@goodandready/dsh-goal 0.2.10 → 0.2.12

package/lib/client.js

@@ -1609,7 +1609,7 @@ window.__ModuleLoader__.load({
         if (!AudioCtx) return;
         const actx = new AudioCtx();
         if (actx.state === 'suspended') {
-          actx.resume().catch(() => {});
+          actx.resume().catch((err) => { console.warn('[dsh-goal] Fetch templates error:', err); });
         }
         const now = actx.currentTime;
         if (scheme === 'retro') {
@@ -2590,9 +2590,51 @@ window.__ModuleLoader__.load({
     function QuickLaunchModal({ onClose, onStart, t }) {
 
       const [title, setTitle] = useState('');
+      const [showTemplates, setShowTemplates] = useState(false);
+      const [backendTemplates, setBackendTemplates] = useState([]);
+      const [selectedTpl, setSelectedTpl] = useState(null);
+      const [tplInputs, setTplInputs] = useState({});
+      const [loadingTpls, setLoadingTpls] = useState(false);
 
       const inputRef = useRef(null);
 
+      useEffect(() => {
+        if (showTemplates && backendTemplates.length === 0) {
+          setLoadingTpls(true);
+          fetch('/dsh-goal/templates')
+            .then((r) => r.json())
+            .then((d) => {
+              if (d && Array.isArray(d.templates)) {
+                setBackendTemplates(d.templates);
+              }
+            })
+            .catch((err) => { console.warn('[dsh-goal] Fetch templates error:', err); })
+            .finally(() => setLoadingTpls(false));
+        }
+      }, [showTemplates, backendTemplates.length]);
+
+      const handleApplyTemplate = async () => {
+        if (!selectedTpl) return;
+        try {
+          const res = await fetch('/dsh-goal/action', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+              action: 'instantiate_template',
+              templateId: selectedTpl.id,
+              inputs: tplInputs,
+            }),
+          });
+          if (res.ok) {
+            const data = await res.json();
+            if (data.ok && data.template) {
+              setTitle(data.template.title);
+              setShowTemplates(false);
+            }
+          }
+        } catch (err) { console.warn('[dsh-goal] Apply template error:', err); }
+      };
+
       useEffect(() => {
 
         if (inputRef.current) inputRef.current.focus();
@@ -2782,8 +2824,94 @@ window.__ModuleLoader__.load({
                     },
                     tpl.label
                   )
+                ),
+                React.createElement(
+                  'button',
+                  {
+                    type: 'button',
+                    className: 'dsh-goal-chip-btn',
+                    style: { fontWeight: 600, borderColor: 'var(--dsw-alias-border-brand, var(--dsw-alias-border-l2))' },
+                    onClick: () => setShowTemplates(!showTemplates),
+                  },
+                  (showTemplates ? '▲ ' : '▼ ') + '📋 ' + (t('templatesTitle') || 'Engineering Templates')
                 )
               ),
+              showTemplates
+                ? React.createElement(
+                    'div',
+                    {
+                      style: {
+                        marginTop: 10,
+                        padding: '10px 12px',
+                        borderRadius: 6,
+                        border: '1px solid var(--dsw-alias-border-l1)',
+                        background: 'var(--dsw-alias-bg-hover)',
+                      },
+                    },
+                    loadingTpls
+                      ? React.createElement('div', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary)' } }, 'Loading templates…')
+                      : React.createElement(
+                          'div',
+                          null,
+                          React.createElement(
+                            'div',
+                            { style: { display: 'flex', flexWrap: 'wrap', gap: 6, marginBottom: 8 } },
+                            backendTemplates.map((bt) =>
+                              React.createElement(
+                                'button',
+                                {
+                                  key: bt.id,
+                                  type: 'button',
+                                  className: `dsh-goal-chip-btn ${selectedTpl?.id === bt.id ? 'active' : ''}`,
+                                  style: selectedTpl?.id === bt.id ? { fontWeight: 600, border: '1px solid var(--dsw-alias-accent-primary)' } : {},
+                                  onClick: () => {
+                                    setSelectedTpl(bt);
+                                    const initial = {};
+                                    (bt.inputs || []).forEach((inp) => {
+                                      initial[inp.key] = inp.defaultValue || '';
+                                    });
+                                    setTplInputs(initial);
+                                  },
+                                },
+                                bt.title
+                              )
+                            )
+                          ),
+                          selectedTpl
+                            ? React.createElement(
+                                'div',
+                                { style: { borderTop: '1px solid var(--dsw-alias-border-l1)', paddingTop: 8 } },
+                                React.createElement('div', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary)', marginBottom: 6 } }, selectedTpl.description),
+                                (selectedTpl.inputs || []).map((inp) =>
+                                  React.createElement(
+                                    'div',
+                                    { key: inp.key, style: { marginBottom: 6 } },
+                                    React.createElement('label', { style: { fontSize: 11, display: 'block', marginBottom: 2 } }, inp.label),
+                                    React.createElement('input', {
+                                      type: 'text',
+                                      className: 'dsh-goal-card-input',
+                                      style: { width: '100%', boxSizing: 'border-box', fontSize: 12, padding: '4px 8px' },
+                                      placeholder: inp.placeholder || '',
+                                      value: tplInputs[inp.key] || '',
+                                      onChange: (e) => setTplInputs({ ...tplInputs, [inp.key]: e.target.value }),
+                                    })
+                                  )
+                                ),
+                                React.createElement(
+                                  'button',
+                                  {
+                                    type: 'button',
+                                    className: 'dsh-goal-btn dsh-goal-btn-primary',
+                                    style: { marginTop: 4, padding: '4px 10px', fontSize: 12 },
+                                    onClick: handleApplyTemplate,
+                                  },
+                                  'Apply Template'
+                                )
+                              )
+                            : null
+                        )
+                  )
+                : null
             ),
 
