taskchef 9.1.0 → 9.3.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "taskchef",
-  "version": "9.1.0",
+  "version": "9.3.0",
   "description": "Native Codex dashboard with lightweight project delegation.",
   "author": {
     "name": "Favo Yang",

package/README.md

@@ -6,9 +6,33 @@ Chats appear regardless of how they were started.
 
 ## Install
 
-Install **TaskChef** from the `favoyang-plugins` Codex marketplace. TaskChef uses
-a local Node.js MCP server; Node.js 22.18+, 23.2+, or 24+ is required. Open **TaskChef**
-from the Codex sidebar. No dispatcher workspace or project indexing is needed.
+TaskChef's marketplace lives in this repository. In Codex, open **Settings →
+Plugins → Add → Add a marketplace** and use
+`https://github.com/favoyang/taskchef.git`. Leave the Git ref as `main` and Sparse
+paths empty. Open **Plugins → Personal**, find **TaskChef** under **TaskChef**,
+and install it.
+
+Alternatively, use the Codex CLI:
+
+```sh
+codex plugin marketplace add favoyang/taskchef
+codex plugin add taskchef@taskchef
+```
+
+Restart Codex. Open **…** below Plugins in the left dock, find **TaskChef**, and
+pin it to keep the board in the sidebar. TaskChef uses a local Node.js MCP
+server and npm. Supported Node.js versions are 22.18+ in the 22 series, or
+23.2 and newer. Node.js 24 is recommended for a new installation. Server
+dependencies are included in the published package.
+
+### Move from the shared marketplace
+
+If you installed `taskchef@favoyang-plugins`, add the new marketplace and install
+`taskchef@taskchef` with the commands above. After it installs successfully,
+remove the old plugin with `codex plugin remove taskchef@favoyang-plugins`, then
+restart Codex. Keep only one released TaskChef installation enabled. Local
+settings, GitHub credentials, and Codex chat history are independent of the
+marketplace cache and do not need to be reset. TaskChef Dev stays separate.
 
 Codex databases and logs stay on your computer and remain the source of truth.
 TaskChef keeps its own settings, manual Done marks, notification state, and
@@ -48,3 +72,8 @@ name; apply that identity only to its local staging package. See
 [development packaging](docs/mcp-app.md#development-plugin-identity).
 
 [Native app guide](docs/mcp-app.md) · [GitHub setup](docs/taskchef-next-github.md)
+
+## Feedback
+
+[Report a bug](https://github.com/favoyang/taskchef/issues/new?template=bug_report.yml)
+or [request a feature](https://github.com/favoyang/taskchef/issues/new?template=feature_request.yml).

