@goodandready/dsh-kanban 0.2.2 → 0.2.8

package/lib/power.js

@@ -134,7 +134,7 @@ export class PowerInhibitor {
           this.child.stdin.end()
         }
         this.child.kill()
-      } catch {}
+      } catch { /* process kill best-effort */ }
       this.child = null
     }
     this.phase = 'disabled'

package/lib/progress-dump.js

@@ -1,9 +1,9 @@
 // dsh-kanban: фиксация и безопасная передача среза прогресса задачи (PROGRESSDUMP).
 // Парсит блок <<<PROGRESSDUMP ... >>>PROGRESSDUMP, маскирует секреты и генерирует вводный бриф.
 
-export const BEGIN_MARKER = '<<<PROGRESSDUMP'
-export const END_MARKER = '>>>PROGRESSDUMP'
-export const FIELD_BYTE_LIMIT = 8 * 1024
+const BEGIN_MARKER = '<<<PROGRESSDUMP'
+const END_MARKER = '>>>PROGRESSDUMP'
+const FIELD_BYTE_LIMIT = 8 * 1024
 export const REDACTED = '[REDACTED]'
 
 const SENSITIVE_PATTERNS = [

package/lib/routes.js

@@ -19,12 +19,54 @@ import { computeNextRun } from './cron.js'
 /** Больше этого тело запроса не читаем: без предела один запрос кладёт хост. */
 export const MAX_BODY_BYTES = 256 * 1024
 
+function isLoopbackAddress(addr) {
+  if (!addr) return true
+  return addr === '127.0.0.1' ||
+    addr === '::1' ||
+    addr === '::ffff:127.0.0.1' ||
+    addr === 'localhost'
+}
+
 /**
  * Запрос с чужого сайта. Изменяющие маршруты правят локальное состояние, и
- * пускать в них кросс-сайтовый запрос нельзя.
+ * пускать в них кросс-сайтовый запрос нельзя (#261).
+ * Защита требует:
+ * 1. Наличие безопасного sec-fetch-site ('same-origin', 'same-site', 'none').
+ * 2. Совпадение origin и host (если origin передан).
+ * 3. Loopback-источник (remoteAddress: 127.0.0.1, ::1, ::ffff:127.0.0.1).
  */
 export function isTrustedRequest(req) {
-  return req?.headers?.['sec-fetch-site'] !== 'cross-site'
+  if (!req || !req.headers) return false
+
+  // 1. Проверка sec-fetch-site (отсутствие или cross-site запрещены)
+  const site = req.headers['sec-fetch-site']
+  if (!site || site === 'cross-site') {
+    return false
+  }
+  if (site !== 'same-origin' && site !== 'same-site' && site !== 'none') {
+    return false
+  }
+
+  // 2. Сверка origin с host
+  const origin = req.headers.origin
+  if (origin !== undefined) {
+    if (origin === 'null') return false
+    try {
+      const parsed = new URL(origin)
+      const host = req.headers.host || ''
+      if (parsed.host && parsed.host !== host) return false
+    } catch {
+      return false
+    }
+  }
+
+  // 3. Проверка loopback remoteAddress
+  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress
+  if (remote && !isLoopbackAddress(remote)) {
+    return false
+  }
+
+  return true
 }
 
 /** Разобрать `/dsh-kanban/task/<id>[/<action>]`; иначе undefined. */
@@ -115,7 +157,13 @@ export function buildBoard({ store, config, board = 'main', repo, liveOf, sync,
     bySession.get(id).push(task)
   }
   const tasks = orderForBoard(
-    raw.map((task) => withPlan(task, liveOf, config, now, bySession.get(task.sessionId) ?? [])),
+    raw.map((task) => {
+      const enriched = withPlan(task, liveOf, config, now, bySession.get(task.sessionId) ?? [])
+      if (task.isEpic) {
+        enriched.subtasksCount = store.countSubtasks(task.id)
+      }
+      return enriched
+    }),
     columnsOf(store.boardKind(board)),
   )
   const kind = store.boardKind(board)
@@ -226,7 +274,7 @@ export function confirmPermission({ store, id }) {
 }
 
