feat(web): W2-09 goal/task/skill browser panels (v0.19.121)

Ship Goal/task controls over leased Code UI routes and A0-07 skill
discovery validation until W3-01 exposes skill HTTP.

Signed-off-by: Eli Ma <eli@patch.sh>

Author: genedna

CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+### Added (plan-20260715 W2-09, 2026-08-11)
+
+- **W2-09 delivers browser Goal/task/skill controls.** Domain helpers under
+  `web/src/lib/code-ui/goal-task-skill/` drive `SessionGoalTaskSkill` panels for
+  Goal start/status/cancel, task dispatch (active controller lease), and A0-07
+  curated skill discovery validation (runtime skill HTTP remains W3-01).
+  `BrowserController.withLease` is exposed for domain writes; command docs
+  clarify browser-capable `/task/dispatch`.
+
 ### Added (plan-20260715 W2-08, 2026-08-11)
 
 - **W2-08 delivers browser approval and `request_user_input` panels.** Domain

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "libra"
-version = "0.19.120"
+version = "0.19.121"
 edition = "2024"
 license = "MIT"
 description = "AI agent-native version control system with Git on-disk compatibility, SQLite-backed metadata, and tiered cloud storage"

Cargo.toml

@@ -111,7 +111,7 @@ Selecting `loopback` is rejected when `--host` is not a loopback address, and th
 - `POST /api/code/controller/attach` — loopback. `kind: "automation"` requests additionally require `X-Libra-Control-Token`. The handler **issues** the lease's `controllerToken` (it does not expect the caller to send one).
 - `POST /api/code/controller/detach`, `POST /api/code/messages`, `POST /api/code/interactions/{id}` — loopback + `X-Code-Controller-Token`; `Automation` leases additionally require `X-Libra-Control-Token`.
 - `POST /api/code/control/cancel` — loopback + `X-Code-Controller-Token`. `Automation` leases also require `X-Libra-Control-Token`; this is the only difference from the TUI `Esc` cancel path.
-- `POST /api/code/task/dispatch` — loopback + `X-Code-Controller-Token`; user-initiated sub-agent dispatch requires an automation lease.
+- `POST /api/code/task/dispatch` — loopback + `X-Code-Controller-Token`; user-initiated sub-agent dispatch requires an active controller write lease (browser or automation). Automation leases additionally require `X-Libra-Control-Token`.
 - `POST /api/code/goal/start`, `POST /api/code/goal/cancel` — loopback + `X-Code-Controller-Token`; goal mutation requires the active controller lease.
 
 Browser write requests share the same 256 KiB body limit and audit-sink wiring as automation control. The browser persists the lease only in memory; reloading the page drops the lease and the next write reattaches.

docs/commands/code.md

@@ -111,7 +111,7 @@ Automation clients 使用 `POST /api/code/controller/attach` 连接，请求体
 - `POST /api/code/controller/attach` — loopback。`kind: "automation"` 请求还要求 `X-Libra-Control-Token`。handler **签发** lease 的 `controllerToken`（不期待调用方发送它）。
 - `POST /api/code/controller/detach`、`POST /api/code/messages`、`POST /api/code/interactions/{id}` — loopback + `X-Code-Controller-Token`；`Automation` leases 还要求 `X-Libra-Control-Token`。
 - `POST /api/code/control/cancel` — loopback + `X-Code-Controller-Token`。`Automation` leases 也要求 `X-Libra-Control-Token`；这是与 TUI `Esc` cancel 路径的唯一区别。
-- `POST /api/code/task/dispatch` — loopback + `X-Code-Controller-Token`；用户发起的 sub-agent dispatch 需要 automation lease。
+- `POST /api/code/task/dispatch` — loopback + `X-Code-Controller-Token`；用户发起的 sub-agent dispatch 需要 active controller write lease（browser 或 automation）。Automation lease 额外要求 `X-Libra-Control-Token`。
 - `POST /api/code/goal/start`、`POST /api/code/goal/cancel` — loopback + `X-Code-Controller-Token`；goal mutation 需要 active controller lease。
 
 浏览器写请求共享与自动化控制相同的 256 KiB body limit 和 audit-sink wiring。浏览器只在内存中持久化 lease；重新加载页面会丢弃 lease，下一次写入会重新 attach。

docs/commands/zh-CN/code.md

@@ -1191,21 +1191,23 @@ command id、跨 adapter durable interaction source 和本卡完整 approval TTL
 **Description:** 交付 goal/task 面板与 skill 搜索/激活组件，复用 W2-07 的 wire 适配层与 fixture 脚手架；usage 展示独立归 W2-13。
 
