@goodandready/dsh-kanban 0.2.15 → 0.2.17

package/README.md

@@ -222,7 +222,7 @@ dsh-kanban:
 
 ## 🧪 Testing & Verification
 
-Run the comprehensive 520+ unit and integration test suite:
+Run the comprehensive 730+ unit and integration test suite:
 
 ```bash
 npm test

package/README.ru.md

@@ -174,7 +174,7 @@ dsh-kanban:
 
 ## 🧪 Тестирование и верификация
 
-Запуск полного набора из более чем 710 юнит- и интеграционных тестов:
+Запуск полного набора из более чем 730 юнит- и интеграционных тестов:
 
 ```bash
 npm test

package/lib/client.js

@@ -210,6 +210,8 @@ window.__ModuleLoader__.load({
 
     function cardStatus(task) {
       const parts = []
+      if (task && task.workflowStatus === 'running') parts.push('⚡ Workflow')
+      else if (task && task.workflowStatus === 'failed') parts.push('⚡ Failed')
       if (task && typeof task.model === 'string' && task.model !== '') parts.push(task.model)
       if (task && typeof task.branch === 'string' && task.branch !== '') parts.push(task.branch)
       return parts.join(' · ')
@@ -1183,6 +1185,9 @@ window.__ModuleLoader__.load({
       'panel.worktree': 'Worktree: {path}',
       'panel.cleanupWorktree': 'Clean Worktree',
       'action.resume': '↻ Resume',
+      'action.cancelWorkflow': 'Cancel Workflow',
+      'panel.startWorkflow': '⚡ Workflow',
+      'panel.startWorkflowHint': 'Run multi-agent workflow via core workflow engine',
       'panel.worktreeDirty': 'Uncommitted changes in worktree: {files}',
       'panel.priority': 'Priority',
       'panel.priorityNone': 'No priority',
@@ -1571,6 +1576,9 @@ window.__ModuleLoader__.load({
       'panel.worktree': '工作区：{path}',
       'panel.cleanupWorktree': '清理工作区',
       'action.resume': '↻ 继续执行',
+      'action.cancelWorkflow': '取消工作流',
+      'panel.startWorkflow': '⚡ 工作流',
+      'panel.startWorkflowHint': '通过核心工作流引擎运行多代理工作流',
       'panel.worktreeDirty': '工作区中存在未提交的更改：{files}',
       'panel.priority': '优先级',
       'panel.priorityNone': '无优先级',
@@ -3835,6 +3843,52 @@ window.__ModuleLoader__.load({
                 }
               },
             }, t('action.resume')) : null,
+            openTask.workflowStatus === 'running' ? h('button', {
+              type: 'button',
+              className: 'dkb-discard',
+              style: { marginRight: '8px' },
+              disabled: starting,
+              onClick: async () => {
+                setStarting(true)
+                try {
+                  await api('/task/' + encodeURIComponent(openTask.id) + '/workflow-cancel', {
+                    method: 'POST',
+                    body: JSON.stringify({ reason: 'cancelled-by-user' }),
+                  })
+                  setOpenTask(null)
+                  await load(board)
+                  if (props.onClose) props.onClose()
+                } catch (e) {
+                  setError(t(e.key || 'error.unknown'))
+                } finally {
+                  setStarting(false)
+                }
+              },
+            }, t('action.cancelWorkflow')) : null,
+            openTask.workflowStatus !== 'running' ? h('button', {
+              type: 'button',
+              className: 'dkb-secondary',
+              style: { marginRight: '8px', border: '1px solid var(--dsw-alias-border-l2)' },
+              title: t('panel.startWorkflowHint'),
+              disabled: starting || model === '',
+              onClick: async () => {
+                setStarting(true)
+                try {
+                  rememberLaunch(board, { provider, model, agentPreset, permission })
+                  await api('/task/' + encodeURIComponent(openTask.id) + '/workflow-start', {
+                    method: 'POST',
+                    body: JSON.stringify({ provider, model, text: draftText, agentPreset, permission }),
+                  })
+                  setOpenTask(null)
+                  await load(board)
+                  if (props.onClose) props.onClose()
+                } catch (e) {
+                  setError(t(e.key || 'error.unknown'))
+                } finally {
+                  setStarting(false)
+                }
+              },
+            }, t('panel.startWorkflow')) : null,
             h('button', {
               type: 'button', className: 'dkb-save', disabled: starting || model === '',
               onClick: async () => {

package/lib/index.js

@@ -61,6 +61,7 @@ import { createGiteaClient } from './gitea.js'
 import { createGitHubClient } from './github.js'
 import { createGitProvider } from './git-provider.js'
 import { createKanbanTaskService } from './task-service.js'
+import { WorkflowBridge } from './workflow-bridge.js'
 import { syncAll, createSyncState, intakeAll, archiveOverdue } from './sync.js'
 import { isWatched } from './intake.js'
 import { handleSessionEvent } from './lifecycle.js'
@@ -278,6 +279,23 @@ export function apply(ctx, config) {
     pid: process.pid,
   })
 