             React.createElement(
@@ -3398,6 +3526,17 @@ window.__ModuleLoader__.load({
 
       const isCompleted = state.state === 'COMPLETED';
 
+      const formatElapsed = (totalSeconds) => {
+        const s = Math.max(0, Math.floor(Number(totalSeconds) || 0));
+        if (s < 60) return `${s}s`;
+        const m = Math.floor(s / 60);
+        const remS = s % 60;
+        if (m < 60) return remS > 0 ? `${m}m ${remS}s` : `${m}m`;
+        const h = Math.floor(m / 60);
+        const remM = m % 60;
+        return remM > 0 ? `${h}h ${remM}m` : `${h}h`;
+      };
+
       const formatLiveElapsed = () => {
 
         if (!state) return '0s';
@@ -3821,7 +3960,7 @@ window.__ModuleLoader__.load({
       const [updateState, setUpdateState] = useState({
         checking: false,
         updating: false,
-        currentVersion: '0.2.3',
+        currentVersion: '',
         latestVersion: '',
         updateAvailable: false,
         notice: '',
@@ -4159,7 +4298,7 @@ window.__ModuleLoader__.load({
                           'div',
                           { style: { display: 'flex', alignItems: 'center', gap: 8 } },
                           React.createElement('span', { style: { fontSize: 13, fontWeight: 500, color: 'var(--dsw-alias-label-primary)' } }, t('version') || 'Version'),
-                          React.createElement('span', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary)' } }, 'v' + (updateState.currentVersion || '0.2.3')),
+                          React.createElement('span', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary)' } }, updateState.currentVersion ? 'v' + updateState.currentVersion : 'v0.2.12'),
                           updateState.updateAvailable
                             ? React.createElement('span', { className: 'dsh-goal-badge dsh-goal-badge-warn', style: { fontSize: 11 } }, 'v' + updateState.latestVersion + ' ' + (t('updateAvailable') || 'available'))
                             : React.createElement('span', { className: 'dsh-goal-badge dsh-goal-badge-ok', style: { fontSize: 11 } }, '✓ ' + (t('upToDate') || 'Up to date')),

