dsh-todo-inbox 0.1.0

package/README.md

@@ -0,0 +1,28 @@
+# DSH 待办插件 dsh-todo-inbox
+
+一个 DeepSeek Harness Web 插件：任何会话的 agent 都能把"等待人类处理"的事（合并 MR、审批工单、评审、发布……）登记到一个全局待办收件箱，你在侧边栏里统一查看和处理，不再因为并行多个会话而漏掉。
+
+## 功能
+
+- **侧边栏入口**：宽侧边栏底部显示"待办"区块（未完成数角标），点击标题折叠/展开；窄侧边栏是圆形按钮，点击展开侧边栏。
+- **处理待办**：待办标题若是外部链接则点击打开；详情内容点击跳转到登记它的来源会话；hover 显示 完成 ✓ / 删除 ✕。
+- **跨会话共享**：所有会话的 agent 通过 `inbox_add` / `inbox_done` / `inbox_list` 工具读写同一个收件箱；数据落盘 `~/.dsh/todo-inbox.json`，进程重启不丢失。
+- **detail 支持简单 markdown**：`**粗体**`、`*斜体*`、`` `代码` ``、`[文字](url)`、裸链接自动识别。
+
+## 安装
+
+```bash
+cd ~/dsh-todo-inbox && pnpm install && pnpm run build
+dsh plugin --profile web add ~/dsh-todo-inbox
+# 重启 dsh web，侧边栏底部出现"待办"区块即成功
+```
+
+## 使用
+
+**给人看**：待办出现在侧边栏（宽态为会话列表下方的区块，窄态为底部圆形按钮），角标是未完成数；hover 条目点 ✓ 完成、✕ 删除，点标题打开关联链接、点详情跳转来源会话。
+
+**给 agent 用**：在任何会话里让 agent 登记待办，例如：
+
+> "帮我登记一条待办：合并 xxx 仓库的 MR !1234"
+
+agent 会调用 `inbox_add` 写入收件箱；你也可以让 agent 用 `inbox_list` 检查当前有几条待办。agent 也可以直接编辑 `~/.dsh/todo-inbox.json`（往 `items` 数组追加一条记录），5 秒内自动同步到界面。

package/cordis.patch.yml

@@ -0,0 +1,20 @@
+# dsh-todo-inbox bundle patch
+#
+# This file is the `dsh.bundle.patch` layer of the package: when the plugin is
+# installed through the official CLI —
+#
+#   dsh plugin --profile <name> add <path-or-name>
+#
+# — the command reconciles `dsh.profile.bundles` against installed packages
+# and, seeing this declaration, appends the package to the bundle stack. The
+# profile boot then merges THIS patch (a single `insert` of the plugin row)
+# into the composition: the host half mounts process-wide and registers the
+# inbox_* tools for every session; the browser half is served as
+# /plugins/todo-inbox/client.js and registers the sidebar footer action.
+#
+# Do NOT add a second manual mount line in the profile's own cordis.patch.yml
+# — one mount only (two mounts register /todo-inbox/api twice and fail the
+# whole plugin tree at boot with "duplicate prefix route").
+- insert:
+    - id: todo-inbox
+      name: 'dsh-todo-inbox'

package/lib/client.js

@@ -0,0 +1,479 @@
+window.__ModuleLoader__.load({
+	id: "dsh-todo-inbox",
+	factory: (require) => {
+		var module = { exports: {} };
+		var exports = module.exports;
+		Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+		//#region \0rolldown/runtime.js
+		var __create = Object.create;
+		var __defProp = Object.defineProperty;
+		var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+		var __getOwnPropNames = Object.getOwnPropertyNames;
+		var __getProtoOf = Object.getPrototypeOf;
+		var __hasOwnProp = Object.prototype.hasOwnProperty;
+		var __copyProps = (to, from, except, desc) => {
+			if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+				key = keys[i];
+				if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+					get: ((k) => from[k]).bind(null, key),
+					enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+				});
+			}
+			return to;
+		};
+		var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
+			value: mod,
+			enumerable: true
+		}) : target, mod));
+		//#endregion
+		let react = require("react");
+		react = __toESM(react, 1);
+		let _deepseek_ai_dsh_client_ui_primitives = require("@deepseek-ai/dsh-client-ui-primitives");
+		let react_jsx_runtime = require("react/jsx-runtime");
+		//#region src/client/index.tsx
+		/**
+		* dsh-todo-inbox browser half: the global inbox, embedded in the sidebar.
+		*
+		* Wide sidebar: a collapsible section stacked above Settings — a header row
+		* (checklist glyph + label + count badge) and an inline list of pending
+		* items with hover-revealed icon actions. Rail sidebar: the standard 36×36
+		* circle button with a corner badge; clicking it expands the sidebar (the
+		* rail has no room for a list).
+		*
+		* All state lives in a module-level store, so the sidebar's wide↔rail
+		* crossfade (which remounts the slot occupant) never loses data or
+		* expansion. Polling starts once at apply time.
+		*
+		* `detail` renders a tiny safe markdown subset (bold / italic / inline code /
+		* [text](url) / bare URLs / line breaks) as React elements — never raw HTML.