+  const workflowBridge = new WorkflowBridge({
+    get store() { return store },
+    get workflowEngine() { return ctx.get('workflowEngine') },
+    get agentPresets() { return ctx.get('agentPresets') },
+    get agents() { return ctx.agents },
+    git,
+    getConfig,
+    logger: ctx.logger,
+    eventHub,
+  })
+  const unbindCoreWorkflow = workflowBridge.bindCoreEvents(ctx)
+  if (typeof ctx.on === 'function') {
+    ctx.on('dispose', () => {
+      unbindCoreWorkflow?.()
+    })
+  }
+
   const syncPower = () => {
     try {
       const cfg = getConfig()
@@ -964,7 +982,31 @@ export function apply(ctx, config) {
         reply(res, await refreshTask({ gitea: git, store, id }))
         return
       }
-      if (req.method === 'POST' && action === 'start') {
+      if (req.method === 'GET' && action === 'workflow-status') {
+        const task = store.getTask(id)
+        if (task === undefined) { writeJson(res, 404, { error: 'task-not-found' }); return }
+        const active = workflowBridge.activeRuns.get(id)
+        reply(res, {
+          active: Boolean(active),
+          runId: active?.runId || task.workflowRunId || '',
+          role: active?.role || '',
+          status: task.workflowStatus || (active ? 'running' : 'idle'),
+        })
+        return
+      }
+      if (req.method === 'POST' && action === 'workflow-cancel') {
+        try {
+          const input = await readBody(req)
+          const reason = typeof input?.reason === 'string' ? input.reason : 'cancelled-by-user'
+          const result = await workflowBridge.cancelTaskWorkflow(id, reason)
+          syncPower()
+          reply(res, result)
+        } catch (error) {
+          writeJson(res, 500, { error: error?.message || 'cancel-failed' })
+        }
+        return
+      }
+      if (req.method === 'POST' && (action === 'start' || action === 'workflow-start')) {
         try {
           const input = await readBody(req)
           const task = store.getTask(id)
@@ -974,6 +1016,27 @@ export function apply(ctx, config) {
             fallback: ctx.get('agentDefaultModel')?.currentSelection?.(),
           })
           if (picked.error) { writeJson(res, picked.status, { error: picked.error }); return }
+
+          if (action === 'workflow-start' || input.workflow === true || input.mode === 'workflow') {
+            const started = await workflowBridge.startTaskWorkflow({
+              task,
+              role: typeof input.role === 'string' ? input.role : (typeof input.agentPreset === 'string' ? input.agentPreset : undefined),
+              provider: picked.provider,
+              model: picked.model,
+              mintSessionId: () => SessionId(`kanban-${id}-${randomUUID()}`),
+              gitRunner,
+              workspaceRegistry: ctx.get('workspaceRegistry'),
+              claimAs: await whoAmI(),
+              permission: typeof input.permission === 'string' ? input.permission : undefined,
+              permissions: ctx.get('permissionPresets'),
+              cwdOf: rootOf(getConfig()),
+              text: typeof input.text === 'string' ? input.text : undefined,
+            })
+            syncPower()
+            reply(res, started)
+            return
+          }
+
           const started = await runTask({
             agents: ctx.agents,
             store,
@@ -999,7 +1062,7 @@ export function apply(ctx, config) {
           ctx.logger?.warn?.(`dsh-kanban: task launch failed: ${error?.message}`)
           // Отказ по уровню доступа называется своим именем: «не удалось» на
           // месте «сессия пошла бы с большими правами» — это молчание.
-          writeJson(res, error?.status ?? 500, { error: error?.key ?? 'start-failed' })
+          writeJson(res, error?.status ?? 500, { error: error?.key ?? error?.message ?? 'start-failed' })
         }
         return
       }