package/docs/mcp-app.md

@@ -304,3 +304,64 @@ update window, and search filters. It starts off when the dashboard opens. Pin
 changes appear on the next data refresh. The current desktop pin list takes
 precedence over the database `is_pinned` field. TaskChef ignores old migration
 snapshots and never writes pin state. Without either source, chats are unpinned.
+
+## Live approval requests
+
+TaskChef optionally subscribes to Running chats through the already-running
+Codex desktop app's private IPC socket (`$CODEX_HOME/ipc/ipc.sock`, or the
+`codex-ipc` named pipe on Windows). It sends only initialization and local-chat
+subscription messages; it never starts a turn or sends an approval decision.
+This is a private compatibility surface, observed with Codex 26.1007.30912,
+state-stream version 11 and subscription version 1.
+
+An active `waitingOnApproval` flag places the chat in Waiting with a **Needs
+approval** cover. Details show the pending request, its source, and its origin
+when available. **Open chat to approve** takes the user to Codex to inspect and
+allow or deny the request. This is separate from the asynchronous questions
+panel. The saved turn can remain `inProgress` throughout the approval wait.
+Approval waits cannot be marked Done or acknowledged as Scheduled.
+
+The bridge keeps only runtime status and pending requests in backend memory.
+TaskChef responses contain only bounded display fields, never raw conversation
+snapshots. Requests must match the chat and selected turn. Missed patch
+revisions trigger a fresh snapshot. Disconnects clear live evidence, and
+subsequent refreshes retry at most once every 15 seconds. Subscriptions end when
+the database turn finishes or the chat is archived, and on MCP shutdown.
+
+If the socket is unavailable, disconnects, or its protocol changes, TaskChef
+falls back to saved database state. The notification center reports the first
+IPC failure once per installed TaskChef version, shared across views and MCP
+processes. The watermark lives in `notifications.json.errors.json`, so the released
+plugin’s older notification writer cannot erase it. Reading or clearing that
+message does not cause polling to replay it. Other features continue working. The first connection waits at most one
+second, and missing chat snapshots wait at most 250 ms for all subscriptions
+combined. Hidden views do not initiate refreshes; an existing subscription can
+still receive live updates while the MCP process remains running.
+
+## Marketplace and release ownership
+
+The public catalog is `.agents/plugins/marketplace.json` in this repository.
+Its marketplace name is `taskchef`; the released install is `taskchef@taskchef`.
+The catalog pins a published npm package containing the built UI and production
+server dependencies. A raw Git checkout is not a packaged release.
+
+After semantic-release publishes, the marketplace job checks the expected npm
+version and archive, then commits only the catalog pin on the latest `main`.
+A failed check leaves the prior pin in place and fails the workflow. The job
+uses this repository's GitHub token; no shared-marketplace deploy key is needed.
+If the push loses a race with another main update, rerun the Release workflow
+on main to retry after checking the current published version. Do not force push.
+
+Keep TaskChef Dev in a separate local marketplace named `taskchef-next-preview`,
+with plugin ID `taskchef-next` and display name **TaskChef Dev**. Store that
+marketplace and its staging packages in a persistent local folder, outside
+this public checkout. Its catalog uses `source.source: local` with a path to
+the prepared staging package. Add that folder with
+`codex plugin marketplace add /path/to/local-dev-marketplace`, then install
+`codex plugin add taskchef-next@taskchef-next-preview`. This can coexist with
+`taskchef@taskchef`. Never rename the source release manifest for Dev.
+
+Retire the old shared catalog entry only after this repository's catalog is
+live, the release workflow has completed, and a clean installation from the
+new marketplace succeeds. Existing users must migrate explicitly; changing
+a marketplace does not automatically move their installed plugin identity.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taskchef",
-  "version": "9.1.0",
+  "version": "9.3.0",
   "description": "A native Codex dashboard for chats, usage, pull requests, and schedules.",
   "license": "Apache-2.0",
   "author": "Favo Yang",

