Add Host Agent local console task cancellation (task-cancellation 7.1-7.3)

- New internal API route POST /internal/v1/hosts/{host_id}/tasks/{task_id}/cancel,
  authenticated via the host's own bearer credential (authorize_host) with an
  ownership check, since host tokens carry no scopes and cannot reach the
  public SDK's tasks:submit-scoped cancel endpoint.
- HostAgentClient.cancel_task() calls the new internal route directly.
- create_console_app() gains a cancel_task callable with automatic default
  wiring from host_client, so production app.py needs no changes.
- Local console: POST /tasks/{task_id}/cancel route resolves the local
  execution id to its Cloud source_task_id before cancelling, and the task
  detail page/template show a Cancel button plus notice/error banners.
- Tests across all three layers: internal API route, Jinja2 template
  rendering, and FastAPI console route behavior.

apps/device-host-agent/tests/host_agent/web/conftest.py

@@ -193,6 +193,9 @@ def make_task_detail_context(
     task: dict[str, Any] | None = None,
     task_rows: list[tuple[str, Any]] | None = None,
     timeline_steps: list[dict[str, Any]] | None = None,
+    can_cancel: bool = False,
+    cancel_notice: str | None = None,
+    cancel_error: str | None = None,
 ) -> dict[str, Any]:
     if task is None:
         task = {
@@ -227,7 +230,11 @@ def make_task_detail_context(
     return {
         "title": "Task task-001",
         "session": session,
+        "csrf_token": session.csrf_token,
         "task": task,
         "task_rows": task_rows,
         "timeline_steps": timeline_steps,
+        "can_cancel": can_cancel,
+        "cancel_notice": cancel_notice,
+        "cancel_error": cancel_error,
     }

apps/device-host-agent/tests/host_agent/web/test_templates.py

@@ -77,6 +77,43 @@ def test_task_detail_renders(env, sample_session) -> None:
     assert "<h2>Timeline</h2>" in html
 
 
+def test_task_detail_shows_cancel_button_for_non_terminal_task(
+    env, sample_session
+) -> None:
+    html = env.get_template("task_detail.html").render(
+        **make_task_detail_context(sample_session, can_cancel=True)
+    )
+    assert 'action="/tasks/task-001/cancel"' in html
+    assert "Cancel task" in html
+
+
+def test_task_detail_hides_cancel_button_for_terminal_task(
+    env, sample_session
+) -> None:
+    html = env.get_template("task_detail.html").render(
+        **make_task_detail_context(sample_session, can_cancel=False)
+    )
+    assert 'action="/tasks/task-001/cancel"' not in html
+
+
+def test_task_detail_renders_cancel_notice_and_error(env, sample_session) -> None:
+    html = env.get_template("task_detail.html").render(
+        **make_task_detail_context(
+            sample_session,
+            cancel_notice="Cancellation requested. It may take a moment to take effect.",
+        )
+    )
+    assert 'id="cancel-notice"' in html
+
+    html = env.get_template("task_detail.html").render(
+        **make_task_detail_context(
+            sample_session,
+            cancel_error="Failed to request cancellation. Try again.",
+        )
+    )
+    assert 'id="cancel-error"' in html
+
+
 # ---------------------------------------------------------------------------
 # 6.4  XSS-probe tests (parametrised over templates with operator-influenced
 #      string fields set to <script>alert(1)</script>)

apps/device-host-agent/tests/test_web_app.py

@@ -3,10 +3,12 @@ from __future__ import annotations
 import re
 from collections.abc import Awaitable, Callable
 from datetime import UTC, datetime
+from typing import Any
 
 from fastapi.testclient import TestClient
 
 from cloud.internal_api.models import AssignmentModel
+from core.models import Task
 from device.manager import DeviceManager
 from host_agent.client import HostAgentAPIError, HostTaskSubmissionUnknownError
 from host_agent.config import HostAgentConfig
@@ -22,6 +24,7 @@ from storage.task_metadata import TaskMetadataStore
 CSRF_PATTERN = re.compile(r'name="csrf_token" value="([^"]+)"')
 
 TaskSubmissionCallable = Callable[[str, str | None], Awaitable[str]]
+TaskCancellationCallable = Callable[[str], Awaitable[Any]]
 
