taskchef 7.19.0 → 7.19.1

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "taskchef",
-  "version": "7.19.0",
+  "version": "7.19.1",
   "description": "Dispatch work from a data-only workspace to visible Codex project tasks.",
   "author": {
     "name": "Favo Yang",

package/README.md

@@ -271,6 +271,11 @@ and its activity timeline remain unchanged. If the bundled CLI is unavailable,
 the dashboard does not fall back to another `codex` executable from `PATH`.
 The header shows the running TaskChef package version reported by the same
 bounded health identity used for compatible-listener checks.
+The canonical port is owned by a dashboard initialized in the TaskChef MCP host
+before its tool transport connects. Health identity records an `mcp` launcher,
+and MCP recovery reuses only another exact-compatible MCP-launched dashboard;
+a foreground `taskchef dashboard` process is intentionally standalone so its
+child commands cannot silently inherit an agent-shell sandbox.
 Task and result times are relative through 29 days (with minute detail for the
 first six hours), then use a locale-aware calendar date. Each time is a keyboard-
 accessible toggle for its full locale-aware date and time, and one shared
@@ -281,16 +286,17 @@ revision, so reconnects and non-semantic rewrites do not replay a notice and a
 later task state cannot rewrite an older notice. A notice remains readable if
 its task disappears; selecting it then explains that current details are no
 longer available.
-It does not mutate TaskChef data and prints its local URL.
-When a compatible foreground dashboard already owns port 3210,
-`ensure_dashboard` reuses it but does not take ownership. If an unknown,
-different-workspace, or stale-version process owns the port, TaskChef reports a
-concise conflict and never kills or replaces that process. The foreground CLI
-similarly asks you to stop the listener or choose another `--port`.
+It does not mutate TaskChef data and prints its local URL. A foreground
+dashboard identifies itself as standalone and is never reused on the canonical
+MCP port. If a standalone, unknown, different-workspace, or stale-version
+process owns port 3210, TaskChef reports a concise conflict and never kills or
+replaces that process. The foreground CLI similarly asks you to stop the
+listener or choose another `--port`.
 
 The health endpoint contains only a fixed service marker, health schema,
-TaskChef version, dashboard-server version, and canonical workspace. It exposes
-no task data, credentials, environment variables, process control, or secrets.
+TaskChef version, dashboard-server version, canonical workspace, and launcher.
+It exposes no task data, credentials, environment variables, process control,
+or secrets.
 
 ![TaskChef dashboard identity and version](docs/images/dashboard-identity.jpg)
 
@@ -351,13 +357,15 @@ does not necessarily reload Codex. Then run `$taskchef-dashboard` (or call
 
 - the expected released TaskChef version;
 - the expected dashboard protocol `serverVersion`;
+- the `mcp` dashboard launcher;
 - the canonical TaskChef workspace path;
 - the canonical `http://127.0.0.1:3210/` URL.
 
 The release-install sequence is therefore: install plugin, activate or reload
 the new MCP process, ensure the dashboard, then verify TaskChef version,
-protocol `serverVersion`, canonical workspace, and URL. Exact-compatible
-servers may be reused; unknown listeners remain untouched.
+protocol `serverVersion`, `mcp` launcher, canonical workspace, and URL.
+Exact-compatible MCP servers may be reused; standalone and unknown listeners
+remain untouched.
 
 ## Development
 

package/docs/spec.md

@@ -121,13 +121,16 @@ fields MUST NOT change after recording.
 
 ## Required lifecycle
 
-When the canonical TaskChef MCP server finishes connecting, it MUST invoke the
-same serialized dashboard ensure path once by default. It MUST read the
+Before the canonical TaskChef MCP server connects and exposes its transport, it
+MUST invoke the same serialized dashboard ensure path once by default. It MUST read the
 canonical configuration and skip this only for explicit
 `dashboard.autostart: false`. Initialization failures, invalid workspace state,
 port conflicts, and dashboard errors MUST NOT prevent tool registration or MCP
 availability. They MUST emit only a bounded non-sensitive diagnostic through
 the MCP process logging channel. MCP initialization MUST NOT open a browser.
+If transport connection fails after dashboard startup, the MCP server MUST
+best-effort close both its owned dashboard and partially attached transport,
+then propagate the original connection failure even when cleanup also fails.
 