package/src/codex-live-state.js

@@ -0,0 +1,207 @@
+import net from "node:net";
+import { lstat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { randomUUID } from "node:crypto";
+
+// Private desktop IPC, observed in Codex 26.1007.30912. Never send decisions or
+// thread mutations. Only initialize and subscribe/unsubscribe to local chats.
+const STREAM_VERSION = 11;
+const MAX_FRAME_BYTES = 32 * 1024 * 1024;
+const text = value => typeof value === "string" ? value.slice(0, 4000) : null;
+const approvalMethods = new Set(["item/commandExecution/requestApproval", "item/fileChange/requestApproval", "item/permissions/requestApproval"]);
+
+function approval(request, task) {
+  const params = request?.params;
+  if (!params || params.threadId !== task.id || params.turnId !== task.turnId) return null;
+  const meta = params._meta ?? {};
+  const elicitation = request.method === "mcpServer/elicitation/request" && meta.codex_approval_kind === "mcp_tool_call";
+  if (!approvalMethods.has(request.method) && !elicitation) return null;
+  let origin = null;
+  try { const url = new URL(meta.origin); if (["http:", "https:"].includes(url.protocol)) origin = url.origin; } catch { /* Optional origin. */ }
+  return {
+    id: String(request.id), turnId: params.turnId,
+    title: text(meta.connector_name) ?? (request.method.includes("commandExecution") ? "Command execution" : request.method.includes("fileChange") ? "File changes" : "Permissions"),
+    message: text(params.message) ?? text(params.reason) ?? "Codex needs permission to continue.",
+    origin,
+  };
+}
+
+function validateState(state) {
+  const status = state.threadRuntimeStatus;
+  if (status != null && (typeof status !== "object" || typeof status.type !== "string"
+    || (status.type === "active" && (!Array.isArray(status.activeFlags) || !status.activeFlags.every(flag => typeof flag === "string"))))) throw new Error("Invalid Codex IPC runtime status");
+  if (!Array.isArray(state.requests) || !state.requests.every(request => request && typeof request === "object"
+    && typeof request.method === "string" && request.params && typeof request.params === "object")) throw new Error("Invalid Codex IPC approval requests");
+  return state;
+}
+
+// Apply only the two fields we consume. Conversation text, images, credentials,
+// and unrelated patches are discarded and never enter TaskChef snapshots.
+function patchState(state, patches) {
+  const result = structuredClone(state);
+  for (const patch of patches) {
+    if (!Array.isArray(patch.path) || !["threadRuntimeStatus", "requests"].includes(patch.path[0])) continue;
+    if (!["add", "replace", "remove"].includes(patch.op) || patch.path.some(key => ["__proto__", "prototype", "constructor"].includes(key))) throw new Error("Invalid live-state patch");
+    let parent = result;
+    for (const key of patch.path.slice(0, -1)) {
+      if (!parent || !Object.hasOwn(parent, key)) throw new Error("Missing live-state patch path");
+      parent = parent[key];
+    }
+    const key = patch.path.at(-1);
+    if (Array.isArray(parent)) {
+      if (!Number.isInteger(key) || key < 0 || key > parent.length || (patch.op !== "add" && key === parent.length)) throw new Error("Invalid live-state array patch");
+      if (patch.op === "remove") parent.splice(key, 1);
+      else if (patch.op === "add") parent.splice(key, 0, patch.value);
+      else parent[key] = patch.value;
+    } else {
+      if (!parent || typeof parent !== "object") throw new Error("Invalid live-state patch path");
+      if (patch.op === "remove") delete parent[key]; else parent[key] = patch.value;
+    }
+  }
+  return validateState(result);
+}
+
+export class CodexLiveState {
+  constructor({ codexHome = process.env.CODEX_HOME || join(homedir(), ".codex"), socketPath, now = Date.now, timeoutMs = 1000 } = {}) {
+    this.socketPath = socketPath ?? (process.platform === "win32" ? "\\\\.\\pipe\\codex-ipc" : join(codexHome, "ipc", "ipc.sock"));
+    this.now = now;
+    this.timeoutMs = timeoutMs;
+    this.entries = new Map();
+    this.retryAt = 0;
+    this.error = null;
+    this.closed = false;
+  }
+  async connect() {
+    if (this.clientId || this.closed || this.now() < this.retryAt) return;
+    if (this.connecting) return this.connecting;
+    this.connecting = (async () => {
+      try {
+        if (process.platform !== "win32") {
+          const [socket, directory] = await Promise.all([lstat(this.socketPath), lstat(dirname(this.socketPath))]);
+          if (!socket.isSocket() || socket.uid !== process.getuid() || !directory.isDirectory() || directory.uid !== process.getuid() || (directory.mode & 0o022)) throw new Error("Codex IPC socket ownership or permissions are invalid");
+        }
+        if (this.closed) return;
+        await new Promise(resolve => {
+          const socket = this.socket = net.createConnection(this.socketPath);
+          this.buffer = Buffer.alloc(0);
+          const timer = setTimeout(() => this.fail("Codex IPC initialization timed out"), this.timeoutMs);
+          this.finishConnect = () => { clearTimeout(timer); resolve(); };
+          socket.on("connect", () => this.send({ type: "request", requestId: randomUUID(), version: 0, method: "initialize", params: { clientType: "taskchef" } }));
+          socket.on("data", chunk => {
+            if (this.socket !== socket) return;
+            try {
+              this.buffer = Buffer.concat([this.buffer, chunk]);
+              while (this.buffer.length >= 4) {
+                const size = this.buffer.readUInt32LE();
+                if (!size || size > MAX_FRAME_BYTES) throw new Error("Codex IPC frame is invalid or too large");
+                if (this.buffer.length < size + 4) break;
+                const message = JSON.parse(this.buffer.subarray(4, size + 4));
+                this.buffer = this.buffer.subarray(size + 4);
+                this.receive(message);
