dsh-taskboard 0.6.7 → 0.7.0

package/lib/shared/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","names":[],"sources":["../../src/shared/api.ts"],"sourcesContent":["/**\n * Wire contract for the /taskboard host routes: the JSON envelope,\n * request/response shapes, and SSE event payloads shared by the host routes\n * and the browser client.\n *\n * @module dsh-taskboard/shared/api\n */\nimport type { BoardSettings, TaskLedger, TaskModel, TaskRecord, TaskSummary } from './protocol.ts'\n\nexport type { TaskModel, TaskRecord }\n\n/** Route prefix on the shared DSH webserver (same origin as the GUI). */\nexport const ROUTE_PREFIX = '/dsh-taskboard'\n\n/** SSE stream path (exact route; longest-prefix wins keep it disjoint). */\nexport const SSE_PATH = '/dsh-taskboard/events'\n\n/** Stable error codes (mirror the tool-level codes plus HTTP mapping). */\nexport type ApiErrorCode =\n  | 'invalid_input'\n  | 'not_found'\n  | 'version_conflict'\n  | 'invalid_transition'\n  | 'forbidden'\n  | 'internal'\n\n/** Success envelope. */\nexport type ApiOk<T> = { ok: true; value: T }\n\n/** Failure envelope. */\nexport type ApiFail = { ok: false; error: { code: ApiErrorCode; message: string } }\n\n/** The envelope either way. */\nexport type ApiResult<T> = ApiOk<T> | ApiFail\n\n// ---------------------------------------------------------------------------\n// payloads\n// ---------------------------------------------------------------------------\n\n/** Full-state response (the reconnect baseline after an SSE gap). */\nexport type StateResponse = TaskLedger & { capabilities?: { archiveSessions: boolean } }\n\n/**\n * Workspace listing for the UI pickers. `repoCount` (0.6.3): how many repos a\n * task mirror of this workspace would cover (root repo + nested) — the form's\n * worktree option shows the mirror badge when it exceeds 1.\n */\nexport type WorkspaceView = { id: string; path: string; title: string; sessionCount: number; gitAvailable?: boolean; repoCount?: number }\n\n/** Create-task request body (actor is always the GUI user). */\nexport type CreateTaskBody = {\n  title: string\n  workspaceId: string\n  urgency: string\n  description?: string\n  prompt?: string\n  execution?: { mode?: string; cron?: string }\n  model?: TaskModel\n  /** Code isolation for executions ('worktree' | 'none'); omitted = default. */\n  isolation?: string\n  /** Agent preset for execution sessions; omitted = deployment default. */\n  presetId?: string\n  /** Execution permission preset ('workspace-write' | 'read-only' | 'danger-full-access'); omitted = default. */\n  permission?: string\n  /** Acceptance checklist item texts (host mints ids, all unchecked). */\n  checklist?: string[]\n}\n\n/** Update-task request body (ifVersion mandatory). */\nexport type UpdateTaskBody = {\n  ifVersion: number\n  title?: string\n  description?: string\n  prompt?: string\n  urgency?: string\n  blocked?: boolean\n  /** Rebind the task to another project (GUI owner surface only). */\n  workspaceId?: string\n  execution?: { mode?: string; cron?: string }\n  model?: TaskModel | null\n  /** Change isolation; locked once the task has execution history. */\n  isolation?: string\n  /** Change the execution preset (takes effect on the next run). */\n  presetId?: string | null\n  /** Change the execution permission (0.5.5; 'workspace-write' | 'read-only' | 'danger-full-access'). */\n  permission?: string | null\n  /** Replace the whole checklist (GUI owner surface); null clears it. */\n  checklist?: unknown\n}\n\n/** Move-task request body (ifVersion mandatory; the user MAY move to done). */\nexport type MoveTaskBody = { ifVersion: number; status: string; archiveSessions?: boolean }\n\nexport type SessionArchiveResult = { archived: string[]; failed: Array<{ sessionId: string; error: string }>; unsupported: string[] }\nexport type MoveTaskResponse = TaskSummary & { sessionArchive?: SessionArchiveResult }\n\n/**\n * Quick-reject request body (card ✗ button): move back to todo plus an\n * optional user comment, committed as ONE ledger mutation so a failed move\n * can never strand an orphan comment.\n */\nexport type RejectTaskBody = { ifVersion: number; body?: string }\n\n/** Comment request body. */\nexport type CommentBody = { body: string }\n\n/** Delete request body (purge=true physically removes a trashed task). */\nexport type DeleteTaskBody = { ifVersion?: number; purge?: boolean }\n\n/** Run request body; `reuse: true` = 续跑 (keep a live worktree as-is). */\nexport type RunTaskBody = { reuse?: boolean }\n\n/** One repo's merge outcome in a multi-repo merge (0.6.3; `repo: ''` = the workspace root repo). */\nexport type MergeRepoResult = {\n  repo: string\n  branch: string\n  outcome: 'merged' | 'noop' | 'failed'\n  /** Failure reason (verbatim git message) when outcome = 'failed'. */\n  error?: string\n}\n\n/**\n * Merge outcome. Legacy single-repo tasks keep the flat shape; multi-repo\n * mirror tasks (0.6.3) additionally return per-repo results — merges run\n * sequentially and a failed repo does not block the others (plan §4.5).