@goodandready/dsh-kanban 0.2.20 → 0.2.22

package/lib/gitea.js

@@ -36,7 +36,14 @@ export function isCredentialName(value) {
 
 /** Check if value looks like a raw token secret rather than a credential reference name. */
 export function looksLikeSecret(value) {
-  return /^[A-Za-z0-9_-]{32,}$/.test(String(value || '').trim())
+  const str = String(value || '').trim()
+  if (str === '') return false
+  if (/^(ghp_|gho_|github_pat_|glpat-|bearer\s+|token\s+)/i.test(str)) return true
+  if (/^[0-9a-f]{40}$/i.test(str)) return true
+  if (/^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(str)) return true
+  // Raw alphanumeric token >= 32 characters without underscores
+  if (/^[A-Za-z0-9]{32,}$/.test(str)) return true
+  return false
 }
 
 /**

package/lib/github.js

@@ -13,12 +13,18 @@ export function normalizeGithubUrl(raw) {
   return match ? match[0].replace(/\/+$/, '') : DEFAULT_BASE_URL
 }
 
+export function safeIssueIndex(value) {
+  const n = typeof value === 'number' ? value : Number.parseInt(String(value ?? '').trim(), 10)
+  if (!Number.isSafeInteger(n) || n <= 0) return undefined
+  if (typeof value === 'string' && String(n) !== value.trim()) return undefined
+  return n
+}
+
 export function safeSegment(value) {
   const s = String(value ?? '').trim()
-  if (!s || s.includes('/') || s.includes('\\') || s.includes('..') || s.includes('\0')) {
-    return undefined
-  }
-  return s
+  if (!s || s === '.' || s === '..') return undefined
+  if (!/^[A-Za-z0-9._-]+$/.test(s)) return undefined
+  return encodeURIComponent(s)
 }
 
 export function isCredentialName(value) {
@@ -170,18 +176,28 @@ export function createGitHubClient({ getConfig, resolveToken, fetchImpl = fetch,
 
     /** Get single issue by number. */
     async getIssue({ owner, repo, index }) {
-      const n = safeSegment(index)
+      const n = safeIssueIndex(index)
       if (n === undefined) throw Object.assign(new Error('invalid issue number'), { code: 'bad-segment' })
       return request('GET', repoPath(owner, repo, `/issues/${n}`))
     },
 
     /** Post comment on issue. */
     async comment({ owner, repo, index, body }) {
-      const n = safeSegment(index)
+      const n = safeIssueIndex(index)
       if (n === undefined) throw Object.assign(new Error('invalid issue number'), { code: 'bad-segment' })
       return request('POST', repoPath(owner, repo, `/issues/${n}/comments`), { body })
     },
 
+    /** Create private, empty repository in organization or user account. */
+    async createRepo({ owner, name, description = '' }) {
+      const safe = safeSegment(name)
+      if (safe === undefined) throw Object.assign(new Error('invalid name'), { code: 'bad-segment' })
+      const path = owner ? `/orgs/${safeSegment(owner)}/repos` : '/user/repos'
+      return request('POST', path, {
+        name: safe, description, private: true, auto_init: false,
+      })
+    },
+
     /** Create new issue. */
     async createIssue({ owner, repo, title, body }) {
       const name = String(title ?? '').trim()

package/lib/import.js

@@ -152,24 +152,24 @@ export async function giteaState(gitea) {
 }
 
 /** List open issues for import dialog, marking already-imported ones. */
-export async function listImportable({ gitea, store, owner, repo, board = 'main' }) {
+export async function listImportable({ gitea, store, owner, repo, board = 'main', provider, forge }) {
   const state = await giteaState(gitea)
   if (state !== 'ready') return { error: `gitea-${state}`, status: 409 }
-  const issues = await gitea.listIssues({ owner, repo, state: 'open' })
+  const issues = await gitea.listIssues({ owner, repo, state: 'open', provider: forge || provider })
   const existing = store.listTasks({ board })
   return { issues: markImported(issues, existing, { owner, repo }) }
 }
 
