feat: add standalone Taskboard application

.github/workflows/taskboard-build.yml

@@ -0,0 +1,48 @@
+name: Taskboard checks
+
+on:
+  pull_request:
+    paths:
+      - "apps/codex-taskboard/**"
+      - ".github/workflows/taskboard-build.yml"
+  push:
+    branches:
+      - main
+    paths:
+      - "apps/codex-taskboard/**"
+      - ".github/workflows/taskboard-build.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  taskboard:
+    name: Taskboard checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    defaults:
+      run:
+        working-directory: apps/codex-taskboard
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: apps/codex-taskboard/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: TypeScript check
+        run: npm run typecheck
+
+      - name: Build frontend
+        run: npm run build:web
+
+      - name: Test
+        run: npm test

apps/codex-taskboard/.gitignore

@@ -0,0 +1,13 @@
+node_modules/
+dist/
+.data/
+.idea/
+.codex-install-source
+.git-original-removed-by-codex/
+.wrangler/
+.dev.vars*
+.tmp/
+cloud-migration-exports/
+.playwright-cli/
+*.log
+.DS_Store

apps/codex-taskboard/AGENTS.md

@@ -0,0 +1,13 @@
+# Project Development Rules
+
+For feature work in this repository, use this order:
+
+1. Before implementation, prove the real operation path to the user: entry point → user or agent action → data change or other side effect → observable result. Cite the actual component, API, and file involved, or demonstrate the path in the product. This proof is not a test.
+2. Implement the requested main path with the smallest direct change that makes it work.
+3. After implementation, demonstrate or verify only that direct operation path and give the result to the user for confirmation.
+4. Before the user confirms the feature works, do not proactively add guardrails, mutation or regression tests, legacy compatibility protection, defensive extensions, or speculative fallback behavior.
+5. User confirmation does not automatically authorize that follow-up work. Add targeted protection or tests only when the user explicitly asks for them, or when the user reports a concrete failure scenario that requires them.
+
+The primary objective is to make the requested function work. Focus on the feature implementation itself and avoid over-design; safety, guardrails, and testing must not dominate the work or turn the feature into a surrounding engineering project. This rule supersedes the earlier standing instruction that every feature must be developed test-first. Test-first language in older issues does not apply unless the user restates it for that issue after this rule.
+
+This ordering does not waive higher-priority safety or security requirements. Keep validation that is necessary at real external boundaries, such as user input or external APIs, but do not expand it into hypothetical protection beyond the requested path.