\n */\nexport type MergeBranchResponse = {\n  merged: boolean\n  noop?: boolean\n  /** The merged task branch (legacy single-repo shape; multi-repo responses omit it). */\n  branch?: string\n  /** Present only on multi-repo mirror merges (0.6.3). */\n  results?: MergeRepoResult[]\n}\n\n/** Remove a task's worktree; optionally delete its branch too. */\nexport type WorktreeRemoveBody = { deleteBranch?: boolean }\n\n/** One orphan worktree directory (exists on disk, owned by no live task). */\nexport type OrphanWorktree = { workspaceId: string; workspacePath: string; taskId: string; path: string }\n\n/** A git-enabled workspace whose .gitignore does not cover the worktree dir. */\nexport type GitignoreSuggestion = { workspaceId: string; workspacePath: string }\n\n/** Health-diagnostics response (⚙ panel). */\nexport type DiagnosticsResponse = {\n  revision: number\n  tasks: number\n  /** Executions currently marked `running`. */\n  staleRunning: number\n  /** Worktree directories whose task no longer exists in the ledger. */\n  orphanWorktrees: OrphanWorktree[]\n  /** Git workspaces whose .gitignore does not ignore the worktree dir. */\n  gitIgnoreSuggestions: GitignoreSuggestion[]\n}\n\n/** Fields a task template may prefill (0.4.0). */\nexport type TaskTemplateSpec = {\n  title?: string\n  description?: string\n  prompt?: string\n  urgency?: string\n  execution?: { mode?: string; cron?: string }\n  model?: TaskModel\n  isolation?: string\n  presetId?: string\n  /** Execution permission preset (0.5.5). */\n  permission?: string\n  /** Checklist item texts (host mints ids at create time). */\n  checklist?: string[]\n}\n\n/** One reusable task template (0.4.0). */\nexport type TaskTemplate = {\n  id: string\n  name: string\n  task: TaskTemplateSpec\n  /** Seeded built-in templates (kept on load, deletable like any other). */\n  builtin?: boolean\n  createdAt: number\n  updatedAt: number\n}\n\n/** Templates listing response. */\nexport type TemplatesResponse = { templates: TaskTemplate[] }\n\n/** Board-settings response (0.5.0; absent fields follow factory defaults). */\nexport type SettingsResponse = BoardSettings\n\n/** Update-board-settings request body (0.5.0; whole-object replace semantics). */\nexport type UpdateSettingsBody = {\n  /** Default code isolation for NEW tasks ('worktree' | 'none'). */\n  defaultIsolation?: string\n  /** Automatically capture external workspace sessions into the taskboard. */\n  syncExternalSessions?: boolean\n  /** Default permission preset for NEW tasks ('workspace-write' | 'read-only' | 'danger-full-access'). */\n  defaultPermission?: string\n}\n\n/** Prompt completion item for skills and slash commands (0.5.5). */\nexport type PromptCompletionItem = {\n  name: string\n  kind: 'skill' | 'command'\n  description?: string\n  hint?: string\n}\n\n/** Prompt completions response (0.5.5). */\nexport type PromptCompletionsResponse = {\n  commands: PromptCompletionItem[]\n  skills: PromptCompletionItem[]\n}\n\n/** Model item in catalog (0.5.5). */\nexport type CatalogModelItem = {\n  provider: string\n  model: string\n  name?: string\n  description?: string\n  reasoning?: {\n    efforts: Array<{ id: string; name: string; description?: string }>\n    defaultEffort?: string\n  }\n}\n\n/** Preset item in catalog (0.5.5). */\nexport type CatalogPresetItem = {\n  id: string\n  name?: string\n}\n\n/** Model and preset catalog response (0.5.5). */\nexport type ModelCatalogResponse = {\n  models: CatalogModelItem[]\n  presets: CatalogPresetItem[]\n  defaultPresetId?: string\n}\n\n/** Import dry-run response (0.4.0): every task classified, nothing written. */\nexport type ImportPreviewResponse = {\n  plan: {\n    create: Array<{ id: string; title: string; status: string }>\n    overwrite: Array<{ id: string; title: string; status: string }>\n    invalid: Array<{ id?: string; reason: string }>\n  }\n}\n\n/** Import commit response. */\nexport type ImportCommitResponse = {\n  mode: 'merge' | 'replace'\n  created: number\n  overwritten: number\n  replacedTotal?: number\n  /** The backup file written BEFORE a replace wiped the live ledger. */\n  backupFile?: string\n}\n\n/** Diff-viewer response (0.4.0). */\nexport type DiffResponse = { diff: string; truncated: boolean }\n\n/** One task (full record) response. */\nexport type TaskResponse = TaskRecord\n\n/** Summary response used by list-ish endpoints. */\nexport type SummaryResponse = { tasks: TaskSummary[] }\n\n// ---------------------------------------------------------------------------\n// SSE\n// ---------------------------------------------------------------------------\n\n/** Change frame pushed on every committed ledger mutation. */\nexport type ChangeEvent = {\n  revision: number\n  kind: 'task-created' | 'task-updated' | 'task-moved' | 'task-deleted' | 'comment-added' | 'execution-recorded' | 'settings-updated' | 'ledger-replaced'\n  tasks: TaskSummary[]\n}\n"],"mappings":";;AAYA,MAAa,eAAe;;AAG5B,MAAa,WAAW"}
+{"version":3,"file":"api.js","names":[],"sources":["../../src/shared/api.ts"],"sourcesContent":["/**\n * Wire contract for the /taskboard host routes: the JSON envelope,\n * request/response shapes, and SSE event payloads shared by the host routes\n * and the browser client.\n *\n * @module dsh-taskboard/shared/api\n */\nimport type { BoardSettings, TaskLedger, TaskModel, TaskRecord, TaskSummary } from './protocol.ts'\n\nexport type { TaskModel, TaskRecord }\n\n/** Route prefix on the shared DSH webserver (same origin as the GUI). */\nexport const ROUTE_PREFIX = '/dsh-taskboard'\n\n/** SSE stream path (exact route; longest-prefix wins keep it disjoint). */\nexport const SSE_PATH = '/dsh-taskboard/events'\n\n/** Stable error codes (mirror the tool-level codes plus HTTP mapping). */\nexport type ApiErrorCode =\n  | 'invalid_input'\n  | 'not_found'\n  | 'version_conflict'\n  | 'invalid_transition'\n  | 'forbidden'\n  | 'internal'\n\n/** Success envelope. */\nexport type ApiOk<T> = { ok: true; value: T }\n\n/** Failure envelope. */\nexport type ApiFail = { ok: false; error: { code: ApiErrorCode; message: string } }\n\n/** The envelope either way. */\nexport type ApiResult<T> = ApiOk<T> | ApiFail\n\n// ---------------------------------------------------------------------------\n// payloads\n// ---------------------------------------------------------------------------\n\n/** Full-state response (the reconnect baseline after an SSE gap). */\nexport type StateResponse = TaskLedger & { capabilities?: { archiveSessions: boolean } }\n\n/**\n * Workspace listing for the UI pickers. `repoCount` (0.6.3): how many repos a\n * task mirror of this workspace would cover (root repo + nested) — the form's\n * worktree option shows the mirror badge when it exceeds 1.