package/lib/store.js

@@ -13,7 +13,7 @@
 
 import { DatabaseSync } from 'node:sqlite'
 import { randomUUID } from 'node:crypto'
-import { mkdirSync, copyFileSync, readdirSync, unlinkSync, statSync } from 'node:fs'
+import { mkdirSync, copyFileSync, readdirSync, unlinkSync, statSync, chmodSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { keyBetween } from './order.js'
 import { DEFAULT_BOARDS, normalizeKind } from './config.js'
@@ -73,6 +73,8 @@ CREATE TABLE IF NOT EXISTS tasks (
   rejectedAt            INTEGER NOT NULL DEFAULT 0,
   parentId              TEXT NOT NULL DEFAULT '',
   isEpic                INTEGER NOT NULL DEFAULT 0,
+  workflowRunId         TEXT NOT NULL DEFAULT '',
+  workflowStatus        TEXT NOT NULL DEFAULT '',
   updatedAt    INTEGER NOT NULL
 );
 CREATE INDEX IF NOT EXISTS tasks_board_col ON tasks(board, col, position);
@@ -103,10 +105,11 @@ const WRITABLE = [
   'labelColors', 'queuedAt', 'createdAt', 'author', 'assignee', 'milestone', 'priority', 'dueAt',
   'cron', 'nextRunAt', 'lastRunAt', 'progressDump', 'permission', 'reasoningEffort', 'permissionConfirmedAt',
   'runs', 'checklist', 'report', 'comments', 'rejectReason', 'rejectedAt', 'parentId', 'isEpic',
+  'workflowRunId', 'workflowStatus',
 ]
 
 /** Источники перехода; чужое значение не пишем, чтобы журнал оставался читаемым. */
-const SOURCES = new Set(['manual', 'session', 'gitea', 'github', 'tool'])
+const SOURCES = new Set(['manual', 'session', 'gitea', 'github', 'tool', 'workflow'])
 
 function rowToTask(row) {
   if (row === undefined) return undefined
@@ -159,13 +162,48 @@ function rowToTask(row) {
   }
 }
 
+/**
+ * Обеспечить безопасные права доступа к каталогу хранилища и файлам базы.
+ * Каталог и подкаталог бэкапов: 0700 (rwx------)
+ * Файлы базы, WAL, SHM и файлы бэкапов: 0600 (rw-------)
+ *
+ * @param {string} dir каталог хранилища
+ */
+export function secureStorePermissions(dir) {
+  try {
+    if (existsSync(dir)) {
+      try { chmodSync(dir, 0o700) } catch { /* best-effort chmod on dir */ }
+      const entries = readdirSync(dir, { withFileTypes: true })
+      for (const entry of entries) {
+        const fullPath = join(dir, entry.name)
+        if (entry.isFile()) {
+          try { chmodSync(fullPath, 0o600) } catch { /* best-effort chmod on file */ }
+        } else if (entry.isDirectory() && entry.name === 'backups') {
+          try { chmodSync(fullPath, 0o700) } catch { /* best-effort chmod on backups dir */ }
+          try {
+            const backupFiles = readdirSync(fullPath, { withFileTypes: true })
+            for (const bFile of backupFiles) {
+              if (bFile.isFile()) {
+                try { chmodSync(join(fullPath, bFile.name), 0o600) } catch { /* best-effort chmod on backup file */ }
+              }
+            }
+          } catch { /* ignore readdir error on backups */ }
+        }
+      }
+    }
+  } catch {
+    /* best-effort permission hardening */
+  }
+}
+
 /**
  * Открыть хранилище задач.
  * @param {{dir: string}} options каталог, в котором лежит файл базы
  * @returns {object} интерфейс хранилища
  */
 export function openStore({ dir }) {
-  mkdirSync(dir, { recursive: true })
+  mkdirSync(dir, { recursive: true, mode: 0o700 })
+  secureStorePermissions(dir)
   const db = new DatabaseSync(join(dir, 'kanban.db'))
   db.exec('PRAGMA journal_mode = WAL')
   db.exec('PRAGMA foreign_keys = ON')
@@ -206,6 +244,8 @@ export function openStore({ dir }) {
     ['isEpic', "INTEGER NOT NULL DEFAULT 0"],
     ['externalRef', "TEXT"],
     ['provider', "TEXT NOT NULL DEFAULT 'gitea'"],
+    ['workflowRunId', "TEXT NOT NULL DEFAULT ''"],
+    ['workflowStatus', "TEXT NOT NULL DEFAULT ''"],
   ]) {
     try { db.exec(`ALTER TABLE tasks ADD COLUMN ${column} ${definition}`) } catch { /* столбец уже есть */ }
   }
@@ -226,6 +266,9 @@ export function openStore({ dir }) {
   db.exec('PRAGMA synchronous = NORMAL')
   try { db.exec('PRAGMA optimize') } catch { /* pragma optimize best-effort */ }
 