 /** Create a task from an issue. */
-export async function importIssue({ gitea, store, owner, repo, issueNumber, board = 'main', column = 'backlog' }) {
+export async function importIssue({ gitea, store, owner, repo, issueNumber, board = 'main', column = 'backlog', provider, forge }) {
   const state = await giteaState(gitea)
   if (state !== 'ready') return { error: `gitea-${state}`, status: 409 }
   if (typeof issueNumber !== 'number') return { error: 'issue-number-required', status: 400 }
   // Simple board is for non-issue tasks. Importing here would bring branches/PRs into columns unable to display them.
   if (store.boardKind(board) !== 'project') return { error: 'board-not-for-issues', status: 400 }
-  const issue = await gitea.getIssue({ owner, repo, index: issueNumber })
+  const issue = await gitea.getIssue({ owner, repo, index: issueNumber, provider: forge || provider })
   if (issue === undefined || issue === null) return { error: 'issue-not-found', status: 404 }
-  return { task: store.createTask(issueToTask(issue, { board, column, owner, repo })) }
+  return { task: store.createTask(issueToTask(issue, { board, column, owner, repo, forge: forge || provider })) }
 }
 
 /** Re-read issue and update task, preserving local state. */
@@ -179,7 +179,8 @@ export async function refreshTask({ gitea, store, id }) {
   const task = store.getTask(id)
   if (task === undefined) return { error: 'task-not-found', status: 404 }
   if (typeof task.issueNumber !== 'number') return { error: 'task-has-no-issue', status: 400 }
-  const issue = await gitea.getIssue({ owner: task.owner, repo: task.repo, index: task.issueNumber })
+  const forge = task.forge || (typeof task.issueUrl === 'string' && task.issueUrl.includes('github.com') ? 'github' : 'gitea')
+  const issue = await gitea.getIssue({ owner: task.owner, repo: task.repo, index: task.issueNumber, provider: forge, issueUrl: task.issueUrl })
   if (issue === undefined || issue === null) return { error: 'issue-not-found', status: 404 }
   return { task: store.updateTask(id, refreshPatch(task, issue)) }
 }
@@ -199,7 +200,7 @@ export async function searchRepos({ gitea, query, limit = 20 }) {
  * Failure midway avoids leaving orphaned cards.
  */
 export async function createProjectTask({
-  gitea, store, owner, repo, newRepo, title, body, board = 'main',
+  gitea, store, owner, repo, newRepo, title, body, board = 'main', provider, forge,
 }) {
   const state = await giteaState(gitea)
   if (state !== 'ready') return { error: `gitea-${state}`, status: 409 }
@@ -214,7 +215,7 @@ export async function createProjectTask({
     // Validate repository name before API call.
     if (safeSegment(wanted) === undefined) return { error: 'bad-repo-name', status: 400 }
     try {
-      await gitea.createRepo({ owner, name: wanted })
+      await gitea.createRepo({ owner, name: wanted, provider: forge || provider })
     } catch (error) {
       return { error: 'repo-not-created', status: 502, detail: String(error?.message ?? error) }
     }
@@ -223,11 +224,11 @@ export async function createProjectTask({
 
   let issue
   try {
-    issue = await gitea.createIssue({ owner, repo: targetRepo, title: name, body })
+    issue = await gitea.createIssue({ owner, repo: targetRepo, title: name, body, provider: forge || provider })
   } catch (error) {
     // Repository may have already been created; avoid deleting on issue creation failure.
     return { error: 'issue-not-created', status: 502, detail: String(error?.message ?? error) }
   }
 
-  return { task: store.createTask(issueToTask(issue, { board, column: 'backlog', owner, repo: targetRepo })) }
+  return { task: store.createTask(issueToTask(issue, { board, column: 'backlog', owner, repo: targetRepo, forge: forge || provider })) }
 }

package/lib/index.js

@@ -119,6 +119,18 @@ export const SETTINGS_NAMESPACE = 'dsh-kanban'
  * Scalar values only: client config API only writes scalar fields;
  * dictionaries or arrays here would make the settings card uneditable.
  */
+// Ensure .volatile() helper exists on Schemastery schema prototype
+try {
+  const schemaProto = Object.getPrototypeOf(z.boolean())
+  if (schemaProto && typeof schemaProto.volatile !== 'function') {
+    schemaProto.volatile = function () {
+      return typeof this.extra === 'function' ? this.extra('volatile', true) : this
+    }
+  }
+} catch {
+  // safe fallback
+}
+
 export const Config = z.object(Object.fromEntries(
   Object.entries(CONFIG_DEFAULTS).map(([field, fallback]) => {
     // Node type derived from default value type.
@@ -128,7 +140,8 @@ export const Config = z.object(Object.fromEntries(
     if (field === 'giteaTokenRef' || field === 'webhookSecretRef' || field === 'githubTokenRef' || field === 'githubWebhookSecretRef') {
       node = node.role('credential-ref')
     }
-    return [field, node.default(fallback).description(CONFIG_HINTS[field] ?? '')]
+    const described = node.default(fallback).description(CONFIG_HINTS[field] ?? '')
+    return [field, typeof described.volatile === 'function' ? described.volatile() : described]
   }),
 ))
 
