sensorium-mcp 3.1.3-board.2 → 3.1.3-board.20

package/Install-Sensorium.ps1

@@ -9,7 +9,8 @@
 
     The release channel follows the SAME switch as the MCP server: the tag in
     MCPStartCommand ("npx -y sensorium-mcp@<tag>"). @latest -> supervisor-latest
-    (stable, built from main); @refactor -> supervisor-refactor (built from the
+    (stable, built from main); @board -> supervisor-board (built from
+    feature/agent-task-board); @refactor -> supervisor-refactor (built from the
     refactor branch). One edit to install.config.json flips both node + supervisor.
 
     All configuration is read from ~/.remote-copilot-mcp/install.config.json.
@@ -95,12 +96,13 @@ $EffectiveMCPStartCommand = $Config["MCPStartCommand"]
 $IsolateMcpRuntime = $Config["IsolateMcpRuntime"] -eq "true"
 
 # Resolve the supervisor release channel from the same tag the node server
-# follows: the "@<tag>" in MCPStartCommand. Only @refactor uses the branch
-# build; everything else (incl. @latest, a bare version pin, or no tag) stays
+# follows: the "@<tag>" in MCPStartCommand. Only @board (supervisor-board, built
+# from feature/agent-task-board) and @refactor (supervisor-refactor) use branch
+# builds; everything else (incl. @latest, a bare version pin, or no tag) stays
 # on the stable supervisor-latest release. This keeps the stable rollback path
 # intact — pointing the config back at @latest restores the main supervisor.
 $mcpTag = if ($EffectiveMCPStartCommand -match 'sensorium-mcp@([A-Za-z0-9._-]+)') { $Matches[1] } else { "latest" }
-$ReleaseTag = if ($mcpTag -eq "refactor") { "supervisor-refactor" } else { "supervisor-latest" }
+$ReleaseTag = if ($mcpTag -eq "board") { "supervisor-board" } elseif ($mcpTag -eq "refactor") { "supervisor-refactor" } else { "supervisor-latest" }
 Write-Host "Supervisor channel: $ReleaseTag (from MCP tag '$mcpTag')" -ForegroundColor Cyan
 
 # Validate config values
@@ -117,8 +119,27 @@ Save-Config $Config
 function Stop-SupervisorProcess {
     $procs = Get-Process -Name "sensorium-supervisor" -ErrorAction SilentlyContinue
     if ($procs) {
+        # Keep the original PID set. A name-only lookup after stopping can confuse a
+        # newly launched process with the instance we were asked to stop.
+        $targetPids = @($procs | Select-Object -ExpandProperty Id)
         Write-Host "Stopping background sensorium-supervisor process(es)..."
-        $procs | Stop-Process -Force
+        $procs | Stop-Process -Force -ErrorAction Stop
+
+        # Stop-Process returns once a signal has been sent, not once all image/file
+        # handles are released. Do not attempt an in-place replacement until every
+        # PID we targeted is gone; a continuing process makes the update unsafe.
+        $deadline = (Get-Date).AddSeconds(10)
+        do {
+            $remainingPids = @($targetPids | Where-Object {
+                Get-Process -Id $_ -ErrorAction SilentlyContinue
+            })
+            if ($remainingPids.Count -eq 0) { break }
+            Start-Sleep -Milliseconds 250
+        } while ((Get-Date) -lt $deadline)
+
+        if ($remainingPids.Count -gt 0) {
+            throw "Refusing to update: sensorium-supervisor PID(s) $($remainingPids -join ', ') did not stop within 10 seconds."
+        }
         Write-Host "Process(es) stopped." -ForegroundColor Yellow
     }
 }
@@ -227,7 +248,45 @@ function Save-BinaryMetadata {
         InstalledAt    = (Get-Date).ToString("o")
     }
 