\n */\nexport type WorkspaceView = { id: string; path: string; title: string; sessionCount: number; gitAvailable?: boolean; repoCount?: number }\n\n/** Create-task request body (actor is always the GUI user). */\nexport type CreateTaskBody = {\n  title: string\n  workspaceId: string\n  urgency: string\n  description?: string\n  prompt?: string\n  execution?: { mode?: string; cron?: string }\n  model?: TaskModel\n  /** Code isolation for executions ('worktree' | 'none'); omitted = default. */\n  isolation?: string\n  /** Agent preset for execution sessions; omitted = deployment default. */\n  presetId?: string\n  /** Execution permission preset ('workspace-write' | 'read-only' | 'danger-full-access'); omitted = default. */\n  permission?: string\n  /** Acceptance checklist item texts (host mints ids, all unchecked). */\n  checklist?: string[]\n}\n\n/** Update-task request body (ifVersion mandatory). */\nexport type UpdateTaskBody = {\n  ifVersion: number\n  title?: string\n  description?: string\n  prompt?: string\n  urgency?: string\n  blocked?: boolean\n  /** Rebind the task to another project (GUI owner surface only). */\n  workspaceId?: string\n  execution?: { mode?: string; cron?: string }\n  model?: TaskModel | null\n  /** Change isolation; locked once the task has execution history. */\n  isolation?: string\n  /** Change the execution preset (takes effect on the next run). */\n  presetId?: string | null\n  /** Change the execution permission (0.5.5; 'workspace-write' | 'read-only' | 'danger-full-access'). */\n  permission?: string | null\n  /** Replace the whole checklist (GUI owner surface); null clears it. */\n  checklist?: unknown\n}\n\n/** Move-task request body (ifVersion mandatory; the user MAY move to done). */\nexport type MoveTaskBody = { ifVersion: number; status: string; archiveSessions?: boolean }\n\nexport type SessionArchiveResult = { archived: string[]; failed: Array<{ sessionId: string; error: string }>; unsupported: string[] }\nexport type MoveTaskResponse = TaskSummary & { sessionArchive?: SessionArchiveResult }\n\n/**\n * Quick-reject request body (card ✗ button): move back to todo plus an\n * optional user comment, committed as ONE ledger mutation so a failed move\n * can never strand an orphan comment.\n */\nexport type RejectTaskBody = { ifVersion: number; body?: string }\n\n/** Comment request body. */\nexport type CommentBody = { body: string }\n\n/** One content-addressed image uploaded outside the ledger. */\nexport type AttachmentUpload = {\n  id: string\n  name: string\n  size: number\n  url: string\n  extension: 'png' | 'jpg' | 'gif' | 'webp'\n  mime: 'image/png' | 'image/jpeg' | 'image/gif' | 'image/webp'\n}\n\n/** Delete request body (purge=true physically removes a trashed task). */\nexport type DeleteTaskBody = { ifVersion?: number; purge?: boolean }\n\n/** Run request body; `reuse: true` = 续跑 (keep a live worktree as-is). */\nexport type RunTaskBody = { reuse?: boolean }\n\n/** One repo's merge outcome in a multi-repo merge (0.6.3; `repo: ''` = the workspace root repo). */\nexport type MergeRepoResult = {\n  repo: string\n  branch: string\n  outcome: 'merged' | 'noop' | 'failed'\n  /** Failure reason (verbatim git message) when outcome = 'failed'. */\n  error?: string\n}\n\n/**\n * Merge outcome. Legacy single-repo tasks keep the flat shape; multi-repo\n * mirror tasks (0.6.3) additionally return per-repo results — merges run\n * sequentially and a failed repo does not block the others (plan §4.5).\n */\nexport type MergeBranchResponse = {\n  merged: boolean\n  noop?: boolean\n  /** The merged task branch (legacy single-repo shape; multi-repo responses omit it). */\n  branch?: string\n  /** Present only on multi-repo mirror merges (0.6.3). */\n  results?: MergeRepoResult[]\n}\n\n/** Remove a task's worktree; optionally delete its branch too. */\nexport type WorktreeRemoveBody = { deleteBranch?: boolean }\n\n/** One orphan worktree directory (exists on disk, owned by no live task). */\nexport type OrphanWorktree = { workspaceId: string; workspacePath: string; taskId: string; path: string }\n\n/** A git-enabled workspace whose .gitignore does not cover the worktree dir. */\nexport type GitignoreSuggestion = { workspaceId: string; workspacePath: string }\n\n/** Health-diagnostics response (⚙ panel). */\nexport type DiagnosticsResponse = {\n  revision: number\n  tasks: number\n  /** Executions currently marked `running`. */\n  staleRunning: number\n  /** Worktree directories whose task no longer exists in the ledger. */\n  orphanWorktrees: OrphanWorktree[]\n  /** Git workspaces whose .gitignore does not ignore the worktree dir. */\n  gitIgnoreSuggestions: GitignoreSuggestion[]\n}\n\n/** Fields a task template may prefill (0.4.0). */\nexport type TaskTemplateSpec = {\n  title?: string\n  description?: string\n  prompt?: string\n  urgency?: string\n  execution?: { mode?: string; cron?: string }\n  model?: TaskModel\n  isolation?: string\n  presetId?: string\n  /** Execution permission preset (0.5.5). */\n  permission?: string\n  /** Checklist item texts (host mints ids at create time). */\n  checklist?: string[]\n}\n\n/** One reusable task