apps/codex-taskboard/README.md

@@ -0,0 +1,142 @@
+# Codex Taskboard
+
+A local-first issue board that runs in a browser and can be embedded in Codex through the standalone CDP launcher or its injection script. The same HTTP API powers the React UI and the `taskctl` CLI used by the bundled Codex Skill.
+
+## Requirements
+
+- Node.js 22.5 or newer
+
+## Clone or download
+
+Download the repository ZIP from GitHub, or clone it with Git:
+
+```bash
+git clone https://github.com/BigPizzaV3/CodexPlusPlus.git
+cd CodexPlusPlus/apps/codex-taskboard
+```
+
+## Run locally
+
+```bash
+npm install
+npm run build
+npm start
+```
+
+Open <http://127.0.0.1:47823>. The SQLite database is stored at `.data/taskboard.sqlite`.
+
+For development with live frontend reload:
+
+```bash
+npm run dev
+```
+
+The Vite UI runs at <http://127.0.0.1:5173> and proxies API requests to the local service.
+
+## Use the CLI
+
+Run it from the project:
+
+```bash
+npm run taskctl -- project create \
+  --id my-project \
+  --name "My project" \
+  --workspace-path /absolute/path/to/repository
+
+npm run taskctl -- issue create \
+  --project my-project \
+  --title "Implement the next slice" \
+  --status todo \
+  --priority high \
+  --labels product,mvp
+```
+
+Use `npm link` if you want `taskctl` on your shell path. Set `CODEX_TASKBOARD_URL` to point the CLI at another local service. Cloud deployments are configured through the loopback companion with `taskctl cloud login`.
+
+## Install the Codex Skill
+
+Copy or symlink `skills/manage-taskboard` into the Codex skills directory, then start a new Codex task:
+
+```bash
+ln -s /absolute/path/to/codex-taskboard/skills/manage-taskboard \
+  ~/.codex/skills/manage-taskboard
+```
+
+The Skill teaches Codex to inspect an issue, move it to `in_progress`, use optimistic versions, verify the work, and then move it to `in_review`; it moves the issue to `done` only after the user explicitly confirms acceptance or asks to mark it complete.
+
+## Embed in Codex
+
+### Recommended: keep your current window and open a separate Taskboard window
+
+Keep the existing Codex window open. From the Taskboard repository, start a second Codex instance with a dedicated CDP port:
+
+```bash
+open -n -a /Applications/ChatGPT.app --args \
+  --remote-debugging-port=9231 \
+  --remote-allow-origins=http://127.0.0.1:9231
+```
+
+After the new Codex window appears, run the injector in another terminal:
+
+```bash
+CODEX_TASKBOARD_HOST=127.0.0.1 \
+npm run codex:inject -- --port 9231 --open
+```
+
+Keep the injector terminal running while using the embedded panel. The original Codex window remains unchanged, and the new window receives the Taskboard sidebar entry. If port `9231` is occupied, use another port in both commands.
+
+### Alternative: restart Codex with the standalone launcher
+
+Quit every running Codex window, then run:
+
+```bash
+CODEX_TASKBOARD_HOST=127.0.0.1 npm run codex
+```
+
+This starts the local Taskboard service when needed, launches the official macOS Codex app with a loopback-only CDP port, injects a native-looking Taskboard entry after Plugins, and keeps watching both the service and replacement renderers. Opening Taskboard asks this launcher to health-check the fixed local service, restart it when needed, and rebuild a failed iframe. Keep this command running while using the embedded panel. The launcher does not modify `ChatGPT.app` or its `app.asar`.
+
+Codex 26.715.52143 ships a renderer CSP that blocks arbitrary HTTP iframes. The launcher therefore enables CDP CSP bypass, reloads that renderer once, installs the document-start script, and waits until the Taskboard OOPIF is actually loaded. CDP is unauthenticated to other processes on the same machine, so only run trusted local code while the launcher is active.
+
+To inject into a Codex instance that was already launched with CDP by another method, run:
+
+```bash
+npm run codex:inject -- --port 9229 --open
+```
+
+This command also stays resident so the injected tab can restart Taskboard after a service exit. Stop it with `Ctrl-C`.
+
+The script adds a Taskboard entry to the Codex sidebar and renders the iframe across Codex's complete main workspace, including the contextual titlebar area so Taskboard's own header does not leave an empty strip. That full rectangular header is placed above Electron's draggable layer and marked `no-drag`; because the native contextual actions are suppressed while Taskboard is active, its own actions use their normal edge padding without an artificial right-side gap. The native sidebar stays mounted, while the previous page selection and contextual header are temporarily suppressed; choosing another Codex page restores them.
+
+The "Open in conversation" action selects the corresponding native Codex project when one is available and opens an unsent native composer with `$manage-taskboard ISSUE-ID`. A conversation is attributed only after it actually processes the issue: `taskctl` reads Codex's `CODEX_THREAD_ID` and records that ID on the issue or comment mutation. Recorded IDs are clickable through Codex's native route bridge. Each issue can bind either one Git branch or one worktree; the options are scanned from the selected Codex project's repository instead of being typed by hand. The integration uses Codex's existing project, composer, and route markers; it does not patch React, replace `fetch`, load private chunks, or edit Codex data files.
+
+To use a different UI origin, set `window.__CODEX_TASKBOARD_URL__` before the user script runs.
+
+## Configuration
+
+| Variable | Default | Purpose |
+| --- | --- | --- |
+| `CODEX_TASKBOARD_HOST` | `127.0.0.1` | HTTP bind address; set `0.0.0.0` only to explicitly share on a private LAN |
+| `TASKBOARD_SHARED_SECRET` | unset | Required for `0.0.0.0`; protects every request with Basic authentication |
+| `CODEX_TASKBOARD_PORT` | `47823` | Local HTTP port |
+| `CODEX_TASKBOARD_DATA_DIR` | `.data` | SQLite data directory |
+| `CODEX_TASKBOARD_URL` | `http://127.0.0.1:47823` | CLI API origin |
+
+By default, the service binds only to `127.0.0.1`. LAN sharing is opt-in: set `CODEX_TASKBOARD_HOST=0.0.0.0` and a non-empty `TASKBOARD_SHARED_SECRET`. Startup prints a warning before binding and then lists detected LAN URLs. Every LAN request must use Basic authentication and an HTTP `Origin` matching its `Host`; cross-origin requests are rejected and the server does not emit wildcard CORS headers. Do not expose the service to the public internet.
+
+Task, comment, and attachment changes are broadcast to every open client through server-sent events; reconnecting clients perform a full refresh so changes made while disconnected are not missed. `taskctl` remains configured for the local companion URL; use the browser UI or an authenticated deployment boundary for shared access.
+
+## Share through Cloudflare
+
+For two trusted collaborators, the taskboard can run on Cloudflare with Worker Static Assets and API routes, D1 as the authoritative business database, and a private R2 bucket for attachments. The deployment uses HTTPS Basic Authentication with a shared password and refreshes open boards after a global revision changes.
+
+Each device keeps its own project checkout mapping and continues to use a local companion for Codex, Git/worktree, Skill, and MCP capabilities. Cloud mode never falls back to or double-writes the local SQLite database.
+
+See [Cloud collaboration](docs/cloud-collaboration.md) for owner deployment, existing GitHub installation setup, password rotation, local path mapping, and the one-time local-data migration flow.
+
+## Verify
+
+```bash
+npm run check
+```
+
+This runs TypeScript checking, a production frontend build, and the server/CLI/injection test suite.