@goodandready/dsh-kanban 0.2.20 → 0.2.21

package/lib/config.js

@@ -106,7 +106,7 @@ export const CONFIG_HINTS = {
   preventIdleSleep: 'Prevent host sleep while task agent sessions are running.',
   progressDumpEnabled: 'Enable PROGRESSDUMP state checkpoints between agent sessions.',
   permissionGateEnabled: 'Require human confirmation before launching elevated permission tasks.',
-  sessionDefaultPermission: 'Default permission tier for task sessions (read-only, workspace-write, full).',
+  sessionDefaultPermission: 'Default permission tier for task sessions (read-only, workspace-write, danger-full-access).',
   announceToAgent: 'Post stage change announcement messages directly into task agent session.',
   maxConcurrentSessions: 'Maximum number of simultaneous active agent sessions on the board.',
   workspaceClaimBoundaries: 'Enforce workspace ownership boundaries to prevent cross-workspace task execution.',

package/lib/events.js

@@ -28,14 +28,26 @@ export class KanbanEventHub {
     }
   }
 
-  handleSseRequest(req, res) {
-    res.writeHead(200, {
+  handleSseRequest(req, res, { isTrustedRequest } = {}) {
+    if (typeof isTrustedRequest === 'function' && !isTrustedRequest(req)) {
+      res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8', 'Cache-Control': 'no-store' })
+      res.end('forbidden')
+      return () => {}
+    }
+
+    const headers = {
       'Content-Type': 'text/event-stream',
       'Cache-Control': 'no-cache, no-transform',
       'Connection': 'keep-alive',
       'X-Accel-Buffering': 'no',
-      'Access-Control-Allow-Origin': '*',
-    })
+    }
+    const origin = req?.headers?.origin
+    if (origin && origin !== 'null') {
+      headers['Access-Control-Allow-Origin'] = origin
+      headers['Vary'] = 'Origin'
+    }
+
+    res.writeHead(200, headers)
 
     res.write(':connected\n\n')
     this.clients.add(res)

package/lib/gitea.js

@@ -36,7 +36,14 @@ export function isCredentialName(value) {
 
 /** Check if value looks like a raw token secret rather than a credential reference name. */
 export function looksLikeSecret(value) {
-  return /^[A-Za-z0-9_-]{32,}$/.test(String(value || '').trim())
+  const str = String(value || '').trim()
+  if (str === '') return false
+  if (/^(ghp_|gho_|github_pat_|glpat-|bearer\s+|token\s+)/i.test(str)) return true
+  if (/^[0-9a-f]{40}$/i.test(str)) return true
+  if (/^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(str)) return true
+  // Raw alphanumeric token >= 32 characters without underscores
+  if (/^[A-Za-z0-9]{32,}$/.test(str)) return true
+  return false
 }
 
 /**

package/lib/github.js

@@ -13,12 +13,18 @@ export function normalizeGithubUrl(raw) {
   return match ? match[0].replace(/\/+$/, '') : DEFAULT_BASE_URL
 }
 
+export function safeIssueIndex(value) {
+  const n = typeof value === 'number' ? value : Number.parseInt(String(value ?? '').trim(), 10)
+  if (!Number.isSafeInteger(n) || n <= 0) return undefined
+  if (typeof value === 'string' && String(n) !== value.trim()) return undefined
+  return n
+}
+
 export function safeSegment(value) {
   const s = String(value ?? '').trim()
-  if (!s || s.includes('/') || s.includes('\\') || s.includes('..') || s.includes('\0')) {
-    return undefined
-  }
-  return s
+  if (!s || s === '.' || s === '..') return undefined
+  if (!/^[A-Za-z0-9._-]+$/.test(s)) return undefined
+  return encodeURIComponent(s)
 }
 
 export function isCredentialName(value) {
@@ -170,14 +176,14 @@ export function createGitHubClient({ getConfig, resolveToken, fetchImpl = fetch,
 
     /** Get single issue by number. */
     async getIssue({ owner, repo, index }) {
-      const n = safeSegment(index)
+      const n = safeIssueIndex(index)
       if (n === undefined) throw Object.assign(new Error('invalid issue number'), { code: 'bad-segment' })
       return request('GET', repoPath(owner, repo, `/issues/${n}`))
     },
 