template (0.4.0). */\nexport type TaskTemplate = {\n  id: string\n  name: string\n  task: TaskTemplateSpec\n  /** Seeded built-in templates (kept on load, deletable like any other). */\n  builtin?: boolean\n  createdAt: number\n  updatedAt: number\n}\n\n/** Templates listing response. */\nexport type TemplatesResponse = { templates: TaskTemplate[] }\n\n/** Board-settings response (0.5.0; absent fields follow factory defaults). */\nexport type SettingsResponse = BoardSettings\n\n/** Current host-side location of all durable taskboard data. */\nexport type StorageStatus = {\n  currentDirectory: string\n  defaultDirectory: string\n  isDefault: boolean\n  configured: boolean\n  writable: boolean\n  assetCount: number\n  assetBytes: number\n  checkedDirectory?: string\n  error?: string\n}\n\n/** Completed storage relocation, including non-fatal old-file cleanup failures. */\nexport type StorageMigrationResult = StorageStatus & { migrated: boolean; warnings: string[] }\n\n/** Update-board-settings request body (0.5.0; whole-object replace semantics). */\nexport type UpdateSettingsBody = {\n  /** Default code isolation for NEW tasks ('worktree' | 'none'). */\n  defaultIsolation?: string\n  /** Automatically capture external workspace sessions into the taskboard. */\n  syncExternalSessions?: boolean\n  /** Default permission preset for NEW tasks ('workspace-write' | 'read-only' | 'danger-full-access'). */\n  defaultPermission?: string\n}\n\n/** Prompt completion item for skills and slash commands (0.5.5). */\nexport type PromptCompletionItem = {\n  name: string\n  kind: 'skill' | 'command'\n  description?: string\n  hint?: string\n}\n\n/** Prompt completions response (0.5.5). */\nexport type PromptCompletionsResponse = {\n  commands: PromptCompletionItem[]\n  skills: PromptCompletionItem[]\n}\n\n/** Model item in catalog (0.5.5). */\nexport type CatalogModelItem = {\n  provider: string\n  model: string\n  name?: string\n  description?: string\n  reasoning?: {\n    efforts: Array<{ id: string; name: string; description?: string }>\n    defaultEffort?: string\n  }\n}\n\n/** Preset item in catalog (0.5.5). */\nexport type CatalogPresetItem = {\n  id: string\n  name?: string\n}\n\n/** Model and preset catalog response (0.5.5). */\nexport type ModelCatalogResponse = {\n  models: CatalogModelItem[]\n  presets: CatalogPresetItem[]\n  defaultPresetId?: string\n}\n\n/** Import dry-run response (0.4.0): every task classified, nothing written. */\nexport type ImportPreviewResponse = {\n  plan: {\n    create: Array<{ id: string; title: string; status: string }>\n    overwrite: Array<{ id: string; title: string; status: string }>\n    invalid: Array<{ id?: string; reason: string }>\n  }\n}\n\n/** Import commit response. */\nexport type ImportCommitResponse = {\n  mode: 'merge' | 'replace'\n  created: number\n  overwritten: number\n  replacedTotal?: number\n  /** The backup file written BEFORE a replace wiped the live ledger. */\n  backupFile?: string\n}\n\n/** Diff-viewer response (0.4.0). */\nexport type DiffResponse = { diff: string; truncated: boolean }\n\n/** One task (full record) response. */\nexport type TaskResponse = TaskRecord\n\n/** Summary response used by list-ish endpoints. */\nexport type SummaryResponse = { tasks: TaskSummary[] }\n\n// ---------------------------------------------------------------------------\n// SSE\n// ---------------------------------------------------------------------------\n\n/** Change frame pushed on every committed ledger mutation. */\nexport type ChangeEvent = {\n  revision: number\n  kind: 'task-created' | 'task-updated' | 'task-moved' | 'task-deleted' | 'comment-added' | 'execution-recorded' | 'settings-updated' | 'ledger-replaced'\n  tasks: TaskSummary[]\n}\n"],"mappings":";;AAYA,MAAa,eAAe;;AAG5B,MAAa,WAAW"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-taskboard",
   "description": "Agent-first task board for the DSH web GUI: host-authoritative task ledger with taskboard_* agent tools, project (= workspace) claim boundaries, per-task model execution in fresh sessions, optional per-task git-worktree isolation (dedicated task branches, commit evidence, one-click merge), host-side cron scheduling, and a live SSE kanban view. Mounts via the official dsh plugin system — no DSH source changes.",
-  "version": "0.6.7",
+  "version": "0.7.0",
   "type": "module",
   "main": "lib/index.js",
   "exports": {
@@ -26,8 +26,9 @@
         "0.1.2-alpha.2": "compatible",
         "0.1.2-alpha.3": "compatible",
         "0.1.2-alpha.4": "compatible",
-        "0.1.2-alpha.5": "compatible",
-        "0.1.2-rc.1": "compatible"
+        "0.1.2-alpha.5": "compatible",
+        "0.1.2-rc.1": "compatible",
+        "0.1.5-rc.1": "compatible"
       }
     }
   },
@@ -68,14 +69,14 @@
     "test": "vitest run"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-agent": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-home-paths": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-system-prompt": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-tools": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-workspace": "^0.1.1-rc.2",
-    "@deepseek-ai/schemastery": "^3.18.1",
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-agent": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-home-paths": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-system-prompt": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-tools": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-workspace": "^0.1.5-rc.2",
+    "@deepseek-ai/schemastery": "^3.18.2",
     "@types/node": "^22.20.1",
     "@types/react": "~18.3.1",
     "@types/react-dom": "^18.3.7",