package/lib/engine-issue-sync.js

@@ -1,3 +1,6 @@
+import fs from 'node:fs';
+import { execFileSync } from 'node:child_process';
+
 /**
  * Parse issue identifier from goal title or string
  * @param {string} input 
@@ -64,3 +67,128 @@ export function updateChecklistInMarkdown(markdown, itemText, done) {
     return line;
   }).join('\n');
 }
+
+/**
+ * Resolve Gitea API credentials from options, environment, or agent config
+ * @param {object} [options]
+ * @returns {{ token?: string, baseUrl: string }}
+ */
+export function resolveGiteaAuth(options = {}) {
+  const defaultUrl = options.baseUrl || process.env.GITEA_BASE_URL || 'http://127.0.0.1:3005';
+  if (options.token) {
+    return { token: options.token, baseUrl: defaultUrl };
+  }
+  if (process.env.GITEA_TOKEN) {
+    return { token: process.env.GITEA_TOKEN, baseUrl: defaultUrl };
+  }
+
+  const credPath = process.env.DSH_GITEA_CREDENTIALS || '/mnt/external/Project/DEV/.gitea-agent-credentials.json';
+  try {
+    if (fs.existsSync(credPath)) {
+      const raw = fs.readFileSync(credPath, 'utf8');
+      const creds = JSON.parse(raw);
+      const agent = creds?.agents?.['deepseek-harness'] || creds?.agents?.antigravity;
+      if (agent?.token) {
+        return {
+          token: agent.token,
+          baseUrl: options.baseUrl || agent.http_remote_base || defaultUrl,
+        };
+      }
+    }
+  } catch (err) {
+    // Non-fatal credential read error
+  }
+  return { baseUrl: defaultUrl };
+}
+
+/**
+ * Resolve repository owner and repo name from git remote or options
+ * @param {string} [cwd]
+ * @param {object} [options]
+ * @returns {{ owner: string, repo: string }}
+ */
+export function resolveRepoInfo(cwd = process.cwd(), options = {}) {
+  if (options.owner && options.repo) {
+    return { owner: options.owner, repo: options.repo };
+  }
+  try {
+    const remote = execFileSync('git', ['remote', 'get-url', 'origin'], {
+      cwd,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+    const match = remote.match(/(?:[:/])([^/]+)\/([^/]+?)(?:\.git)?$/);
+    if (match) {
+      return { owner: match[1], repo: match[2] };
+    }
+  } catch (err) {
+    // Fallback to default repository
+  }
+  return { owner: 'goodandready', repo: 'dsh-goal' };
+}
+
+/**
+ * Actively sync completed milestone checklist item with Gitea issue
+ * @param {object} goal
+ * @param {object} milestone
+ * @param {object} [options]
+ * @returns {Promise<{ synced: boolean, updated?: boolean, issueNumber?: number, error?: string }>}
+ */
+export async function syncMilestoneWithIssue(goal, milestone, options = {}) {
+  if (!goal?.issueRef?.issueNumber || !milestone?.title) {
+    return { synced: false, error: 'No issue reference or milestone title' };
+  }
+
+  const auth = resolveGiteaAuth(options);
+  if (!auth.token) {
+    return { synced: false, error: 'No Gitea API token available' };
+  }
+
+  const repoInfo = resolveRepoInfo(goal.cwd || process.cwd(), options);
+  const issueNum = goal.issueRef.issueNumber;
+  const issueApiUrl = `${auth.baseUrl}/api/v1/repos/${repoInfo.owner}/${repoInfo.repo}/issues/${issueNum}`;
+
+  try {
+    const fetchFn = options.fetch || globalThis.fetch;
+    if (typeof fetchFn !== 'function') {
+      return { synced: false, error: 'Fetch API unavailable' };
+    }
+
+    const getRes = await fetchFn(issueApiUrl, {
+      headers: {
+        'Authorization': `token ${auth.token}`,
+        'Accept': 'application/json',
+      },
+    });
+
+    if (!getRes.ok) {
+      return { synced: false, error: `HTTP ${getRes.status} fetching issue #${issueNum}` };
+    }
+
+    const issueData = await getRes.json();
+    const currentBody = issueData.body || '';
+    const updatedBody = updateChecklistInMarkdown(currentBody, milestone.title, true);
+
+    if (updatedBody === currentBody) {
+      return { synced: true, updated: false, issueNumber: issueNum };
+    }
+
+    const patchRes = await fetchFn(issueApiUrl, {
+      method: 'PATCH',
+      headers: {
+        'Authorization': `token ${auth.token}`,
+        'Content-Type': 'application/json',
+        'Accept': 'application/json',
+      },
+      body: JSON.stringify({ body: updatedBody }),
+    });
+
+    if (!patchRes.ok) {
+      return { synced: false, error: `HTTP ${patchRes.status} updating issue #${issueNum}` };
+    }
+
+    return { synced: true, updated: true, issueNumber: issueNum };
+  } catch (err) {
+    return { synced: false, error: err.message };
+  }
+}

package/lib/engine-store.js

@@ -6,9 +6,10 @@ import { GoalState } from './goal-engine-constants.js';
  * Storage manager for goal engine disk state persistence
  */
 export class EngineStore {
-  constructor(engine, storagePath) {
+  constructor(engine, storagePath, logger) {
     this.engine = engine;
     this.storagePath = storagePath || null;
+    this.logger = logger || engine?.logger || console;
     this.saveTimer = null;
   }
 
@@ -77,7 +78,7 @@ export class EngineStore {
       }
     } catch (err) {
       // best-effort load failure logged defensively
-      console.warn?.('[GoalEngine] Failed to load state from disk:', err?.message || err);
+      this.logger?.warn?.('[GoalEngine] Failed to load state from disk:', err?.message || err);
     }
   }
 
