: GatewayPeer;
     signal?: AbortSignal;
 }
+/**
+ * Mint the in-process owner peer this plugin's Host calls speak for.
+ *
+ * The 0.2.1 gateway made `peer` mandatory on every request, and the
+ * authorization layer reads only `peer.principal`: a principal of
+ * `{ kind: 'owner' }` is how host-local code states that the call IS the local
+ * user driving their own Host, so the gateway answers it directly instead of
+ * running a remote-access decision (only non-owner principals are judged).
+ * That is exactly the task board's position — it creates, renames, prompts,
+ * and reads sessions as the Host itself, which before 0.2.1 was the implicit
+ * privilege of every in-process caller. The board claims owner explicitly, and
+ * only ever inside its own Host process: no wire field can set a principal,
+ * and this plugin never forwards a browser-supplied one.
+ *
+ * `interactions` stays `'none'`: the board only invokes methods and opens the
+ * short `session/follow` stream. The gateway's interactions check gates
+ * exactly the forwarded-event endpoints (opening an event stream, answering a
+ * waterfall), which this caller never touches; an `'answer'` peer would
+ * additionally receive forwarded Host events, a capability the board neither
+ * needs nor wants.
+ *
+ * The peer's signal aborts once `ctx` disposes, so streams opened for it end
+ * with the plugin fiber, and `dispose()` is idempotent with racing calls
+ * sharing one completion. The id carries no credential — the protocol fixes
+ * `principal` as the only identity persisted in a session log — so a fresh
+ * unique id per mount is sufficient.
+ */
+export declare function createOwnerPeer(ctx: Context): GatewayPeer;
 interface SessionGateway {
     invoke(request: GatewayRequest): Promise<unknown>;
     stream?(request: GatewayRequest): Promise<AsyncIterable<unknown>>;
@@ -111,15 +148,25 @@ export declare class HostExecutionRunner {
     private readonly gateway;
     private readonly commands?;
     private readonly workspaceRegistry?;
-    /** Newest scanned event sequence per session with no matching execution end. */
+    /**
+     * Newest event sequence per session whose COMPLETE history walk (reaching
+     * the execution boundary) found no matching execution end. A later walk may
+     * trust everything at or below it and examine only newer records.
+     */
     private readonly scanMemos;
     private readonly unavailableAttempts;
     private readonly unavailableBackoffMs;
+    /**
+     * The peer every request speaks for. Production passes the peer bound to the
+     * plugin fiber; a bare runner (unit tests around fake gateways) gets one
+     * bound to a fresh root context instead.
+     */
+    private readonly ownerPeer;
     private unsupportedSessionListWarned;
     constructor(gateway: SessionGateway | TypertGateway, commands?: SessionCommandDispatcher | undefined, workspaceRegistry?: TaskBoardWorkspaceRegistry | undefined, unavailableRetry?: {
         attempts?: number;
         backoffMs?: number;
-    });
+    }, ownerPeer?: GatewayPeer);
     private invoke;
     private stream;
     /**
@@ -157,6 +204,14 @@ export declare class HostExecutionRunner {
          * `goalRun` still applies on top of it (both must ASK for a goal).
          */
         goalEnabled?: boolean;
+        /**
+         * The host model catalog, read ONCE per execution by the caller. The card's
+         * pinned reasoning effort is sent only when this catalog declares it for the
+         * route the execution runs at, so one snapshot decides both the acceptance
+         * contract and the effort this run freezes. Absent means "no capability
+         * evidence": an effort is then not sent at all.
+         */
+        catalog?: ModelCatalogView;
     }): Promise<string>;
     /**
      * Fail closed when a reused session records a different Agent preset than
@@ -173,10 +228,30 @@ export declare class HostExecutionRunner {
      * @param pinned - the preset id the task pins, when it pins one.
      */
     private assertReusedPreset;
+    /**
+     * Split a `provider/model` pin. A pin without a provider keeps only the model
+     * id: the provider is the one the host catalog declares for it, resolved at
+     * launch because the session wire contract requires a provider.
+     */
+    private static pinnedRoute;
+    /**
+     * The route a card that pins no model actually runs at: the session's own
+     * recorded selection (the durable fold the GUI reads; `next` is the pending
+     * user choice, `lastUsed` what the last request consumed), or — for a session
+     * that has selected none yet, which is exactly a session that would start at
+     * the deployment default — the host default from the catalog.
+     *
+     * A route that cannot be READ is undefined and the effort is not sent:
+     * falling back to the host default there would silently switch the model of a
+     * session this run only meant to continue.
+     */
+    private sessionRoute;
     /**
      * Re-assert the pinned execution contract on a session and queue the task
      * prompt. Shared by the fresh-session and reuse paths so both apply exactly
-     * the same permission/model pins before the prompt.