+		*
+		* The bundle is compiled to a window.__ModuleLoader__ closure; react and the
+		* ui-primitives icons resolve through the module table at runtime, so this
+		* file must not runtime-import anything else (type-only imports are erased).
+		*
+		* @module dsh-todo-inbox/client
+		*/
+		const name = "todo-inbox-client";
+		const inject = [
+			"slots",
+			"sessions",
+			"layout"
+		];
+		const API = "/todo-inbox/api";
+		/**
+		* Design notes:
+		* - The inline section mirrors the sidebar's own geometry: the header row
+		*   uses the Settings trigger's padding/gap/text (8px gap, 14px label), rows
+		*   use the 8px hover-radius family, and every color is a semantic alias
+		*   token with a light-dark() fallback.
+		* - Rows show a one-line title; detail (markdown-rendered) clamps to two
+		*   lines; actions are icon buttons revealed on row hover / focus-within.
+		* - The rail-mode panel is a menu surface (--dsw-specific-menu + l4 stroke
+		*   ring + prominent shadow, the ContextMeter recipe), draggable by its
+		*   header, with a 200ms rise-and-fade entrance.
+		*/
+		const CSS = `
+  .tib-root { position: relative; }
+  .tib-root.wide { width: calc(100% + 4px); margin: 4px -2px; }
+  .tib-root.rail { width: 36px; margin: 8px 0 10px; }
+
+  /* ── wide mode: inline section ─────────────────────────────────────── */
+  .tib-section { padding-top: 2px; }
+  .tib-section-head {
+    display: flex; align-items: center; gap: 8px; width: 100%;
+    height: 32px; padding: 0 10px 0 8px; box-sizing: border-box;
+    border: none; border-radius: 10px; background: transparent; cursor: pointer;
+    color: var(--dsw-alias-label-primary, light-dark(#333, #ccc));
+    font-family: inherit; font-size: 14px; line-height: 22px;
+  }
+  .tib-section-head:hover {
+    background: var(--dsw-alias-interactive-bg-hover, light-dark(rgba(0,0,0,.05), rgba(255,255,255,.07)));
+  }
+  .tib-head-icon { flex: none; display: grid; place-items: center; color: var(--dsw-alias-label-secondary, light-dark(#555, #bbb)); }
+  .tib-head-label { overflow: hidden; white-space: nowrap; text-overflow: ellipsis; }
+  .tib-chevron { /* unused: header matches the plain icon+label Settings row */ }
+    margin-left: auto; flex: none; display: grid; place-items: center;
+    color: var(--dsw-alias-label-tertiary, light-dark(#888, #999));
+  }
+  .tib-badge {
+    min-width: 18px; padding: 0 6px; height: 16px; line-height: 16px;
+    border-radius: 999px; text-align: center; font-size: 11px; font-weight: 600;
+    background: var(--dsw-alias-brand-primary, light-dark(#4259d1, #7a9bff));
+    color: var(--dsw-alias-brand-primary-invert, #fff);
+  }
+  .tib-list-inline {
+    max-height: min(260px, 32vh); overflow-y: auto; padding: 2px 2px 4px;
+  }
+  .tib-empty-inline {
+    padding: 8px 10px; font-size: .88em;
+    color: var(--dsw-alias-label-tertiary, light-dark(#888, #999));
+  }
+  .tib-row { padding: 5px 8px 5px 32px; border-radius: 8px; }
+  .tib-row:hover {
+    background: var(--dsw-alias-interactive-bg-hover, light-dark(rgba(0,0,0,.04), rgba(255,255,255,.06)));
+  }
+  .tib-row-top { display: flex; align-items: center; gap: 4px; }
+  .tib-row-title {
+    flex: 1; min-width: 0; font-weight: 500; overflow: hidden;
+    text-overflow: ellipsis; white-space: nowrap;
+  }
+  a.tib-row-title { color: inherit; text-decoration: none; }
+  a.tib-row-title:hover { color: var(--dsw-alias-link, light-dark(#1a73e8, #8ab4f8)); }
+  .tib-row-actions {
+    display: flex; gap: 2px; flex: none;
+    opacity: 0; transition: opacity 120ms ease;
+  }
+  .tib-row:hover .tib-row-actions, .tib-row:focus-within .tib-row-actions { opacity: 1; }
+  .tib-icon-btn {
+    display: grid; place-items: center; width: 28px; height: 28px; padding: 0;
+    border: none; border-radius: 50%; corner-shape: round;
+    background: transparent; cursor: pointer;
+    color: var(--dsw-alias-label-tertiary, light-dark(#777, #999));
+  }
+  .tib-icon-btn:hover {
+    background: var(--dsw-alias-interactive-bg-hover, light-dark(rgba(0,0,0,.05), rgba(255,255,255,.07)));
+    color: var(--dsw-alias-label-primary, light-dark(#222, #eee));
+  }
+  .tib-icon-btn.danger:hover {
+    color: var(--dsw-alias-state-error-primary, light-dark(#d93025, #f28b82));
+    background: var(--dsw-alias-interactive-bg-hover-danger, transparent);
+  }
+  .tib-row-detail {
+    margin-top: 1px; font-size: .86em; line-height: 1.45;
+    color: var(--dsw-alias-label-secondary, light-dark(#555, #bbb));
+    white-space: pre-wrap; word-break: break-word;
+    display: -webkit-box; -webkit-line-clamp: 2; -webkit-box-orient: vertical; overflow: hidden;
+  }
+  .tib-row-detail-session { cursor: pointer; }
+  .tib-row-detail-session:hover { color: var(--dsw-alias-label-primary, light-dark(#333, #ccc)); }
+  .tib-row-meta {
+    margin-top: 2px; font-size: .8em; letter-spacing: .01em;