 
 def _build_client(
@@ -29,6 +32,7 @@ def _build_client(
     *,
     create_account: bool = True,
     submit_self_task: TaskSubmissionCallable | None = None,
+    cancel_task: TaskCancellationCallable | None = None,
     include_metadata_store: bool = True,
 ) -> tuple[TestClient, dict]:
     config = HostAgentConfig(
@@ -62,6 +66,7 @@ def _build_client(
         session_manager=session_manager,
         enrollment_client=None,
         submit_self_task=submit_self_task,
+        cancel_task=cancel_task,
         metadata_store=metadata_store,
     )
     client = TestClient(app)
@@ -795,4 +800,162 @@ def test_submitted_redirect_does_not_include_goal_text(tmp_path) -> None:
     assert "bearer-token-deadbeef" not in response.headers["location"]
     follow = client.get(response.headers["location"])
     assert secret_goal not in follow.text
-    assert "bearer-token-deadbeef" not in follow.text
+
+
+def _make_cancellation_recorder(
+    *,
+    raise_api_error: HostAgentAPIError | None = None,
+) -> tuple[TaskCancellationCallable, dict]:
+    captured: dict = {}
+
+    async def cancel(task_id: str) -> None:
+        captured["task_id"] = task_id
+        if raise_api_error is not None:
+            raise raise_api_error
+
+    return cancel, captured
+
+
+def _seed_local_task(
+    metadata_store: TaskMetadataStore,
+    *,
+    status: str = "running",
+    source_task_id: str | None = "cloud-task-1",
+) -> str:
+    task = Task(goal="open settings", device_id="dev-1", status=status)
+    metadata_store.create_task(
+        task, source_task_id=source_task_id, source_attempt=1
+    )
+    return task.id
+
+
+def test_task_detail_page_shows_cancel_button_for_non_terminal_task(
+    tmp_path,
+) -> None:
+    cancel, _ = _make_cancellation_recorder()
+    client, context = _build_client(tmp_path, cancel_task=cancel)
+    execution_id = _seed_local_task(context["metadata_store"], status="running")
+    _login(client)
+
+    response = client.get(f"/tasks/{execution_id}")
+
+    assert response.status_code == 200
+    assert f'action="/tasks/{execution_id}/cancel"' in response.text
+    assert "Cancel task" in response.text
+
+
+def test_task_detail_page_hides_cancel_button_for_terminal_task(tmp_path) -> None:
+    cancel, _ = _make_cancellation_recorder()
+    client, context = _build_client(tmp_path, cancel_task=cancel)
+    execution_id = _seed_local_task(context["metadata_store"], status="completed")
+    _login(client)
+
+    response = client.get(f"/tasks/{execution_id}")
+
+    assert response.status_code == 200
+    assert f'action="/tasks/{execution_id}/cancel"' not in response.text
+
+
+def test_task_detail_page_hides_cancel_button_when_client_unavailable(
+    tmp_path,
+) -> None:
+    client, context = _build_client(tmp_path, cancel_task=None)
+    execution_id = _seed_local_task(context["metadata_store"], status="running")
+    _login(client)
+
+    response = client.get(f"/tasks/{execution_id}")
+
+    assert response.status_code == 200
+    assert f'action="/tasks/{execution_id}/cancel"' not in response.text
+
+
+def test_cancel_task_success_calls_client_with_cloud_task_id_and_redirects(
+    tmp_path,
+) -> None:
+    cancel, captured = _make_cancellation_recorder()
+    client, context = _build_client(tmp_path, cancel_task=cancel)
+    execution_id = _seed_local_task(
+        context["metadata_store"], status="running", source_task_id="cloud-task-99"
+    )
+    csrf_token = _login(client)
+
+    response = client.post(
+        f"/tasks/{execution_id}/cancel",
+        data={"csrf_token": csrf_token},
+        follow_redirects=False,
+    )
+
+    assert response.status_code == 303
+    assert response.headers["location"] == f"/tasks/{execution_id}?cancelled=1"
+    assert captured == {"task_id": "cloud-task-99"}
+
+    follow = client.get(response.headers["location"])
+    assert "cancel-notice" in follow.text
+
+
+def test_cancel_task_client_error_redirects_with_cancel_error(tmp_path) -> None:
+    cancel, _ = _make_cancellation_recorder(
+        raise_api_error=HostAgentAPIError(502, "control plane unavailable")
+    )
+    client, context = _build_client(tmp_path, cancel_task=cancel)
+    execution_id = _seed_local_task(context["metadata_store"], status="running")
+    csrf_token = _login(client)
+
+    response = client.post(
+        f"/tasks/{execution_id}/cancel",
+        data={"csrf_token": csrf_token},
+        follow_redirects=False,
+    )
+
+    assert response.status_code == 303
+    assert response.headers["location"] == f"/tasks/{execution_id}?cancel_error=1"
+
+    follow = client.get(response.headers["location"])
+    assert "cancel-error" in follow.text
+
+
+def test_cancel_task_unknown_execution_id_returns_404(tmp_path) -> None:
+    cancel, captured = _make_cancellation_recorder()
+    client, _ = _build_client(tmp_path, cancel_task=cancel)
+    csrf_token = _login(client)
+
+    response = client.post(
+        "/tasks/does-not-exist/cancel",
+        data={"csrf_token": csrf_token},
+    )
+
+    assert response.status_code == 404
+    assert captured == {}
+
+
+def test_unauthenticated_cancel_redirects_to_login_without_calling_client(
+    tmp_path,
+) -> None:
+    cancel, captured = _make_cancellation_recorder()
+    client, context = _build_client(tmp_path, cancel_task=cancel)
+    execution_id = _seed_local_task(context["metadata_store"], status="running")
+
+    response = client.post(
+        f"/tasks/{execution_id}/cancel",
+        data={},
+        follow_redirects=False,
+    )
+
+    assert response.status_code == 303
+    assert response.headers["location"] == "/login"
+    assert captured == {}
+
+
+def test_cancel_task_without_csrf_token_is_rejected(tmp_path) -> None:
+    cancel, captured = _make_cancellation_recorder()
+    client, context = _build_client(tmp_path, cancel_task=cancel)
+    execution_id = _seed_local_task(context["metadata_store"], status="running")
+    _login(client)
+
+    response = client.post(
+        f"/tasks/{execution_id}/cancel",
+        data={"csrf_token": "wrong-token"},
+    )
+
+    assert response.status_code == 403
+    assert captured == {}