package/src/client/api.ts

@@ -7,6 +7,7 @@
  */
 import type {
   ApiResult,
+  AttachmentUpload,
   ChangeEvent,
   CreateTaskBody,
   DeleteTaskBody,
@@ -23,6 +24,8 @@ import type {
   RejectTaskBody,
   RunTaskBody,
   SettingsResponse,
+  StorageMigrationResult,
+  StorageStatus,
   StateResponse,
   TaskRecord,
   TaskTemplate,
@@ -60,6 +63,17 @@ async function post<T>(path: string, body: unknown): Promise<T> {
   return unwrap<T>(res)
 }
 
+/** Upload raw image bytes; a custom header keeps the route outside simple CSRF requests. */
+async function uploadImage(file: Blob): Promise<AttachmentUpload> {
+  const res = await fetch('/dsh-taskboard/assets', {
+    method: 'POST',
+    headers: { 'content-type': file.type, 'x-dsh-taskboard-upload': '1' },
+    body: file,
+    signal: AbortSignal.timeout(30_000),
+  })
+  return unwrap<AttachmentUpload>(res)
+}
+
 /** Route client face (the controller consumes this narrow surface). */
 export interface TaskboardClient {
   state(): Promise<StateResponse>
@@ -72,6 +86,8 @@ export interface TaskboardClient {
   /** Quick-reject (card ✗): back to todo + optional comment, one mutation. */
   reject(id: string, body: RejectTaskBody): Promise<TaskSummary>
   comment(id: string, bodyText: string): Promise<CommentRecord>
+  /** Persist an image and return the short Markdown-safe URL. */
+  uploadImage(file: Blob): Promise<AttachmentUpload>
   remove(id: string, body: DeleteTaskBody): Promise<{ trashed?: boolean; purged?: boolean }>
   /** Trigger a manual run (fresh in-project session); `reuse: true` = 续跑. */
   run(id: string, body?: RunTaskBody): Promise<{ executionId: string; sessionId: string }>
@@ -101,6 +117,11 @@ export interface TaskboardClient {
   settings(): Promise<SettingsResponse>
   /** Replace board settings (whole-object semantics; affects new tasks only). */
   updateSettings(body: UpdateSettingsBody): Promise<SettingsResponse>
+  /** Inspect and validate the host-side data directory. */
+  storage(): Promise<StorageStatus>
+  checkStorage(directory: string): Promise<StorageStatus>
+  /** Move ledger, templates, and attachments together. */
+  migrateStorage(directory: string): Promise<StorageMigrationResult>
   /** Prompt completions for skills and slash commands (0.5.5). */
   promptCompletions(): Promise<PromptCompletionsResponse>
   /** Model catalog and agent preset roster (0.5.5). */
@@ -121,6 +142,7 @@ export function createClient(): TaskboardClient {
     archiveSessions: id => post(`/dsh-taskboard/tasks/${encodeURIComponent(id)}/archive-sessions`, {}),
     reject: (id, body) => post(`/dsh-taskboard/tasks/${encodeURIComponent(id)}/reject`, body),
     comment: (id, bodyText) => post(`/dsh-taskboard/tasks/${encodeURIComponent(id)}/comment`, { body: bodyText }),
+    uploadImage,
     remove: (id, body) => post(`/dsh-taskboard/tasks/${encodeURIComponent(id)}/delete`, body),
     run: (id, body) => post(`/dsh-taskboard/tasks/${encodeURIComponent(id)}/run`, body ?? {}),
     cancel: id => post(`/dsh-taskboard/tasks/${encodeURIComponent(id)}/cancel`, {}),
@@ -142,6 +164,14 @@ export function createClient(): TaskboardClient {
     templateDelete: id => post('/dsh-taskboard/templates/delete', { id }),
     settings: () => get<SettingsResponse>('/dsh-taskboard/settings'),
     updateSettings: body => post('/dsh-taskboard/settings/update', body),
+    storage: () => get<StorageStatus>('/dsh-taskboard/storage'),
+    checkStorage: directory => post<StorageStatus>('/dsh-taskboard/storage/check', { directory }),
+    migrateStorage: directory => unwrap<StorageMigrationResult>(fetch('/dsh-taskboard/storage/migrate', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ directory }),
+      signal: AbortSignal.timeout(120_000),
+    })),
     promptCompletions: () => get<PromptCompletionsResponse>('/dsh-taskboard/prompt-completions'),
     modelCatalog: () => get<ModelCatalogResponse>('/dsh-taskboard/model-catalog'),
     stream(onChange, onGap) {

package/src/client/board/SettingsModal.tsx

@@ -1,13 +1,12 @@
 /**
  * Board-settings modal (0.5.0): the user-owned defaults applied when a NEW
- * task is created without an explicit choice. Currently one section — 默认执行
- * 隔离 (worktree vs original directory); further sections can slot into the
- * body below. Saving goes through the host route (whole-object replace) and
+ * task is created without an explicit choice, plus the host data-directory
+ * migration surface. Saving goes through host routes and
  * the SSE change stream refreshes every open view.
  *
  * @module dsh-taskboard/client/board/SettingsModal
  */
-import { useState } from 'react'
+import { useEffect, useState } from 'react'
 import type { BoardController } from '../controller.ts'
 import { DEFAULT_ISOLATION, defaultPermissionOf, defaultSyncExternalSessionsOf, type IsolationMode, type PermissionMode } from '../../shared/protocol.ts'
 import { useT, type Translate } from '../i18n/runtime.ts'
@@ -32,7 +31,16 @@ export function SettingsModal({ controller }: { controller: BoardController }) {
   const [draftIso, setDraftIso] = useState<IsolationMode>(currentIso)
   const [draftSync, setDraftSync] = useState<boolean>(currentSync)
   const [draftPerm, setDraftPerm] = useState<PermissionMode>(currentPerm)
+  const [storagePath, setStoragePath] = useState(state.storage?.currentDirectory ?? '')
+  const [storageTouched, setStorageTouched] = useState(false)
+  const [storageBusy, setStorageBusy] = useState(false)
   const dirty = draftIso !== currentIso || draftSync !== currentSync || draftPerm !== currentPerm
+  const effectiveStoragePath = storagePath.trim().length === 0 ? state.storage?.defaultDirectory ?? '' : storagePath.trim()
+  const storageDirty = state.storage !== undefined && effectiveStoragePath !== state.storage.currentDirectory
+
+  useEffect(() => {
+    if (!storageTouched && state.storage !== undefined) setStoragePath(state.storage.currentDirectory)
+  }, [state.storage, storageTouched])
 
