feat: add fail-closed Local Delegation to Cairn (signals-dashboard 0.3.0) - #2666

extensions/signals-dashboard/extension.mjs:801

• This is an on/off toggle, but its accessible name only describes the next action and does not expose the current pressed state. Add aria-pressed based on the stored preference so screen-reader users can determine whether Local Delegation is selected, including the requested-but-unavailable state.

        <button data-act="local-delegation" data-preference="${esc(next)}"
            aria-label="Set Local Delegation ${esc(next)}"

extensions/signals-dashboard/local-delegation.mjs:54

• Windows environment variable names are case-insensitive, but spreading process.env creates a normal case-sensitive object. Deleting only the canonical spelling leaves a parent key such as workshop_local_delegation=enabled, so an off launch can still inherit delegation as enabled. Remove all case-insensitive matches before optionally adding the canonical key.

        delete env[LOCAL_DELEGATION_ENV];

extensions/signals-dashboard/extension.mjs:416

• On Windows, wt.exe does not pass the caller's process environment to the command created in a new tab (especially when Terminal is already running). Both wt branches therefore report Local Delegation as effective while the launched Copilot process may never receive WORKSHOP_LOCAL_DELEGATION=enabled; an off launch can likewise inherit a stale value from the Terminal broker. The terminal command needs to set or clear the variable explicitly before starting the agent, with coverage for both states.

        if (direct && wt && await trySpawn(wt, ["-d", deskPath, ...run], { env })) return true;

extensions/signals-dashboard/local-delegation.mjs:44

• This intentionally makes the effective-on and off prompts identical, contradicting the PR summary's promised frontier-owned orientation note and the linked Sealed Delegation launch contract, which says the desk instruction should establish the authority boundary. The installed skill does not consume this environment flag itself, so the toggle currently changes no frontier instruction. Add a short shell-safe instruction (or another enforced handoff) when effective, or revise the stated contract if env-only behavior is intended.

This issue also appears on line 54 of the same file.

    // localDelegationEffective is intentionally unused in the -i string: policy
    // is carried by env + skill so Windows launch cannot reparse a long appendix.
    void localDelegationEffective;

extensions/signals-dashboard/extension.mjs:417

• When wt.exe attaches to an already-running Windows Terminal instance, the new tab inherits the Terminal server's environment rather than the environment passed to this wt.exe client. Consequently an effective launch can omit WORKSHOP_LOCAL_DELEGATION, while an off launch can retain a stale enabled value, despite Cairn reporting the requested state. Set or clear the variable inside the command executed in the new tab (for both direct and cmd-shim branches), rather than relying on spawn(..., { env }).

        if (direct && wt && await trySpawn(wt, ["-d", deskPath, ...run], { env })) return true;

extensions/signals-dashboard/extension.mjs:387

• This recomputes availability synchronously on every render/open. The dashboard refreshes / every five seconds, and the common unavailable case makes findLocalDelegationSkillDir synchronously traverse every installed marketplace/plugin and probe up to four paths per plugin each time, blocking the server event loop and creating continuous filesystem churn. Cache this probe for a bounded TTL (as MCP discovery already does) or make discovery asynchronous, with an explicit refresh/invalidation policy.

    const availability = resolveLocalDelegationAvailability();

extensions/signals-dashboard/extension.mjs:805

• This is a stateful toggle, but its accessible name exposes only the next action and no programmatic pressed state; screen-reader users cannot distinguish Off, requested-On-but-unavailable, and effective-On, since title is not a reliable accessible description. Expose the preference via aria-pressed and include the effective/availability text in the accessible name or description.

        <button data-act="local-delegation" data-preference="${esc(next)}"
            aria-label="Set Local Delegation ${esc(next)}"
            style="background:#020617;border:1px solid ${border};color:${color};padding:2px 8px;border-radius:999px;

extensions/signals-dashboard/extension.mjs:382

• writeFile follows an existing .local-delegation.json symlink. A workshop repository can therefore contain a planted symlink, and clicking the new toggle will truncate and overwrite an arbitrary writable file outside the workshop. Write to a newly created temporary file in the workshop and atomically rename it over the state path (with cleanup/concurrency handling), so the destination symlink itself is replaced rather than followed.