     /** Post comment on issue. */
     async comment({ owner, repo, index, body }) {
-      const n = safeSegment(index)
+      const n = safeIssueIndex(index)
       if (n === undefined) throw Object.assign(new Error('invalid issue number'), { code: 'bad-segment' })
       return request('POST', repoPath(owner, repo, `/issues/${n}/comments`), { body })
     },

package/lib/index.js

@@ -119,6 +119,18 @@ export const SETTINGS_NAMESPACE = 'dsh-kanban'
  * Scalar values only: client config API only writes scalar fields;
  * dictionaries or arrays here would make the settings card uneditable.
  */
+// Ensure .volatile() helper exists on Schemastery schema prototype
+try {
+  const schemaProto = Object.getPrototypeOf(z.boolean())
+  if (schemaProto && typeof schemaProto.volatile !== 'function') {
+    schemaProto.volatile = function () {
+      return typeof this.extra === 'function' ? this.extra('volatile', true) : this
+    }
+  }
+} catch {
+  // safe fallback
+}
+
 export const Config = z.object(Object.fromEntries(
   Object.entries(CONFIG_DEFAULTS).map(([field, fallback]) => {
     // Node type derived from default value type.
@@ -128,7 +140,8 @@ export const Config = z.object(Object.fromEntries(
     if (field === 'giteaTokenRef' || field === 'webhookSecretRef' || field === 'githubTokenRef' || field === 'githubWebhookSecretRef') {
       node = node.role('credential-ref')
     }
-    return [field, node.default(fallback).description(CONFIG_HINTS[field] ?? '')]
+    const described = node.default(fallback).description(CONFIG_HINTS[field] ?? '')
+    return [field, typeof described.volatile === 'function' ? described.volatile() : described]
   }),
 ))
 
@@ -215,13 +228,57 @@ export function apply(ctx, config) {
     }
   }
 
+  let settingsSvc = null
+
+  const readServedConfig = () => {
+    if (typeof settingsSvc?.describe !== 'function') return null
+    try {
+      const row = settingsSvc.describe().find((r) => r?.ns === SETTINGS_NAMESPACE)
+      if (!row || row.status !== 'ready' || !row.value) return null
+      return withDefaults(row.value)
+    } catch (err) {
+      ctx.logger?.warn?.(`dsh-kanban: settings describe failed: ${err?.message || err}`)
+      return null
+    }
+  }
+
   ctx.inject(['settings'], (sctx) => {
-    const scope = sctx.settings.register(SETTINGS_NAMESPACE, Config, { base: effective })
-    const read = () => withDefaults(scope.get() ?? effective)
-    effective = read()
-    ctx.effect(() => scope.watch(() => { effective = read(); rearm() }), 'dsh-kanban: settings watcher')
+    try {
+      settingsSvc = sctx?.settings ?? sctx?.get?.('settings') ?? null
+      const served = readServedConfig()
+      if (served) {
+        effective = served
+        rearm()
+      }
+    } catch (err) {
+      ctx.logger?.warn?.(`dsh-kanban: settings service unavailable: ${err?.message || err}`)
+    }
   })
 
+  // Listen for config and volatile updates from host
+  if (typeof ctx?.on === 'function') {
+    const applyPatch = (updated) => {
+      if (updated && typeof updated === 'object') {
+        const incoming = updated[SETTINGS_NAMESPACE] ?? updated
+        if (incoming && typeof incoming === 'object') {
+          try {
+            effective = withDefaults({ ...effective, ...incoming })
+            rearm()
+          } catch { /* ignore invalid update */ }
+        }
+      }
+    }
+    if (typeof ctx.effect === 'function') {
+      ctx.effect(() => ctx.on('loader/volatile-update', applyPatch))
+      ctx.effect(() => ctx.on('config', applyPatch))
+      ctx.effect(() => ctx.on('settings/document-updated', applyPatch))
+    } else {
+      ctx.on('loader/volatile-update', applyPatch)
+      ctx.on('config', applyPatch)
+      ctx.on('settings/document-updated', applyPatch)
+    }
+  }
+
   // Dedicated Gitea client resolves token via core credentials service.
   // Secret token values are never exposed externally; only the credential reference name is stored.
   const resolveSecret = async (name) => {
@@ -470,7 +527,7 @@ export function apply(ctx, config) {
 