@@ -128,7 +129,7 @@ export class EngineStore {
       fs.writeFileSync(tmp, JSON.stringify(payload, null, 2), 'utf8');
       fs.renameSync(tmp, this.storagePath);
     } catch (err) {
-      console.warn?.('[GoalEngine] Failed to write state to disk:', err?.message || err);
+      this.logger?.warn?.('[GoalEngine] Failed to write state to disk:', err?.message || err);
     }
   }
 

package/lib/goal-engine.js

@@ -5,12 +5,12 @@ import { buildStatePromptInjection } from './engine-prompt.js';
 import { matchMilestone, parseMilestoneItems, applyMilestoneUpdate, toggleMilestoneChecklistItem } from './engine-milestones.js';
 import { applyIntervention, recordActivity, processTokenBudget } from './engine-intervention.js';
 import { createGoalBranch, sanitizeBranchSlug, getCurrentGitBranch, mergeGoalBranch, discardGoalBranch } from './engine-git-branch.js';
-import { parseIssueRef } from './engine-issue-sync.js';
+import { parseIssueRef, parseIssueChecklist, syncMilestoneWithIssue } from './engine-issue-sync.js';
 import { generateRetrospectiveData } from './engine-retrospective.js';
 import { generatePreplanDraft } from './engine-templates.js';
 import { pruneInactiveSessions, addNudgeToGoal, consumeGoalNudge, extendGoalBudget } from './engine-sessions.js';
 
-export { GoalState, MilestoneStatus, formatElapsed, formatETA, detectLanguage, sessionIdOf, matchMilestone };
+export { GoalState, MilestoneStatus, formatElapsed, formatETA, detectLanguage, sessionIdOf, matchMilestone, parseIssueChecklist };
 export { getGitCurrentCommit, exportReportMarkdown, exportReportGitHubPR, createMilestoneCheckpoint, rollbackToCheckpoint, saveGoalArtifact };
 
 /**
@@ -73,7 +73,7 @@ export class GoalEngine {
       try {
         listener(snapshot, sid);
       } catch (err) {
-        console.error('[dsh-goal] Error in GoalEngine listener:', err);
+        this.logger?.error?.('[dsh-goal] Error in GoalEngine listener:', err);
       }
     }
   }
@@ -234,6 +234,13 @@ export class GoalEngine {
       }
     }
 
+    if (options.issueBody && (!options.milestones || options.milestones.length === 0)) {
+      const items = parseIssueChecklist(options.issueBody);
+      if (items.length > 0) {
+        options.milestones = items.map((it) => ({ title: it.text, status: it.done ? MilestoneStatus.COMPLETED : MilestoneStatus.PENDING }));
+      }
+    }
+
     if (this.enablePreplanning && options.preplan !== false && (!options.milestones || options.milestones.length === 0)) {
       goal.preplan = { active: true, draftMilestones: generatePreplanDraft(cleanTitle) };
     }
@@ -378,11 +385,22 @@ export class GoalEngine {
     const prevStatus = res.prevStatus;
     recordActivity(goal, { type: 'milestone', tool: 'updateMilestone', status: 'success', details: `${id} -> ${status}` });
 
-    if (target.status === MilestoneStatus.COMPLETED && prevStatus !== MilestoneStatus.COMPLETED && this.autoCheckpointOnMilestone) {
-      const commitHash = createMilestoneCheckpoint(target, sid);
-      if (commitHash) {
-        target.checkpointCommit = commitHash;
-        goal.logs.push({ timestamp: Date.now(), type: 'info', message: `Git checkpoint saved for [${target.title}]: ${commitHash}` });
+    if (target.status === MilestoneStatus.COMPLETED && prevStatus !== MilestoneStatus.COMPLETED) {
+      if (this.autoCheckpointOnMilestone) {
+        const commitHash = createMilestoneCheckpoint(target, sid);
+        if (commitHash) {
+          target.checkpointCommit = commitHash;
+          goal.logs.push({ timestamp: Date.now(), type: 'info', message: `Git checkpoint saved for [${target.title}]: ${commitHash}` });
+        }
+      }
+      if (goal.issueRef) {
+        syncMilestoneWithIssue(goal, target).then((syncRes) => {
+          if (syncRes?.updated) {
+            goal.logs.push({ timestamp: Date.now(), type: 'info', message: `Synced checklist for issue #${syncRes.issueNumber}` });
+            recordActivity(goal, { type: 'issue', tool: 'syncIssueChecklist', status: 'success', details: `Issue #${syncRes.issueNumber} updated` });
+            this.emit(sid);
+          }
+        }).catch(() => {});
       }
     }
 

package/lib/index.js

@@ -65,9 +65,12 @@ export function apply(ctx, config = {}) {
   };
 