@@ -215,13 +228,57 @@ export function apply(ctx, config) {
     }
   }
 
+  let settingsSvc = null
+
+  const readServedConfig = () => {
+    if (typeof settingsSvc?.describe !== 'function') return null
+    try {
+      const row = settingsSvc.describe().find((r) => r?.ns === SETTINGS_NAMESPACE)
+      if (!row || row.status !== 'ready' || !row.value) return null
+      return withDefaults(row.value)
+    } catch (err) {
+      ctx.logger?.warn?.(`dsh-kanban: settings describe failed: ${err?.message || err}`)
+      return null
+    }
+  }
+
   ctx.inject(['settings'], (sctx) => {
-    const scope = sctx.settings.register(SETTINGS_NAMESPACE, Config, { base: effective })
-    const read = () => withDefaults(scope.get() ?? effective)
-    effective = read()
-    ctx.effect(() => scope.watch(() => { effective = read(); rearm() }), 'dsh-kanban: settings watcher')
+    try {
+      settingsSvc = sctx?.settings ?? sctx?.get?.('settings') ?? null
+      const served = readServedConfig()
+      if (served) {
+        effective = served
+        rearm()
+      }
+    } catch (err) {
+      ctx.logger?.warn?.(`dsh-kanban: settings service unavailable: ${err?.message || err}`)
+    }
   })
 
+  // Listen for config and volatile updates from host
+  if (typeof ctx?.on === 'function') {
+    const applyPatch = (updated) => {
+      if (updated && typeof updated === 'object') {
+        const incoming = updated[SETTINGS_NAMESPACE] ?? updated
+        if (incoming && typeof incoming === 'object') {
+          try {
+            effective = withDefaults({ ...effective, ...incoming })
+            rearm()
+          } catch { /* ignore invalid update */ }
+        }
+      }
+    }
+    if (typeof ctx.effect === 'function') {
+      ctx.effect(() => ctx.on('loader/volatile-update', applyPatch))
+      ctx.effect(() => ctx.on('config', applyPatch))
+      ctx.effect(() => ctx.on('settings/document-updated', applyPatch))
+    } else {
+      ctx.on('loader/volatile-update', applyPatch)
+      ctx.on('config', applyPatch)
+      ctx.on('settings/document-updated', applyPatch)
+    }
+  }
+
   // Dedicated Gitea client resolves token via core credentials service.
   // Secret token values are never exposed externally; only the credential reference name is stored.
   const resolveSecret = async (name) => {
@@ -470,7 +527,7 @@ export function apply(ctx, config) {
 
   // Periodic Gitea reconciliation. 0 disables it; overlapping executions are prevented.
   // Outbound push queue to Gitea. Card moves do not block on network; failures retry in background.
-  const outbox = createOutbox({ gitea: git, store, logger: ctx.logger })
+  const outbox = createOutbox({ gitea: git, get store() { return store }, logger: ctx.logger })
 
