taskchef 5.11.1 → 5.12.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "taskchef",
-  "version": "5.11.1",
+  "version": "5.12.0",
   "description": "Dispatch work from a data-only workspace to visible Codex project tasks.",
   "author": {
     "name": "Favo Yang",

package/README.md

@@ -174,10 +174,9 @@ executors report results:
 taskchef dashboard
 ```
 
-Open the printed capability URL, which starts with `http://127.0.0.1:3210` and
-contains a one-time launch token. Do not share it: the browser exchanges it for
-a local session cookie before loading task data, then removes the token from the
-address bar. Use `--port <number>` to choose another port and `--workspace
+Open the printed local URL, which is `http://127.0.0.1:3210/` by default. The
+same server can be open in the Codex in-app browser and an external browser at
+the same time. Use `--port <number>` to choose another port and `--workspace
 <path>` to override the normal workspace resolution. Press Ctrl+C in the
 terminal to stop the server.
 
@@ -191,10 +190,14 @@ The dashboard:
 - opens the recorded task directly in Codex when it has a supported UUID thread
   ID, with a project-opening fallback for unresolved or legacy identities.
 
-The server binds only to the numeric IPv4 loopback interface, requires the
-unguessable launch capability before serving instructions or results, validates
-the same task schema as the CLI, retains its last valid snapshot if the log
-becomes invalid, and never writes dispatcher-workspace files. It limits event
+The server binds only to the numeric IPv4 loopback interface and rejects
+non-loopback configuration. It intentionally does not authenticate browser
+sessions, so any local process or browser that can reach the port can read the
+dashboard data. Keep the server running only while needed and do not expose it
+through a proxy or tunnel. State-changing actions still require an exact Host
+and same-origin request. The server validates the same task schema as the CLI,
+retains its last valid snapshot if the log becomes invalid, and never writes
+dispatcher-workspace files. It limits event
 streams and disconnects slow clients instead of buffering snapshots without
 bound. It watches the workspace directory
 so TaskChef's atomic log replacement remains visible, uses a low-frequency file

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taskchef",
-  "version": "5.11.1",
+  "version": "5.12.0",
   "description": "A non-blocking interactive dispatcher for visible Codex tasks.",
   "license": "MIT",
   "author": "Favo Yang",

package/src/dashboard/actions.js

@@ -0,0 +1,17 @@
+export async function openTaskFromControl(event, taskId, {
+  fetchAction = globalThis.fetch,
+  showMessage,
+} = {}) {
+  event.stopPropagation();
+  const control = event.currentTarget;
+  control.disabled = true;
+  try {
+    const response = await fetchAction(`/api/tasks/${encodeURIComponent(taskId)}/open-codex`, {
+      method: "POST",
+    });
+    const result = await response.json();
+    showMessage(result.message);
+  } finally {
+    control.disabled = false;
+  }
+}

package/src/dashboard/app.js

@@ -7,6 +7,7 @@ import {
   taskStatusLabel,
   taskWithinDateFilter,
 } from "./state.js";
+import { openTaskFromControl } from "./actions.js";
 
 const state = {
   tasks: [],
@@ -161,7 +162,18 @@ function taskCard(task) {
   const time = document.createElement("time");
   time.dateTime = task.meaningfulUpdatedAt ?? task.updatedAt ?? task.createdAt;
   time.textContent = `Updated ${formatTime(time.dateTime)}`;
-  article.append(heading, project, summary, time);
+  const footer = document.createElement("div");
+  footer.className = "task-footer";
+  const openTask = document.createElement("button");
+  openTask.type = "button";
+  openTask.className = "secondary-button task-open";
+  openTask.textContent = "Open task";
+  openTask.setAttribute("aria-label", `Open ${task.title} in Codex`);
+  openTask.addEventListener("click", (event) => openTaskFromControl(event, task.id, {
+    showMessage,
+  }));
+  footer.append(time, openTask);
+  article.append(heading, project, summary, footer);
   return article;
 }
 
@@ -251,16 +263,7 @@ elements.copyThreadId.addEventListener("click", async () => {
     showMessage("Clipboard access is unavailable. Copy the thread ID from the metadata below.");
   }
 });
-elements.openProject.addEventListener("click", async () => {
+elements.openProject.addEventListener("click", async (event) => {
   if (!state.selectedTask) return;
-  elements.openProject.disabled = true;
-  try {
-    const response = await fetch(`/api/tasks/${encodeURIComponent(state.selectedTask.id)}/open-codex`, {
-      method: "POST",
-    });
-    const result = await response.json();
-    showMessage(result.message);
-  } finally {
-    elements.openProject.disabled = false;
-  }
+  await openTaskFromControl(event, state.selectedTask.id, { showMessage });
 });

package/src/dashboard/index.html

@@ -12,7 +12,7 @@