+  // Повторно обеспечиваем права на созданные/изменённые файлы базы, WAL и SHM
+  secureStorePermissions(dir)
+
   const q = {
     boards: db.prepare('SELECT * FROM boards ORDER BY position'),
     insertTask: db.prepare(`INSERT INTO tasks
@@ -233,8 +276,9 @@ export function openStore({ dir }) {
        labels, branch, worktree, workspaceId, sessionId, model, provider, waiting, syncedAt,
        labelColors, author, assignee, milestone, priority, dueAt, columnAt, createdAt, updatedAt,
        cron, nextRunAt, lastRunAt, progressDump, permission, permissionConfirmedAt, runs,
-       checklist, report, comments, rejectReason, rejectedAt, reasoningEffort, parentId, isEpic)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`),
+       checklist, report, comments, rejectReason, rejectedAt, reasoningEffort, parentId, isEpic,
+       workflowRunId, workflowStatus)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`),
     boardById: db.prepare('SELECT * FROM boards WHERE id = ?'),
     insertBoard: db.prepare('INSERT INTO boards (id, title, kind, position, createdAt) VALUES (?, ?, ?, ?, ?)'),
     lastBoard: db.prepare('SELECT position FROM boards ORDER BY position DESC LIMIT 1'),
@@ -309,7 +353,8 @@ export function openStore({ dir }) {
 
     backupDatabase() {
       const backupsDir = join(dir, 'backups')
-      mkdirSync(backupsDir, { recursive: true })
+      mkdirSync(backupsDir, { recursive: true, mode: 0o700 })
+      try { chmodSync(backupsDir, 0o700) } catch { /* ignore */ }
       const stamp = new Date().toISOString().replace(/[:.]/g, '-')
       const backupName = `kanban-backup-${stamp}.db`
       const dest = join(backupsDir, backupName)
@@ -317,6 +362,7 @@ export function openStore({ dir }) {
         db.exec('PRAGMA wal_checkpoint(TRUNCATE)')
       } catch { /* wal checkpoint may not be strictly required */ }
       copyFileSync(join(dir, 'kanban.db'), dest)
+      try { chmodSync(dest, 0o600) } catch { /* ignore */ }
 
       // Ротация: сохраняем только последние 10 бэкапов
       try {
@@ -432,6 +478,8 @@ export function openStore({ dir }) {
         typeof input.reasoningEffort === 'string' ? input.reasoningEffort : '',
         input.parentId ?? '',
         input.isEpic ? 1 : 0,
+        input.workflowRunId ?? '',
+        input.workflowStatus ?? '',
       )
       return rowToTask(q.taskById.get(id))
     },
@@ -661,8 +709,14 @@ export function openStore({ dir }) {
       }
     },
 
+    securePermissions() {
+      secureStorePermissions(dir)
+    },
+
     close() {
+      try { secureStorePermissions(dir) } catch { /* ignore */ }
       db.close()
+      try { secureStorePermissions(dir) } catch { /* ignore */ }
     },
   }
 }