   const defaultStorageDir = process.env.DSH_HOME || path.join(os.homedir(), '.dsh');
-  const storagePath = currentSettings.storagePath !== undefined && currentSettings.storagePath !== null
-    ? currentSettings.storagePath
-    : path.join(defaultStorageDir, 'dsh-goal-state.json');
+  const customStorage = typeof currentSettings.storagePath === 'string' && currentSettings.storagePath.trim()
+    ? currentSettings.storagePath.trim()
+    : null;
+  const isTest = process.env.NODE_ENV === 'test' || Boolean(process.env.NODE_TEST_CONTEXT);
+  const storagePath = customStorage || (isTest ? null : path.join(defaultStorageDir, 'dsh-goal-state.json'));
+  const logger = ctx.logger ? ctx.logger('goal') : console;
 
   const engine = new GoalEngine({
     defaultMaxIterations: currentSettings.maxIterations,
@@ -88,6 +91,7 @@ export function apply(ctx, config = {}) {
     soundScheme: currentSettings.soundScheme,
     enableVoiceAnnouncements: currentSettings.enableVoiceAnnouncements,
     storagePath,
+    logger,
   });
 
   // Track running agents through global DSH core event
@@ -122,7 +126,7 @@ export function apply(ctx, config = {}) {
       try {
         specificAgent.cancel({ kind: 'user' });
       } catch (err) {
-        console.warn('[dsh-goal] Failed to cancel specific agent for session:', err);
+        logger.warn('Failed to cancel specific agent for session:', err);
       }
     }
 
@@ -135,7 +139,7 @@ export function apply(ctx, config = {}) {
           }
         }
       } catch (err) {
-        console.warn('[dsh-goal] Failed to cancel running agent:', err);
+        logger.warn('Failed to cancel running agent:', err);
       }
     }
 
@@ -145,7 +149,7 @@ export function apply(ctx, config = {}) {
         try {
           lastActiveAgent.cancel({ kind: 'user' });
         } catch (err) {
-          console.warn('[dsh-goal] Failed to cancel lastActiveAgent:', err);
+          logger.warn('Failed to cancel lastActiveAgent:', err);
         }
       }
     }
@@ -193,7 +197,7 @@ export function apply(ctx, config = {}) {
         sessionAgents.set(sid, target);
         return true;
       } catch (err) {
-        console.warn('[dsh-goal] Failed to resume agent:', err);
+        logger.warn('Failed to resume agent:', err);
       }
     }
     return false;
@@ -202,35 +206,19 @@ export function apply(ctx, config = {}) {
   const getConfig = () => {
     if (settingsScope) {
       const snap = typeof settingsScope.getSnapshot === 'function' ? settingsScope.getSnapshot() : null;
+      let live = null;
       if (snap) {
-        if (snap.status === 'ready' || snap.status === undefined) {
-          const live = snap.value || (typeof settingsScope.get === 'function' ? settingsScope.get() : null);
-          if (live && typeof live === 'object') {
-            return {
-              maxIterations: typeof live.maxIterations === 'number' ? live.maxIterations : currentSettings.maxIterations,
-              autoDrive: typeof live.autoDrive === 'boolean' ? live.autoDrive : currentSettings.autoDrive,
-              enableSound: typeof live.enableSound === 'boolean' ? live.enableSound : currentSettings.enableSound,
-              showQuickLaunchButton: typeof live.showQuickLaunchButton === 'boolean' ? live.showQuickLaunchButton : currentSettings.showQuickLaunchButton,
-              consecutiveToolFailureLimit: typeof live.consecutiveToolFailureLimit === 'number' ? live.consecutiveToolFailureLimit : currentSettings.consecutiveToolFailureLimit,
-              enableBrowserNotifications: typeof live.enableBrowserNotifications === 'boolean' ? live.enableBrowserNotifications : currentSettings.enableBrowserNotifications,
-              maxTokenBudget: typeof live.maxTokenBudget === 'number' ? live.maxTokenBudget : currentSettings.maxTokenBudget,
-              budgetWarningThreshold: typeof live.budgetWarningThreshold === 'number' ? live.budgetWarningThreshold : currentSettings.budgetWarningThreshold,
-              autoCheckpointOnMilestone: typeof live.autoCheckpointOnMilestone === 'boolean' ? live.autoCheckpointOnMilestone : currentSettings.autoCheckpointOnMilestone,
-              storagePath: typeof live.storagePath === 'string' ? live.storagePath : currentSettings.storagePath,
-            };
-          }
+        if (snap.status === 'ready' || snap.status === 'writable' || snap.status === undefined) {
+          live = snap.value || (typeof settingsScope.get === 'function' ? settingsScope.get() : null);
         }
       } else if (typeof settingsScope.get === 'function') {
-        const live = settingsScope.get();
-        if (live && typeof live === 'object') {
-          return {
-            maxIterations: typeof live.maxIterations === 'number' ? live.maxIterations : currentSettings.maxIterations,
-            autoDrive: typeof live.autoDrive === 'boolean' ? live.autoDrive : currentSettings.autoDrive,
-            enableSound: typeof live.enableSound === 'boolean' ? live.enableSound : currentSettings.enableSound,
-            showQuickLaunchButton: typeof live.showQuickLaunchButton === 'boolean' ? live.showQuickLaunchButton : currentSettings.showQuickLaunchButton,
-            storagePath: typeof live.storagePath === 'string' ? live.storagePath : currentSettings.storagePath,
-          };
-        }
+        live = settingsScope.get();
+      }
+      if (live && typeof live === 'object') {
+        return {
+          ...currentSettings,
+          ...live,
+        };
       }
     }
     return currentSettings;
@@ -279,7 +267,7 @@ export function apply(ctx, config = {}) {
         }
       }
     } catch (err) {
-      console.warn('[dsh-goal] Settings register skipped:', err.message);
+      logger.warn('Settings register skipped:', err.message);
     }
   });
 
