Stage 3 PR (consolidated). Originally split across PRs 3.2–3.5 in #28
but each was a 30–60 line leaf extraction — not enough review value
for the PR overhead. Folded the four into one architectural slice.

New files under dashboard/src/lib/:

- use-poll.ts (45 LoC) — typed `usePoll<T>` hook over the api() wrapper.
- bus.ts (65 LoC) — appBus, toastBus, showToast, ToastStack, plus
  reportAppError and the two window error listeners (registered on
  module load, same as before).
- error-boundary.ts (159 LoC) — ErrorOverlay component, ErrorBoundary
  class, buildIssueBody helper. Both consumers of bus.ts.
- markdown.ts (169 LoC) — escapeHtml, SEARCH_REPLACE_RE,
  renderSearchReplace, renderUnifiedDiff, the marked renderer
  customisation, renderMarkdownToString (was inline in
  renderMessageBody), LANG_BY_EXT, langFromPath,
  renderHighlightedBlock, hlLine. Drops the unused previewMarked
  (was only for the Editor that #31 removed).

Other moves:

- types.d.ts — module shims so TypeScript resolves the CDN URL
  imports against npm types. Specific shims for preact, htm,
  marked, highlight.js; wildcard fallback for anything else.
- package.json — preact, htm, marked, highlight.js added as
  devDependencies (types only — runtime still loads from esm.sh,
  tsup keeps them external).
- dashboard/app.js — drops ~500 LoC of moved blocks. renderMessageBody
  stays as a thin wrapper around renderMarkdownToString since it
  needs the Preact-bound `html` template literal.

Bundle output verified: dashboard/dist/app.js still 121 KB, CDN
imports preserved external. 1682/1682 tests pass.

Stage 2 (#31) removed the dashboard's editor surface — the
CodeMirror integration that was its only consumer. The 20
@codemirror/* packages have been dead weight in package-lock
since then.

Removed:
  @codemirror/autocomplete, commands, language, search, state,
  theme-one-dark, view, plus 13 lang-* grammars.

Build / typecheck / 1682 tests still green.

…tems (#1394)

Fixes #1295 — Desktop MCP tools panel crashes with React error #31 ("Objects are not valid as a React child") when `config.json` contains non-string items in the `mcp` array.

Root cause: `readConfig()` does `JSON.parse` without runtime validation, so `cfg.mcp` can contain objects even though it's typed as `string[]`. When `summarizeMcpSpec()` threw on these object inputs, its catch block returned `summary: raw` directly, leaking objects into JSX.

Fix:
- `summarizeMcpSpec` catch block — stringify non-string `raw` before returning.
- `emitMcpSpecs` — filter `cfg.mcp` to string items before mapping.
- `CtxTools` / `PageMCP` — render `summary` / `name` only when string.
- Regression test in `tests/mcp-desktop-react31.test.ts`.

Follow-up tracked separately: tighten `readConfig` with zod schema validation so this boundary check lives in one place.

Stage 3 PR (consolidated). Originally split across PRs 3.2–3.5 in esengine#28
but each was a 30–60 line leaf extraction — not enough review value
for the PR overhead. Folded the four into one architectural slice.

New files under dashboard/src/lib/:

- use-poll.ts (45 LoC) — typed `usePoll<T>` hook over the api() wrapper.
- bus.ts (65 LoC) — appBus, toastBus, showToast, ToastStack, plus
  reportAppError and the two window error listeners (registered on
  module load, same as before).
- error-boundary.ts (159 LoC) — ErrorOverlay component, ErrorBoundary
  class, buildIssueBody helper. Both consumers of bus.ts.
- markdown.ts (169 LoC) — escapeHtml, SEARCH_REPLACE_RE,
  renderSearchReplace, renderUnifiedDiff, the marked renderer
  customisation, renderMarkdownToString (was inline in
  renderMessageBody), LANG_BY_EXT, langFromPath,
  renderHighlightedBlock, hlLine. Drops the unused previewMarked
  (was only for the Editor that esengine#31 removed).

Other moves:

- types.d.ts — module shims so TypeScript resolves the CDN URL
  imports against npm types. Specific shims for preact, htm,
  marked, highlight.js; wildcard fallback for anything else.
- package.json — preact, htm, marked, highlight.js added as
  devDependencies (types only — runtime still loads from esm.sh,
  tsup keeps them external).
- dashboard/app.js — drops ~500 LoC of moved blocks. renderMessageBody
  stays as a thin wrapper around renderMarkdownToString since it
  needs the Preact-bound `html` template literal.

Bundle output verified: dashboard/dist/app.js still 121 KB, CDN
imports preserved external. 1682/1682 tests pass.

Stage 2 (esengine#31) removed the dashboard's editor surface — the
CodeMirror integration that was its only consumer. The 20
@codemirror/* packages have been dead weight in package-lock
since then.

Removed:
  @codemirror/autocomplete, commands, language, search, state,
  theme-one-dark, view, plus 13 lang-* grammars.

Build / typecheck / 1682 tests still green.

…string items (esengine#1394)

Fixes esengine#1295 — Desktop MCP tools panel crashes with React error esengine#31 ("Objects are not valid as a React child") when `config.json` contains non-string items in the `mcp` array.

Root cause: `readConfig()` does `JSON.parse` without runtime validation, so `cfg.mcp` can contain objects even though it's typed as `string[]`. When `summarizeMcpSpec()` threw on these object inputs, its catch block returned `summary: raw` directly, leaking objects into JSX.

Fix:
- `summarizeMcpSpec` catch block — stringify non-string `raw` before returning.
- `emitMcpSpecs` — filter `cfg.mcp` to string items before mapping.
- `CtxTools` / `PageMCP` — render `summary` / `name` only when string.
- Regression test in `tests/mcp-desktop-react31.test.ts`.

Follow-up tracked separately: tighten `readConfig` with zod schema validation so this boundary check lives in one place.