   // Periodic Gitea reconciliation. 0 disables it; overlapping executions are prevented.
   // Outbound push queue to Gitea. Card moves do not block on network; failures retry in background.
-  const outbox = createOutbox({ gitea: git, store, logger: ctx.logger })
+  const outbox = createOutbox({ gitea: git, get store() { return store }, logger: ctx.logger })
 
   const queueOutbound = (taskId, column) => {
     if (getConfig().pushToGitea !== true) return
@@ -852,7 +909,7 @@ export function apply(ctx, config) {
     kind: 'exact',
     path: '/dsh-kanban/events',
     handler: (req, res) => {
-      eventHub.handleSseRequest(req, res)
+      eventHub.handleSseRequest(req, res, { isTrustedRequest })
     },
   }), 'dsh-kanban: sse events stream')
 
@@ -1174,7 +1231,7 @@ export function apply(ctx, config) {
             agentPreset: input?.agentPreset || task.agentPreset,
             permission: input?.permission || task.permission,
             permissions: ctx.get('permissionPresets'),
-            claimAs: req.headers['x-dsh-user'] || (await whoAmI()),
+            claimAs: await whoAmI(),
             workspaceRegistry: ctx.get('workspaceRegistry'),
             resume: true,
           })

package/lib/launcher.js

@@ -289,7 +289,9 @@ export async function runTask({
   if (config?.permissionGateEnabled) {
     const perm = permission || task.permission || 'read-only'
     const defaultPerm = config?.sessionDefaultPermission || 'read-only'
-    if ((PERMISSION_RANKS[perm] ?? 0) > (PERMISSION_RANKS[defaultPerm] ?? 0)) {
+    const permRank = PERMISSION_RANKS[perm] ?? Infinity
+    const defaultRank = PERMISSION_RANKS[defaultPerm] ?? 0
+    if (permRank > defaultRank) {
       if (!task.permissionConfirmedAt || task.permissionConfirmedAt === 0) {
         const err = new Error('Permission confirmation required')
         err.key = 'permission-unconfirmed'
@@ -473,9 +475,11 @@ export async function runBatch({
   }))
 
   if (own !== '' && list.length === 1) {
-    send(own, 'task-start')
+    await send(own, 'task-start')
   } else {
-    list.forEach((task, at) => send(buildQueuedMessage(task, config, at + 1, list.length), 'batch-queued'))
+    for (let at = 0; at < list.length; at++) {
+      await send(buildQueuedMessage(list[at], config, at + 1, list.length), 'batch-queued')
+    }
   }
 
   const started = []

package/lib/outbound.js

@@ -90,9 +90,10 @@ export function createOutbox({ gitea, store, logger, maxAttempts = 4 }) {
           dropped += 1
           logger?.warn?.(`dsh-kanban: Gitea delivery failed permanently: ${error?.message}`)
           try {
-            const task = store.getTask(item.taskId)
+            const currentStore = typeof store === 'function' ? store() : store
+            const task = currentStore?.getTask?.(item.taskId)
             if (task !== undefined) {
-              store.addTransition({
+              currentStore?.addTransition?.({
                 taskId: item.taskId,
                 fromCol: task.column,
                 toCol: task.column,

package/lib/routes.js

@@ -171,6 +171,12 @@ export function buildBoard({ store, config, board = 'main', repo, liveOf, sync,
 export function applyMove({ store, config, id, column, beforeId, afterId, source = 'manual', detail = '' }) {
   const before = store.getTask(id)
   if (before === undefined) return { error: 'task-not-found', status: 404 }
+  if (column !== undefined && column !== null) {
+    const allowed = columnsOf(store.boardKind(before.board))
+    if (!allowed.includes(column)) {
+      return { error: 'invalid-column', status: 400 }
+    }
+  }
   const task = store.moveTask(id, { column, beforeId, afterId })
   if (task.column !== before.column) {
     store.addTransition({

package/lib/store.js

@@ -541,6 +541,15 @@ export function openStore({ dir }) {
       return this.updateTask(id, { comments })
     },
 
+    addTaskComment(id, comment) {
+      if (!comment || typeof comment !== 'object') return undefined
+      return this.addComment(id, {
+        author: comment.author,
+        role: comment.role,
+        text: comment.text || comment.body || '',
+      })
+    },
+
     updateChecklist(id, items) {
       const task = rowToTask(q.taskById.get(id))
       if (!task) return undefined

package/lib/transitions.js

@@ -1,3 +1,7 @@
+function escapeRegex(str) {
+  return String(str).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
 // Card auto-movement: derive column from observations and source priority.
 // Pure module without network, storage, or harness dependencies.
 // Observations arrive as data, verdicts return as values.
@@ -85,19 +89,19 @@ export function branchOfTask(task, branches) {
 