@@ -307,7 +295,7 @@ export function apply(ctx, config = {}) {
         cctx.effect(() => () => unregister(), 'dsh-goal: /goal command unregister');
       }
     } catch (err) {
-      console.warn('[dsh-goal] Commands register skipped:', err.message);
+      logger.warn('Commands register skipped:', err.message);
     }
   });
 
@@ -316,7 +304,9 @@ export function apply(ctx, config = {}) {
     try {
       if (typeof pctx.systemPrompt?.section === 'function') {
         const globalSections = pctx.systemPrompt.layers?.global?.sections;
+        let displacedPromptSection = null;
         if (globalSections?.data instanceof Map && globalSections.data.has('tool:goal')) {
+          displacedPromptSection = globalSections.data.get('tool:goal');
           globalSections.data.delete('tool:goal');
         }
 
@@ -334,28 +324,39 @@ export function apply(ctx, config = {}) {
         });
 
         if (typeof unregisterSection === 'function') {
-          pctx.effect(() => () => unregisterSection(), 'dsh-goal: system prompt section');
+          pctx.effect(() => () => {
+            unregisterSection();
+            if (displacedPromptSection && globalSections?.data instanceof Map) {
+              globalSections.data.set('tool:goal', displacedPromptSection);
+            }
+          }, 'dsh-goal: system prompt section');
         }
       }
     } catch (err) {
-      console.warn('[dsh-goal] SystemPrompt section register skipped:', err.message);
+      logger.warn('SystemPrompt section register skipped:', err.message);
     }
   });
 
   // 4. Tools registration
-  registerTools(ctx, { engine, resumeActiveAgent });
+  registerTools(ctx, { engine, resumeActiveAgent, logger });
 
-  // 5. One-click auto-updater registration
+  // 5. One-click auto-updater registration with Cordis effect cleanup (Issue #99)
   if (ctx.webServer?.register) {
-    try {
-      registerPluginUpdater(ctx, {
-        packageName: '@goodandready/dsh-goal',
-        endpoint: '/api/dsh-goal/update',
-        manifestUrl: new URL('../package.json', import.meta.url),
-      });
-    } catch (err) {
-      console.warn('[dsh-goal] Failed to register plugin updater:', err.message);
-    }
+    ctx.effect(() => {
+      let unreg = null;
+      try {
+        unreg = registerPluginUpdater(ctx, {
+          packageName: '@goodandready/dsh-goal',
+          endpoint: '/api/dsh-goal/update',
+          manifestUrl: new URL('../package.json', import.meta.url),
+        });
+      } catch (err) {
+        logger.warn('Failed to register plugin updater:', err.message);
+      }
+      return () => {
+        if (typeof unreg === 'function') unreg();
+      };
+    }, 'dsh-goal: plugin auto-updater');
   }
 
   // 6. WebServer HTTP & SSE routes
@@ -466,7 +467,7 @@ export function apply(ctx, config = {}) {
                 target.followup(promptMsg);
                 sessionAgents.set(sid, target);
               } catch (err) {
-                console.warn('[dsh-goal] Failed auto-drive followup:', err);
+                logger.warn('Failed auto-drive followup:', err);
               }
             }
           }

package/lib/routes.js

@@ -2,7 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { MilestoneStatus, detectLanguage, sessionIdOf } from './goal-engine-constants.js';
 import { saveGoalArtifact, rollbackToCheckpoint } from './engine-reports.js';
-import { getTemplatesCatalogue } from './engine-templates.js';
+import { getTemplatesCatalogue, instantiateTemplate } from './engine-templates.js';
 
 export function isLoopback(value) {
   if (!value) return false;
@@ -21,10 +21,6 @@ export function isTrustedCaller(req) {
   const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || '';
   if (isLoopback(remote)) return true;
 