-    $metadata | ConvertTo-Json | Set-Content -LiteralPath $MetadataPath -Encoding ASCII
+    # Do not write metadata in place: a failure halfway through a write would make a
+    # good binary look stale on the next run. The temp name is unique so concurrent
+    # or previously interrupted installs cannot collide with it.
+    $metadataTempPath = "$MetadataPath.tmp.$PID.$([guid]::NewGuid().ToString('N'))"
+    try {
+        $metadata | ConvertTo-Json | Set-Content -LiteralPath $metadataTempPath -Encoding ASCII
+        Move-FileWithRetry -Source $metadataTempPath -Destination $MetadataPath -Operation "update release metadata"
+    }
+    finally {
+        if (Test-Path -LiteralPath $metadataTempPath) {
+            Remove-Item -LiteralPath $metadataTempPath -Force -ErrorAction SilentlyContinue
+        }
+    }
+}
+
+function Move-FileWithRetry {
+    param(
+        [string]$Source,
+        [string]$Destination,
+        [string]$Operation = "replace file",
+        [int]$MaxAttempts = 20,
+        [int]$RetryDelayMs = 1500
+    )
+
+    for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
+        try {
+            Move-Item -LiteralPath $Source -Destination $Destination -Force -ErrorAction Stop
+            return
+        }
+        catch {
+            if ($attempt -eq $MaxAttempts) {
+                throw "Failed to $Operation at $Destination after $MaxAttempts attempts (~$([math]::Round($MaxAttempts * $RetryDelayMs / 1000))s). Original error: $_"
+            }
+            if ($attempt % 4 -eq 0) {
+                Write-Host "  ... waiting to $Operation (attempt $attempt/$MaxAttempts)..." -ForegroundColor Yellow
+            }
+            Start-Sleep -Milliseconds $RetryDelayMs
+        }
+    }
 }
 
 function Get-BinaryAsset {
@@ -244,7 +303,13 @@ function Get-BinaryAsset {
     $headers = Get-GithubAuthHeaders -Accept "application/octet-stream"
     Write-Host "Downloading $($AssetInfo.AssetName) ..."
 
-    $tmpFile = "$Destination.tmp"
+    $operationId = "$PID.$([guid]::NewGuid().ToString('N'))"
+    $tmpFile = "$Destination.tmp.$operationId"
+    $backupPath = "$Destination.bak.$operationId"
+    $metadataBackupPath = "$MetadataPath.bak.$operationId"
+    $hadBinary = Test-Path -LiteralPath $Destination
+    $hadMetadata = Test-Path -LiteralPath $MetadataPath
+    $swapped = $false
     try {
         Invoke-WebRequest -Uri $downloadUrl -Headers $headers -OutFile $tmpFile -UseBasicParsing -ErrorAction Stop
     }
@@ -256,15 +321,74 @@ function Get-BinaryAsset {
         throw "Download failed: $_"
     }
 