+              }
+            } catch (error) { this.fail(error.message); }
+          });
+          socket.on("error", error => this.fail(`Codex IPC connection failed (${error.code ?? "error"})`));
+          socket.on("close", () => { if (this.socket === socket && !this.closed) this.fail("Codex IPC connection closed"); });
+        });
+      } catch (error) { this.fail(error.code ? `Codex IPC unavailable (${error.code})` : error.message); }
+    })().finally(() => { this.connecting = null; });
+    return this.connecting;
+  }
+  send(message) {
+    if (!this.socket || this.socket.destroyed) return;
+    const body = Buffer.from(JSON.stringify(message));
+    const frame = Buffer.alloc(4 + body.length);
+    frame.writeUInt32LE(body.length); body.copy(frame, 4);
+    this.socket.write(frame);
+  }
+  follow(id, following) {
+    this.send({ type: "broadcast", method: "thread-stream-following-changed", sourceClientId: this.clientId, version: 1, params: { conversationId: id, hostId: "local", following } });
+  }
+  receive(message) {
+    if (message.type === "response" && message.method === "initialize" && message.resultType === "success") {
+      if (typeof message.result?.clientId !== "string") throw new Error("Invalid Codex IPC initialization");
+      this.clientId = message.result.clientId;
+      this.finishConnect?.(); this.finishConnect = null;
+      return;
+    }
+    if (message.type === "client-discovery-request") {
+      this.send({ type: "client-discovery-response", requestId: message.requestId, response: { canHandle: false } });
+      return;
+    }
+    if (message.method === "client-status-changed" && message.params?.status === "disconnected") {
+      for (const entry of this.entries.values()) if (entry.owner === message.params.clientId) { entry.state = null; entry.revision = null; }
+      return;
+    }
+    if (message.type !== "broadcast" || message.method !== "thread-stream-state-changed" || message.params?.hostId !== "local") return;
+    const entry = this.entries.get(message.params.conversationId);
+    if (!entry) return;
+    if (message.version !== STREAM_VERSION) throw new Error("Codex IPC protocol changed; live approvals are unavailable");
+    const change = message.params.change;
+    if (!change || !Number.isSafeInteger(change.revision)) throw new Error("Invalid Codex IPC revision");
+    if (change.type === "snapshot") {
+      const state = change.conversationState;
+      if (state?.id !== message.params.conversationId || !Array.isArray(state.requests)) throw new Error("Invalid Codex IPC snapshot");
+      entry.state = validateState({ threadRuntimeStatus: state.threadRuntimeStatus, requests: state.requests });
+      entry.owner = message.sourceClientId;
+    } else if (change.type === "patches") {
+      if (!entry.state || entry.owner !== message.sourceClientId || entry.revision !== change.baseRevision) {
+        entry.state = null; entry.revision = null;
+        this.follow(message.params.conversationId, true);
+        return;
+      }
+      if (!Array.isArray(change.patches)) throw new Error("Invalid Codex IPC patches");
+      entry.state = patchState(entry.state, change.patches);
+    } else throw new Error("Unknown Codex IPC state message");
+    entry.revision = change.revision;
+    entry.ready?.(); entry.ready = null;
+  }
+  fail(message) {
+    this.error ??= message;
+    this.retryAt = this.now() + 15_000;
+    this.socket?.destroy(); this.socket = null; this.clientId = null; this.buffer = Buffer.alloc(0);
+    this.finishConnect?.(); this.finishConnect = null;
+    for (const entry of this.entries.values()) entry.ready?.();
+    this.entries.clear();
+  }
+  async refresh(tasks) {
+    if (this.closed) return;
+    const selected = tasks.filter(task => !task.observed?.archive && task.observed?.lastTurnEvent === "inProgress");
+    const ids = new Set(selected.map(task => task.id));
+    for (const [id, entry] of this.entries) if (!ids.has(id) || selected.find(task => task.id === id)?.turnId !== entry.turnId) {
+      this.follow(id, false); entry.ready?.(); this.entries.delete(id);
+    }
+    if (!selected.length) return;
+    await this.connect();
+    if (!this.clientId) return;
+    const waiting = [];
+    for (const task of selected) if (!this.entries.get(task.id)?.state) {
+      const entry = this.entries.get(task.id) ?? { turnId: task.turnId, state: null, revision: null };
+      entry.ready?.();
+      waiting.push(new Promise(resolve => { entry.ready = resolve; }));
+      this.entries.set(task.id, entry); this.follow(task.id, true);
+    }
+    if (waiting.length) {
+      let timer;
+      await Promise.race([Promise.all(waiting), new Promise(resolve => { timer = setTimeout(resolve, 250); })]);
+      clearTimeout(timer);
+    }
+  }
+  decorate(task) {
+    if (!task || task.observed?.archive || task.observed?.lastTurnEvent !== "inProgress") return task;
+    const entry = this.entries.get(task.id);
+    if (!entry?.state || entry.turnId !== task.turnId) return task;
+    const state = entry.state;
+    if (state.threadRuntimeStatus?.type !== "active" || !Array.isArray(state.threadRuntimeStatus.activeFlags) || !state.threadRuntimeStatus.activeFlags.includes("waitingOnApproval")) return task;
+    const pendingApprovals = state.requests.map(request => approval(request, task)).filter(Boolean);
+    // An old request must not decorate a newly selected database turn.
+    if (state.requests.length && !state.requests.some(request => request.params?.turnId === task.turnId)) return task;
+    return { ...task, needsApproval: true, pendingApprovals, status: "needs_input", statusLabel: "Needs approval", summary: "Codex is waiting for permission. Open the chat to review and approve." };
+  }
+  close() {
+    this.closed = true;
+    for (const id of this.entries.keys()) this.follow(id, false);
+    this.fail("Codex IPC closed");
+  }
+}