   // Agent creates branch matching workflow conventions with issue number.
   // Look up by issue number rather than fixed string template.
-  if (typeof task?.issueNumber !== 'number') return undefined
-  const marker = String(task.issueNumber)
+  if (!Number.isSafeInteger(task?.issueNumber) || task.issueNumber <= 0) return undefined
+  const marker = escapeRegex(task.issueNumber)
   return names.find((n) => new RegExp(`(^|[^0-9])${marker}([^0-9]|$)`).test(n))
 }
 
 /** Pull requests related to task: matched by branch or issue reference. */
 export function pullsOfTask(task, pulls, branch) {
-  const number = typeof task?.issueNumber === 'number' ? task.issueNumber : undefined
+  const number = Number.isSafeInteger(task?.issueNumber) && task.issueNumber > 0 ? task.issueNumber : undefined
   return (pulls ?? []).filter((p) => {
     if (branch !== undefined && p?.head?.ref === branch) return true
     if (number === undefined) return false
     const haystack = `${p?.title ?? ''} ${p?.body ?? ''}`
-    return new RegExp(`#${number}([^0-9]|$)`).test(haystack)
+    return new RegExp(`#${escapeRegex(number)}([^0-9]|$)`).test(haystack)
   })
 }
 

package/lib/workflow-bridge.js

@@ -120,18 +120,20 @@ export function resolvePreset({ role, availablePresets = [], defaultPreset = und
  * @returns {string}
  */
 export function buildWorkflowScript({ task, role }) {
-  const taskId = String(task?.id || 'unknown').replace(/["\\]/g, '')
-  const safeRole = String(role || 'backend').replace(/["\\]/g, '')
-  const issueNum = task?.issueNumber ? `#${task.issueNumber}` : taskId
+  const rawRole = String(role || 'backend')
+  const rawTaskId = String(task?.id || 'unknown')
+  const validIssue = Number.isSafeInteger(task?.issueNumber) && task.issueNumber > 0 ? task.issueNumber : undefined
+  const cardLabel = validIssue !== undefined ? `#${validIssue}` : rawTaskId
+  const logMsg = `Starting phase ${rawRole} for card ${cardLabel}`
 
   return [
-    `phase("${safeRole}");`,
-    `log("Starting phase ${safeRole} for card ${issueNum}");`,
+    `phase(${JSON.stringify(rawRole)});`,
+    `log(${JSON.stringify(logMsg)});`,
     `const prompt = args.prompt;`,
-    `const result = await agent(prompt, { label: "${safeRole}", phase: "${safeRole}" });`,
+    `const result = await agent(prompt, { label: ${JSON.stringify(rawRole)}, phase: ${JSON.stringify(rawRole)} });`,
     `return {`,
-    `  role: "${safeRole}",`,
-    `  taskId: "${taskId}",`,
+    `  role: ${JSON.stringify(rawRole)},`,
+    `  taskId: ${JSON.stringify(rawTaskId)},`,
     `  summary: typeof result === 'string' ? result : (result ? JSON.stringify(result) : '')`,
     `};`,
   ].join('\n')
@@ -469,11 +471,13 @@ export class WorkflowBridge {
       }
 
       // Add comment to card
-      if (typeof this.store.addTaskComment === 'function' && summary) {
-        this.store.addTaskComment(taskId, {
-          author: 'workflow',
-          body: `🚀 **Workflow completed (${role}):**\n\n${summary}`,
-        })
+      if (summary) {
+        const text = `🚀 **Workflow completed (${role}):**\n\n${summary}`
+        if (typeof this.store?.addComment === 'function') {
+          this.store.addComment(taskId, { author: 'workflow', role: 'workflow', text })
+        } else if (typeof this.store?.addTaskComment === 'function') {
+          this.store.addTaskComment(taskId, { author: 'workflow', role: 'workflow', text, body: text })
+        }
       }
     } else {
       this.store.addTransition({