 **Acceptance criteria:**
-- [ ] goal 面板、task 面板、skill 搜索/激活组件从 runtime 投影驱动；领域模块仅位于 `goal-task-skill/*`，不修改 W2-07 共享基础文件。
-- [ ] vitest 覆盖 goal start/status/cancel、task dispatch 与 skill search/activation；skill registry 数据只来自 A0-07 projection。
-- [ ] `pnpm --dir web lint` 与 `pnpm --dir web build` 通过；`web/out/` 不漂移。
+- [x] goal 面板、task 面板、skill 搜索/激活组件从 runtime 投影驱动；领域模块仅位于 `goal-task-skill/*`，不修改 W2-07 共享基础文件。
+- [x] vitest 覆盖 goal start/status/cancel、task dispatch 与 skill search/activation；skill registry 数据只来自 A0-07 projection。
+- [x] `pnpm --dir web lint` 与 `pnpm --dir web build` 通过；`web/out/` 不漂移。
 
 **Verification:**
-- [ ] `pnpm --dir web lint && pnpm --dir web build`
-- [ ] `pnpm --dir web test`
-- [ ] `LIBRA_ENABLE_TEST_PROVIDER=1 cargo test --features test-provider --test code_ui_remote_state_matrix -- --test-threads=1`
+- [x] `pnpm --dir web lint && pnpm --dir web build`
+- [x] `pnpm --dir web test`
+- [x] `LIBRA_ENABLE_TEST_PROVIDER=1 cargo test --features test-provider --test code_ui_remote_state_matrix -- --test-threads=1`
 
 **Dependencies:** W2-06（goal/task/skill service）, W2-07（适配层/脚手架）。
 
 **Files likely touched:** `web/src/components/workspace/goal-task-skill/*`, `web/src/lib/code-ui/goal-task-skill/*` 及其 colocated `*.test.{ts,tsx}`（新增领域模块与 fixture）。
 
 **Estimated scope:** M.
 
+**已发布 v0.19.121（Codex gpt-5.6-terra PASS，r8 无 P0/P1）**：Goal/task 浏览器面板 + A0-07 skill 校验；`withLease` 域写入；mount-only goal probe；skill HTTP 仍归 W3-01。
+
 ### Task W2-10: Web 前端 session resume/cancel 生命周期
 
 **Description:** 交付 session selection/resume/cancel UI，复用 W2-07 的 wire 适配层与 fixture 脚手架。Execution/repair 投影归 W2-14，SSE reconnect/resync 归 W2-15。

docs/development/plan/plan-20260715.md

@@ -22,7 +22,7 @@ $ErrorActionPreference = "Stop"
 # One of the release version surfaces. `compat_version_surface_sync` pins it
 # to Cargo.toml: this value is substituted verbatim into the download URL, so
 # a stale value silently installs an old binary when -Version is not given.
-$DefaultVersion = "v0.19.120"
+$DefaultVersion = "v0.19.121"
 $ExeName = "libra.exe"
 $ReleaseAsset = "libra-windows-amd64.exe"
 

install.ps1

@@ -18,7 +18,7 @@ INSTALL_DIR="${LIBRA_INSTALL_DIR:-$LIBRA_HOME/bin}"
 # user opts in with LIBRA_ALLOW_FALLBACK=1. Default behaviour is fail-fast so
 # offline installs cannot silently regress to a stale version. Bump this on
 # every release so the opt-in fallback remains useful.
-DEFAULT_VERSION="v0.19.120"
+DEFAULT_VERSION="v0.19.121"
 
 # ─── theme (Dusk) ────────────────────────────────────────────────────────────
 if [ -t 1 ] && [ -z "${NO_COLOR:-}" ] && [ -z "${LIBRA_NO_TUI:-}" ] && [ "${TERM:-dumb}" != "dumb" ]; then