-    # Atomic replace
-    if (Test-Path $Destination) {
-        $backupPath = "$Destination.bak"
-        Copy-Item $Destination $backupPath -Force
+    try {
+        # Preserve both halves of the installed state. If anything after the
+        # executable swap fails (notably metadata persistence), restore the pair.
+        if ($hadBinary) { Copy-Item -LiteralPath $Destination -Destination $backupPath -Force -ErrorAction Stop }
+        if ($hadMetadata) { Copy-Item -LiteralPath $MetadataPath -Destination $metadataBackupPath -Force -ErrorAction Stop }
+
+        # The old exe can still be locked for a while after Stop-Process — AV/EDR
+        # may retain its image-section handle during a post-exit scan.
+        Move-FileWithRetry -Source $tmpFile -Destination $Destination -Operation "replace supervisor binary"
+        $swapped = $true
+
+        try {
+            Unblock-File -Path $Destination -ErrorAction Stop
+        }
+        catch {
+            Write-Host "[WARN] Could not unblock ${Destination}: $($_.Exception.Message)" -ForegroundColor Yellow
+        }
+
+        Save-BinaryMetadata -MetadataPath $MetadataPath -AssetInfo $AssetInfo
+        Write-Host "Binary placed at: $Destination" -ForegroundColor Green
+    }
+    catch {
+        $updateError = $_
+        if ($swapped) {
+            Write-Host "[WARN] Update failed after binary replacement; restoring the previous binary and metadata..." -ForegroundColor Yellow
+            $restoreErrors = @()
+            try {
+                if ($hadBinary) {
+                    $restoreFile = "$Destination.restore.$operationId"
+                    Copy-Item -LiteralPath $backupPath -Destination $restoreFile -Force -ErrorAction Stop
+                    Move-FileWithRetry -Source $restoreFile -Destination $Destination -Operation "restore previous supervisor binary"
+                }
+                elseif (Test-Path -LiteralPath $Destination) {
+                    Remove-Item -LiteralPath $Destination -Force -ErrorAction Stop
+                }
+            }
+            catch { $restoreErrors += "binary: $($_.Exception.Message)" }
+
+            try {
+                if ($hadMetadata) {
+                    # Stage the backup under a unique name, then use the same
+                    # retrying replacement path as the binary. Copy-Item directly
+                    # to $MetadataPath could leave metadata restoration vulnerable
+                    # to a locked destination and bypass the retry policy.
+                    $metadataRestoreFile = "$MetadataPath.restore.$operationId"
+                    Copy-Item -LiteralPath $metadataBackupPath -Destination $metadataRestoreFile -Force -ErrorAction Stop
+                    Move-FileWithRetry -Source $metadataRestoreFile -Destination $MetadataPath -Operation "restore previous release metadata"
+                }
+                elseif (Test-Path -LiteralPath $MetadataPath) {
+                    Remove-Item -LiteralPath $MetadataPath -Force -ErrorAction Stop
+                }
+            }
+            catch { $restoreErrors += "metadata: $($_.Exception.Message)" }
+
+            if ($restoreErrors.Count -gt 0) {
+                throw "Update failed and recovery was incomplete ($($restoreErrors -join '; ')). Original error: $($updateError.Exception.Message)"
+            }
+            throw "Update failed after replacement; the previous binary and metadata were restored. Original error: $($updateError.Exception.Message)"
+        }
+        throw
+    }
+    finally {
+        foreach ($path in @($tmpFile, $backupPath, $metadataBackupPath, "$Destination.restore.$operationId", "$MetadataPath.restore.$operationId")) {
+            if (Test-Path -LiteralPath $path) {
+                Remove-Item -LiteralPath $path -Force -ErrorAction SilentlyContinue
+            }
+        }
     }
-    Move-Item $tmpFile $Destination -Force
-    Unblock-File -Path $Destination -ErrorAction SilentlyContinue
-    Save-BinaryMetadata -MetadataPath $MetadataPath -AssetInfo $AssetInfo
-    Write-Host "Binary placed at: $Destination" -ForegroundColor Green
 }
 
 function Install-StartupLauncher {
@@ -439,7 +563,7 @@ function Sync-ReleaseBinary {
     Write-Host "Fetching release via SecureVault (profile: $SecureVaultProfile)..."
     securevault run pwsh -NoProfile -File "`"$PSCommandPath`"" -SyncReleaseOnly --profile $SecureVaultProfile
     if ($LASTEXITCODE -ne 0) {
-        throw "SecureVault-driven release sync failed (exit $LASTEXITCODE). Ensure profile '$SecureVaultProfile' maps a GitHub PAT to env var SENSORIUM_GH_TOKEN."
+        throw "SecureVault-driven release sync failed (exit $LASTEXITCODE). See the error above for the actual cause (e.g. a locked binary, network failure, or a missing GitHub PAT for profile '$SecureVaultProfile' -> `$env:SENSORIUM_GH_TOKEN)."
     }
 }
 
