@goodandready/dsh-kanban 0.2.20 → 0.2.22

package/lib/launcher.js

@@ -12,11 +12,38 @@
 
 import { isAbsolute, join, resolve, sep } from 'node:path'
 import { randomUUID } from 'node:crypto'
-import { createTaskWorktree, registerDshWorkspace } from './worktree.js'
+import { createTaskWorktree, registerDshWorkspace, isGitRepo } from './worktree.js'
 import { formatHandoverPreamble, parseProgressDump } from './progress-dump.js'
 
 export const PERMISSION_RANKS = { 'read-only': 0, 'workspace-write': 1, 'danger-full-access': 2 }
 
+const activeReservations = new Set()
+
+export function reserveSessionSlot(taskId) {
+  if (taskId) activeReservations.add(taskId)
+}
+
+export function releaseSessionSlot(taskId) {
+  if (taskId) activeReservations.delete(taskId)
+}
+
+export function verifyPermissionGate({ task, permission, config }) {
+  if (!config?.permissionGateEnabled) return
+  const perm = permission || task?.permission || config?.sessionDefaultPermission || 'read-only'
+  const defaultPerm = config?.sessionDefaultPermission || 'read-only'
+  const permRank = PERMISSION_RANKS[perm] ?? Infinity
+  const defaultRank = PERMISSION_RANKS[defaultPerm] ?? 0
+  const confirmedTier = task?.permissionConfirmedTier || (task?.permissionConfirmedAt ? task?.permission : undefined)
+  const confirmedRank = confirmedTier ? (PERMISSION_RANKS[confirmedTier] ?? -1) : -1
+
+  if (permRank > defaultRank && permRank > confirmedRank) {
+    const err = new Error('Permission confirmation required')
+    err.key = 'permission-unconfirmed'
+    err.status = 403
+    throw err
+  }
+}
+
 /**
  * Tail instructions for local board tasks.
  *
@@ -134,20 +161,44 @@ export function applyPermission({ permissions, agent, name }) {
 export async function obtainAgent({
   agents, task, config, provider, model, mintSessionId, cwdOf, logger,
   agentPreset, permission, permissions, gitRunner, workspaceRegistry,
+  reasoningEffort,
 }) {
+  const chosenPerm = permission || task?.permission || ''
+  const effort = reasoningEffort || task?.reasoningEffort || undefined
+  const agentOptions = { provider, model, ...(effort ? { reasoningEffort: effort } : {}) }
+
   const known = typeof task?.sessionId === 'string' && task.sessionId !== '' ? task.sessionId : undefined
 
   if (known !== undefined) {
     // Live agent — reuse active session.
     let live
     try { live = agents.get(known) } catch { live = undefined }
-    if (live !== undefined) return { agent: live, sessionId: known, mode: 'opened' }
+    if (live !== undefined) {
+      const access = applyPermission({ permissions, agent: live, name: chosenPerm })
+      if (access.error !== undefined) {
+        const error = new Error('access tier not set')
+        error.key = access.error
+        error.status = 409
+        throw error
+      }
+      return { agent: live, sessionId: known, mode: 'opened' }
+    }
 
     // Session suspended; attempt resume.
     try {
-      const handle = await agents.resume({ resumeSessionId: known, agentOptions: { provider, model } })
+      const handle = await agents.resume({ resumeSessionId: known, agentOptions })
+      const access = applyPermission({ permissions, agent: handle.agent, name: chosenPerm })
+      if (access.error !== undefined) {
+        const error = new Error('access tier not set')
+        error.key = access.error
+        error.status = 409
+        throw error
+      }
       return { agent: handle.agent, sessionId: handle.agent.session.id, mode: 'resumed' }
     } catch (error) {
+      if (error?.key === 'permission-refused' || error?.key === 'permission-unavailable' || error?.status === 409) {
+        throw error
+      }
       logger?.warn?.(`dsh-kanban: session ${known} resume failed: ${error?.message}`)
     }
   }
@@ -159,30 +210,41 @@ export async function obtainAgent({
   let workspaceId = task?.workspaceId || undefined
   let worktreeCreated = false
 