+    color: var(--dsw-alias-label-tertiary, light-dark(#999, #888));
+  }
+  .tib-link { color: var(--dsw-alias-link, light-dark(#1a73e8, #8ab4f8)); text-decoration: none; }
+  .tib-link:hover { text-decoration: underline; }
+  .tib-code {
+    font-family: var(--ds-font-family-code, ui-monospace, monospace);
+    font-size: .92em; padding: 0 4px; border-radius: 4px;
+    background: var(--dsw-alias-bg-base, light-dark(#f0f0f0, #333));
+  }
+
+  /* ── rail mode: circle button only (click expands the sidebar) ─────── */
+  .tib-bell {
+    display: flex; align-items: center; justify-content: center;
+    width: 36px; height: 36px; padding: 0;
+    border: none; border-radius: 50%; corner-shape: round;
+    background: transparent; cursor: pointer;
+    color: var(--dsw-alias-label-primary, light-dark(#333, #ccc));
+  }
+  .tib-bell:hover {
+    background: var(--dsw-alias-interactive-bg-hover, light-dark(rgba(0,0,0,.05), rgba(255,255,255,.07)));
+  }
+  .tib-bell .tib-badge {
+    position: absolute; top: 1px; right: 1px;
+    min-width: 14px; height: 14px; line-height: 14px; padding: 0 4px; font-size: 9px;
+  }
+`;
+		async function listItems() {
+			const response = await fetch(`${API}/items`);
+			if (!response.ok) throw new Error(`inbox list failed: ${response.status}`);
+			return await response.json();
+		}
+		async function mutate(method, body) {
+			const response = await fetch(`${API}/${method}`, {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify(body)
+			});
+			if (!response.ok) throw new Error(`inbox ${method} failed: ${response.status}`);
+		}
+		function isSafeUrl(href) {
+			return /^(https?:|mailto:)/i.test(href);
+		}
+		/**
+		* Render one detail string as React nodes. Supported: `inline code`, **bold**,
+		* *italic*, [text](url), bare https?:// URLs, and line breaks (white-space:
+		* pre-wrap). Anything unmatched renders as plain text — never HTML.
+		* Exported for the smoke test; the loader only consumes name/inject/apply.
+		*/
+		function renderDetail(text, keyBase) {
+			const out = [];
+			let rest = text;
+			let key = 0;
+			while (rest.length > 0) {
+				const code = /^`([^`]+)`/.exec(rest);
+				if (code !== null) {
+					out.push(/* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", {
+						className: "tib-code",
+						children: code[1]
+					}, `${keyBase}-${key}`));
+					key += 1;
+					rest = rest.slice(code[0].length);
+					continue;
+				}
+				const link = /^\[([^\]]+)\]\(([^)\s]+)\)/.exec(rest);
+				if (link !== null) {
+					const href = link[2] ?? "";
+					if (isSafeUrl(href)) out.push(/* @__PURE__ */ (0, react_jsx_runtime.jsx)("a", {
+						className: "tib-link",
+						href,
+						target: "_blank",
+						rel: "noreferrer",
+						children: link[1]
+					}, `${keyBase}-${key}`));
+					else out.push(link[0]);
+					key += 1;
+					rest = rest.slice(link[0].length);
+					continue;
+				}
+				const bold = /^\*\*([^*]+)\*\*/.exec(rest);
+				if (bold !== null) {
+					out.push(/* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", { children: renderDetail(bold[1] ?? "", `${keyBase}-${key}`) }, `${keyBase}-${key}`));
+					key += 1;
+					rest = rest.slice(bold[0].length);
+					continue;
+				}
+				const italic = /^\*([^*]+)\*/.exec(rest);
+				if (italic !== null) {
+					out.push(/* @__PURE__ */ (0, react_jsx_runtime.jsx)("em", { children: renderDetail(italic[1] ?? "", `${keyBase}-${key}`) }, `${keyBase}-${key}`));
+					key += 1;
+					rest = rest.slice(italic[0].length);
+					continue;
+				}
+				const url = /^https?:\/\/[^\s<>"')\]]+/.exec(rest);
+				if (url !== null) {
+					const href = url[0];
+					out.push(/* @__PURE__ */ (0, react_jsx_runtime.jsx)("a", {
+						className: "tib-link",
+						href,
+						target: "_blank",
+						rel: "noreferrer",
+						children: href
+					}, `${keyBase}-${key}`));
+					key += 1;
+					rest = rest.slice(href.length);
+					continue;
+				}
+				const nextSpecial = rest.search(/(`|\*|\[|https?:\/\/)/);
+				if (nextSpecial <= 0) {
+					out.push(rest.slice(0, 1));
+					rest = rest.slice(1);
+				} else {
+					out.push(rest.slice(0, nextSpecial));
+					rest = rest.slice(nextSpecial);
+				}
+			}
+			return out;
+		}
+		/** Jump to the session that recorded this item (source = session id). */
+		function openSourceSession(source) {
+			if (source === "" || inboxStore.sessions === null) return;
+			try {
+				inboxStore.sessions.open(source);
+			} catch (error) {
+				console.error("[todo-inbox] open source session failed", error);
+			}
+		}
+		const inboxStore = {
+			current: {
+				state: {
+					ok: true,
+					pending: 0,
+					items: []
+				},
+				loaded: false,
+				wide: true,
+				sectionOpen: true
+			},
+			listeners: /* @__PURE__ */ new Set(),
+			sessions: null,
+			layout: null
+		};
+		function storeUpdate(patch) {