   const save = (): void => {
     void controller.updateSettings({
@@ -145,6 +153,61 @@ export function SettingsModal({ controller }: { controller: BoardController }) {
               {t('set.perm.current', { current: currentPerm === 'read-only' ? t('set.perm.readOnlyName') : currentPerm === 'danger-full-access' ? t('set.perm.fullName') : t('set.perm.writeName') })}
             </span>
           </section>
+
+          <section className="dsh-atb-diag-sec">
+            <h4>{t('set.storage.heading')}</h4>
+            <p className="dsh-atb-isolation-note">{t('set.storage.hint')}</p>
+            <input
+              className="dsh-atb-input dsh-atb-storage-path"
+              value={storagePath}
+              disabled={state.storage === undefined || storageBusy}
+              placeholder={state.storage?.defaultDirectory ?? t('set.storage.loading')}
+              onChange={e => { setStoragePath(e.target.value); setStorageTouched(true) }}
+            />
+            {state.storage !== undefined && (
+              <div className="dsh-atb-storage-meta">
+                <span>{t('set.storage.current', { path: state.storage.currentDirectory })}</span>
+                <span>{t('set.storage.assets', { count: state.storage.assetCount, size: (state.storage.assetBytes / 1024 / 1024).toFixed(1) })}</span>
+                {state.storage.error !== undefined && <span className="dsh-atb-storage-error">{state.storage.error}</span>}
+              </div>
+            )}
+            <div className="dsh-atb-storage-actions">
+              <button
+                type="button"
+                className="dsh-atb-btn"
+                disabled={state.storage === undefined || storageBusy}
+                onClick={() => { setStoragePath(state.storage?.defaultDirectory ?? ''); setStorageTouched(true) }}
+              >
+                {t('set.storage.default')}
+              </button>
+              <button
+                type="button"
+                className="dsh-atb-btn"
+                disabled={state.storage === undefined || storageBusy || effectiveStoragePath.length === 0}
+                onClick={() => {
+                  setStorageBusy(true)
+                  void controller.checkStorage(effectiveStoragePath).finally(() => setStorageBusy(false))
+                }}
+              >
+                {t('set.storage.check')}
+              </button>
+              <button
+                type="button"
+                className="dsh-atb-btn"
+                data-primary="true"
+                disabled={!storageDirty || storageBusy}
+                onClick={() => {
+                  if (!window.confirm(t('set.storage.confirm', { from: state.storage?.currentDirectory ?? '', to: effectiveStoragePath }))) return
+                  setStorageBusy(true)
+                  void controller.migrateStorage(effectiveStoragePath).then(ok => {
+                    if (ok) { setStorageTouched(false); setStoragePath(effectiveStoragePath) }
+                  }).finally(() => setStorageBusy(false))
+                }}
+              >
+                {storageBusy ? t('set.storage.migrating') : t('set.storage.migrate')}
+              </button>
+            </div>
+          </section>
         </div>
 
         <div className="dsh-atb-modal-foot">

package/src/client/board/SlashPromptInput.tsx

@@ -11,6 +11,7 @@ import { createPortal } from 'react-dom'
 import type { BoardController } from '../controller.ts'
 import type { PromptCompletionItem } from '../../shared/api.ts'
 import { useT, type Translate } from '../i18n/runtime.ts'
+import { IMAGE_ACCEPT, acceptedImageFiles, imageAlt, imageMarkdown, insertImageMarkdown } from '../image-insert.ts'
 
 /** Default built-in slash commands (descriptions resolve through t at render,
  * so they follow the GUI language live; host-provided items override by name). */
@@ -65,6 +66,8 @@ export interface SlashPromptInputProps {
   autoFocus?: boolean
   className?: string
   ariaLabel?: string
+  allowImages?: boolean
+  onUploadingChange?: (uploading: boolean) => void
 }
 
 /**
@@ -81,11 +84,14 @@ export function SlashPromptInput({
   autoFocus = false,
   className,
   ariaLabel,
+  allowImages = false,
+  onUploadingChange,
 }: SlashPromptInputProps) {
   const t = useT()
   const textareaRef = useRef<HTMLTextAreaElement>(null)
   const popupRef = useRef<HTMLDivElement>(null)
   const listRef = useRef<HTMLDivElement>(null)
+  const fileInputRef = useRef<HTMLInputElement>(null)
   // Inline fixed-position style for the portaled popup (set by positionPopup).
   const [popupStyle, setPopupStyle] = useState<CSSProperties>({})
 
@@ -106,6 +112,40 @@ export function SlashPromptInput({
   const [slashQuery, setSlashQuery] = useState('')
   const [slashStart, setSlashStart] = useState(-1)
   const [selectedIndex, setSelectedIndex] = useState(0)
+  const [uploading, setUploading] = useState(false)
+
+  const uploadFiles = async (rawFiles: Iterable<File>): Promise<void> => {
+    const files = acceptedImageFiles(rawFiles)
+    if (!allowImages || controller === undefined || files.length === 0 || uploading) return
+    setUploading(true)
+    onUploadingChange?.(true)
+    const element = textareaRef.current
+    let nextValue = element?.value ?? value
+    let start = element?.selectionStart ?? nextValue.length
+    let end = element?.selectionEnd ?? start
+    let changed = false
+    try {
+      for (const file of files) {
+        const asset = await controller.uploadImage(file)
+        if (asset === undefined) continue
+        const next = insertImageMarkdown(nextValue, start, end, imageMarkdown(asset, imageAlt(file.name, t('image.defaultAlt'))))
+        nextValue = next.value
+        start = next.cursor
+        end = start
+        changed = true
+      }
+      if (changed) {
+        onChange(nextValue)
+        setTimeout(() => {
+          textareaRef.current?.focus()
+          textareaRef.current?.setSelectionRange(start, start)
+        }, 0)
+      }
+    } finally {
+      setUploading(false)
+      onUploadingChange?.(false)
+    }
+  }
 