 /** Известные приоритеты. Пустой — «без приоритета». */
-export const PRIORITIES = ['', 'high', 'medium', 'low']
+const PRIORITIES = ['', 'high', 'medium', 'low']
 
 /**
  * Дописать заметку в тело задачи.
@@ -386,7 +434,7 @@ export function importBoard({ store, input }) {
   if (typeof store.backupDatabase === 'function') {
     try {
       backupMeta = store.backupDatabase()
-    } catch {}
+    } catch { /* backup best effort */ }
   }
   if (input === null || typeof input !== 'object') return { error: 'bad-import', status: 400 }
   if (input.version !== 1) return { error: 'bad-import-version', status: 400 }
@@ -495,3 +543,353 @@ export function exportTasksCsv({ store, board = 'main' }) {
   // Префикс UTF-8 BOM для Microsoft Excel
   return '\uFEFF' + rows.join('\r\n')
 }
+
+
+/**
+ * Очистить воркдерево задачи.
+ */
+export async function handleCleanupWorktree({ store, task, workspaceRegistry, force, cleanupTaskWorktree }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const out = await cleanupTaskWorktree({
+    store,
+    task,
+    workspaceRegistry,
+    force: force === true,
+  })
+  return { status: 200, body: out }
+}
+
+/**
+ * Получить diff рабочей копии задачи.
+ */
+export async function handleTaskDiff({ task, getTaskDiff }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const diffResult = await getTaskDiff({ worktreePath: task.worktree })
+  return { status: 200, body: diffResult }
+}
+
+/**
+ * Получить список коммитов задачи.
+ */
+export async function handleTaskCommits({ task, getTaskCommits }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const commits = await getTaskCommits({ worktreePath: task.worktree })
+  return { status: 200, body: { commits } }
+}
+
+/**
+ * Слить воркдерево задачи и перевести в done.
+ */
+export async function handleTaskMerge({ store, task, targetBranch, workspaceRegistry, mergeTaskWorktree }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const mergeResult = await mergeTaskWorktree({
+    task,
+    targetBranch: typeof targetBranch === 'string' ? targetBranch.trim() : undefined,
+    workspaceRegistry,
+  })
+  if (!mergeResult.success) {
+    return {
+      status: 400,
+      body: { error: mergeResult.error, detail: mergeResult.detail, files: mergeResult.files },
+    }
+  }
+  const updated = store.acceptTask(task.id)
+  store.addTransition({
+    taskId: task.id,
+    fromCol: task.column,
+    toCol: 'done',
+    source: 'manual',
+    detail: `принята и смержена ветка ${task.branch} в ${mergeResult.targetBranch}`,
+  })
+  return { status: 200, body: { task: updated, merged: true, targetBranch: mergeResult.targetBranch } }
+}
+
+/**
+ * Проверить статус воркдерева задачи (ветка, dirty, воркспейс).
+ */
+export async function handleTaskWorktreeStatus({ task, checkWorktreeDirty }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const dirtyCheck = await checkWorktreeDirty({ worktreePath: task.worktree })
+  return {
+    status: 200,
+    body: {
+      worktree: task.worktree || '',
+      branch: task.branch || '',
+      workspaceId: task.workspaceId || '',
+      dirty: dirtyCheck.dirty,
+      files: dirtyCheck.files,
+    },
+  }
+}
+
+/**
+ * Обновить DoD чеклист задачи.
+ */
+export function handleTaskChecklist({ store, task, input }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const list = Array.isArray(input?.checklist) ? input.checklist : Array.isArray(input) ? input : []
+  const updated = store.updateChecklist(task.id, list)
+  return { status: 200, body: { task: updated } }
+}
+
+/**
+ * Установить отчёт выполнения задачи.
+ */
+export function handleTaskReport({ store, task, input }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const updated = store.setReport(task.id, input)
+  return { status: 200, body: { task: updated } }
+}
+
+/**
+ * Получить комментарии задачи.
+ */
+export function handleGetTaskComments({ task }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  return { status: 200, body: { comments: task.comments || [] } }
+}
+