-  if (config?.worktreeIsolation !== false && task?.repo) {
+  const isGit = await isGitRepo(cwd, gitRunner)
+  if (config?.worktreeIsolation !== false && isGit) {
+    let created
     try {
-      const created = await createTaskWorktree({
+      created = await createTaskWorktree({
         task,
         repoDir: cwd,
         config,
         gitRunner,
         cwdOf,
       })
-      if (created) {
-        worktreePath = created.worktreePath
-        branchName = created.branchName
-        worktreeCreated = created.created === true
-
-        if (workspaceRegistry) {
-          workspaceId = await registerDshWorkspace({
-            workspaceRegistry,
-            worktreePath,
-            title: `${task.owner ? task.owner + '/' : ''}${task.repo}#${task.issueNumber || task.id.slice(0, 8)}: ${task.title}`,
-          })
-        }
-      }
     } catch (err) {
-      logger?.warn?.(`dsh-kanban: failed to create worktree for ${task.id}: ${err.message}`)
+      const error = new Error(`worktree-creation-failed: ${err.message}`)
+      error.key = 'worktree-creation-failed'
+      error.status = 500
+      throw error
+    }
+
+    if (!created?.worktreePath) {
+      const error = new Error('worktree-creation-failed')
+      error.key = 'worktree-creation-failed'
+      error.status = 500
+      throw error
+    }
+
+    worktreePath = created.worktreePath
+    branchName = created.branchName
+    worktreeCreated = created.created === true
+
+    if (workspaceRegistry) {
+      workspaceId = await registerDshWorkspace({
+        workspaceRegistry,
+        worktreePath,
+        title: `${task.owner ? task.owner + '/' : ''}${task.repo}#${task.issueNumber || task.id.slice(0, 8)}: ${task.title}`,
+      })
     }
   }
 
@@ -197,9 +259,9 @@ export async function obtainAgent({
     sessionId: mintSessionId(),
     // Profile is set during session creation.
     meta,
-    agentOptions: { provider, model },
+    agentOptions,
   })
-  const access = applyPermission({ permissions, agent: handle.agent, name: permission })
+  const access = applyPermission({ permissions, agent: handle.agent, name: chosenPerm })
   if (access.error !== undefined) {
     // Session already initialized; preserve configured permissions.
     try { handle.dispose?.() } catch { /* cleanup is secondary to rejection */ }
@@ -265,9 +327,11 @@ export async function runTask({
   agents, store, task, config, provider, model,
   mintSessionId, createMessage, cwdOf, logger, text,
   agentPreset, permission, permissions, claimAs,
-  gitRunner, workspaceRegistry, resume = false,
+  gitRunner, workspaceRegistry, resume = false, reasoningEffort,
 }) {
-  // Concurrency limit check (#214)
+  const effort = reasoningEffort || task?.reasoningEffort || undefined
+
+  // Concurrency limit check (#214, #330)
   const maxConcurrent = typeof config?.maxConcurrentSessions === 'number' ? config.maxConcurrentSessions : 3
   if (maxConcurrent > 0) {
     const activeCount = countActiveSessions({ store, agents })
@@ -275,7 +339,16 @@ export async function runTask({
     const isAlreadyRunning = task.sessionId && agents?.get?.(task.sessionId)?.status === 'running'
     if (!isAlreadyRunning && activeCount >= maxConcurrent) {
       const now = Date.now()
-      store.updateTask(task.id, { queuedAt: task.queuedAt > 0 ? task.queuedAt : now })
+      store.updateTask(task.id, {
+        queuedAt: task.queuedAt > 0 ? task.queuedAt : now,
+        ...(provider ? { provider } : {}),
+        ...(model ? { model } : {}),
+        ...(permission ? { permission } : {}),
+        ...(effort ? { reasoningEffort: effort } : {}),
+        queuedRequest: JSON.stringify({
+          provider, model, permission, reasoningEffort: effort, agentPreset, text,
+        }),
+      })
       store.addTransition({
         taskId: task.id,
         fromCol: task.column,
@@ -286,26 +359,23 @@ export async function runTask({
       return { mode: 'queued', queued: true, taskId: task.id, activeCount, maxConcurrent }
     }
   }
-  if (config?.permissionGateEnabled) {
-    const perm = permission || task.permission || 'read-only'
-    const defaultPerm = config?.sessionDefaultPermission || 'read-only'
-    if ((PERMISSION_RANKS[perm] ?? 0) > (PERMISSION_RANKS[defaultPerm] ?? 0)) {
-      if (!task.permissionConfirmedAt || task.permissionConfirmedAt === 0) {
-        const err = new Error('Permission confirmation required')
-        err.key = 'permission-unconfirmed'
-        err.status = 403
-        throw err
-      }
-    }
-  }
 
-  const taken = await obtainAgent({
-    agents, task, config, provider, model, mintSessionId, cwdOf, logger,
-    agentPreset, permission, permissions, gitRunner, workspaceRegistry,
-  })
+  verifyPermissionGate({ task, permission, config })
 