+     * the same permission/model/effort pins before the prompt. A session that
+     * refuses a selection carrying a catalog-confirmed effort throws here, so the
+     * prompt is never queued behind a run at the wrong level.
      */
     private pinAndPrompt;
     /**

package/lib/types/host-service.d.ts

@@ -1,11 +1,12 @@
 import type { TypertGateway } from '@deepseek-ai/dsh-api-gateway';
 import { HostTaskLedger } from './host-ledger.ts';
-import { HostExecutionRunner, type SessionCommandDispatcher, type TaskBoardWorkspaceRegistry } from './host-runner.ts';
+import { HostExecutionRunner, type GatewayPeer, type SessionCommandDispatcher, type TaskBoardWorkspaceRegistry } from './host-runner.ts';
 import { PowerInhibitor } from './power-inhibitor.ts';
 import { type TaskBoardAction, type TaskBoardEventPayload, type TaskBoardSnapshot } from './protocol.ts';
+import type { CardDefaults } from './core/card-defaults.ts';
 import { TaskBoardExtensionRegistry } from './host/extension-registry.ts';
 import type { TaskBoardExtension } from './core/extension.ts';
-import type { ScheduleMode } from './core/tasks.ts';
+import { type ScheduleMode } from './core/tasks.ts';
 import { type ModelCatalogView, type VerificationContract, type VerificationSettings } from './core/verification.ts';
 import type { TaskPermission } from './core/handover.ts';
 /** One teammate the Host asks the Agent Teams service to spawn for a team run. */
@@ -103,6 +104,12 @@ export declare class TaskBoardHostService {
     private disposed;
     private pollInFlight;
     private active;
+    /**
+     * Admission control for the session-creating half of a run: one board action
+     * opens a whole subtree, and this is what keeps the Host from asking DSH for
+     * every member's session at once (see {@link LaunchAdmissionQueue}).
+     */
+    private readonly launches;
     /**
      * Consecutive unreadable-history polls per open execution (see
      * {@link noteUnreadableInspection}). Cleared as soon as an inspection
@@ -116,6 +123,14 @@ export declare class TaskBoardHostService {
     private readonly timers;
     /** Live reader of the global native-/goal switch; frozen per execution. */
     private readonly goalRunEnabled;
+    /** Live reader of the deployment's new-card defaults (published and applied per create). */
+    private readonly cardDefaults;
+    /**
+     * Live reader of the run-launch admission width: how many launches may be in
+     * flight at once. Read at every admission, so a settings edit bounds the next
+     * launch without remounting the row. Absent means the default.
+     */
+    private readonly runLaunchWidth;
     private lastPowerJson;
     private readonly now;
     /** The deployment's workspaces, consulted to resolve a card that pins none. */
@@ -132,12 +147,26 @@ export declare class TaskBoardHostService {
         now?: () => number;
         commandDispatcher?: SessionCommandDispatcher;
         workspaceRegistry?: TaskBoardWorkspaceRegistry;
+        /**
+         * The owner peer every gateway request the runner makes speaks for.
+         * Production passes the peer bound to the plugin fiber (see
+         * {@link createOwnerPeer}); absent is fine for tests and bare mounts,
+         * where the runner binds one to a fresh root context.
+         */
+        ownerPeer?: GatewayPeer;
         /**
          * Permission baseline of the confirmation gate: a fixed value, or a live
          * resolver the board re-reads so a Host Settings change needs no remount.
          */
         sessionDefaultPermission?: TaskPermission | (() => TaskPermission);
         maxSubtaskDepth?: number;
+        /**
+         * Live reader of the deployment's new-card defaults (volatile config reads).
+         * The board publishes them for the create dialog and re-reads them for every
+         * create that opts in, so a settings edit reaches the next created card
+         * without remounting the row. Absent means the deployment configures none.
+         */
+        cardDefaults?: () => CardDefaults;
         team?: TaskBoardTeamDispatcher;
         timers?: HostTimerFace;
         /**
@@ -156,6 +185,13 @@ export declare class TaskBoardHostService {
         verificationSettings?: () => VerificationSettings;
         /** The host model catalog the acceptance contract resolves its route from. */
         verificationCatalog?: () => Promise<ModelCatalogView | undefined>;
+        /**
+         * Live admission width for run launches: the number of launches (one
+         * session creation and its prompt each) that may be in flight at once. Read
+         * per admission, so editing the setting bounds the next launch of a run that
+         * is still queueing. Absent means the default width.