 At the start of every dispatcher turn, the dispatcher SHOULD call
 `ensure_dashboard` best-effort. Failure MUST NOT block direct TaskChef answers,
@@ -228,6 +231,7 @@ HTTP server; it does not mutate dispatcher workspace files.
 ```text
 { dashboard: {
   action: "started" | "reused",
+  launcher: "mcp",
   url: "http://127.0.0.1:3210/",
   workspace: string,
   taskchefVersion: string,
@@ -235,20 +239,22 @@ HTTP server; it does not mutate dispatcher workspace files.
 } }
 ```
 
-Calls MUST serialize within one MCP process. The first call starts an owned
-dashboard or reuses an exact compatible listener; later and concurrent calls
-are idempotent and report reuse after the single start. The stable default MUST
+MCP initialization MUST complete its best-effort dashboard start before exposing
+the MCP transport. Calls MUST serialize within one MCP process. The first call
+starts an owned dashboard or reuses an exact compatible MCP-launched listener;
+later and concurrent calls are idempotent and report reuse after the single start. The stable default MUST
 bind only to `127.0.0.1:3210` and MUST NOT accept a model-supplied workspace,
 host, or port.
 
 Before reuse, TaskChef MUST query a bounded loopback identity endpoint and
 require the exact fixed service/schema, TaskChef version, dashboard-server
-version, and canonical workspace. An unknown, malformed, different-workspace,
-or stale-version listener MUST produce a concise actionable conflict. TaskChef
+version, canonical workspace, and `mcp` launcher identity. A standalone,
+unknown, malformed, different-workspace, or stale-version listener MUST produce a concise actionable conflict. TaskChef
 MUST NOT kill, replace, signal, or otherwise control that listener. A startup
 failure MUST leave no owned listener. The MCP server MUST close its owned
-dashboard when its transport or process shuts down; it MUST NOT close a reused
-external foreground server.
+dashboard when its transport or process shuts down. This keeps dashboard child
+operations in the MCP host environment and prevents an agent-shell or foreground
+CLI dashboard from being mistaken for the canonical MCP-owned runtime.
 
 The packaged `$taskchef-dashboard` skill MUST call this tool, report `started`
 or `reused`, and return the canonical clickable URL. It MAY use an available
@@ -510,6 +516,6 @@ closed.
 Installing or replacing plugin files MUST NOT be described as activating the
 new MCP code. Release verification MUST install the plugin, activate or reload
 the new MCP process, ensure the dashboard, and verify the expected TaskChef
-version, dashboard protocol `serverVersion`, canonical workspace, and canonical
-URL. Exact-compatible listener reuse remains valid; installation MUST NOT be
+version, dashboard protocol `serverVersion`, `mcp` launcher, canonical workspace,
+and canonical URL. Exact-compatible MCP-listener reuse remains valid; installation MUST NOT be
 claimed to reload Codex automatically.