   const queueOutbound = (taskId, column) => {
     if (getConfig().pushToGitea !== true) return
@@ -750,14 +807,14 @@ export function apply(ctx, config) {
     // Single setting switch controls both board tools.
     const registerBoardTool = () => {
       const off = [
-        ctx.tools.register(defineTool(boardMoveDefinition({ store, config: getConfig }))),
-        ctx.tools.register(defineTool(boardPlanDefinition({ store }))),
-        ctx.tools.register(defineTool(boardChecklistDefinition({ store }))),
+        ctx.tools.register(defineTool(boardMoveDefinition({ store, config: getConfig, eventHub }))),
+        ctx.tools.register(defineTool(boardPlanDefinition({ store, eventHub }))),
+        ctx.tools.register(defineTool(boardChecklistDefinition({ store, eventHub }))),
         ctx.tools.register(defineTool(boardReportDefinition({ store }))),
         ctx.tools.register(defineTool(boardCommentsDefinition({ store }))),
         ctx.tools.register(defineTool(boardCommentAddDefinition({ store }))),
         ctx.tools.register(defineTool(boardDecomposeDefinition({ store, gitea: git }))),
-        ctx.tools.register(defineTool(boardChecklistItemDefinition({ store }))),
+        ctx.tools.register(defineTool(boardChecklistItemDefinition({ store, eventHub }))),
       ]
       return () => { for (const stop of off) stop?.() }
     }
@@ -852,7 +909,7 @@ export function apply(ctx, config) {
     kind: 'exact',
     path: '/dsh-kanban/events',
     handler: (req, res) => {
-      eventHub.handleSseRequest(req, res)
+      eventHub.handleSseRequest(req, res, { isTrustedRequest })
     },
   }), 'dsh-kanban: sse events stream')
 
@@ -889,7 +946,11 @@ export function apply(ctx, config) {
       if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
       try {
         const input = await readBody(req)
-        reply(res, importBoard({ store, input }))
+        const impResult = importBoard({ store, input })
+        if (impResult?.imported > 0) {
+          eventHub.broadcast('task:change', { action: 'imported', count: impResult.imported })
+        }
+        reply(res, impResult)
       } catch {
         writeJson(res, 400, { error: 'bad-request' })
       }
@@ -908,7 +969,11 @@ export function apply(ctx, config) {
         if (req.method !== 'POST') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
         if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
         try {
-          reply(res, createTask({ store, input: await readBody(req) }))
+          const resObj = createTask({ store, input: await readBody(req) })
+          if (resObj?.task) {
+            eventHub.broadcast('task:change', { taskId: resObj.task.id, action: 'created' })
+          }
+          reply(res, resObj)
         } catch (error) {
           writeJson(res, error?.status ?? 500, { error: 'bad-request' })
         }
@@ -930,12 +995,23 @@ export function apply(ctx, config) {
         return
       }
       if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
-      if (req.method === 'DELETE' && action === undefined) { reply(res, deleteTask({ store, id })); return }
+      if (req.method === 'DELETE' && action === undefined) {
+        const resObj = deleteTask({ store, id })
+        if (resObj?.deleted) {
+          eventHub.broadcast('task:change', { taskId: id, action: 'deleted' })
+        }
+        reply(res, resObj)
+        return
+      }
       // Card fields update: title, body, labels, priority. Priority is board-local.
       if (req.method === 'POST' && action === 'update') {
         try {
           const input = await readBody(req)
-          reply(res, updateTask({ store, id, input }))
+          const resObj = updateTask({ store, id, input })
+          if (resObj?.task) {
+            eventHub.broadcast('task:change', { taskId: id, action: 'updated' })
+          }
+          reply(res, resObj)
         } catch {
           writeJson(res, 400, { error: 'bad-request' })
         }
@@ -1112,6 +1188,9 @@ export function apply(ctx, config) {
         }
         if (req.method === 'POST' && action === 'checklist-toggle') {
           const resObj = handleToggleChecklistItem({ store, task: store.getTask(id), input })
+          if (resObj?.body?.task) {
+            eventHub.broadcast('task:change', { taskId: id, action: 'updated' })
+          }
           writeJson(res, resObj.status, resObj.body)
           return
         }
@@ -1122,6 +1201,9 @@ export function apply(ctx, config) {
         }
         if (req.method === 'POST' && action === 'checklist') {
           const resObj = handleTaskChecklist({ store, task: store.getTask(id), input })
+          if (resObj?.body?.task) {
+            eventHub.broadcast('task:change', { taskId: id, action: 'updated' })
+          }
           writeJson(res, resObj.status, resObj.body)
           return
         }
@@ -1174,7 +1256,7 @@ export function apply(ctx, config) {
             agentPreset: input?.agentPreset || task.agentPreset,
             permission: input?.permission || task.permission,
             permissions: ctx.get('permissionPresets'),
-            claimAs: req.headers['x-dsh-user'] || (await whoAmI()),
+            claimAs: await whoAmI(),
             workspaceRegistry: ctx.get('workspaceRegistry'),
             resume: true,
           })