install.sh

@@ -15,17 +15,21 @@ pnpm test           # vitest unit tests for the browser foundation
 pnpm build          # static export → web/out/
 ```
 
-## Current UI status (W2-07 + W2-08)
+## Current UI status (W2-07 + W2-08 + W2-09)
 
 The shipped page mounts the shared session/SSE store and browser-controller
-lease provider, shows the current session title and phase, and renders the
+lease provider, shows the current session title and phase, renders the
 pending approval / `request_user_input` panel when the snapshot has one
-(`SessionInteractions` → `InteractionsHost`). It does not yet ship a
-three-pane workspace, composer, thread sidebar, terminal, or workflow tabs.
+(`SessionInteractions` → `InteractionsHost`), and mounts goal/task/skill
+controls (`SessionGoalTaskSkill`). It does not yet ship a three-pane
+workspace, composer, thread sidebar, terminal, or workflow tabs.
 
 W2-07 owns the shared wire foundation under `web/src/lib/code-ui/`. W2-08 owns
 approval and structured user-input under `web/src/lib/code-ui/interactions/`
-and `web/src/components/workspace/interactions/`. Later domain panels remain
+and `web/src/components/workspace/interactions/`. W2-09 owns goal/task/skill
+under `web/src/lib/code-ui/goal-task-skill/` and
+`web/src/components/workspace/goal-task-skill/` (skills use the A0-07 curated
+registry until W3-01 exposes Code UI skill HTTP). Later domain panels remain
 with later W2 cards (usage W2-13, workflow review W2-16, etc.).
 
 ## Live API contract
@@ -46,6 +50,10 @@ The browser only talks to its same-origin server. The Rust side enforces loopbac
 | `/api/code/messages` | POST | Submit a user message (header `X-Code-Controller-Token`, body ≤256 KiB). |
 | `/api/code/interactions/{id}` | POST | Resolve a pending `CodeUiInteractionRequest`. |
 | `/api/code/control/cancel` | POST | Cancel the active turn. Browser leases need only the controller token; automation leases additionally require `X-Libra-Control-Token`. |
+| `/api/code/goal/start` | POST | Start a Goal (`{ objective }`, header `X-Code-Controller-Token`) → `{ accepted, status }`. |
+| `/api/code/goal/status` | GET | Observe the active Goal status text (`{ status }`). No controller token; empty sessions return a no-active-Goal error treated as empty UI state. |
+| `/api/code/goal/cancel` | POST | Cancel the active Goal (`{ reason }`, header `X-Code-Controller-Token`) → `{ accepted, status }`. |
+| `/api/code/task/dispatch` | POST | Dispatch a user-initiated sub-agent task (`{ agent, prompt }`, header `X-Code-Controller-Token`) → `{ accepted, result }`. |
 
 The wire types are pinned in two places — keep them in lock-step:
 
@@ -56,22 +64,26 @@ The wire types are pinned in two places — keep them in lock-step:
 
 ```
 web/src/
-├── app/                       # Next.js app router entry (mounts SessionInteractions)
+├── app/                       # Next.js app router entry (mounts domain panels)
 ├── components/workspace/
-│   └── interactions/          # Approval + request_user_input panels (W2-08)
+│   ├── interactions/          # Approval + request_user_input panels (W2-08)
+│   └── goal-task-skill/       # Goal / task / skill panels (W2-09)
 └── lib/
     └── code-ui/               # Shared wire types, client, store, controller (W2-07)
-        └── interactions/      # Approval/user-input helpers + fixtures (W2-08)
+        ├── interactions/      # Approval/user-input helpers + fixtures (W2-08)
+        └── goal-task-skill/   # Goal/task API + A0-07 skill helpers (W2-09)
 ```
 
-`web/src/lib/code-ui/store.tsx` owns the `CodeUiSessionSnapshot` and the SSE reconnect loop. `web/src/lib/code-ui/controller.tsx` owns the browser controller lease. `app/page.tsx` mounts both providers once and renders `SessionInteractions` so pending approval/user-input prompts resolve through the leased controller.
+`web/src/lib/code-ui/store.tsx` owns the `CodeUiSessionSnapshot` and the SSE reconnect loop. `web/src/lib/code-ui/controller.tsx` owns the browser controller lease. `app/page.tsx` mounts both providers once and renders `SessionInteractions` plus `SessionGoalTaskSkill` so pending prompts and goal/task/skill controls resolve through the leased controller.
 
 ## Browser write surface
 
 Composer and other domain writers will continue to land in later W2 cards.
-Approval and `request_user_input` already flow through `useBrowserController()`
-via `SessionInteractions`: `respond` posts to `/api/code/interactions/{id}` and
-`cancel` posts to `/api/code/control/cancel`. On the first write the hook calls
+Approval, `request_user_input`, Goal start/cancel, and task dispatch already flow
+through `useBrowserController()` via `SessionInteractions` /
+`SessionGoalTaskSkill`: writes post with `X-Code-Controller-Token` after
+`withLease` recovery. Skill buttons only validate the A0-07 curated registry
+until W3-01 exposes skill HTTP. On the first write the hook calls
 `POST /api/code/controller/attach`, caches `controllerToken` + `leaseExpiresAt`
 in memory, and replays the original request. The browser `clientId` is
 persisted in `sessionStorage` so an unexpected reload can renew the same