@@ -451,47 +575,76 @@ if ($SyncReleaseOnly) {
 }
 
 # ── Main ─────────────────────────────────────────────────────────────────────
-$alreadyExists = Test-Path $Binary
+# Serialize only full installer invocations for this Windows user. The
+# SecureVault child above deliberately returns before this point, so it can do
+# the authenticated release sync without waiting on (and deadlocking with) its
+# parent installer process.
+$currentUserSid = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+$installMutexName = "Local\SensoriumSupervisor.Install.$($currentUserSid -replace '[^A-Za-z0-9_.-]', '_')"
+$installMutex = [System.Threading.Mutex]::new($false, $installMutexName)
+$mutexHeld = $false
+
+try {
+    try {
+        $mutexHeld = $installMutex.WaitOne([TimeSpan]::FromMinutes(5))
+    }
+    catch [System.Threading.AbandonedMutexException] {
+        # The prior installer died without releasing the mutex; Windows has given
+        # us ownership, so continue while making that state visible to the user.
+        $mutexHeld = $true
+        Write-Host "[WARN] Recovered an abandoned installer mutex; continuing." -ForegroundColor Yellow
+    }
 
-Write-Host ""
-if ($alreadyExists) {
-    Write-Host "=== Sensorium Supervisor UPDATE ===" -ForegroundColor Cyan
-}
-else {
-    Write-Host "=== Sensorium Supervisor INSTALL ===" -ForegroundColor Cyan
-}
-Write-Host "SecureVault profile: $(if ([string]::IsNullOrWhiteSpace($SecureVaultProfile)) { '<disabled>' } else { $SecureVaultProfile })"
-Write-Host "Watcher mode: $UpdateMode"
-Write-Host "MCP start command: $EffectiveMCPStartCommand"
-Write-Host "MCP runtime isolation: $(if ($IsolateMcpRuntime) { 'ENABLED' } else { 'disabled (legacy npx)' })"
-Write-Host "Binary     : $Binary"
-Write-Host ""
-
-# Step 1 — stop existing instance
-if ($alreadyExists) {
-    Stop-SupervisorProcess
-}
+    if (-not $mutexHeld) {
+        throw "Another Sensorium install/update is still running for this user. Timed out waiting for it to finish."
+    }
 
-# Step 2 — ensure bin dir exists
-New-Item -ItemType Directory -Path $BinDir -Force | Out-Null
+    $alreadyExists = Test-Path $Binary
 
-# Step 3 — fetch release metadata and download only when needed
-Sync-ReleaseBinary
+    Write-Host ""
+    if ($alreadyExists) {
+        Write-Host "=== Sensorium Supervisor UPDATE ===" -ForegroundColor Cyan
+    }
+    else {
+        Write-Host "=== Sensorium Supervisor INSTALL ===" -ForegroundColor Cyan
+    }
+    Write-Host "SecureVault profile: $(if ([string]::IsNullOrWhiteSpace($SecureVaultProfile)) { '<disabled>' } else { $SecureVaultProfile })"
+    Write-Host "Watcher mode: $UpdateMode"
+    Write-Host "MCP start command: $EffectiveMCPStartCommand"
+    Write-Host "MCP runtime isolation: $(if ($IsolateMcpRuntime) { 'ENABLED' } else { 'disabled (legacy npx)' })"
+    Write-Host "Binary     : $Binary"
+    Write-Host ""
 
-# Step 3b — prepare the isolated MCP runtime area (opt-in): a private npm cache +
-# repo-independent cwd. The `npx ...@latest` command is unchanged (auto-update
-# preserved). On any failure this disables the isolation env in Start-Supervisor,
-# so the install degrades safely to legacy behaviour.
-if ($IsolateMcpRuntime) {
-    if (-not (Initialize-IsolatedMcpRuntime)) {
-        $IsolateMcpRuntime = $false
-        Write-Host "[WARN] Isolation disabled for this run — using the shared npm cache / inherited cwd." -ForegroundColor Yellow
+    # Step 1 — stop existing instance
+    if ($alreadyExists) {
+        Stop-SupervisorProcess
     }
-}
 