+			inboxStore.current = {
+				...inboxStore.current,
+				...patch
+			};
+			for (const listener of inboxStore.listeners) listener();
+		}
+		function useInboxStore() {
+			const [, force] = react.default.useReducer((x) => x + 1, 0);
+			react.default.useEffect(() => {
+				inboxStore.listeners.add(force);
+				return () => {
+					inboxStore.listeners.delete(force);
+				};
+			}, []);
+			return inboxStore.current;
+		}
+		let pollTimer = null;
+		async function refreshInbox() {
+			try {
+				storeUpdate({
+					state: await listItems(),
+					loaded: true
+				});
+			} catch (error) {
+				console.error("[todo-inbox] list failed", error);
+			}
+		}
+		function startPolling() {
+			if (pollTimer !== null) return;
+			refreshInbox();
+			pollTimer = setInterval(() => {
+				refreshInbox();
+			}, 1e4);
+		}
+		async function act(method, id) {
+			try {
+				await mutate(method, { id });
+			} catch (error) {
+				console.error(`[todo-inbox] ${method} failed`, error);
+			}
+			refreshInbox();
+		}
+		function itemMeta(item) {
+			return [
+				item.type,
+				item.source ? `来自 ${item.source.startsWith("session-") ? item.source.slice(8) : item.source}` : null,
+				item.dueAt ? `截止 ${item.dueAt.replace("T", " ").slice(0, 16)}` : null
+			].filter(Boolean).join(" · ");
+		}
+		function InlineSection() {
+			const { state, loaded, sectionOpen } = useInboxStore();
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: "tib-section",
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+					className: "tib-section-head",
+					onClick: () => storeUpdate({ sectionOpen: !sectionOpen }),
+					title: "待办",
+					children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "tib-head-icon",
+							children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconChecklistOutline14, { size: 16 })
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "tib-head-label",
+							children: "待办"
+						}),
+						state.pending > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "tib-badge",
+							children: String(state.pending)
+						}) : null
+					]
+				}), sectionOpen ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					className: "tib-list-inline",
+					children: !loaded ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "tib-empty-inline",
+						children: "加载中…"
+					}) : state.items.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "tib-empty-inline",
+						children: "暂无"
+					}) : state.items.map((item) => {
+						const meta = itemMeta(item);
+						return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: "tib-row",
+							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									className: "tib-row-top",
+									children: [item.link ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("a", {
+										className: "tib-row-title",
+										href: item.link,
+										target: "_blank",
+										rel: "noreferrer",
+										title: item.title,
+										children: item.title
+									}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "tib-row-title",
+										title: item.title,
+										children: item.title
+									}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+										className: "tib-row-actions",
+										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											className: "tib-icon-btn",
+											onClick: () => void act("done", item.id),
+											title: "完成",
+											children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconCheckOutline16, { size: 14 })
+										}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											className: "tib-icon-btn danger",
+											onClick: () => void act("remove", item.id),
+											title: "删除",
+											children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconCloseOutline16, { size: 14 })
+										})]
+									})]
+								}),
+								item.detail ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+									className: "tib-row-detail tib-row-detail-session",
+									title: "点击跳转到来源会话",
+									onClick: () => openSourceSession(item.source),
+									children: renderDetail(item.detail, item.id)
+								}) : null,
+								meta ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+									className: "tib-row-meta",
+									children: meta
+								}) : null
+							]
+						}, item.id);
+					})
+				}) : null]
+			});
+		}
+		function RailButton() {
+			const { state } = useInboxStore();
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+				className: "tib-bell",
+				onClick: () => inboxStore.layout?.toggleSidebar(),
+				title: "待办（点击展开侧边栏）",
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconChecklistOutline14, { size: 18 }), state.pending > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+					className: "tib-badge",
+					children: String(state.pending)
+				}) : null]
+			});
+		}