+/**
+ * Добавить комментарий к задаче.
+ */
+export function handleAddTaskComment({ store, task, input }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const author = input?.author || 'user'
+  const role = input?.role || 'user'
+  const text = input?.text || ''
+  const updated = store.addComment(task.id, { author, role, text })
+  return { status: 200, body: { task: updated } }
+}
+
+/**
+ * Принять задачу на ревью (перевод в done).
+ */
+export function handleAcceptTask({ store, task }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const updated = store.acceptTask(task.id)
+  return { status: 200, body: { task: updated } }
+}
+
+/**
+ * Отклонить задачу на ревью (перевод обратно в in_progress).
+ */
+export function handleRejectTask({ store, task, input }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const reason = String(input?.reason || '').trim()
+  if (!reason) return { status: 400, body: { error: 'reason-required' } }
+  const updated = store.rejectTask(task.id, reason)
+  return { status: 200, body: { task: updated } }
+}
+
+/**
+ * Сохранить дамп прогресса задачи.
+ */
+export function handleProgressDump({ store, task, input, formatProgressDump }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const formatted = typeof input === 'string' ? input : formatProgressDump(input)
+  const updated = store.updateTask(task.id, { progressDump: formatted })
+  return { status: 200, body: { task: updated } }
+}
+
+/**
+ * Decompose a task into subtasks and make the parent an Epic.
+ */
+export async function handleTriageTask({ store, gitea, task, input }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const subtasksInput = Array.isArray(input?.subtasks) ? input.subtasks : []
+  if (subtasksInput.length === 0) {
+    return { status: 400, body: { error: 'subtasks-required' } }
+  }
+  const createGitea = input?.createGiteaIssues === true && Boolean(task.owner && task.repo && gitea)
+
+  // Convert parent into Epic
+  store.updateTask(task.id, { isEpic: true })
+
+  const created = []
+  for (const item of subtasksInput) {
+    const title = String(item?.title ?? '').trim()
+    if (!title) continue
+    const body = String(item?.body ?? '').trim()
+    let issueNumber = null
+    let issueUrl = null
+
+    if (createGitea) {
+      try {
+        const issueBody = body ? `${body}\n\nParent epic: #${task.issueNumber || task.id}` : `Parent epic: #${task.issueNumber || task.id}`
+        const giteaIssue = await gitea.createIssue({
+          owner: task.owner,
+          repo: task.repo,
+          title,
+          body: issueBody,
+        })
+        if (giteaIssue?.number) {
+          issueNumber = giteaIssue.number
+          issueUrl = giteaIssue.html_url || null
+        }
+      } catch { /* ignore gitea subtask creation failure */ }
+    }
+
+    const sub = store.createTask({
+      board: task.board || 'main',
+      column: 'backlog',
+      title,
+      body,
+      parentId: task.id,
+      owner: task.owner || null,
+      repo: task.repo || null,
+      issueNumber,
+      issueUrl,
+      labels: Array.isArray(item?.labels) ? item.labels : [],
+      workspaceId: task.workspaceId || '',
+    })
+    created.push(sub)
+  }
+
+  store.addTransition({
+    taskId: task.id,
+    fromCol: task.column,
+    toCol: task.column,
+    source: 'manual',
+    detail: `decomposed into ${created.length} subtasks (epic triage)`,
+  })
+
+  return {
+    status: 200,
+    body: {
+      epic: store.getTask(task.id),
+      subtasks: store.listSubtasks(task.id),
+      counts: store.countSubtasks(task.id),
+      createdCount: created.length,
+    },
+  }
+}
+
+/**
+ * Get subtasks of a task.
+ */
+export function handleGetSubtasks({ store, task }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  return {
+    status: 200,
+    body: {
+      subtasks: store.listSubtasks(task.id),
+      counts: store.countSubtasks(task.id),
+    },
+  }
+}
+
+/**
+ * Create a single subtask linked to a parent task.
+ */