package/lib/workflow-bridge.js

@@ -0,0 +1,566 @@
+// Мост между карточками Kanban и встроенным в ядро DSH workflowEngine.
+//
+// Выполняет перенос логики из dsh-agent-orchestrator/lib/integrations/kanban-bridge.js:
+// 1. Сопоставление карточка ↔ роль (по меткам и колонкам).
+// 2. Выбор пресета агента с проверкой доступности через ctx.agentPresets.list()
+//    и фоллбэком на пресет по умолчанию.
+// 3. Формирование сценария и запуск через ctx.workflowEngine.start().
+// 4. Отслеживание жизненного цикла workflow/* (agent-start, agent-end, end):
+//    - running -> review/done/failed;
+//    - фиксация runId и сессии в задаче;
+//    - отправка summary в связанный issue Gitea / GitHub.
+// 5. Отмена активного workflow по запросу из карточки.
+
+import { buildStartMessage, obtainAgent } from './launcher.js'
+import { applyMove } from './routes.js'
+
+export const DEFAULT_COLUMN_ROLES = {
+  backlog: 'spec',
+  ready: 'spec',
+  progress: 'backend',
+  review: 'qa_tests',
+  done: 'docs',
+}
+
+export const LABEL_ROLE_PATTERNS = [
+  { role: 'spec', patterns: ['spec', 'specification', 'requirements', 'requirements-analysis', 'анализ', 'тз'] },
+  { role: 'architecture', patterns: ['architecture', 'архитектура', 'contract'] },
+  { role: 'ui_design', patterns: ['ui', 'ui_design', 'design', 'ux', 'дизайн'] },
+  { role: 'frontend', patterns: ['frontend', 'web', 'client', 'ui-impl', 'фронтенд'] },
+  { role: 'backend', patterns: ['backend', 'api', 'server', 'бэкенд'] },
+  { role: 'fullstack', patterns: ['fullstack', 'full-stack', 'e2e'] },
+  { role: 'qa_tests', patterns: ['qa', 'qa_tests', 'test', 'tests', 'testing', 'verification', 'тест', 'тесты'] },
+  { role: 'bugfix', patterns: ['bug', 'bugfix', 'fix', 'баг', 'фикс'] },
+  { role: 'docs', patterns: ['docs', 'doc', 'documentation', 'документация'] },
+  { role: 'refactoring', patterns: ['refactor', 'refactoring', 'рефакторинг'] },
+  { role: 'research', patterns: ['research', 'spike', 'исследование'] },
+  { role: 'devops', patterns: ['devops', 'infra', 'ci', 'cd', 'deploy', 'деплой'] },
+]
+
+/**
+ * Определить роль для задачи по меткам, колонке или явному полю role.
+ *
+ * @param {object} task Задача доски
+ * @returns {string} Идентификатор роли
+ */
+export function resolveRole(task) {
+  if (!task) return 'backend'
+
+  if (typeof task.role === 'string' && task.role.trim() !== '') {
+    return task.role.trim()
+  }
+
+  let labels = []
+  if (Array.isArray(task.labels)) {
+    labels = task.labels
+  } else if (typeof task.labels === 'string') {
+    try {
+      const parsed = JSON.parse(task.labels)
+      if (Array.isArray(parsed)) labels = parsed
+    } catch {
+      labels = task.labels.split(',').map((s) => s.trim()).filter(Boolean)
+    }
+  }
+
+  for (const label of labels) {
+    const l = String(label).toLowerCase()
+    for (const item of LABEL_ROLE_PATTERNS) {
+      if (item.patterns.some((p) => l === p || l.includes(p))) {
+        return item.role
+      }
+    }
+  }
+
+  const col = String(task.col || task.column || '').toLowerCase()
+  if (col && DEFAULT_COLUMN_ROLES[col]) {
+    return DEFAULT_COLUMN_ROLES[col]
+  }
+
+  return 'backend'
+}
+
+/**
+ * Подобрать пресет агента из доступных.
+ * Если роль найдена в списке доступных пресетов — возвращает её.
+ * Иначе выполняет безопасную деградацию на defaultPreset или undefined.
+ *
+ * @param {object} params
+ * @param {string} params.role Имя роли
+ * @param {Array<object|string>} [params.availablePresets] Список пресетов
+ * @param {string} [params.defaultPreset] Пресет по умолчанию
+ * @returns {string|undefined}
+ */
+export function resolvePreset({ role, availablePresets = [], defaultPreset = undefined }) {
+  if (!role) return defaultPreset
+
+  const presetIds = new Set(
+    (Array.isArray(availablePresets) ? availablePresets : []).map((p) =>
+      typeof p === 'string' ? p : p?.id
+    ).filter(Boolean)
+  )
+
+  if (presetIds.has(role)) {
+    return role
+  }
+
+  if (defaultPreset && presetIds.has(defaultPreset)) {
+    return defaultPreset
+  }
+
+  return undefined
+}
+
+/**
+ * Построить JavaScript сценарий для ctx.workflowEngine.start().
+ *
+ * @param {object} params
+ * @param {object} params.task
+ * @param {string} params.role
+ * @returns {string}
+ */
+export function buildWorkflowScript({ task, role }) {
+  const taskId = String(task?.id || 'unknown').replace(/["\\]/g, '')