-  const secSite = String(req.headers?.['sec-fetch-site'] || '').toLowerCase();
-  if (secSite === 'same-origin' || secSite === 'same-site' || secSite === 'none') return true;
-  if (secSite === 'cross-site') return false;
-
   const host = String(req.headers?.host || '').toLowerCase();
   const origin = String(req.headers?.origin || '').trim().toLowerCase();
   if (origin) {
@@ -167,6 +163,11 @@ export function registerRoutes(ctx, {
 
         // GET /dsh-goal/events: Server-Sent Events realtime snapshot stream
         if (req.method === 'GET' && (pathname === '/dsh-goal/events' || pathname === '/dsh-goal/events/')) {
+          if (!isTrustedCaller(req)) {
+            res.statusCode = 403;
+            res.setHeader('Content-Type', 'application/json; charset=utf-8');
+            return res.end(JSON.stringify({ error: 'Forbidden: untrusted caller origin' }));
+          }
           const sid = sessionIdOf(req, 'default');
           res.writeHead(200, {
             'Content-Type': 'text/event-stream',
@@ -197,12 +198,20 @@ export function registerRoutes(ctx, {
 
         // GET /dsh-goal/templates
         if (req.method === 'GET' && (pathname === '/dsh-goal/templates' || pathname === '/dsh-goal/templates/')) {
+          if (!isTrustedCaller(req)) {
+            res.statusCode = 403;
+            return res.end(JSON.stringify({ error: 'Forbidden: untrusted caller origin' }));
+          }
           res.statusCode = 200;
           return res.end(JSON.stringify({ ok: true, templates: getTemplatesCatalogue() }));
         }
 
         // GET /dsh-goal/state
         if (req.method === 'GET' && (pathname === '/dsh-goal/state' || pathname === '/dsh-goal/state/')) {
+          if (!isTrustedCaller(req)) {
+            res.statusCode = 403;
+            return res.end(JSON.stringify({ error: 'Forbidden: untrusted caller origin' }));
+          }
           const sid = sessionIdOf(req, 'default');
           res.statusCode = 200;
           return res.end(JSON.stringify(engine.getSnapshot(sid)));
@@ -268,13 +277,27 @@ export function registerRoutes(ctx, {
                     res.statusCode = 400;
                     return res.end(JSON.stringify({ error: 'Goal title cannot be empty' }));
                   }
+                  const trustedRoots = [process.cwd()];
+                  if (process.env.DSH_WORKSPACE_ROOT) {
+                    trustedRoots.push(process.env.DSH_WORKSPACE_ROOT);
+                  }
+                  let safeStartCwd = undefined;
+                  if (data.cwd) {
+                    const validated = getSafeCwd(data.cwd, trustedRoots);
+                    if (!validated) {
+                      res.statusCode = 400;
+                      return res.end(JSON.stringify({ error: 'Invalid or unauthorized working directory' }));
+                    }
+                    safeStartCwd = validated;
+                  }
                   const detectedLang = data.lang || detectLanguage(cleanTitle);
                   const conf = typeof getConfig === 'function' ? getConfig() : { maxIterations: 25 };
                   result = engine.startGoal(cleanTitle, {
                     description: typeof description === 'string' ? description.trim() : '',
                     maxIterations: conf.maxIterations || 25,
                     lang: detectedLang,
-                    cwd: data.cwd,
+                    cwd: safeStartCwd,
+                    issueBody: data.issueBody,
                   }, sid);
 