-  if (task.queuedAt > 0) {
-    store.updateTask(task.id, { queuedAt: 0 })
+  reserveSessionSlot(task.id)
+  let taken
+  try {
+    taken = await obtainAgent({
+      agents, task, config, provider, model, mintSessionId, cwdOf, logger,
+      agentPreset, permission, permissions, gitRunner, workspaceRegistry,
+      reasoningEffort: effort,
+    })
+  } finally {
+    releaseSessionSlot(task.id)
+  }
+
+  if (task.queuedAt > 0 || task.queuedRequest) {
+    store.updateTask(task.id, { queuedAt: 0, queuedRequest: '' })
   }
 
   // Record run in task execution history
@@ -460,10 +530,31 @@ export async function runBatch({
   const list = (tasks ?? []).filter((task) => task !== undefined)
   if (list.length === 0) return { error: 'nothing-picked', status: 400 }
 
-  const taken = await obtainAgent({
-    agents, task: list[0], config, provider, model, mintSessionId, cwdOf, logger,
-    agentPreset, permission, permissions,
-  })
+  for (const t of list) {
+    verifyPermissionGate({ task: t, permission, config })
+  }
+
+  const maxConcurrent = typeof config?.maxConcurrentSessions === 'number' ? config.maxConcurrentSessions : 3
+  if (maxConcurrent > 0) {
+    const activeCount = countActiveSessions({ store, agents })
+    if (activeCount >= maxConcurrent) {
+      const err = new Error('concurrent-limit-reached')
+      err.key = 'concurrent-limit-reached'
+      err.status = 429
+      throw err
+    }
+  }
+
+  reserveSessionSlot(list[0].id)
+  let taken
+  try {
+    taken = await obtainAgent({
+      agents, task: list[0], config, provider, model, mintSessionId, cwdOf, logger,
+      agentPreset, permission, permissions,
+    })
+  } finally {
+    releaseSessionSlot(list[0].id)
+  }
 
   await taken.agent.whenIdle()
   const own = typeof text === 'string' ? text.trim() : ''
@@ -473,9 +564,11 @@ export async function runBatch({
   }))
 
   if (own !== '' && list.length === 1) {
-    send(own, 'task-start')
+    await send(own, 'task-start')
   } else {
-    list.forEach((task, at) => send(buildQueuedMessage(task, config, at + 1, list.length), 'batch-queued'))
+    for (let at = 0; at < list.length; at++) {
+      await send(buildQueuedMessage(list[at], config, at + 1, list.length), 'batch-queued')
+    }
   }
 
   const started = []
@@ -559,12 +652,23 @@ export function unqueueTask({ store, task }) {
  */
 export function countActiveSessions({ store, agents }) {
   const sessions = liveSessions({ store, agents })
-  return sessions.filter((s) => s.status === 'running' || s.status === 'busy' || s.status === 'thinking').length
+  const activeCount = sessions.filter((s) => s.status === 'running' || s.status === 'busy' || s.status === 'thinking').length
+  return activeCount + activeReservations.size
 }
 
 export function liveSessions({ store, agents }) {
   const byId = new Map()
-  const all = [...store.listTasks({ board: 'main' }), ...store.listTasks({ board: 'simple' })]
+  let all = []
+  if (typeof store?.listBoards === 'function' && typeof store?.listTasks === 'function') {
+    const boards = store.listBoards() || []
+    all = boards.flatMap((b) => store.listTasks({ board: b.id }) || [])
+  } else if (typeof store?.listTasks === 'function') {
+    all = store.listTasks() || []
+  } else if (typeof store?.listInColumn === 'function') {
+    all = store.listInColumn('in-progress') || []
+  } else if (Array.isArray(store?.tasks)) {
+    all = store.tasks
+  }
   for (const task of all) {
     const id = typeof task.sessionId === 'string' ? task.sessionId : ''
     if (id === '') continue
@@ -602,19 +706,26 @@ export async function dispatchNextQueuedTask({
   if (queued.length === 0) return null
 
   const nextTask = queued[0]
+  let queuedParams = {}
+  if (typeof nextTask.queuedRequest === 'string' && nextTask.queuedRequest) {
+    try { queuedParams = JSON.parse(nextTask.queuedRequest) } catch { /* ignore */ }
+  }
   try {
     return await runTask({
       agents,
       store,
       task: nextTask,
       config,
-      provider: nextTask.provider || undefined,
-      model: nextTask.model || undefined,
+      provider: queuedParams.provider || nextTask.provider || undefined,
+      model: queuedParams.model || nextTask.model || undefined,
+      permission: queuedParams.permission || nextTask.permission || undefined,
+      reasoningEffort: queuedParams.reasoningEffort || nextTask.reasoningEffort || undefined,
+      text: queuedParams.text || undefined,
+      agentPreset: queuedParams.agentPreset || agentPreset,
       mintSessionId: mintSessionId || (() => `kanban-${nextTask.id}-${randomUUID()}`),
       createMessage: createMessage || ((msg) => msg),
       cwdOf,
       logger,
-      agentPreset,
       permissions,
       workspaceRegistry,
       claimAs: claimAs || 'queue-dispatcher',