     <header class="site-header">
       <div>
         <p class="eyebrow">TaskChef</p>
-        <h1>Task dashboard</h1>
+        <h1>TaskChef dashboard</h1>
         <p class="subtitle">Latest delegated work, updated as TaskChef reports change.</p>
       </div>
       <div class="connection" role="status" aria-live="polite">

package/src/dashboard/styles.css

@@ -74,6 +74,8 @@ select { min-width: 180px; padding: 9px 34px 9px 11px; border: 1px solid var(--b
 .task-project { margin: 3px 0 12px; font-size: 0.86rem; }
 .task-summary { max-width: 78ch; margin-bottom: 14px; }
 time { font-size: 0.78rem; }
+.task-footer { display: flex; align-items: center; justify-content: space-between; gap: 16px; }
+.task-open { flex: none; }
 
 .status { flex: none; padding: 4px 9px; border-radius: 999px; background: var(--surface-muted); color: var(--muted); font-size: 0.72rem; font-weight: 750; text-transform: capitalize; }
 .status-completed { background: var(--accent-soft); color: var(--accent); }
@@ -122,6 +124,8 @@ pre { max-height: 280px; margin: 0; padding: 14px; overflow: auto; border-radius
   .toolbar label, .toolbar select { width: 100%; }
   .task-count { margin: 0; }
   .task-heading { align-items: flex-start; }
+  .task-footer { align-items: flex-start; flex-direction: column; }
+  .task-open { width: 100%; }
   .dialog-actions { align-items: stretch; flex-direction: column; }
   .metadata { grid-template-columns: 1fr; }
   .metadata dt { padding-bottom: 0; border-bottom: 0; }

package/src/dashboard.js

@@ -1,4 +1,3 @@
-import { randomBytes } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { constants, watch } from "node:fs";
 import { open, readFile, realpath, stat } from "node:fs/promises";
@@ -38,6 +37,7 @@ const CONTENT_SECURITY_POLICY = [
 
 const STATIC_FILES = new Map([
   ["/", ["index.html", "text/html; charset=utf-8"]],
+  ["/actions.js", ["actions.js", "text/javascript; charset=utf-8"]],
   ["/app.js", ["app.js", "text/javascript; charset=utf-8"]],
   ["/state.js", ["state.js", "text/javascript; charset=utf-8"]],
   ["/styles.css", ["styles.css", "text/css; charset=utf-8"]],
@@ -383,14 +383,6 @@ export function createSseClient(response, {
   return client;
 }
 
-function requestSessionCookie(request, cookieName) {
-  return request.headers.cookie
-    ?.split(";")
-    .map((part) => part.trim())
-    .find((part) => part.startsWith(`${cookieName}=`))
-    ?.slice(cookieName.length + 1) ?? null;
-}
-
 function publicMonitorError() {
   return {
     message: "The task log is temporarily unavailable. Showing the last valid snapshot.",
@@ -418,10 +410,6 @@ export async function createDashboardServer({
   const monitor = new DashboardMonitor(workspace, monitorOptions);
   await monitor.start();
   const clients = new Set();
-  const capabilityToken = randomBytes(32).toString("base64url");
-  let launchToken = capabilityToken;
-  const sessionToken = randomBytes(32).toString("base64url");
-  const sessionCookieName = `taskchef_session_${randomBytes(12).toString("hex")}`;
   let allowedAuthority;
   let allowedOrigin;
 
@@ -447,26 +435,6 @@ export async function createDashboardServer({
       sendJson(response, 421, { message: "Misdirected request." });
       return;
     }
-    const authenticated = requestSessionCookie(request, sessionCookieName) === sessionToken;
-    if (
-      (method === "GET" || method === "HEAD")
-      && launchToken !== null
-      && url.pathname === "/"
-      && url.searchParams.get("token") === launchToken
-    ) {
-      launchToken = null;
-      response.writeHead(303, {
-        ...securityHeaders("text/plain; charset=utf-8"),
-        Location: "/",
-        "Set-Cookie": `${sessionCookieName}=${sessionToken}; HttpOnly; SameSite=Strict; Path=/`,
-      });
-      response.end("Opening TaskChef dashboard.\n");
-      return;
-    }
-    if (!authenticated) {
-      sendJson(response, 401, { message: "Dashboard launch capability required." });
-      return;
-    }
     if (method !== "GET" && method !== "HEAD" && method !== "POST") {
       response.writeHead(405, { Allow: "GET, HEAD, POST" });
       response.end();
@@ -514,7 +482,7 @@ export async function createDashboardServer({
     const taskMatch = url.pathname.match(/^\/api\/tasks\/([a-zA-Z0-9._-]+)\/open-codex$/);
     if (taskMatch && method === "POST") {
       if (request.headers.origin !== allowedOrigin) {
-        sendJson(response, 403, { message: "Dashboard session validation failed." });
+        sendJson(response, 403, { message: "Dashboard origin validation failed." });
         return;
       }
       const task = monitor.tasks.find((candidate) => candidate.id === taskMatch[1]);
@@ -600,7 +568,7 @@ export async function createDashboardServer({
     host,
     port: boundPort,
     origin: allowedOrigin,
-    url: `${allowedOrigin}/?token=${encodeURIComponent(capabilityToken)}`,
+    url: `${allowedOrigin}/`,
     monitor,
     get eventClientCount() { return clients.size; },
     async close() {