package/docs/workflows.md

@@ -40,11 +40,11 @@ sequenceDiagram
   participant H as Loopback health
   participant S as Dashboard server
   M->>M: Read dashboard.autostart (absent means true)
-  M->>M: Best-effort ensure after MCP connect
+  M->>M: Best-effort ensure before MCP transport connects
   D->>M: ensure_dashboard()
   M->>M: Serialize concurrent ensure calls
   M->>H: GET 127.0.0.1:3210/api/health
-  alt Exact service, versions, and canonical workspace
+  alt Exact service, versions, canonical workspace, and MCP launcher
     H-->>M: Bounded compatible identity
     M-->>D: reused, URL, workspace, versions
   else No listener
@@ -52,7 +52,7 @@ sequenceDiagram
     M->>S: Start in this MCP process on 127.0.0.1:3210
     S-->>M: Owned server
     M-->>D: started, URL, workspace, versions
-  else Unknown, stale, or different workspace
+  else Standalone, unknown, stale, or different workspace
     H-->>M: Missing or incompatible identity
     M-->>D: Actionable conflict, listener untouched
   end
@@ -62,9 +62,10 @@ sequenceDiagram
 ```
 
 When the MCP transport or plugin process closes, it closes only the server it
-started. A compatible foreground `taskchef dashboard` listener may be reused
-but remains owned by that CLI process. No TaskChef path terminates an unknown
-listener or installs OS persistence.
+started. A foreground `taskchef dashboard` listener identifies itself as
+standalone and is never reused as the canonical MCP dashboard, because its
+archive child process may inherit a different host environment. No TaskChef
+path terminates an incompatible listener or installs OS persistence.
 
 Autostart and explicit ensures share the same manager promise, so concurrent
 initialization and recovery calls produce at most one owned listener. An
@@ -79,13 +80,13 @@ The practical release handoff ends in this order:
 1. Install the released plugin.
 2. Activate or reload its new TaskChef MCP process.
 3. Run `$taskchef-dashboard` or call `ensure_dashboard`.
-4. Verify the expected TaskChef version, protocol `serverVersion`, canonical
-   workspace, and canonical URL returned by the dashboard identity.
+4. Verify the expected TaskChef version, protocol `serverVersion`, `mcp`
+   launcher, canonical workspace, and canonical URL returned by the dashboard identity.
 
 Replacing plugin files alone cannot execute autostart because old code remains
 in the already-running MCP process. Installation does not necessarily reload
-Codex. An exact-compatible dashboard may be reused; an unknown listener is
-never terminated or replaced.
+Codex. An exact-compatible MCP dashboard may be reused; a standalone or unknown
+listener is never terminated or replaced.
 
 ## Normal delegation and self-linking
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taskchef",
-  "version": "7.19.0",
+  "version": "7.19.1",
   "description": "A non-blocking interactive dispatcher for visible Codex tasks.",
   "license": "MIT",
   "author": "Favo Yang",

package/src/dashboard-manager.js

@@ -14,13 +14,14 @@ const DEFAULT_HOST = "127.0.0.1";
 const DEFAULT_PORT = 3210;
 const HEALTH_TIMEOUT_MS = 750;
 
-function expectedIdentity(workspace, taskchefVersion, serverVersion) {
+function expectedIdentity(workspace, taskchefVersion, serverVersion, launcher) {
   return {
     schemaVersion: 1,
     service: "taskchef-dashboard",
     taskchefVersion,
     serverVersion,
     workspace,
+    launcher,
   };
 }
 
@@ -107,6 +108,7 @@ export function createDashboardManager({
   port = DEFAULT_PORT,
   taskchefVersion = TASKCHEF_VERSION,
   serverVersion = DASHBOARD_SERVER_VERSION,
+  launcher = "mcp",
   createServer = createDashboardServer,
   readIdentity = readDashboardIdentity,
 } = {}) {
@@ -117,6 +119,7 @@ export function createDashboardManager({
 
   const publicResult = (action) => ({
     action,
+    launcher,
     url: `http://${dashboardAuthority(host, ownedServer?.port ?? port)}/`,
     workspace: canonicalWorkspace,
     taskchefVersion,
@@ -132,9 +135,12 @@ export function createDashboardManager({
       if (listenerAbsent(error)) return false;