    await writeFile(
        join(workshopDir, LOCAL_DELEGATION_STATE_FILE),
        JSON.stringify(state, null, 2) + "\n",
        "utf8");

extensions/signals-dashboard/extension.mjs:1161

• When terminal launch fails and Local Delegation was requested but unavailable, localDetail replaces path. If clipboard access also fails, the toast says “copy this path” but never displays the path, removing the only fallback handle. Keep the path in the detail and append the delegation warning instead of replacing it.

                    showToast(copyTitle + localTitle, localDetail || path);

extensions/signals-dashboard/README.md:110

• The linked source implementation also adds .local-delegation.json to the workshop .gitignore, but this port writes the runtime preference at the repository root without adding an equivalent ignore rule to the Workshop scaffolding. Toggling Local in a Git-backed workshop created by this plugin will leave operator runtime state untracked and easy to commit accidentally. Update the workshop creation guidance/scaffold (and existing-workshop guidance) to ignore this file.

Operator preference is stored at the workshop root in `.local-delegation.json`.

extensions/signals-dashboard/extension.mjs:439

• This safety check also examines the --add-dir workshop path and resolved executable path, not just untrusted desk input. Valid Windows locations such as C:\Work (Local) or C:\R&D\Workshop therefore make cmdSafe false and every desk open falls back instead of launching. Preserve support for quoted metacharacters in trusted paths while still preventing cmd expansion/injection.

        const cmdSafe = run.every((arg) => !/[&|<>^%!()\r\n]/.test(arg))
            && run.every((arg) => isSafeWindowsCmdShim(arg));
        if (!cmdSafe || !cmd) return false;

extensions/signals-dashboard/extension.mjs:1180

• When a terminal launch fails while Local Delegation was requested but unavailable, localDetail contains the availability reason and replaces path. The toast then says “copy this path” but never displays the path, defeating the manual fallback when clipboard access also failed. Include both the path and the Local Delegation detail in this branch.

                    const copyTitle = copied ? (name + ' · path copied') : (name + ' · copy this path');
                    showToast(copyTitle + localTitle, localDetail || path);

extensions/signals-dashboard/extension.mjs:1517

• This description still says the toggle defaults from .local-delegation.json, but the implementation now deliberately ignores repo-root state and reads the hashed user-local file under ~/.copilot/workshop-local-delegation/. Update the action contract so callers are not directed to a rejected state file.

                                description: "Optional Local Delegation preference for this launch. Defaults to the workshop Cairn toggle (.local-delegation.json).",

extensions/signals-dashboard/local-delegation.mjs:207

• The dashboard refreshes every five seconds, and each render recomputes availability, so when the skill is absent this synchronous scan walks every installed marketplace and plugin and probes four paths per plugin on every refresh. That blocks the loopback server's event loop and scales with the user's entire plugin inventory. Cache skill discovery (including a negative result) for a bounded TTL while continuing to re-check the lightweight route receipt.

    if (exists(pluginsRoot)) {
        try {
            for (const market of readdirSync(pluginsRoot, { withFileTypes: true })) {

extensions/signals-dashboard/extension.mjs:1517

• This tool description still says the toggle defaults from .local-delegation.json, but this change deliberately ignores repository-root state and stores the preference under ~/.copilot/workshop-local-delegation/. The stale schema text can direct callers to the rejected file and contradicts the new fail-closed storage model.

                                description: "Optional Local Delegation preference for this launch. Defaults to the workshop Cairn toggle (.local-delegation.json).",

extensions/signals-dashboard/extension.mjs:1518

• This API description points consumers to .local-delegation.json, but the implementation now deliberately ignores repo-root state and reads the hashed user-local preference under ~/.copilot/workshop-local-delegation/. Update the schema text so agents do not create or rely on a file that has no effect.

                                enum: ["off", "on"],

extensions/signals-dashboard/extension.mjs:831

• When the preference is on but availability fails, the accessible name becomes Local Delegation On*; the asterisk has no accessible explanation and incorrectly sounds effective to screen-reader users. Include the requested-but-unavailable state and reason in the button's accessible name.

        <button data-act="local-delegation" data-preference="${esc(next)}"

extensions/signals-dashboard/extension.mjs:1519

• This tool description still says the default comes from .local-delegation.json, but the implementation now explicitly ignores repo-root state and reads the user-local hashed preference under ~/.copilot/workshop-local-delegation/. Since this schema is exposed to the agent, it can direct callers toward a file that has no effect and contradicts the fail-closed storage model. Describe the user-local Cairn preference instead.

                                description: "Optional Local Delegation preference for this launch. Defaults to the workshop Cairn toggle (.local-delegation.json).",