+		/** Slot occupant: pure view over the store; syncs the wide fact into it. */
+		function InboxAction(props) {
+			const wide = Boolean(props.wide);
+			react.default.useEffect(() => {
+				if (inboxStore.current.wide !== wide) storeUpdate({ wide });
+			}, [wide]);
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+				className: `tib-root ${wide ? "wide" : "rail"}`,
+				children: wide ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(InlineSection, {}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(RailButton, {})
+			});
+		}
+		function apply(ctx) {
+			inboxStore.sessions = ctx.sessions;
+			inboxStore.layout = ctx.layout;
+			ctx.effect(() => {
+				if (typeof document === "undefined") return;
+				if (document.querySelector("style[data-plugin-css=\"todo-inbox\"]") !== null) return;
+				const tag = document.createElement("style");
+				tag.dataset.pluginCss = "todo-inbox";
+				tag.textContent = CSS;
+				document.head.appendChild(tag);
+			});
+			ctx.effect(() => {
+				if (typeof document === "undefined") return;
+				startPolling();
+				return () => {
+					if (pollTimer !== null) {
+						clearInterval(pollTimer);
+						pollTimer = null;
+					}
+				};
+			});
+			ctx.slots.inject("sidebar.footer.action", () => ctx.slots.register({
+				name: "sidebar.footer.action",
+				id: "todo-inbox"
+			}, InboxAction));
+		}
+		//#endregion
+		exports.apply = apply;
+		exports.inject = inject;
+		exports.name = name;
+		exports.renderDetail = renderDetail;
+		return module.exports;
+	}
+});
+
+//# sourceMappingURL=client.js.map

package/lib/index.js

@@ -0,0 +1,437 @@
+import { defineTool } from "@deepseek-ai/dsh-tools";
+import { readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+//#region src/index.ts
+const name = "todo-inbox";
+const inject = [
+	"tools",
+	"webServer",
+	"systemPrompt"
+];
+/** API prefix for the browser half (registered as a webserver prefix route). */
+const API_PREFIX = "/todo-inbox/api";
+/**
+* Normalize a session source to the canonical session id `sessions.open()`
+* expects: the client session list uses the persisted `header.id`, which
+* carries the `session-` prefix. Sources recorded before this fix (bare ids)
+* are upgraded to the prefixed form on read.
+*/
+function normalizeSource(source) {
+	return source === "" || source.startsWith("session-") ? source : `session-${source}`;
+}
+/**
+* System-prompt section registered for every session: the trigger discipline
+* that turns "mentioned in prose" into "recorded in the inbox". Registered
+* in the tool-guidance band (after the read/write tool sections, before the
+* SDK section) so it lands next to the tool catalog it governs.
+*/
+const INBOX_PROMPT_SECTION = {
+	name: "todo-inbox:discipline",
+	order: 1600,
+	text: "## Global todo inbox\nWhen your work produces an action that waits on the human — merge an MR, approve a work order, review something, release, roll back after a future event, or any follow-up you name in your reply (\"after X completes, do Y\") — you MUST call `inbox_add` in the same turn. Never leave such an action only in prose: if you wrote it in the reply, it belongs in the inbox. Use `inbox_list` to check what is still pending, and `inbox_done` once the human confirms it is handled."
+};
+function apply(ctx, config) {
+	const dataPath = typeof config?.dataPath === "string" && config.dataPath.length > 0 ? config.dataPath : join(homedir(), ".dsh", "todo-inbox.json");
+	let items = [];
+	let lastSeen = "";
+	let chain = Promise.resolve();
+	const validItem = (x) => typeof x === "object" && x !== null && typeof x.id === "string" && typeof x.title === "string" && x.title.length > 0;
+	async function loadFromDisk() {
+		let text;
+		try {
+			text = await readFile(dataPath, "utf8");
+		} catch {
+			lastSeen = "";
+			items = [];
+			return;
+		}
+		lastSeen = text;
+		try {
+			const parsed = JSON.parse(text);
+			if (typeof parsed === "object" && parsed !== null && Array.isArray(parsed.items)) items = parsed.items.filter(validItem).map((item) => ({
+				...item,
+				source: normalizeSource(item.source)
+			}));
+			else items = [];
+		} catch (error) {
+			console.error(`[todo-inbox] data file parse failed, skipping: ${dataPath}`, error);
+			items = [];
+		}
+	}
+	async function persist() {
+		const text = JSON.stringify({
+			version: 1,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			items
+		}, null, 2);
+		await writeFile(dataPath, text, "utf8");
+		lastSeen = text;
+	}
+	function enqueue(fn) {
+		const run = chain.then(fn);
+		chain = run.then(() => void 0, () => void 0);
+		return run;
+	}
+	function pendingItems() {
+		return items.filter((item) => item.doneAt === null);
+	}
+	function pendingCount() {
+		return pendingItems().length;
+	}
+	function compact(item) {
+		return { ...item };
+	}
+	function nextId() {