-# Step 4 — install launcher and start
-Install-StartupLauncher
-Start-Supervisor
+    # Step 2 — ensure bin dir exists
+    New-Item -ItemType Directory -Path $BinDir -Force | Out-Null
+
+    # Step 3 — fetch release metadata and download only when needed
+    Sync-ReleaseBinary
 
-# Step 5 — verify
-Show-Status
+    # Step 3b — prepare the isolated MCP runtime area (opt-in): a private npm cache +
+    # repo-independent cwd. The `npx ...@latest` command is unchanged (auto-update
+    # preserved). On any failure this disables the isolation env in Start-Supervisor,
+    # so the install degrades safely to legacy behaviour.
+    if ($IsolateMcpRuntime) {
+        if (-not (Initialize-IsolatedMcpRuntime)) {
+            $IsolateMcpRuntime = $false
+            Write-Host "[WARN] Isolation disabled for this run — using the shared npm cache / inherited cwd." -ForegroundColor Yellow
+        }
+    }
+
+    # Step 4 — install launcher and start
+    Install-StartupLauncher
+    Start-Supervisor
+
+    # Step 5 — verify
+    Show-Status
+}
+finally {
+    if ($mutexHeld) { $installMutex.ReleaseMutex() }
+    if ($installMutex) { $installMutex.Dispose() }
+}

package/README.md

@@ -5,6 +5,8 @@
 
 MCP server with multi-layer memory, voice analysis, multi-thread orchestration, and Telegram bridge for AI assistants.
 
+Internal TypeScript conventions: [coding guidelines](docs/coding-guidelines.md).
+
 ## Why?
 
