Local task observer / 本机任务总览（只读）

dsh-local-task-observer is an independent, MIT-licensed alpha plugin for the official DeepSeek Harness desktop app. It adds Settings → Local task observer. It is not an official DSH component, a task runner, or a security audit product.

Compatibility: DSH 0.2.2-rc.1 exactly, Node.js 24+, macOS only. No compatibility with other DSH versions is claimed; do not bypass the version gate. Plain ESM, zero dependencies, and no install/build scripts.

Release status: 0.1.0-alpha.1, GitHub-only source distribution. The renamed public namespace has not been installed or verified live. The synthetic suite and syntax checks are not a full UI, authentication-in-browser, or real-source acceptance test.

English

Read-only by design

• Reads one bounded page from the current Host schedule.list({ limit: 150, offset: 0 }) API. Reads do not activate Sessions. No legacy schedule-file reader, task creation, edits, starts, pauses or deliveries.
• Projects limited metadata from the current user's macOS LaunchAgents, Codex version-1 automation definitions, and explicitly recognized Claude candidate directories. Ordinary Claude tasks are not scheduled tasks.
• Uses fixed plutil parsing and launchctl print only. Never executes a definition's program, command arguments or shell.
• Has no agent tools, prompt injection, model calls, telemetry, external network access, SSH, background polling, task-file writes or snapshot persistence. Its browser request goes only to the authenticated local app.
• Uses the official settings slots, host theme, locale service and host React runtime. No separate server, bundled React, workspace integration or remote data service is required.

Interpret the observations carefully

Status or field	Meaning
ok	Supported metadata was read within the scan's bounds; not proof that work succeeded.
empty	A supported source was enumerated without discovering definitions; missing or truncated sources are not called empty.
partial	Some coverage or metadata is incomplete, unverified, truncated or failed.
unavailable	The source could not be read, is missing, or the scan timed out. Not proof of zero tasks.
unsupported	Platform or definition format is not supported; it is not guessed.
unknown / null	No supported observation. Unknown exit code is not zero or success.

loaded, active, paused, ended and running describe observations, not valid output or completed business work. DSH inbox delivery is not execution or completion. The optional last-delivery field is an inbox receipt, not a last successful run. No log, file modification time or missing exit code is used to infer success. Local sources do not calculate a next run.

Claude's local definition schema has not been independently verified. Recognized candidate metadata remains partial with unknown runtime state; other formats remain unsupported. It does not infer execution from arbitrary JSON dates or status fields. Codex support is a deliberately small, dependency-free version-1 TOML subset, not a complete TOML parser or automation-format compatibility promise.

Privacy and lifecycle boundaries

The only route is an authenticated, local-owner-only GET at /api-ext/dsh-local-task-observer/v1/snapshot. Non-owner, foreign-origin/cross-site, non-GET and query-bearing requests are denied. This is not intended for remote sharing or reverse-proxy use.

Raw sessions, authentication files and business-data directories are not enumerated. Bounded definition files and subprocess output are parsed in memory; prompt, command arguments, environment variables, paths, raw errors and other non-allowlisted fields are not returned or persisted. This is not a claim that the process never encounters non-allowlisted bytes. Titles are React text, not HTML; task names may still be sensitive, and this is not a semantic redaction system.

Opening the page or pressing Refresh starts a read. Concurrent HTTP requests share one scan. The in-memory cache has a 5-second reuse TTL, not a five-second data-destruction guarantee: the old snapshot can remain in memory until replacement/disposal, and the page retains what it displays. There is no periodic polling.

The whole-scan response deadline is 8 seconds. Local collection uses 1.5-second operation/subprocess bounds, sequential traversal, and shared limits of 100 files and 150 rows, plus bounded directory enumeration and file/output sizes. Partial coverage is visible rather than silently treated as zero.

Cancelling a browser request does not cancel the shared scan. The Host schedule.list API has no cancellation parameter; a deadline/disposal cannot physically stop that underlying read-only promise. Disposal removes registrations, clears the cache and aborts local collection, but can wait until the scan deadline. A requested SIGKILL is not proof that native exit has been observed. Late-opened handles are closed when available; a 150 ms close-wait bound is not proof that a permanently stalled OS resource was reclaimed. Long-term resource stability and all hostile same-user filesystem races are not established by this alpha.

Install through DSH's plugin manager

After the release tag is published, use this exact GitHub tag spec in the DSH plugin manager:

{
  "action": "install_bundle",
  "target": "github:MatteoCui001/dsh-local-task-observer#v0.1.0-alpha.1"
}

This is an installation target, not a claim that the tag already exists or that installation has succeeded. Read the manager's application result; restart-required is not live success. Disable/remove through that manager as well. Do not edit the active profile by hand, start another server, or grant version exemptions.