       throw listenerConflict(url, `is occupied but did not return a compatible identity (${error.message}).`);
     }
-    const expected = expectedIdentity(canonicalWorkspace, taskchefVersion, serverVersion);
+    const expected = expectedIdentity(canonicalWorkspace, taskchefVersion, serverVersion, launcher);
     if (!isExactIdentity(identity, expected)) {
-      throw listenerConflict(url, "belongs to an unknown, stale, or different-workspace service.");
+      throw listenerConflict(
+        url,
+        "belongs to an unknown, stale, different-workspace, or differently launched service.",
+      );
     }
     return true;
   };
@@ -150,6 +156,7 @@ export function createDashboardManager({
         port,
         taskchefVersion,
         serverVersion,
+        launcher,
       });
       return publicResult("started");
     } catch (error) {

package/src/dashboard.js

@@ -452,6 +452,7 @@ export async function createDashboardServer({
   monitorOptions = {},
   openProject = null,
   openThread = null,
+  launcher = "standalone",
   taskchefVersion = TASKCHEF_VERSION,
   serverVersion = DASHBOARD_SERVER_VERSION,
 } = {}) {
@@ -464,6 +465,9 @@ export async function createDashboardServer({
   if (!Number.isInteger(maxEventClients) || maxEventClients < 0) {
     throw new Error("dashboard event-client limit must be a non-negative integer");
   }
+  if (!new Set(["mcp", "standalone"]).has(launcher)) {
+    throw new Error("dashboard launcher must be mcp or standalone");
+  }
   const monitor = new DashboardMonitor(workspace, monitorOptions);
   await monitor.start();
   const identity = Object.freeze({
@@ -472,6 +476,7 @@ export async function createDashboardServer({
     taskchefVersion,
     serverVersion,
     workspace: monitor.workspace,
+    launcher,
   });
   if (Buffer.byteLength(`${JSON.stringify(identity)}\n`) > DASHBOARD_HEALTH_MAX_BYTES) {
     monitor.close();

package/src/mcp.js

@@ -88,6 +88,7 @@ const preparationSchema = z.object({
 
 const dashboardSchema = z.object({
   action: z.enum(["started", "reused"]),
+  launcher: z.literal("mcp"),
   url: z.string().url(),
   workspace: z.string(),
   taskchefVersion: z.string(),
@@ -163,7 +164,7 @@ export function createTaskChefMcpServer({
     return closePromise;
   };
   server.server.onclose = () => {
-    void dashboardManager.close();
+    void dashboardManager.close().catch(() => {});
   };
 
   server.registerTool(
@@ -171,7 +172,7 @@ export function createTaskChefMcpServer({
     {
       title: "Ensure TaskChef dashboard",
       description:
-        "Best-effort ensure the canonical TaskChef dashboard is available on 127.0.0.1:3210. Starts one dashboard inside this MCP process or reuses only an exact compatible TaskChef dashboard for the same canonical workspace; unknown listeners are never terminated or replaced.",
+        "Best-effort ensure the canonical TaskChef dashboard is available on 127.0.0.1:3210. Starts one dashboard inside this MCP process or reuses only an exact compatible MCP-launched TaskChef dashboard for the same canonical workspace; standalone and unknown listeners are never terminated or replaced.",
       inputSchema: {},
       outputSchema: { dashboard: dashboardSchema },
       annotations: {
@@ -325,8 +326,16 @@ export function createTaskChefMcpServer({
     ...(logDashboardDiagnostic ? { log: logDashboardDiagnostic } : {}),
   });
   server.connect = async (...args) => {
-    await originalConnect(...args);
-    void autostartDashboard();
+    await autostartDashboard();
+    try {
+      await originalConnect(...args);
+    } catch (error) {
+      await Promise.allSettled([
+        Promise.resolve().then(() => dashboardManager.close()),
+        Promise.resolve().then(() => originalClose()),
+      ]);
+      throw error;
+    }
   };
 
   return server;

package/src/version.js

@@ -4,4 +4,4 @@ const require = createRequire(import.meta.url);
 const packageMetadata = require("../package.json");
 
 export const TASKCHEF_VERSION = packageMetadata.version;
-export const DASHBOARD_SERVER_VERSION = "2";
+export const DASHBOARD_SERVER_VERSION = "3";