 AI assistants forget everything between sessions. Every restart is a blank slate — no memory of your preferences, past decisions, or ongoing projects. Voice messages arrive as opaque audio blobs. And there's no way to talk to your agent when it's running headless in CI or on a remote machine.
@@ -157,6 +159,7 @@ Customizable prompt templates that agents can discover and load on demand.
 | `send_sticker` | Send a Telegram sticker |
 | `send_message_to_thread` | Send a message to another thread's agent |
 | `start_thread` | Spawn a worker, branch, daily, or root thread |
+| `stop_thread` | Stop a worker whose parent link is this thread |
 | `get_threads_health` | Show thread status, PIDs, last activity |
 | `schedule_wake_up` | Schedule a one-shot, cron, or idle-triggered task |
 | `memory_search` | Search episodic/semantic memory by query |
@@ -238,7 +241,7 @@ lib → config → integrations → data, llm → sessions → services → tool
 ```
 ~/.remote-copilot-mcp/
   memory.db                   <- SQLite: episodes, semantic notes, voice signatures, thread registry
-  settings.json               <- Per-thread agent types, keep-alive, conversation modes
+  settings.json               <- Dashboard settings, MCP servers, conversation modes (read at start; hand edits apply at restart)
   install.config.json          <- Installer configuration (SecureVault profile, update mode)
   poller.lock                 <- PID + timestamp; first instance becomes the poller
   offset                      <- Shared getUpdates offset

package/dist/board/api/api.js

@@ -19,10 +19,11 @@ let implPromise = null;
 /** @returns {Promise<BoardApi>} */
 function load() {
   if (!implPromise) {
-    implPromise =
+    implPromise = (
       MODE === "preview"
         ? import("../mock/api.mock.js").then((m) => m.mockApi)
-        : import("./client.js").then((m) => m.client);
+        : import("./client.js").then((m) => m.client)
+    ).then(assertAdapterComplete);
   }
   return implPromise;
 }
@@ -31,31 +32,53 @@ const METHODS = [
   "listCards",
   "getCard",
   "createCard",
+  "previewBriefing",
   "updateCard",
   "deleteCard",
   "stopCard",
   "addComment",
-  "listLanes",
+  "postDecision",
+  "listLaneGroups",
   "getProfiles",
+  "saveProfile",
   "threadRunning",
-  // Card-builder "How" schema + presets. Preview is served by mock/api.mock.js
-  // (from the editable schema/policy.js). TODO(P1): api/client.js must implement
-  // getPolicySchema()/getPresets() against the real board API before production
-  // uses the schema-driven builder; until then production calls reject and
-  // useBuilder() degrades to a schema-less builder (no crash).
+  "threadLogs",
+  // Card-builder "How" schema + presets.
   "getPolicySchema",
   "getPresets",
-  // Lane management (Settings). Preview served by the mock; TODO(P1): implement
-  // in api/client.js before production exposes lane CRUD.
-  "createLane",
-  "updateLane",
-  "deleteLane",
+  "createLaneGroup",
+  "updateLaneGroup",
+  "deleteLaneGroup",
+  // Working-directory picker: one filesystem level per call (lazy browse).
+  "listDir",
 ];
 
+/**
+ * Fail LOUD if the resolved adapter is missing any METHODS entry. A method listed
+ * in the contract/registry but never implemented in the active adapter used to
+ * surface as a late "undefined is not a function" at call time — exactly how
+ * lane-group CRUD and previewBriefing broke in production
+ * while preview worked. Asserting completeness once, at load, turns that silent
+ * drift into an immediate, named error.
+ *
+ * @param {Partial<BoardApi>} impl
+ * @returns {BoardApi}
+ */
+function assertAdapterComplete(impl) {
+  const missing = METHODS.filter((name) => typeof impl?.[name] !== "function");
+  if (missing.length) {
+    throw new Error(
+      `Board API adapter is missing method(s): ${missing.join(", ")}. ` +
+        `Every METHODS entry must be implemented by the active adapter (api/client.js or mock/api.mock.js).`,
+    );
+  }
+  return /** @type {BoardApi} */ (impl);
+}
+
 /** @type {BoardApi} */
 const api = /** @type {any} */ ({});
 for (const name of METHODS) {
   api[name] = (...args) => load().then((impl) => impl[name](...args));
 }
 
-export { api };
+export { api, assertAdapterComplete };

package/dist/board/api/api.test.ts

@@ -0,0 +1,24 @@
+import "../../test-bootstrap.js";
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { assertAdapterComplete } from "./api.js";
+import { client } from "./client.js";
+import type { BoardApi } from "./contract.js";