The package name, Host row/name, Client loader/locale/settings IDs, route, request marker and CSS/data-attribute prefix use the independent dsh-local-task-observer namespace. It does not replace an existing task-center plugin.

private: true deliberately prevents accidental npm publication. It does not restrict the MIT license or GitHub source redistribution. There is no npm release or npm publishing workflow in this project.

Checks and known verification gaps

From the repository root, using Node.js 24+:

node --check index.js
node --check client.js
node --test test/*.test.mjs

The 61-test synthetic suite uses unique owned temporary directories and cleans them up. Real plutil is used only for a synthetic owned plist on macOS; launchctl is mocked throughout. No live task definitions, credentials or raw sessions are used by tests.

The new public namespace has not been installed or tested live. Full visual acceptance (including light/dark, narrow screens and rendered icons), actual browser/native authentication, Host unload/reload integration, disconnected shared requests, repeated permanently stalled schedule reads and long-term native resource stability remain unverified. Test success and slot contracts are not substitutes for those checks. This is not a complete security audit or a community-first claim.

中文

功能与只读范围

官方 DSH 桌面版的独立只读元数据页，入口为 设置 → 本机任务总览（只读）。仅支持 DSH 0.2.2-rc.1 / Node.js 24+ / macOS，不宣称兼容其它版本。

仅通过当前官方 schedule.list 读取一页 DSH 定时指令，并读取当前用户 LaunchAgents、Codex version=1 定义及明确的 Claude 候选目录。只允许固定 plutil 解析与 launchctl print，不执行定义中的程序，不创建、修改、启动、暂停或投递任务。不调用模型、SSH 或外部网络，不注入 agent 工具/提示词，不后台轮询、不持久化任务快照。

未知不等于零，投递不等于执行，更不等于完成。 loaded、active、ended、running 等状态不是产物成功证明；退出码缺失保持未知，不从日志、文件修改时间或日期猜执行成功。缺源、超限、超时、未知格式分别保留 unavailable / partial / unsupported，不能当作“没有任务”。

Claude 本地定义 schema 尚未独立核验：识别到的候选元数据仍为部分覆盖，执行状态保持 unknown；普通 .claude/tasks 不当调度源。Codex 只支持保守的 version=1 顶层元数据与小型 TOML 子集，不承诺完整格式矩阵。

隐私、缓存与取消边界

仅已鉴权的本机 owner 可 GET 读取；非 owner、跨来源、非 GET 或带 query 的请求被拒绝，不支持远程共享。定义文件与子进程输出会在有界内存中解析，但不返回或保存提示词、命令参数、环境变量、路径、原始异常等非白名单内容。不读取 auth 或原始会话目录；不声称“内存从未接触非白名单字节”。任务名称本身仍可能敏感，也不是全语义脱敏器。

仅打开页面或手动刷新时采集；并发请求共享 scan。5 秒只是缓存复用 TTL，不是强制清除内存的期限：旧快照可留至替换/卸载，页面也会保留展示结果。无定期轮询。

总响应截止时间为 8 秒；本地单操作/子进程上限 1.5 秒、顺序采集、总文件/行与目录枚举均有界。浏览器取消不会取消共享 scan；官方 schedule.list 没有取消参数，超时/卸载不能物理终止其底层只读 promise。卸载会移除注册、清缓存并取消本地采集，但可能等到截止时间；发出 SIGKILL 不等于观察到真实退出，150 ms close 等待上界不证明 OS 永久阻塞资源已回收。

分发、验证与贡献

本版是 MIT 许可、GitHub-only 的 0.1.0-alpha.1 预发布。上方给出发布 tag 后的插件管理器安装 spec；不发 npm。private: true 仅防误发 npm，不限制 MIT 公开源码。安装/禁用/移除均用官方插件管理器，不手改 profile、不启旧服务、不绕版本限制。

公开新 namespace 尚未安装或实机验证，不把私有原型的结果当成它已 live。保留的 61 项合成测试不读取真实本机任务；真实 plutil 仅解析自建临时 fixture，launchctl 全部为桩。尚无完整 UI 视觉验收、真实浏览器鉴权与卸载重载集成、断连共享请求、反复不可取消 schedule 读取或长期资源稳定性验收。

See CHANGELOG, contribution guidance, security reporting, NOTICE and the MIT license. Bugs and non-sensitive suggestions: GitHub issues. Security details should use a private channel, not a public issue.