+         */
+        runLaunchWidth?: () => number;
     });
     start(): void;
     /**
@@ -230,6 +266,26 @@ export declare class TaskBoardHostService {
     private emitStatusChanges;
     dispose(): void;
     private launch;
+    /**
+     * Read the acceptance contract one run group freezes, in the order the board
+     * has always read it: the acceptance settings, then the global native-/goal
+     * switch, then the model catalog that both resolves the contract's route and
+     * decides the reasoning effort the session may be given.
+     */
+    private freezeRunContract;
+    /**
+     * A {@link RunContractFreezer} that reads once and hands the SAME value to
+     * every later caller of one run group. A read that fails is not cached: the
+     * next member reads again, exactly as a per-execution read would have.
+     */
+    private contractFreezerForRunGroup;
+    /**
+     * Give back the occurrence a launch consumed, for a launch that never reached
+     * a session: a failed launch, or one the Host abandoned while it was still
+     * waiting for an admission slot. A manual run, and a launch that DID reach a
+     * session, are never refunded.
+     */
+    private refundUnstartedSchedule;
     private scheduleTeammate;
     /**
      * Spawn one teammate inside the Lead session and attach the teammate's
@@ -335,6 +391,13 @@ export declare class TaskBoardHostService {
      * member then launches on its own so one refused participant cannot hold the
      * others back. A team run's members are spawned inside the root's Lead
      * session instead, once that session exists.
+     *
+     * Every launch of one run set goes through the admission queue, which admits
+     * at most `runLaunchWidth` of them at a time — the whole subtree still opens,
+     * members just enter the running column in batches. Order inside the group is
+     * the order they are enqueued here, so the root's session always exists before
+     * any member's, and one member's launch settling (or failing) is what admits
+     * the next. All members share the one contract this group freezes.
      */
     private dispatchRuns;
     /**
@@ -343,6 +406,26 @@ export declare class TaskBoardHostService {
      */
     private setApplicability;
     private scheduleLaunch;
+    /**
+     * Hand one launch to the admission queue, or abandon it on the spot when the
+     * Host is already stopping: a queue entry created after {@link dispose} would
+     * otherwise never be drained, and its card would sit in the running column
+     * until the next Host start recovered it.
+     */
+    private enqueueLaunch;
+    /** Whether one opened execution is still open in the ledger. */
+    private isExecutionOpen;
+    /**
+     * Take one launch that never started out of the running column.
+     *
+     * Settled as CANCELLED, not failed: nothing about the run's work went wrong —
+     * the Host stopped before the launch got a slot, which is exactly what the
+     * next start's interrupted-start recovery records for an execution that never
+     * reached a session. A scheduled occurrence that never reached a session is
+     * refunded on the same terms as any other pre-session failure, so a run the
+     * Host never started cannot silently spend the user's run budget.
+     */
+    private abandonQueuedRun;
     private schedulePoll;
     /**
      * Count one failed pass and arm the retry that follows it.

package/lib/types/index.d.ts

@@ -69,6 +69,17 @@ export interface Config {
      * at all, so this cadence only bounds how quickly a running card settles.
      */
     sessionPollSeconds?: Volatile<number>;
+    /**
+     * How many run launches this board may have in flight at once (1..16,
+     * default 3). One run opens its whole subtree, so without a bound the Host
+     * asks DSH for every member's session in the same tick; this is the mechanism
+     * that enforces the repository's measured guidance for heavy implementation
+     * subagents. Members wait their turn instead of being dropped: the subtree
+     * still opens completely, they only enter the running column in batches. Read
+     * at each admission, so an edit bounds the next launch of a run that is still
+     * queueing.
+     */
+    runLaunchWidth?: Volatile<number>;
     /**
      * Continuable-subagent provider the Agent Teams service uses to compose a
      * teammate. Matches the Agent Teams tool plugin's `freshProvider` default;
@@ -91,6 +102,33 @@ export interface Config {
      * becomes a goal run.
      */
     goalRunEnabled?: Volatile<boolean>;
+    /**
+     * Agent preset a NEW card starts from (volatile, default blank = not set).
+     * A prefill, never a pin: the create dialog opens with it selected, the
+     * caller may override it, and the card stores what it was created with. It
+     * reaches the create path only when that caller opts in with
+     * `applyCardDefaults`, so the extension provider's own create and the legacy
+     * import are untouched.
+     */
+    cardDefaultMode?: Volatile<string>;
+    /**
+     * Permission a NEW card starts from (volatile, default blank = not set), one
+     * of the three presets. A prefill like the rest: a value above
+     * `sessionDefaultPermission` still has to be confirmed by a human before the
+     * card may run, because the pre-execution gate is what decides that.
+     */
+    cardDefaultPermission?: Volatile<TaskPermission | ''>;
+    /**
+     * Model a NEW card starts from (volatile, default blank = not set).