+
+test("the adapter completeness guard passes for the production client", () => {
+  // Arrange
+  const impl = client;
+
+  // Act & Assert — every contract/registry method is now implemented in client.js.
+  assert.doesNotThrow(() => assertAdapterComplete(impl));
+});
+
+test("the adapter completeness guard throws naming a method missing from the adapter", () => {
+  // Arrange — a client with one contract method dropped (the exact drift that
+  // shipped lane CRUD as a late `undefined is not a function`).
+  const incomplete: Partial<BoardApi> = { ...client };
+  delete incomplete.createLaneGroup;
+
+  // Act & Assert
+  assert.throws(() => assertAdapterComplete(incomplete), /createLaneGroup/);
+});

package/dist/board/api/client.js

@@ -2,15 +2,14 @@
  * Production data adapter.  ❌ FROZEN SEAM.
  *
  * Real `fetch` to the board API. Root-relative `/api/...` paths (never a host or
- * port) so the app works unchanged behind the Cloudflare Tunnel. Bearer token is
- * injected from state/auth.js. This is the ONLY module that talks to the network.
+ * port) so the app works unchanged behind the Dev Tunnel. This is the ONLY module
+ * that talks to the network.
  *
  * @typedef {import('./contract.js').BoardApi}   BoardApi
  * @typedef {import('./contract.js').BoardCard}  BoardCard
  */
 
 import { API_BASE } from "../config.js";
-import { getToken } from "../state/auth.js";
 
 /**
  * @param {string} method
@@ -19,8 +18,6 @@ import { getToken } from "../state/auth.js";
  */
 async function req(method, path, body) {
   const headers = {};
-  const token = getToken();
-  if (token) headers.Authorization = `Bearer ${token}`;
   if (body !== undefined) headers["Content-Type"] = "application/json";
 
   const res = await fetch(`${API_BASE}${path}`, {
@@ -49,12 +46,11 @@ async function req(method, path, body) {
 
 /** @type {BoardApi} */
 export const client = {
-  listCards({ includeArchived = false, lane } = {}) {
+  listCards({ includeArchived = false } = {}) {
     const p = new URLSearchParams();
     if (includeArchived) p.set("includeArchived", "1");
-    if (lane != null) p.set("lane", String(lane));
     const qs = p.toString();
-    return req("GET", `/api/board/cards${qs ? `?${qs}` : ""}`).then((d) => d.cards);
+    return req("GET", `/api/board/cards${qs ? `?${qs}` : ""}`);
   },
   getCard(id) {
     return req("GET", `/api/board/cards/${id}`);
@@ -62,6 +58,9 @@ export const client = {
   createCard(card) {
     return req("POST", "/api/board/cards", card).then((d) => d.card);
   },
+  previewBriefing(draft) {
+    return req("POST", "/api/board/cards/preview", draft).then((d) => d.briefing);
+  },
   updateCard(id, patch) {
     return req("PATCH", `/api/board/cards/${id}`, patch).then((d) => d.card);
   },
@@ -74,23 +73,41 @@ export const client = {
   addComment(id, content) {
     return req("POST", `/api/board/cards/${id}/comments`, { content }).then((d) => d.comment);
   },
-  listLanes() {
-    return req("GET", "/api/board/lanes").then((d) => d.lanes);
+  postDecision(id, answer) {
+    return req("POST", `/api/board/cards/${id}/decision`, { answer }).then((d) => d.card);
+  },
+  listLaneGroups() {
+    return req("GET", "/api/board/lane-groups").then((d) => d.laneGroups);
+  },
+  createLaneGroup(name) {
+    return req("POST", "/api/board/lane-groups", { name }).then((d) => d.laneGroup);
+  },
+  updateLaneGroup(id, patch) {
+    return req("PATCH", `/api/board/lane-groups/${id}`, patch).then((d) => d.laneGroup);
+  },
+  deleteLaneGroup(id) {
+    return req("DELETE", `/api/board/lane-groups/${id}`).then(() => undefined);
   },
   getProfiles() {
     return req("GET", "/api/board/profiles").then((d) => d.profiles);
   },
+  saveProfile(input) {
+    return req("POST", "/api/board/profiles", input).then((d) => d.profile);
+  },
   threadRunning(threadId) {
     return req("GET", `/api/threads/${threadId}/running`).then((d) => !!d.running);
   },
-  // TODO(P1): serve the card-builder "How" schema/presets from the real board
-  // API (e.g. GET /api/board/policy). Until then these reject explicitly so the
-  // production failure is legible; useBuilder() swallows the rejection and falls
-  // back to a schema-less builder (no crash).
+  threadLogs(threadId, { view = "assistant", offset = 0, limit = 4000 } = {}) {
+    const params = new URLSearchParams({ view, offset: String(offset), limit: String(limit) });
+    return req("GET", `/api/threads/${threadId}/logs?${params}`);
+  },
   getPolicySchema() {