+		return `i${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+	}
+	function sourceOf(exec) {
+		try {
+			const agent = exec?.agent;
+			return normalizeSource(String(agent?.sessionId ?? agent?.id ?? ""));
+		} catch {
+			return "";
+		}
+	}
+	const renderJson = (_args, value) => [{
+		type: "text",
+		text: JSON.stringify(value, null, 2)
+	}];
+	ctx.effect(() => ctx.systemPrompt.section(INBOX_PROMPT_SECTION));
+	ctx.tools.register(defineTool({
+		name: "inbox_add",
+		description: "Record one item waiting on the human in the GLOBAL todo inbox (merge MR, approve work order, review, release, rollback after a future event...). TRIGGER RULE: whenever your reply names a future human action, call this tool in the same turn — never mention it only in prose. Any session can add; the user sees every pending item in the sidebar inbox section.",
+		parameters: {
+			type: {
+				type: "string",
+				enum: [
+					"merge-mr",
+					"approve-order",
+					"review",
+					"release",
+					"other"
+				],
+				description: "Item type"
+			},
+			title: {
+				type: "string",
+				required: true,
+				description: "One line saying what the human must do, e.g. \"merge MR !1234\""
+			},
+			detail: {
+				type: "string",
+				description: "Optional extra context"
+			},
+			link: {
+				type: "string",
+				description: "Optional link, e.g. the MR / work-order URL"
+			},
+			due: {
+				type: "string",
+				description: "Optional ISO 8601 deadline, e.g. 2026-09-08T10:00:00+08:00"
+			}
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					ok: {
+						type: "boolean",
+						required: true
+					},
+					id: { type: "string" },
+					pending: {
+						type: "integer",
+						required: true
+					}
+				}
+			},
+			render: renderJson
+		},
+		execute(args, exec) {
+			const title = String(args.title ?? "").trim();
+			if (title.length === 0) return Promise.resolve({
+				ok: false,
+				pending: pendingCount()
+			});
+			const item = {
+				id: nextId(),
+				type: args.type ?? "other",
+				title,
+				detail: args.detail ? String(args.detail) : "",
+				link: args.link ? String(args.link) : "",
+				dueAt: args.due ? String(args.due) : null,
+				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+				source: sourceOf(exec),
+				doneAt: null
+			};
+			return enqueue(async () => {
+				items.push(item);
+				await persist();
+				return {
+					ok: true,
+					id: item.id,
+					pending: pendingCount()
+				};
+			});
+		},
+		presentCall: (args) => ({
+			card: "generic",
+			title: "Add inbox item",
+			kind: "other",
+			rawInput: args.title
+		})
+	}));
+	ctx.tools.register(defineTool({
+		name: "inbox_done",
+		description: "Mark one global inbox item as done.",
+		parameters: { id: {
+			type: "string",
+			required: true,
+			description: "Item id (from inbox_list)"
+		} },
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					ok: {
+						type: "boolean",
+						required: true
+					},
+					id: { type: "string" },
+					pending: {
+						type: "integer",
+						required: true
+					}
+				}
+			},
+			render: renderJson
+		},
+		execute(args) {
+			const id = String(args.id ?? "");
+			return enqueue(async () => {
+				const item = items.find((candidate) => candidate.id === id);
+				if (item === void 0) return {
+					ok: false,
+					pending: pendingCount()
+				};
+				item.doneAt = (/* @__PURE__ */ new Date()).toISOString();
+				await persist();
+				return {
+					ok: true,
+					id,
+					pending: pendingCount()
+				};
+			});
+		},
+		presentCall: (args) => ({
+			card: "generic",
+			title: "Done inbox item",
+			kind: "other",
+			rawInput: args.id
+		})
+	}));
+	ctx.tools.register(defineTool({
+		name: "inbox_list",
+		description: "List every pending item in the GLOBAL todo inbox (across all sessions).",
+		parameters: {},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					ok: {
+						type: "boolean",
+						required: true
+					},
+					pending: {
+						type: "integer",
+						required: true
+					},
+					items: {
+						type: "array",
+						items: {
+							type: "object",
+							additionalProperties: true
+						}
+					}
+				}
+			},
+			render: renderJson
+		},
+		execute() {
+			return Promise.resolve({
+				ok: true,
+				pending: pendingCount(),
+				items: pendingItems().map((item) => ({
+					id: item.id,
+					type: item.type,
+					title: item.title,
+					detail: item.detail,
+					link: item.link,
+					dueAt: item.dueAt,
+					createdAt: item.createdAt,
+					source: normalizeSource(item.source),
+					doneAt: item.doneAt
+				}))
+			});
+		},
+		presentCall: () => ({
+			card: "generic",
+			title: "List inbox items",
+			kind: "other",
+			rawInput: "pending"
+		})
+	}));
+	function fence(req) {
+		const origin = req.headers.origin;
+		if (origin === void 0) return true;
+		try {
+			return new URL(origin).host === (req.headers.host ?? "");