+     */
+    cardDefaultModel?: Volatile<string>;
+    /**
+     * Reasoning level a NEW card starts from (volatile, default blank = not set).
+     * Bound to `cardDefaultModel` exactly as a card's own level is bound to its
+     * own model: it applies only while the card's final model IS that default
+     * model, and a blank `cardDefaultModel` makes it inert.
+     */
+    cardDefaultReasoningEffort?: Volatile<string>;
     /**
      * Goal acceptance for executions this board starts (default ON). When on,
      * update_goal(action: complete) inside a task execution is refused until an
@@ -166,10 +204,20 @@ export interface ConfigInput {
     maxSubtaskDepth?: number;
     /** Roster-poll cadence in seconds while the board has work to reconcile. */
     sessionPollSeconds?: number;
+    /** Concurrent run launches allowed at once, 1..16. */
+    runLaunchWidth?: number;
     /** Continuable-subagent provider the Agent Teams service composes a teammate from. */
     teamProvider?: string;
     /** Global native /goal switch; default off, frozen per execution. */
     goalRunEnabled?: boolean;
+    /** Agent preset a new card starts from; blank = not set. */
+    cardDefaultMode?: string;
+    /** Permission a new card starts from; blank = not set. */
+    cardDefaultPermission?: TaskPermission | '';
+    /** Model a new card starts from; blank = not set. */
+    cardDefaultModel?: string;
+    /** Reasoning level a new card starts from; blank = not set. */
+    cardDefaultReasoningEffort?: string;
     /** Goal acceptance switch. */
     goalVerification?: boolean;
     /** Judge model route for goal acceptance; blank inherits the host default. */
@@ -304,6 +352,45 @@ export declare function buildTeamDispatcher(ctx: Context, provider: string): Tas
  * @returns the llm service, or undefined when this deployment serves none.
  */
 export declare function resolveLlmRuntime(ctx: Context): LlmRuntime | undefined;
+/**
+ * The subset of `sessionController` the board uses to wake a cold persisted
+ * session before running a slash command on it (issue #1861).
+ */
+interface SessionControllerFace {
+    resolveAgent(sessionId: Parameters<Context['agents']['get']>[0]): Promise<{
+        readonly agent: Parameters<Context['commands']['execute']>[0];
+    } | {
+        readonly error: {
+            readonly message?: string;
+        };
+    }>;
+}
+/**
+ * Resolve the optional `sessionController` service. Like the tool registry and
+ * the llm runtime, it is read dynamically so capture-only test contexts that do
+ * not mount the full session controller still activate the board.
+ * @param ctx - the plugin context.
+ * @returns the session controller face, or undefined when unavailable.
+ */
+export declare function resolveSessionController(ctx: Context): SessionControllerFace | undefined;
+/**
+ * Resolve the live Agent for an execution session, resuming a cold persisted
+ * session through `sessionController.resolveAgent` when it is not yet in
+ * `ctx.agents` (issue #1861).
+ *
+ * A fresh run (`session/create`) or a session the browser is currently
+ * following is already in `ctx.agents`, so the fast path returns immediately.
+ * A scheduled or manual reuse of a cold session — one that `session/list`
+ * reports as idle from disk without activating its Agent — is not in
+ * `ctx.agents` when `pinAndPrompt` runs `/permission` ahead of
+ * `session/selectModel` and `session/prompt`; delegating to
+ * `sessionController.resolveAgent` resumes it with its recorded preset and
+ * model-selection state, matching what those gateway endpoints do next.
+ * @param ctx - the plugin context.
+ * @param sessionId - the target execution session id.
+ * @returns the live Agent for `sessionId`.
+ */
+export declare function resolveExecutionAgent(ctx: Context, sessionId: Parameters<Context['agents']['get']>[0]): Promise<Parameters<Context['commands']['execute']>[0]>;
 /**
  * Activate the board's host half: ledger, routes, cron scheduler, power
  * inhibitor, and the model-facing announcement.

package/lib/types/protocol.d.ts

@@ -74,6 +74,19 @@ export interface TaskBoardSnapshot {
      * flight.
      */
     goalRunEnabled?: boolean;
+    /**
+     * New-card defaults this deployment configures: what the create dialog opens
+     * with, and what the create path fills an omitted target from when the caller
+     * opts in (`applyCardDefaults`). A target the board configures nothing for is
+     * omitted rather than published blank, so the browser can tell "no default
+     * model" from "a blank one".
+     */
+    cardDefaults?: {
+        mode?: string;
+        permission?: TaskPermission;
+        model?: string;
+        reasoningEffort?: string;
+    };
     /**
      * Read-only summaries published by running extensions, keyed by extension id.
      * The board forwards them verbatim; it never interprets their shape.