-    return Promise.reject(new Error("getPolicySchema not implemented — P1"));
+    return req("GET", "/api/board/policy").then((d) => d.schema);
   },
   getPresets() {
-    return Promise.reject(new Error("getPresets not implemented — P1"));
+    return req("GET", "/api/board/policy").then((d) => d.presets);
+  },
+  listDir(path) {
+    return req("GET", `/api/board/dir-listing?path=${encodeURIComponent(path || "")}`);
   },
 };

package/dist/board/components/Card.js

@@ -1,43 +1,77 @@
 /**
  * Card tile — ✅ EDITABLE. Pure: `card` + `laneName` in, `open` out.
  * Dispatch design: floating dark card — title, then chip row with priority,
- * type, live worker pulse / blocked / archived.
+ * live worker pulse / blocked / archived. A decision_needed card gets a distinct
+ * badge plus a waiting-age cue so a stalled decision is obvious at a glance.
  */
 
 import StatusChip from "./StatusChip.js";
 import PriorityChip from "./PriorityChip.js";
+import { proactiveLimitKind, providerLabel, retryLabel } from "./rateLimit.js";
+import { humanMins, minsSince } from "./time.js";
 
 export default {
   name: "Card",
   components: { StatusChip, PriorityChip },
   props: {
     card: { type: Object, required: true },
-    laneName: { type: Function, default: (id) => `Thread ${id}` },
+    laneName: { type: Function, default: () => "Ungrouped" },
+    limitedProviders: { type: Array, default: () => [] },
   },
   emits: ["open"],
   setup(props, { emit }) {
     function elapsed() {
       if (!props.card.startedAt) return "";
-      const mins = Math.max(0, Math.round((Date.now() - new Date(props.card.startedAt)) / 60000));
-      return mins >= 60 ? Math.floor(mins / 60) + "h " + (mins % 60) + "m" : mins + "m";
+      return humanMins(minsSince(props.card.startedAt));
     }
-    return { emit, elapsed };
+    function rlText() {
+      const p = providerLabel(props.card.rateLimitProvider);
+      return (p ? p + " · " : "") + retryLabel(props.card);
+    }
+    function proactiveProvider() {
+      return providerLabel(props.card.profile?.agentType);
+    }
+    function proactiveKind() {
+      return proactiveLimitKind(props.card, props.limitedProviders);
+    }
+    /** How long this card has been waiting on the operator. */
+    function waiting() {
+      const c = props.card;
+      if (c.status !== "decision_needed") return null;
+      const mins = minsSince(c.updatedAt || c.finishedAt || c.startedAt || c.createdAt);
+      return { text: humanMins(mins), stale: mins >= 480 };
+    }
+    return { emit, elapsed, proactiveKind, proactiveProvider, rlText, waiting };
   },
   template: `
     <article class="card" role="listitem" tabindex="0"
+      :class="{ 'card--decision': card.status === 'decision_needed' }"
       @click="emit('open', card)"
       @keydown.enter="emit('open', card)">
+      <div v-if="waiting()" class="card__decision" :class="{ 'is-stale': waiting().stale }">
+        <span class="card__decision-label">
+          <span class="dot dot--pulse"></span>NEEDS YOU
+        </span>
+        <span class="card__decision-age">waiting {{ waiting().text }}</span>
+      </div>
       <h3 class="card__title">{{ card.title }}</h3>
       <p v-if="card.description" class="card__desc">{{ card.description }}</p>
+      <div v-if="card.status === 'rate_limited'" class="card__rl">
+        <svg viewBox="0 0 12 12" width="11" height="11" fill="none" stroke="currentColor" stroke-width="1.3" stroke-linecap="round" aria-hidden="true"><circle cx="6" cy="6" r="4.6"></circle><path d="M6 3.6V6l1.8 1.2"></path></svg>
+        <span>rate limited · {{ rlText() }}</span>
+      </div>
+      <div v-if="proactiveKind()" class="card__rl">
+        <StatusChip status="rate_limited" :kind="proactiveKind()" />
+        <span v-if="proactiveProvider()">{{ proactiveProvider() }}</span>
+      </div>
       <div class="card__foot">
         <PriorityChip :priority="card.priority" />
-        <span class="chip chip--muted">{{ card.type }}</span>
         <span v-if="card.status === 'in_progress'" class="chip chip--live">
           <span class="dot dot--pulse"></span>working<template v-if="card.startedAt"> · {{ elapsed() }}</template>
         </span>
         <span v-else-if="card.blockedReason" class="chip chip--warn">blocked</span>
         <span v-if="card.archivedAt" class="chip chip--muted">archived</span>
-        <span class="card__lane">{{ laneName(card.laneThreadId) }}</span>
+        <span class="card__lane">{{ laneName(card.laneGroupId) }}</span>
       </div>
     </article>
   `,