+		} catch {
+			return false;
+		}
+	}
+	async function readBody(req) {
+		let body = "";
+		for await (const chunk of req) body += chunk;
+		if (body.length === 0) return {};
+		try {
+			const parsed = JSON.parse(body);
+			return typeof parsed === "object" && parsed !== null ? parsed : {};
+		} catch {
+			throw new Error("invalid json body");
+		}
+	}
+	function writeJson(res, status, value) {
+		res.writeHead(status, { "content-type": "application/json; charset=utf-8" });
+		res.end(JSON.stringify(value));
+	}
+	const apiHandler = async (req, res) => {
+		if (!fence(req)) {
+			writeJson(res, 403, {
+				ok: false,
+				error: "forbidden"
+			});
+			return;
+		}
+		const method = new URL(req.url ?? "/", "http://dsh.local").pathname.slice(16);
+		try {
+			if (req.method === "GET" && method === "items") {
+				writeJson(res, 200, {
+					ok: true,
+					pending: pendingCount(),
+					items: pendingItems().map(compact),
+					path: dataPath
+				});
+				return;
+			}
+			if (req.method === "POST" && method === "done") {
+				const args = await readBody(req);
+				const id = String(args.id ?? "");
+				writeJson(res, 200, await enqueue(async () => {
+					const item = items.find((candidate) => candidate.id === id);
+					if (item === void 0) return {
+						ok: false,
+						error: "not_found",
+						pending: pendingCount()
+					};
+					item.doneAt = (/* @__PURE__ */ new Date()).toISOString();
+					await persist();
+					return {
+						ok: true,
+						id,
+						pending: pendingCount()
+					};
+				}));
+				return;
+			}
+			if (req.method === "POST" && method === "remove") {
+				const args = await readBody(req);
+				const id = String(args.id ?? "");
+				writeJson(res, 200, await enqueue(async () => {
+					const before = items.length;
+					items = items.filter((candidate) => candidate.id !== id);
+					if (items.length === before) return {
+						ok: false,
+						error: "not_found",
+						pending: pendingCount()
+					};
+					await persist();
+					return {
+						ok: true,
+						id,
+						pending: pendingCount()
+					};
+				}));
+				return;
+			}
+			if (req.method === "POST" && method === "add") {
+				const args = await readBody(req);
+				const title = String(args.title ?? "").trim();
+				if (title.length === 0) {
+					writeJson(res, 400, {
+						ok: false,
+						error: "empty_title",
+						pending: pendingCount()
+					});
+					return;
+				}
+				const item = {
+					id: nextId(),
+					type: typeof args.type === "string" ? args.type : "other",
+					title,
+					detail: typeof args.detail === "string" ? args.detail : "",
+					link: typeof args.link === "string" ? args.link : "",
+					dueAt: typeof args.due === "string" ? args.due : null,
+					createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+					source: "api",
+					doneAt: null
+				};
+				writeJson(res, 200, await enqueue(async () => {
+					items.push(item);
+					await persist();
+					return {
+						ok: true,
+						id: item.id,
+						pending: pendingCount()
+					};
+				}));
+				return;
+			}
+			writeJson(res, 404, {
+				ok: false,
+				error: "not_found"
+			});
+		} catch (error) {
+			writeJson(res, 500, {
+				ok: false,
+				error: String(error)
+			});
+		}
+	};
+	ctx.effect(() => ctx.webServer.register({
+		kind: "prefix",
+		path: API_PREFIX,
+		handler: apiHandler
+	}));
+	ctx.effect(() => {
+		const timer = setInterval(() => {
+			enqueue(async () => {
+				let text;
+				try {
+					text = await readFile(dataPath, "utf8");
+				} catch {
+					return;
+				}
+				if (text !== lastSeen) await loadFromDisk();
+			});
+		}, 5e3);
+		return () => clearInterval(timer);
+	});
+	chain = chain.then(loadFromDisk);
+}
+//#endregion
+export { apply, inject, name };

package/lib/types/client/index.d.ts

@@ -0,0 +1,56 @@
+/**
+ * dsh-todo-inbox browser half: the global inbox, embedded in the sidebar.
+ *
+ * Wide sidebar: a collapsible section stacked above Settings — a header row
+ * (checklist glyph + label + count badge) and an inline list of pending
+ * items with hover-revealed icon actions. Rail sidebar: the standard 36×36
+ * circle button with a corner badge; clicking it expands the sidebar (the
+ * rail has no room for a list).
+ *
+ * All state lives in a module-level store, so the sidebar's wide↔rail
+ * crossfade (which remounts the slot occupant) never loses data or
+ * expansion. Polling starts once at apply time.
+ *
+ * `detail` renders a tiny safe markdown subset (bold / italic / inline code /
+ * [text](url) / bare URLs / line breaks) as React elements — never raw HTML.
+ *
+ * The bundle is compiled to a window.__ModuleLoader__ closure; react and the
+ * ui-primitives icons resolve through the module table at runtime, so this
+ * file must not runtime-import anything else (type-only imports are erased).