package/lib/worktree.js

@@ -87,6 +87,22 @@ export function resolveWorktreeRoot(config, env = process.env, cwdOf = () => pro
 /**
  * Resolve canonical worktree path for task with path traversal protection.
  */
+export function isSafeBranchName(name) {
+  if (typeof name !== 'string') return false
+  const trimmed = name.trim()
+  if (trimmed === '' || trimmed.startsWith('-') || trimmed.startsWith('/') || trimmed.endsWith('/')) return false
+  if (trimmed.includes('..') || trimmed.includes('~') || trimmed.includes('^') || trimmed.includes(':') || trimmed.includes('?') || trimmed.includes('*') || trimmed.includes('[') || trimmed.includes('\\') || trimmed.includes('@{') || trimmed.endsWith('.lock')) return false
+  return /^[A-Za-z0-9_./-]+$/.test(trimmed)
+}
+
+export function isPathFenced(targetPath, rootPath) {
+  if (!targetPath || !rootPath) return false
+  const resolvedTarget = resolve(targetPath)
+  const resolvedRoot = resolve(rootPath)
+  const fence = resolvedRoot.endsWith(sep) || resolvedRoot.endsWith('/') ? resolvedRoot : resolvedRoot + sep
+  return resolvedTarget === resolvedRoot || resolvedTarget.startsWith(fence)
+}
+
 export function resolveTaskWorktreePath({ task, config, env, cwdOf }) {
   const root = resolveWorktreeRoot(config, env, cwdOf)
   const repoKey = safeRepoKey(task)
@@ -262,11 +278,16 @@ export async function removeTaskWorktree({
   force = false,
   deleteBranch = true,
   gitRunner = defaultGitRunner,
+  rootPath,
 }) {
   if (!worktreePath || !existsSync(worktreePath)) {
     return { removed: false, reason: 'not-found' }
   }
 
+  if (rootPath && !isPathFenced(worktreePath, rootPath)) {
+    return { removed: false, error: 'unfenced-worktree-path' }
+  }
+
   const dirtyCheck = await checkWorktreeDirty({ worktreePath, gitRunner })
   if (dirtyCheck.dirty && !force) {
     return {
@@ -333,11 +354,26 @@ export async function cleanupTaskWorktree({
   force = false,
   deleteBranch = true,
   gitRunner = defaultGitRunner,
+  config,
+  env,
+  cwdOf,
 }) {
   const current = typeof task === 'object' && task !== null ? task : store?.getTask?.(task)
   if (!current) return { error: 'task-not-found', status: 404 }
   if (!current.worktree) return { noop: true, removed: false }
 
+  const root = resolveWorktreeRoot(config, env, cwdOf)
+  const candidateRoots = [
+    root,
+    repoDir,
+    typeof cwdOf === 'function' ? cwdOf() : process.cwd(),
+    process.cwd(),
+  ].filter(Boolean)
+  const isFenced = candidateRoots.some((c) => isPathFenced(current.worktree, c))
+  if (!isFenced) {
+    return { error: 'unfenced-worktree-path', status: 403 }
+  }
+
   const targetRepoDir = repoDir || current.worktree
   const result = await removeTaskWorktree({
     repoDir: targetRepoDir,
@@ -479,6 +515,10 @@ export async function mergeTaskWorktree({
     return { success: false, merged: false, error: 'no-worktree-or-branch' }
   }
 
+  if (targetBranch && !isSafeBranchName(targetBranch)) {
+    return { success: false, merged: false, error: 'invalid-target-branch' }
+  }
+
   // 1. Verify worktree cleanliness
   const dirtyCheck = await checkWorktreeDirty({ worktreePath: task.worktree, gitRunner })
   if (dirtyCheck.dirty) {
@@ -499,15 +539,18 @@ export async function mergeTaskWorktree({
 
   // 3. Resolve target merge branch
   let target = targetBranch
+  if (target && !isSafeBranchName(target)) {
+    return { success: false, merged: false, error: 'invalid-target-branch' }
+  }
   if (!target) {
     target = await determineBaseRef(mainRepoDir, gitRunner)
   }
-  if (!target) target = 'main'
+  if (!target || !isSafeBranchName(target)) target = 'main'
 
   // 4. Switch or verify target branch in main repository
   const currentBranch = await gitRunner(['branch', '--show-current'], mainRepoDir)
   if (currentBranch.stdout.trim() !== target) {
-    const checkoutRes = await gitRunner(['checkout', target], mainRepoDir)
+    const checkoutRes = await gitRunner(['checkout', '--', target], mainRepoDir)
     if (checkoutRes.exitCode !== 0) {
       return { success: false, merged: false, error: 'checkout-target-failed', detail: checkoutRes.stderr }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-kanban",
-  "version": "0.2.20",
+  "version": "0.2.21",
   "description": "Visual Kanban board for DeepSeek Harness: Gitea and GitHub-backed tasks, workflow columns, and a dedicated agent session per task.",
   "type": "module",
   "main": "lib/index.js",