   // Fetch host completions if controller provided
   useEffect(() => {
@@ -282,7 +322,7 @@ export function SlashPromptInput({
           value={value}
           rows={rows}
           maxLength={maxLength}
-          disabled={disabled}
+          disabled={disabled || uploading}
           autoFocus={autoFocus}
           placeholder={placeholder}
           aria-label={ariaLabel}
@@ -293,6 +333,25 @@ export function SlashPromptInput({
           onKeyUp={checkSlashTrigger}
           onClick={checkSlashTrigger}
           onKeyDown={handleKeyDown}
+          onPaste={e => {
+            const files = acceptedImageFiles(e.clipboardData.files)
+            if (allowImages && files.length > 0) {
+              e.preventDefault()
+              void uploadFiles(files)
+            }
+          }}
+          onDragOver={e => {
+            // Browsers keep DataTransfer.files empty while dragging over a
+            // page; the concrete files become readable only on drop.
+            if (allowImages && e.dataTransfer.types.includes('Files')) e.preventDefault()
+          }}
+          onDrop={e => {
+            const files = acceptedImageFiles(e.dataTransfer.files)
+            if (allowImages && files.length > 0) {
+              e.preventDefault()
+              void uploadFiles(files)
+            }
+          }}
         />
 
         {/* Slash Autocomplete Popup — portaled to document.body so the
@@ -329,6 +388,26 @@ export function SlashPromptInput({
         )}
       </div>
 
+      {allowImages && (
+        <div className="dsh-atb-image-actions">
+          <input
+            ref={fileInputRef}
+            type="file"
+            accept={IMAGE_ACCEPT}
+            multiple
+            hidden
+            onChange={e => {
+              if (e.target.files !== null) void uploadFiles(e.target.files)
+              e.target.value = ''
+            }}
+          />
+          <button type="button" className="dsh-atb-image-add" disabled={disabled || uploading} onClick={() => fileInputRef.current?.click()}>
+            {uploading ? t('image.uploading') : t('image.add')}
+          </button>
+          <span className="dsh-atb-image-hint">{t('image.hint')}</span>
+        </div>
+      )}
+
       {/* Bottom helper toolbar */}
       <div className="dsh-atb-prompt-foot">
         <span className="dsh-atb-prompt-tip">

package/src/client/board/TaskDetail.tsx

@@ -7,7 +7,7 @@
  *
  * @module dsh-taskboard/client/board/TaskDetail
  */
-import { useEffect, useState, type ReactNode } from 'react'
+import { useEffect, useRef, useState, type ReactNode } from 'react'
 import type { BoardController } from '../controller.ts'
 import type { CommentRecord, ExecutionRecord, TaskRecord } from '../../shared/protocol.ts'
 import { canTransition, checklistProgress, taskAssociatedSessionIds } from '../../shared/protocol.ts'
@@ -15,6 +15,7 @@ import { useAlert } from './AlertModal.tsx'
 import { fmtTime, isStaleClaim } from './format.ts'
 import { MOVE_KEYS, OUTCOME_KEYS, STATUS_KEYS, URGENCY_KEYS } from './labels.ts'
 import { useT, type Translate } from '../i18n/runtime.ts'
+import { IMAGE_ACCEPT, acceptedImageFiles, imageAlt, imageMarkdown, insertImageMarkdown } from '../image-insert.ts'
 
 /** Statuses a user may move this task to, per the state machine. */
 function moveTargets(task: TaskRecord): TaskRecord['status'][] {
@@ -514,6 +515,9 @@ function IsolationBlock({ task, controller }: { task: TaskRecord; controller: Bo
 export function TaskDetail({ task, controller, now }: { task: TaskRecord; controller: BoardController; now?: number }) {
   const t = useT()
   const [comment, setComment] = useState('')
+  const [commentUploading, setCommentUploading] = useState(false)
+  const commentRef = useRef<HTMLTextAreaElement>(null)
+  const commentFileRef = useRef<HTMLInputElement>(null)
   const [confirmDone, setConfirmDone] = useState(false)
   const [confirmPurge, setConfirmPurge] = useState(false)
   const [confirmCancel, setConfirmCancel] = useState(false)
@@ -542,6 +546,42 @@ export function TaskDetail({ task, controller, now }: { task: TaskRecord; contro
     void action().catch(() => undefined).finally(() => setActionBusy(false))
   }
 