+ *
+ * @module dsh-todo-inbox/client
+ */
+import React from 'react';
+export declare const name = "todo-inbox-client";
+export declare const inject: string[];
+/** Structural typing only — the loader supplies the real slot registry. */
+interface SlotBridge {
+    inject(slot: string, factory: () => unknown): void;
+    register(options: {
+        name: string;
+        id?: string;
+    }, component: unknown): unknown;
+}
+/** Structural typing for the sessions service we use: open a session by id. */
+interface SessionsBridge {
+    open(id: string): void;
+}
+/** Structural typing for the layout service we use: expand the sidebar. */
+interface LayoutBridge {
+    toggleSidebar(): void;
+}
+interface ClientCtx {
+    effect(callback: () => void | (() => void)): void;
+    slots: SlotBridge;
+    sessions: SessionsBridge;
+    layout: LayoutBridge;
+}
+/**
+ * Render one detail string as React nodes. Supported: `inline code`, **bold**,
+ * *italic*, [text](url), bare https?:// URLs, and line breaks (white-space:
+ * pre-wrap). Anything unmatched renders as plain text — never HTML.
+ * Exported for the smoke test; the loader only consumes name/inject/apply.
+ */
+export declare function renderDetail(text: string, keyBase: string): React.ReactNode[];
+export declare function apply(ctx: ClientCtx): void;
+export {};

package/lib/types/index.d.ts

@@ -0,0 +1,45 @@
+/**
+ * dsh-todo-inbox host half: a process-wide global todo inbox.
+ *
+ * Any session's agent can record "waiting on human" todos through the
+ * inbox_add / inbox_done / inbox_list model tools (registered once at the
+ * root realm, visible to every session). Items persist to a JSON file
+ * (~/.dsh/todo-inbox.json by default, overridable via row `config.dataPath`)
+ * which is the single source of truth: agents may also edit the file
+ * directly, and a 5-second poll picks external edits up.
+ *
+ * The browser half talks to this host through plain HTTP routes under
+ * /todo-inbox/api (registered on the shared webserver) — no remote-bridge
+ * machinery needed, exactly like other third-party bundles.
+ *
+ * Persistence uses node:fs directly, NOT the injected `fs` service: the app's
+ * fs service applies the workspace sandbox policy (writes to ~/.dsh/... are
+ * denied), while a static host plugin runs in the real host process with full
+ * Node privileges — same as other static bundles (e.g. dsh-better-sidebar).
+ *
+ * No Config schema: the row config passes through raw and unknown fields are
+ * ignored, so a boot-time schema/version mismatch can never fail the plugin
+ * tree.
+ *
+ * @module dsh-todo-inbox/host
+ */
+import type { Context } from '@deepseek-ai/cordis';
+export declare const name = "todo-inbox";
+export declare const inject: string[];
+/** One inbox item (mirrors the data-file record; all scalar fields). */
+export interface InboxItem {
+    id: string;
+    type: string;
+    title: string;
+    detail: string;
+    link: string;
+    dueAt: string | null;
+    createdAt: string;
+    source: string;
+    doneAt: string | null;
+}
+export interface TodoInboxConfig {
+    /** Absolute path of the JSON data file; parent directory must exist. */
+    dataPath?: string;
+}
+export declare function apply(ctx: Context, config?: TodoInboxConfig): void;

package/package.json

@@ -0,0 +1,77 @@
+{
+  "name": "dsh-todo-inbox",
+  "version": "0.1.0",
+  "description": "DSH web static plugin: a global cross-session todo inbox. Any session's agent records human-action todos (merge MR, approve work orders, reviews) via inbox_add/inbox_done/inbox_list; a root-scope sidebar entry shows a count badge and an expandable list to view, open, and complete them. Host persists to ~/.dsh/todo-inbox.json and serves /todo-inbox/api HTTP routes for the browser half.",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/lumoping/dsh-todo-inbox.git"
+  },
+  "homepage": "https://github.com/lumoping/dsh-todo-inbox",
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./client": {
+      "default": "./lib/client.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "packageManager": "pnpm@9.15.9",
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-slots",
+        "@deepseek-ai/dsh-client-modules"
+      ],
+      "platform": "web"
+    }
+  },
+  "files": [
+    "lib/index.js",
+    "lib/client.js",
+    "lib/types/**/*.d.ts",
+    "cordis.patch.yml",
+    "README.md"
+  ],
+  "scripts": {
+    "clean": "node -e \"require('node:fs').rmSync('lib',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc -p tsconfig.build.json && tsdown",
+    "prepare": "tsdown",
+    "typecheck": "tsc --noEmit",
+    "test": "node scripts/smoke-test.mjs"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-client-ui-primitives": ">=0.1.2-rc.1 <0.2.0-0",
+    "@deepseek-ai/dsh-fs": ">=0.1.2-rc.1 <0.2.0-0",
+    "@deepseek-ai/dsh-host-webserver": ">=0.1.2-rc.1 <0.2.0-0",
+    "@deepseek-ai/dsh-system-prompt": ">=0.1.2-rc.1 <0.2.0-0",
+    "@deepseek-ai/dsh-tools": ">=0.1.2-rc.1 <0.2.0-0",
+    "react": "^18.2.0"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-fs": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-system-prompt": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-tools": "0.1.2-rc.1",
+    "@types/node": "^24.0.0",
+    "@types/react": "~18.3.1",
+    "@types/react-dom": "~18.3.1",
+    "react": "^18.2.0",
+    "react-dom": "18.2.0",
+    "tsdown": "^0.22.2",
+    "typescript": "^5.6.0"
+  }
+}