+  const safeRole = String(role || 'backend').replace(/["\\]/g, '')
+  const issueNum = task?.issueNumber ? `#${task.issueNumber}` : taskId
+
+  return [
+    `phase("${safeRole}");`,
+    `log("Запуск этапа ${safeRole} по карточке ${issueNum}");`,
+    `const prompt = args.prompt;`,
+    `const result = await agent(prompt, { label: "${safeRole}", phase: "${safeRole}" });`,
+    `return {`,
+    `  role: "${safeRole}",`,
+    `  taskId: "${taskId}",`,
+    `  summary: typeof result === 'string' ? result : (result ? JSON.stringify(result) : '')`,
+    `};`,
+  ].join('\n')
+}
+
+/**
+ * Сформировать метаданные сценария workflow.
+ *
+ * @param {object} params
+ * @param {object} params.task
+ * @param {string} params.role
+ * @returns {object}
+ */
+export function buildWorkflowMeta({ task, role }) {
+  const shortId = String(task?.id || 'run').slice(0, 8)
+  const title = String(task?.title || 'task').slice(0, 60)
+  const safeRole = String(role || 'backend')
+
+  return {
+    name: `kanban-${shortId}`,
+    description: `Workflow run for task #${task?.issueNumber || shortId} (${safeRole}): ${title}`,
+    phases: [
+      { title: safeRole, detail: `Execute ${safeRole} role for task` },
+    ],
+  }
+}
+
+/**
+ * Определить целевую колонку после успешного завершения этапа workflow.
+ *
+ * @param {string} currentCol
+ * @returns {string}
+ */
+export function resolveTargetColumn(currentCol) {
+  const col = String(currentCol || '').toLowerCase()
+  if (col === 'backlog' || col === 'ready' || col === 'progress') {
+    return 'review'
+  }
+  if (col === 'review') {
+    return 'done'
+  }
+  return col || 'review'
+}
+
+/**
+ * Класс-мост между доской и встроенным сервисом workflow ядра DSH.
+ */
+export class WorkflowBridge {
+  constructor({
+    store,
+    workflowEngine,
+    agentPresets,
+    agents,
+    git,
+    getConfig = () => ({}),
+    logger,
+    eventHub,
+  } = {}) {
+    this.store = store
+    this.workflowEngine = workflowEngine
+    this.agentPresets = agentPresets
+    this.agents = agents
+    this.git = git
+    this.getConfig = getConfig
+    this.logger = logger
+    this.eventHub = eventHub
+
+    // taskId -> { run, runId, taskId, role, preset, parentAgent, task }
+    this.activeRuns = new Map()
+    // runId -> taskId
+    this.runToTask = new Map()
+  }
+
+  /**
+   * Список зарегистрированных пресетов ядра.
+   */
+  async getAvailablePresets() {
+    if (!this.agentPresets || typeof this.agentPresets.list !== 'function') {
+      return []
+    }
+    try {
+      return await this.agentPresets.list()
+    } catch (err) {
+      this.logger?.warn?.(`dsh-kanban: не удалось получить список пресетов: ${err.message}`)
+      return []
+    }
+  }
+
+  /**
+   * Запуск workflow по карточке.
+   */
+  async startTaskWorkflow({
+    task,
+    role: explicitRole,
+    provider,
+    model,
+    mintSessionId,
+    gitRunner,
+    workspaceRegistry,
+    claimAs,
+    permission,
+    permissions,
+    cwdOf,
+    text,
+  }) {
+    if (!task || !task.id) throw new Error('task is required')
+
+    if (!this.workflowEngine || typeof this.workflowEngine.start !== 'function') {
+      const err = new Error('workflow engine is not available in core')
+      err.key = 'workflow-engine-unavailable'
+      err.status = 503
+      throw err
+    }
+
+    if (this.activeRuns.has(task.id)) {
+      const existing = this.activeRuns.get(task.id)
+      return {
+        mode: 'workflow',
+        alreadyRunning: true,
+        runId: existing.runId,
+        taskId: task.id,
+        role: existing.role,
+      }
+    }
+
+    const role = explicitRole || resolveRole(task)
+    const availablePresets = await this.getAvailablePresets()
+    const preset = resolvePreset({
+      role,
+      availablePresets,
+      defaultPreset: this.getConfig()?.defaultAgentPreset || undefined,
+    })
+
+    const config = this.getConfig()
+    const taken = await obtainAgent({
+      agents: this.agents,
+      task,
+      config,
+      provider,
+      model,
+      mintSessionId,
+      cwdOf,
+      logger: this.logger,
+      agentPreset: preset,
+      permission,
+      permissions,
+      gitRunner,
+      workspaceRegistry,
+    })
+
+    const promptText = typeof text === 'string' && text.trim() !== ''
+      ? text.trim()
+      : buildStartMessage(task, config)
