browser/openspec/changes/reveal-server-deployment-inputs/tasks.md

任务提示

• 正向提示词：为“服务器管理”提供已授权管理者主动查看和编辑已保存部署路径/命令的能力，并显示不泄露原文的 Platform→Run 调度证据。成功标准是显式展示可用、常规读取仍脱敏、测试可证明授权和调度行为。
• 方向提示词：在 platform/ 增加受限 reveal DTO、路由、服务和测试；在 platform_web/ 的既有 ServerDeploymentWorkflow 内增加显式展示控件，复用现有控制台样式。验证运行 Go/前端测试、openspec validate --strict 和 scripts/check-structure.sh。
• 任务边界：不修改独立 run/ 源码或协议；不增加 SSH、主机浏览、日志/审计原文泄露、插件访问或运行绑定凭据展示；不触及未相关根目录或既有用户改动。

1. Platform reveal and dispatch diagnostics

• 1.1 Define reveal and safe dispatch-diagnostic domain/DTO contracts, then add the authorized reveal endpoint without changing existing redacted views.
• 1.2 Derive safe latest-lifecycle-job dispatch evidence from the stored job record and include it in the normal deployment view.
• 1.3 Add service/API tests for owner reveal, unauthorized denial, existing-view redaction, and dispatched deployment evidence.

2. Deployment editor reveal

• 2.1 Add API client/types for the explicit reveal operation and safe dispatch diagnostic.
• 2.2 Add an intentional reveal control to the shared deployment editor, populate returned fields, and clear the displayed values when it closes.
• 2.3 Add frontend tests that retain the normal redacted opening state and cover explicit reveal behavior.

3. Verification

• 3.1 Run focused backend and frontend validation, strict OpenSpec validation, and the repository structure check.
• 3.2 Inspect the active Platform metadata and lifecycle-job evidence to report whether Run received the saved deployment definition without exposing raw values in the report.