+export async function handleCreateSubtask({ store, gitea, task, input }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const title = String(input?.title ?? '').trim()
+  if (!title) return { status: 400, body: { error: 'title-required' } }
+  const body = String(input?.body ?? '').trim()
+  let issueNumber = null
+  let issueUrl = null
+
+  if (input?.createGiteaIssue === true && task.owner && task.repo && gitea) {
+    try {
+      const issueBody = body ? `${body}\n\nParent epic: #${task.issueNumber || task.id}` : `Parent epic: #${task.issueNumber || task.id}`
+      const giteaIssue = await gitea.createIssue({
+        owner: task.owner,
+        repo: task.repo,
+        title,
+        body: issueBody,
+      })
+      if (giteaIssue?.number) {
+        issueNumber = giteaIssue.number
+        issueUrl = giteaIssue.html_url || null
+      }
+    } catch { /* ignore gitea subtask creation failure */ }
+  }
+
+  store.updateTask(task.id, { isEpic: true })
+  const sub = store.createTask({
+    board: task.board || 'main',
+    column: input?.column || 'backlog',
+    title,
+    body,
+    parentId: task.id,
+    owner: task.owner || null,
+    repo: task.repo || null,
+    issueNumber,
+    issueUrl,
+    labels: Array.isArray(input?.labels) ? input.labels : [],
+    workspaceId: task.workspaceId || '',
+  })
+  return { status: 200, body: { subtask: sub, counts: store.countSubtasks(task.id) } }
+}
+
+/**
+ * Toggle a checklist item atomically by index or text.
+ */
+export function handleToggleChecklistItem({ store, task, input }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const current = Array.isArray(task.checklist) ? [...task.checklist] : []
+  let targetIndex = -1
+
+  if (typeof input?.index === 'number' && input.index >= 0 && input.index < current.length) {
+    targetIndex = input.index
+  } else if (typeof input?.text === 'string' && input.text.trim()) {
+    const q = input.text.trim().toLowerCase()
+    targetIndex = current.findIndex((item) => {
+      const t = typeof item === 'string' ? item : item?.text
+      return typeof t === 'string' && t.toLowerCase().includes(q)
+    })
+  }
+
+  if (targetIndex === -1) {
+    return { status: 404, body: { error: 'checklist-item-not-found' } }
+  }
+
+  const item = current[targetIndex]
+  let updatedItem
+  if (typeof item === 'string') {
+    const checked = input?.checked !== undefined ? Boolean(input.checked) : true
+    updatedItem = { text: item, done: checked }
+  } else {
+    const checked = input?.checked !== undefined ? Boolean(input.checked) : !item.done
+    updatedItem = { ...item, done: checked }
+  }
+  current[targetIndex] = updatedItem
+  const updated = store.updateChecklist(task.id, current)
+  return { status: 200, body: { task: updated, item: updatedItem, index: targetIndex } }
+}
+
+/**
+ * Create a Gitea Pull Request for a task.
+ */
+export async function handleCreateTaskPr({ store, gitea, task, input }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  if (!task.owner || !task.repo) {
+    return { status: 400, body: { error: 'task-no-repo' } }
+  }
+  const head = String(input?.head || task.branch || '').trim()
+  if (!head) return { status: 400, body: { error: 'branch-required' } }
+  const base = String(input?.base || 'main').trim()
+  const title = String(input?.title || task.title || `PR: ${task.title}`).trim()
+  const body = String(input?.body || (task.issueNumber ? `Closes #${task.issueNumber}` : '')).trim()
+
+  try {
+    const pr = await gitea.createPullRequest({
+      owner: task.owner,
+      repo: task.repo,
+      title,
+      body,
+      head,
+      base,
+    })
+    store.addTransition({
+      taskId: task.id,
+      fromCol: task.column,
+      toCol: task.column,
+      source: 'manual',
+      detail: `Created PR #${pr?.number || ''}: ${head} -> ${base}`,
+    })
+    return { status: 200, body: { pr, prUrl: pr?.html_url } }
+  } catch (err) {
+    return { status: 502, body: { error: 'gitea-pr-failed', detail: err?.message } }
+  }
+}