+  const postComment = (): void => {
+    if (commentUploading || comment.trim().length === 0) return
+    void controller.comment(task.id, comment).then(ok => { if (ok) setComment('') })
+  }
+
+  const uploadCommentImages = async (rawFiles: Iterable<File>): Promise<void> => {
+    const files = acceptedImageFiles(rawFiles)
+    if (files.length === 0 || commentUploading) return
+    setCommentUploading(true)
+    const element = commentRef.current
+    let nextValue = element?.value ?? comment
+    let start = element?.selectionStart ?? nextValue.length
+    let end = element?.selectionEnd ?? start
+    let changed = false
+    try {
+      for (const file of files) {
+        const asset = await controller.uploadImage(file)
+        if (asset === undefined) continue
+        const next = insertImageMarkdown(nextValue, start, end, imageMarkdown(asset, imageAlt(file.name, t('image.defaultAlt'))))
+        nextValue = next.value
+        start = next.cursor
+        end = start
+        changed = true
+      }
+      if (changed) {
+        setComment(nextValue)
+        setTimeout(() => {
+          commentRef.current?.focus()
+          commentRef.current?.setSelectionRange(start, start)
+        }, 0)
+      }
+    } finally {
+      setCommentUploading(false)
+    }
+  }
+
   /** Jump to an execution's session; prompt precisely when it cannot open. */
   const jumpToSession = (sessionId: string): void => {
     void controller.openSession(sessionId).then(result => {
@@ -836,7 +876,7 @@ export function TaskDetail({ task, controller, now }: { task: TaskRecord; contro
                         <b>{c.threadId !== undefined ? `agent ${shortId(c.threadId)}` : t('detail.comments.user')}</b>
                         <span>{fmtTime(c.createdAt)}</span>
                       </div>
-                      <div className="dsh-atb-bubble-body">{commentBody(t, c)}</div>
+                      <div className="dsh-atb-bubble-body"><MarkdownContent text={commentBody(t, c)} /></div>
                     </div>
                   </div>
                 ))}
@@ -844,24 +884,47 @@ export function TaskDetail({ task, controller, now }: { task: TaskRecord; contro
             )}
         <div className="dsh-atb-composer">
           <textarea
+            ref={commentRef}
             className="dsh-atb-composer-input"
             value={comment}
             placeholder={t('detail.composer.placeholder')}
+            disabled={commentUploading}
             onChange={e => setComment(e.target.value)}
             onKeyDown={e => {
-              if ((e.ctrlKey || e.metaKey) && e.key === 'Enter' && comment.trim().length > 0) {
+              if ((e.ctrlKey || e.metaKey) && e.key === 'Enter' && comment.trim().length > 0 && !commentUploading) {
                 // T13: keep the draft when the post fails (reject 表单同样保留).
-                void controller.comment(task.id, comment).then(ok => { if (ok) setComment('') })
+                postComment()
               }
             }}
+            onPaste={e => {
+              const files = acceptedImageFiles(e.clipboardData.files)
+              if (files.length > 0) { e.preventDefault(); void uploadCommentImages(files) }
+            }}
+            onDragOver={e => { if (e.dataTransfer.types.includes('Files')) e.preventDefault() }}
+            onDrop={e => {
+              const files = acceptedImageFiles(e.dataTransfer.files)
+              if (files.length > 0) { e.preventDefault(); void uploadCommentImages(files) }
+            }}
+          />
+          <input
+            ref={commentFileRef}
+            type="file"
+            accept={IMAGE_ACCEPT}
+            multiple
+            hidden
+            onChange={e => {
+              if (e.target.files !== null) void uploadCommentImages(e.target.files)
+              e.target.value = ''
+            }}
           />
+          <button type="button" className="dsh-atb-image-add" disabled={commentUploading} title={t('image.add')} onClick={() => commentFileRef.current?.click()}>
+            {commentUploading ? '…' : '🖼'}
+          </button>
           <button
             type="button"
             className="dsh-atb-composer-send"
-            disabled={comment.trim().length === 0}
-            onClick={() => {
-              void controller.comment(task.id, comment).then(ok => { if (ok) setComment('') })
-            }}
+            disabled={comment.trim().length === 0 || commentUploading}
+            onClick={postComment}
           >
             {t('detail.composer.send')}
           </button>

package/src/client/board/TaskFormModal.tsx

@@ -212,6 +212,7 @@ export function TaskFormModal({ controller, task }: { controller: BoardControlle
   // create/update/run round-trip is pending — a double click used to fire
   // duplicate creates (and runs) before the first one returned (review P0).
   const [busy, setBusy] = useState(false)
+  const [imageUploading, setImageUploading] = useState(false)
 
   // Focus the title and close on Esc while the dialog is open.
   useEffect(() => {
@@ -294,7 +295,7 @@ export function TaskFormModal({ controller, task }: { controller: BoardControlle
   }
 
   const submit = (): void => {
-    if (!valid || busy) return
+    if (!valid || busy || imageUploading) return
     const picked = buildPickedModel()
     if (!editing) saveLastModel(picked)
     const isolationOut = isolationPayload()
@@ -335,7 +336,7 @@ export function TaskFormModal({ controller, task }: { controller: BoardControlle
 
   /** Save the form, then immediately trigger a manual run of the task. */
   const submitAndRun = (): void => {
-    if (!valid || runBlocked || busy) return
+    if (!valid || runBlocked || busy || imageUploading) return
     const picked = buildPickedModel()
     if (!editing) saveLastModel(picked)
     const isolationOut = isolationPayload()
@@ -602,6 +603,8 @@ export function TaskFormModal({ controller, task }: { controller: BoardControlle
                 controller={controller}
                 rows={7}
                 placeholder={t('form.desc.placeholder')}
+                allowImages
+                onUploadingChange={setImageUploading}
               />
             </Field>
 
@@ -624,13 +627,13 @@ export function TaskFormModal({ controller, task }: { controller: BoardControlle
             <button
               type="button"
               className="dsh-atb-btn"
-              disabled={!valid || runBlocked || busy}
-              title={runBlocked ? t('form.action.runBlockedTitle') : busy ? t('form.action.runBusyTitle') : t('form.action.runTitle')}
+              disabled={!valid || runBlocked || busy || imageUploading}
+              title={runBlocked ? t('form.action.runBlockedTitle') : busy || imageUploading ? t('form.action.runBusyTitle') : t('form.action.runTitle')}
               onClick={submitAndRun}
             >
               {t('form.action.run')}
             </button>
-            <button type="button" className="dsh-atb-btn" data-primary="true" disabled={!valid || busy} onClick={submit}>
+            <button type="button" className="dsh-atb-btn" data-primary="true" disabled={!valid || busy || imageUploading} onClick={submit}>
               {editing ? t('form.action.save') : t('form.action.create')}
             </button>
           </span>