                   const startPrompt = detectedLang === 'zh'
@@ -390,7 +413,15 @@ export function registerRoutes(ctx, {
                   }
                   const sessionGoal = engine.getGoal(sid);
                   const allowedRoots = [process.cwd()];
-                  if (sessionGoal?.cwd) allowedRoots.push(sessionGoal.cwd);
+                  if (process.env.DSH_WORKSPACE_ROOT) {
+                    allowedRoots.push(process.env.DSH_WORKSPACE_ROOT);
+                  }
+                  if (sessionGoal?.cwd) {
+                    const isCwdAllowed = allowedRoots.some((root) => isPathInsideOrEqual(root, sessionGoal.cwd));
+                    if (isCwdAllowed) {
+                      allowedRoots.push(sessionGoal.cwd);
+                    }
+                  }
                   const safeCwd = getSafeCwd(data.cwd, allowedRoots);
                   if (!safeCwd) {
                     res.statusCode = 400;
@@ -413,7 +444,15 @@ export function registerRoutes(ctx, {
                   }
                   const sessionGoal = engine.getGoal(sid);
                   const allowedRoots = [process.cwd()];
-                  if (sessionGoal?.cwd) allowedRoots.push(sessionGoal.cwd);
+                  if (process.env.DSH_WORKSPACE_ROOT) {
+                    allowedRoots.push(process.env.DSH_WORKSPACE_ROOT);
+                  }
+                  if (sessionGoal?.cwd) {
+                    const isCwdAllowed = allowedRoots.some((root) => isPathInsideOrEqual(root, sessionGoal.cwd));
+                    if (isCwdAllowed) {
+                      allowedRoots.push(sessionGoal.cwd);
+                    }
+                  }
                   const safeCwd = getSafeCwd(data.cwd, allowedRoots);
                   if (!safeCwd) {
                     res.statusCode = 400;
@@ -473,6 +512,21 @@ export function registerRoutes(ctx, {
                   res.statusCode = 200;
                   return res.end(JSON.stringify({ ok: true, templates: getTemplatesCatalogue() }));
 
+                case 'instantiate_template': {
+                  const tplId = data.templateId || data.id;
+                  if (!tplId) {
+                    res.statusCode = 400;
+                    return res.end(JSON.stringify({ error: 'templateId is required' }));
+                  }
+                  const instance = instantiateTemplate(tplId, data.inputs || {});
+                  if (!instance) {
+                    res.statusCode = 404;
+                    return res.end(JSON.stringify({ error: `Template "${tplId}" not found` }));
+                  }
+                  res.statusCode = 200;
+                  return res.end(JSON.stringify({ ok: true, template: instance }));
+                }
+
                 default:
                   res.statusCode = 400;
                   return res.end(JSON.stringify({ error: `Unknown action: ${action}` }));
@@ -488,6 +542,20 @@ export function registerRoutes(ctx, {
           return;
         }
 
+        const KNOWN_ROUTES = {
+          '/dsh-goal/events': ['GET'],
+          '/dsh-goal/templates': ['GET'],
+          '/dsh-goal/state': ['GET'],
+          '/dsh-goal/action': ['POST'],
+        };
+        const cleanPath = pathname.replace(/\/+$/, '') || '/';
+        const allowedMethods = KNOWN_ROUTES[cleanPath];
+        if (allowedMethods && !allowedMethods.includes(req.method)) {
+          res.statusCode = 405;
+          res.setHeader('Allow', allowedMethods.join(', '));
+          return res.end(JSON.stringify({ error: `Method Not Allowed: use ${allowedMethods.join(', ')}` }));
+        }
+
         res.statusCode = 404;
         res.end(JSON.stringify({ error: 'Endpoint not found' }));
       },

package/lib/tools.js

@@ -42,23 +42,30 @@ export function formatGoalValue(snap) {
  * @param {any} options.engine
  * @param {Function} [options.resumeActiveAgent]
  */
-export function registerTools(ctx, { engine, resumeActiveAgent }) {
+export function registerTools(ctx, { engine, resumeActiveAgent, logger = console }) {
   ctx.inject(['tools'], (tctx) => {
     if (!tctx.tools?.register) return;
 
+    const displacedTools = new Map();
     const safeRegister = (definition) => {
       try {
         const name = definition.name;
         const globalTools = tctx.tools.layers?.global?.tools;
         if (globalTools?.data instanceof Map && globalTools.data.has(name)) {
+          displacedTools.set(name, globalTools.data.get(name));
           globalTools.data.delete(name);
         }
         const unregister = tctx.tools.register(definition);
         if (typeof unregister === 'function') {
-          tctx.effect(() => () => unregister(), `dsh-goal: tool ${name}`);
+          tctx.effect(() => () => {
+            unregister();
+            if (displacedTools.has(name) && globalTools?.data instanceof Map) {
+              globalTools.data.set(name, displacedTools.get(name));
+            }
+          }, `dsh-goal: tool ${name}`);
         }
       } catch (err) {
-        console.warn(`[dsh-goal] Tool ${definition.name} registration skipped:`, err.message);
+        logger.warn(`[dsh-goal] Tool ${definition.name} registration skipped:`, err.message);
       }
     };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-goal",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "description": "Autonomous Goal Execution & Multi-Turn Task Tracking Engine with Sticky Header for DeepSeek Harness",
   "type": "module",
   "main": "./lib/index.js",