package/lib/store.js

@@ -37,6 +37,7 @@ CREATE TABLE IF NOT EXISTS tasks (
   repo         TEXT,
   issueNumber  INTEGER,
   issueUrl     TEXT,
+  externalRef  TEXT,
   labels       TEXT NOT NULL DEFAULT '[]',
   branch       TEXT,
   worktree     TEXT,
@@ -70,6 +71,8 @@ CREATE TABLE IF NOT EXISTS tasks (
   comments              TEXT NOT NULL DEFAULT '[]',
   rejectReason          TEXT NOT NULL DEFAULT '',
   rejectedAt            INTEGER NOT NULL DEFAULT 0,
+  parentId              TEXT NOT NULL DEFAULT '',
+  isEpic                INTEGER NOT NULL DEFAULT 0,
   updatedAt    INTEGER NOT NULL
 );
 CREATE INDEX IF NOT EXISTS tasks_board_col ON tasks(board, col, position);
@@ -95,10 +98,11 @@ CREATE TABLE IF NOT EXISTS dismissed (
 
 /** Поля задачи, которые разрешено править через updateTask. */
 const WRITABLE = [
-  'title', 'body', 'owner', 'repo', 'issueNumber', 'issueUrl', 'labels',
+  'title', 'body', 'owner', 'repo', 'issueNumber', 'issueUrl', 'externalRef', 'labels',
   'branch', 'worktree', 'workspaceId', 'sessionId', 'model', 'provider', 'waiting', 'syncedAt', 'plan',
   'labelColors', 'queuedAt', 'createdAt', 'author', 'assignee', 'milestone', 'priority', 'dueAt',
-  'cron', 'nextRunAt', 'lastRunAt', 'progressDump', 'permission', 'reasoningEffort', 'permissionConfirmedAt', 'runs', 'checklist', 'report', 'comments', 'rejectReason', 'rejectedAt',
+  'cron', 'nextRunAt', 'lastRunAt', 'progressDump', 'permission', 'reasoningEffort', 'permissionConfirmedAt',
+  'runs', 'checklist', 'report', 'comments', 'rejectReason', 'rejectedAt', 'parentId', 'isEpic',
 ]
 
 /** Источники перехода; чужое значение не пишем, чтобы журнал оставался читаемым. */
@@ -106,7 +110,7 @@ const SOURCES = new Set(['manual', 'session', 'gitea', 'tool'])
 
 function rowToTask(row) {
   if (row === undefined) return undefined
-  const { col, labels, waiting, labelColors, runs, checklist, report, comments, rejectReason, rejectedAt, ...rest } = row
+  const { col, labels, waiting, labelColors, runs, checklist, report, comments, rejectReason, rejectedAt, isEpic, parentId, ...rest } = row
   let parsedChecklist = []
   try {
     const value = JSON.parse(checklist ?? '[]')
@@ -150,6 +154,8 @@ function rowToTask(row) {
     rejectReason: rejectReason ?? '',
     rejectedAt: Number(rejectedAt) || 0,
     reasoningEffort: rest.reasoningEffort ?? '',
+    isEpic: isEpic === 1,
+    parentId: parentId ?? '',
   }
 }
 