+
+    const script = buildWorkflowScript({ task, role })
+    const meta = buildWorkflowMeta({ task, role })
+
+    let run
+    try {
+      run = this.workflowEngine.start({
+        script,
+        meta,
+        args: { prompt: promptText },
+        parent: taken.agent,
+      })
+    } catch (err) {
+      this.logger?.warn?.(`dsh-kanban: workflowEngine.start failed: ${err.message}`)
+      throw err
+    }
+
+    const runId = String(run.id)
+    const entry = {
+      run,
+      runId,
+      taskId: task.id,
+      role,
+      preset,
+      parentAgent: taken.agent,
+      task,
+      startTime: Date.now(),
+    }
+
+    this.activeRuns.set(task.id, entry)
+    this.runToTask.set(runId, task.id)
+
+    // Обновляем карточку в базе данных
+    this.store.updateTask(task.id, {
+      workflowRunId: runId,
+      workflowStatus: 'running',
+      sessionId: taken.sessionId,
+      provider,
+      model,
+      ...(permission ? { permission } : {}),
+      ...(taken.worktree ? { worktree: taken.worktree } : {}),
+      ...(taken.branch ? { branch: taken.branch } : {}),
+      ...(taken.workspaceId ? { workspaceId: taken.workspaceId } : {}),
+    })
+
+    this.store.addTransition({
+      taskId: task.id,
+      fromCol: task.col || task.column,
+      toCol: task.col || task.column,
+      source: 'workflow',
+      detail: `запуск workflow ${runId} (роль: ${role}, пресет: ${preset || 'default'})`,
+    })
+
+    this.eventHub?.broadcast?.('task:change', {
+      taskId: task.id,
+      action: 'workflow-started',
+      runId,
+      role,
+      preset,
+      sessionId: taken.sessionId,
+    })
+
+    // Асинхронное ожидание завершения run
+    run.result.then(async (result) => {
+      await this.handleWorkflowResult(task.id, runId, role, result)
+    }).catch(async (err) => {
+      this.logger?.warn?.(`dsh-kanban: workflow run ${runId} rejected: ${err?.message}`)
+      await this.handleWorkflowResult(task.id, runId, role, {
+        stopReason: 'error',
+        error: err?.message || 'unknown error',
+      })
+    })
+
+    return {
+      mode: 'workflow',
+      started: true,
+      runId,
+      taskId: task.id,
+      role,
+      preset: preset || 'default',
+      sessionId: taken.sessionId,
+    }
+  }
+
+  /**
+   * Отмена запущенного workflow.
+   */
+  async cancelTaskWorkflow(taskId, reason = 'cancelled-by-user') {
+    if (!taskId) return { cancelled: false, error: 'task-id-required' }
+
+    const entry = this.activeRuns.get(taskId)
+    if (!entry) {
+      // Возможно, статус в БД ещё числится running
+      const task = this.store.getTask(taskId)
+      if (task?.workflowStatus === 'running') {
+        this.store.updateTask(taskId, { workflowStatus: 'cancelled' })
+        return { cancelled: true, note: 'marked-cancelled-in-store' }
+      }
+      return { cancelled: false, error: 'no-active-workflow' }
+    }
+
+    try {
+      entry.run.cancel(reason)
+    } catch (err) {
+      this.logger?.warn?.(`dsh-kanban: error canceling workflow run ${entry.runId}: ${err.message}`)
+    }
+
+    this.store.updateTask(taskId, { workflowStatus: 'cancelled' })
+    this.store.addTransition({
+      taskId,
+      fromCol: entry.task?.col || entry.task?.column || 'progress',
+      toCol: entry.task?.col || entry.task?.column || 'progress',
+      source: 'workflow',
+      detail: `отмена workflow ${entry.runId}: ${reason}`,
+    })
+
+    this.eventHub?.broadcast?.('task:change', {
+      taskId,
+      action: 'workflow-cancelled',
+      runId: entry.runId,
+      reason,
+    })
+
+    return { cancelled: true, runId: entry.runId }
+  }
+
+  /**
+   * Обработка завершения выполнения workflow.
+   */
+  async handleWorkflowResult(taskId, runId, role, result) {
+    const entry = this.activeRuns.get(taskId)
+    const task = this.store.getTask(taskId) || entry?.task
+
+    this.activeRuns.delete(taskId)
+    this.runToTask.delete(runId)
+
+    if (!task) return
+
+    const stopReason = result?.stopReason || 'error'
+    const isCompleted = stopReason === 'completed'
+    const summary = typeof result?.value?.summary === 'string'
+      ? result.value.summary
+      : (result?.error || '')
+
+    const newStatus = isCompleted ? 'completed' : (stopReason === 'cancelled' ? 'cancelled' : 'failed')
+    this.store.updateTask(taskId, {
+      workflowStatus: newStatus,