@@ -163,6 +169,8 @@ export function openStore({ dir }) {
   const db = new DatabaseSync(join(dir, 'kanban.db'))
   db.exec('PRAGMA journal_mode = WAL')
   db.exec('PRAGMA foreign_keys = ON')
+  db.exec('PRAGMA busy_timeout = 5000')
+  db.exec('PRAGMA busy_timeout = 5000')
   db.exec(SCHEMA)
   // База могла быть создана прежней версией. Добавляем недостающие столбцы
   // поштучно: ALTER на существующий столбец бросает, и это штатный ответ
@@ -194,6 +202,9 @@ export function openStore({ dir }) {
     ['comments', "TEXT NOT NULL DEFAULT '[]'"],
     ['rejectReason', "TEXT NOT NULL DEFAULT ''"],
     ['rejectedAt', "INTEGER NOT NULL DEFAULT 0"],
+    ['parentId', "TEXT NOT NULL DEFAULT ''"],
+    ['isEpic', "INTEGER NOT NULL DEFAULT 0"],
+    ['externalRef', "TEXT"],
   ]) {
     try { db.exec(`ALTER TABLE tasks ADD COLUMN ${column} ${definition}`) } catch { /* столбец уже есть */ }
   }
@@ -202,6 +213,16 @@ export function openStore({ dir }) {
   // заведения: это честнее нуля, который читался бы как «в 1970 году».
   db.exec('UPDATE tasks SET columnAt = createdAt WHERE columnAt = 0')
 
+  // Индексы для ускорения выборок активных задач, поиска по Gitea issue и cron-задач
+  db.exec('CREATE INDEX IF NOT EXISTS tasks_board_active ON tasks(board, archivedAt, col, position)')
+  db.exec('CREATE INDEX IF NOT EXISTS tasks_gitea_issue ON tasks(owner, repo, issueNumber)')
+  db.exec('CREATE INDEX IF NOT EXISTS tasks_external_ref ON tasks(externalRef)')
+  db.exec('CREATE INDEX IF NOT EXISTS tasks_cron_next ON tasks(archivedAt, nextRunAt)')
+  db.exec('CREATE INDEX IF NOT EXISTS tasks_queued ON tasks(archivedAt, queuedAt)')
+  db.exec('CREATE INDEX IF NOT EXISTS tasks_parent_id ON tasks(parentId)')
+  db.exec('PRAGMA synchronous = NORMAL')
+  try { db.exec('PRAGMA optimize') } catch { /* pragma optimize best-effort */ }
+
   const q = {
     boards: db.prepare('SELECT * FROM boards ORDER BY position'),
     boardById: db.prepare('SELECT * FROM boards WHERE id = ?'),
@@ -217,6 +238,7 @@ export function openStore({ dir }) {
     dismiss: db.prepare('INSERT OR REPLACE INTO dismissed (owner, repo, issueNumber, at) VALUES (?, ?, ?, ?)'),
     isDismissed: db.prepare('SELECT 1 FROM dismissed WHERE owner = ? AND repo = ? AND issueNumber = ?'),
     byIssue: db.prepare('SELECT * FROM tasks WHERE owner = ? AND repo = ? AND issueNumber = ?'),
+    byExternalRef: db.prepare('SELECT * FROM tasks WHERE externalRef = ? ORDER BY createdAt ASC LIMIT 1'),
     tasksBySession: db.prepare('SELECT * FROM tasks WHERE sessionId = ? LIMIT 1'),
     lastInColumn: db.prepare('SELECT position FROM tasks WHERE board = ? AND col = ? ORDER BY position DESC LIMIT 1'),
     deleteTask: db.prepare('DELETE FROM tasks WHERE id = ?'),
@@ -227,6 +249,9 @@ export function openStore({ dir }) {
       "SELECT * FROM tasks WHERE issueNumber IS NOT NULL AND col NOT IN ('done') ORDER BY updatedAt DESC"),
     scheduledDue: db.prepare(
       "SELECT * FROM tasks WHERE cron != '' AND nextRunAt > 0 AND nextRunAt <= ? AND archivedAt = 0 ORDER BY nextRunAt ASC"),
+    subtasksOf: db.prepare('SELECT * FROM tasks WHERE parentId = ? AND archivedAt = 0 ORDER BY createdAt ASC, position ASC'),
+    countSubtasks: db.prepare(
+      "SELECT COUNT(*) AS total, SUM(CASE WHEN col = 'done' THEN 1 ELSE 0 END) AS completed FROM tasks WHERE parentId = ? AND archivedAt = 0"),
   }
 
   function ensureBoard(id, title, kind) {
@@ -279,10 +304,10 @@ export function openStore({ dir }) {
           .sort((a, b) => b.time - a.time)
         if (files.length > 10) {
           for (const old of files.slice(10)) {
-            try { unlinkSync(old.path) } catch {}
+            try { unlinkSync(old.path) } catch { /* unlink old backup best-effort */ }
           }
         }
-      } catch {}
+      } catch { /* backup rotation best-effort */ }
       return { backup: backupName, path: dest }
     },
 