+    })
+
+    if (isCompleted) {
+      const targetCol = resolveTargetColumn(task.col || task.column)
+      if (targetCol !== (task.col || task.column)) {
+        applyMove({
+          store: this.store,
+          config: this.getConfig(),
+          id: taskId,
+          column: targetCol,
+          source: 'workflow',
+          detail: `workflow ${runId} завершён успешно (роль: ${role})`,
+        })
+      }
+
+      // Отправляем комментарий в связанный issue Gitea / GitHub
+      if (this.git && task.repo && task.issueNumber) {
+        const commentBody = [
+          `🚀 **Workflow завершён успешно!** (роль: \`${role}\`)`,
+          summary ? `\n${summary}` : '',
+          `\n*Статус карточки переведён в колонку "${targetCol}".*`,
+        ].filter(Boolean).join('\n')
+
+        try {
+          await this.git.comment({
+            owner: task.owner,
+            repo: task.repo,
+            index: task.issueNumber,
+            body: commentBody,
+            provider: task.provider,
+          })
+        } catch (err) {
+          this.logger?.warn?.(`dsh-kanban: не удалось отправить комментарий в issue ${task.repo}#${task.issueNumber}: ${err.message}`)
+        }
+      }
+
+      // Добавляем комментарий в карточку
+      if (typeof this.store.addTaskComment === 'function' && summary) {
+        this.store.addTaskComment(taskId, {
+          author: 'workflow',
+          body: `🚀 **Workflow завершён (${role}):**\n\n${summary}`,
+        })
+      }
+    } else {
+      this.store.addTransition({
+        taskId,
+        fromCol: task.col || task.column,
+        toCol: task.col || task.column,
+        source: 'workflow',
+        detail: `workflow ${runId} завершён со статусом ${stopReason}: ${result?.error || ''}`,
+      })
+    }
+
+    if (entry?.run && typeof entry.run.dispose === 'function') {
+      try {
+        await entry.run.dispose()
+      } catch (err) {
+        this.logger?.warn?.(`dsh-kanban: ошибка при dispose workflow run ${runId}: ${err.message}`)
+      }
+    }
+
+    this.eventHub?.broadcast?.('task:change', {
+      taskId,
+      action: 'workflow-ended',
+      runId,
+      role,
+      status: newStatus,
+      stopReason,
+    })
+  }
+
+  /**
+   * Подключить слушатели событий ядра workflow/*.
+   *
+   * @param {object} ctx Cordis context
+   */
+  bindCoreEvents(ctx) {
+    if (!ctx || typeof ctx.on !== 'function') return () => {}
+
+    const unbind = [
+      ctx.on('workflow/agent-start', (runInfo, agentInfo) => {
+        const runId = String(runInfo?.id || '')
+        const taskId = this.runToTask.get(runId)
+        if (!taskId) return
+
+        if (agentInfo?.childId) {
+          this.store.updateTask(taskId, { sessionId: String(agentInfo.childId) })
+          this.eventHub?.broadcast?.('task:change', {
+            taskId,
+            action: 'workflow-agent-start',
+            runId,
+            sessionId: String(agentInfo.childId),
+            label: agentInfo.label,
+          })
+        }
+      }),
+
+      ctx.on('workflow/agent-end', (runInfo, endInfo) => {
+        const runId = String(runInfo?.id || '')
+        const taskId = this.runToTask.get(runId)
+        if (!taskId) return
+
+        this.eventHub?.broadcast?.('task:change', {
+          taskId,
+          action: 'workflow-agent-end',
+          runId,
+          outcome: endInfo?.outcome,
+        })
+      }),
+
+      ctx.on('workflow/end', (runInfo, resultInfo) => {
+        const runId = String(runInfo?.id || '')
+        const taskId = this.runToTask.get(runId)
+        if (!taskId) return
+
+        // handleWorkflowResult также вызывается через run.result.then,
+        // но событие workflow/end гарантирует синхронизацию наблюдателей
+        this.eventHub?.broadcast?.('task:change', {
+          taskId,
+          action: 'workflow-core-end',
+          runId,
+          stopReason: resultInfo?.stopReason,
+        })
+      }),
+    ]
+
+    return () => {
+      for (const fn of unbind) {
+        if (typeof fn === 'function') fn()
+      }
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-kanban",
-  "version": "0.2.15",
+  "version": "0.2.17",
   "description": "Visual Kanban board for DeepSeek Harness: Gitea and GitHub-backed tasks, workflow columns, and a dedicated agent session per task.",
   "type": "module",
   "main": "lib/index.js",