@@ -354,16 +379,16 @@ export function openStore({ dir }) {
       const id = typeof input.id === 'string' && input.id !== '' ? input.id : randomUUID()
       const position = positionFor(board, column, input.beforeId, input.afterId)
       db.prepare(`INSERT INTO tasks
-        (id, board, col, position, title, body, owner, repo, issueNumber, issueUrl,
+        (id, board, col, position, title, body, owner, repo, issueNumber, issueUrl, externalRef,
          labels, branch, worktree, workspaceId, sessionId, model, provider, waiting, syncedAt,
          labelColors, author, assignee, milestone, priority, dueAt, columnAt, createdAt, updatedAt,
          cron, nextRunAt, lastRunAt, progressDump, permission, permissionConfirmedAt, runs,
-         checklist, report, comments, rejectReason, rejectedAt, reasoningEffort)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(
+         checklist, report, comments, rejectReason, rejectedAt, reasoningEffort, parentId, isEpic)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(
         id, board, column, position,
         input.title ?? '', input.body ?? '',
         input.owner ?? null, input.repo ?? null,
-        input.issueNumber ?? null, input.issueUrl ?? null,
+        input.issueNumber ?? null, input.issueUrl ?? null, input.externalRef ?? null,
         JSON.stringify(input.labels ?? []),
         input.branch ?? null, input.worktree ?? null, input.workspaceId ?? '',
         input.sessionId ?? null, input.model ?? null, input.provider ?? null,
@@ -389,6 +414,8 @@ export function openStore({ dir }) {
         input.rejectReason ?? '',
         Number(input.rejectedAt) || 0,
         typeof input.reasoningEffort === 'string' ? input.reasoningEffort : '',
+        input.parentId ?? '',
+        input.isEpic ? 1 : 0,
       )
       return rowToTask(q.taskById.get(id))
     },
@@ -411,6 +438,8 @@ export function openStore({ dir }) {
         else if (key === 'rejectReason') values.push(String(patch[key] ?? ''))
         else if (key === 'waiting') values.push(patch[key] ? 1 : 0)
         else if (key === 'syncedAt') values.push(Number(patch[key]) || 0)
+        else if (key === 'isEpic') values.push(patch[key] ? 1 : 0)
+        else if (key === 'parentId') values.push(String(patch[key] ?? ''))
         else values.push(patch[key] ?? null)
       }
       if (fields.length > 0) {
@@ -546,6 +575,27 @@ export function openStore({ dir }) {
       return rowToTask(q.byIssue.get(owner, repo, issueNumber))
     },
 
+    findTaskByExternalRef(externalRef) {
+      const key = typeof externalRef === 'string' ? externalRef.trim() : ''
+      if (!key) return undefined
+      return rowToTask(q.byExternalRef.get(key))
+    },
+
+    listSubtasks(parentId) {
+      if (!parentId) return []
+      return q.subtasksOf.all(parentId).map(rowToTask)
+    },
+
+    countSubtasks(parentId) {
+      if (!parentId) return { total: 0, completed: 0 }
+      const res = q.countSubtasks.get(parentId)
+      return { total: res?.total ?? 0, completed: res?.completed ?? 0 }
+    },
+
+    setParent(id, parentId) {
+      return this.updateTask(id, { parentId: parentId ?? '' })
+    },
+
     /** Задачи в архиве: свой список, а не колонка. */
     listArchived() {
       return q.archived.all().map(rowToTask)