package/lib/order.js

@@ -1,63 +1,33 @@
 // Fractional ordering index for cards.
 //
-// Naive approach stores integer index, and dragging card to the top of column
-// with ten items requires rewriting all ten. Here order is stored as string,
-// and new value is generated BETWEEN two neighbors, so drag-and-drop is always
-// a single UPDATE of one row regardless of how many cards are in column.
-//
-// String-based implementation is intentional. Floating-point numbers fail
-// after ~50 insertions into the same position when precision runs out.
-//
-// Key is read as fraction after implicit '0.': comparison is standard
-// lexicographical. Key never ends with first alphabet character to ensure
-// subsequent division remains possible.
-
-/** Alphabet in ascending character code order. */
-const DIGITS = '0123456789abcdefghijklmnopqrstuvwxyz'
-const FIRST = DIGITS[0]
-
-/** Value strictly between `a` and `b`; `b === undefined` means unbounded right. */
-function midpoint(a, b) {
-  if (b !== undefined && a >= b) {
-    throw new Error(`order violated: ${JSON.stringify(a)} not less than ${JSON.stringify(b)}`)
-  }
-  if (a.endsWith(FIRST) || (b !== undefined && b.endsWith(FIRST))) {
-    throw new Error('order key cannot end with first alphabet symbol')
-  }
-
-  if (b !== undefined) {
-    // Common prefix carried as-is, division continues on remainder
-    // to avoid inflating key length unnecessarily.
-    let n = 0
-    while ((a[n] ?? FIRST) === b[n]) n += 1
-    if (n > 0) return b.slice(0, n) + midpoint(a.slice(n), b.slice(n))
-  }
-
-  const from = a === '' ? 0 : DIGITS.indexOf(a[0])
-  const to = b === undefined ? DIGITS.length : DIGITS.indexOf(b[0])
-  if (from < 0 || to < 0) throw new Error('order key contains character outside alphabet')
+// String-based implementation using rocicorp/fractional-indexing (CC0-1.0).
+// Generates bounded-length order keys strictly between neighbors, avoiding
+// O(N^2) string inflation on repeated appends/prepends.
 
-  if (to - from > 1) {
-    return DIGITS[Math.round(0.5 * (from + to))]
-  }
-  if (b !== undefined && b.length > 1) {
-    return b.slice(0, 1)
-  }
-  // Adjacent symbols: take `a` digit and divide next position.
-  return DIGITS[from] + midpoint(a.slice(1), undefined)
-}
+import { generateKeyBetween, generateNKeysBetween } from './fractional-indexing.js'
 
 /**
  * Fractional order key strictly between two neighbors.
  *
- * Both neighbors are optional: without either returns default initial value;
- * without right returns value after `a`; without left returns value before `b`.
- *
  * @param {string} [a] left neighbor order key
  * @param {string} [b] right neighbor order key
  * @returns {string} key strictly between them
- * @throws if `a` is not less than `b` or key contains invalid character
+ * @throws if a >= b or key contains invalid character
  */
 export function keyBetween(a, b) {
-  return midpoint(a ?? '', b ?? undefined)
+  if (a !== undefined && a !== null && b !== undefined && b !== null) {
+    if (a >= b) {
+      throw new Error(`order violated: ${JSON.stringify(a)} not less than ${JSON.stringify(b)}`)
+    }
+  }
+  if (typeof a === 'string' && /[^0-9a-zA-Z]/.test(a)) {
+    throw new Error('order key contains character outside alphabet')
+  }
+  if (typeof b === 'string' && /[^0-9a-zA-Z]/.test(b)) {
+    throw new Error('order key contains character outside alphabet')
+  }
+
+  return generateKeyBetween(a ?? null, b ?? null)
 }
+
+export { generateKeyBetween, generateNKeysBetween }

package/lib/outbound.js

@@ -19,22 +19,32 @@
  */
 export function planAssign(task, login) {
   if (typeof task?.issueNumber !== 'number') return []
-  return [{
+  const op = {
     kind: 'assign',
     owner: task.owner,
     repo: task.repo,
     index: task.issueNumber,
     login: typeof login === 'string' ? login : '',
-  }]
+  }
+  if (task.forge) op.provider = task.forge
+  else if (typeof task.issueUrl === 'string' && task.issueUrl.includes('github.com')) op.provider = 'github'
+  if (task.issueUrl) op.issueUrl = task.issueUrl
+  return [op]
 }
 
 export function planOutbound(task, column, config) {
   if (typeof task?.issueNumber !== 'number') return []
-  // Closing issue is the only mutation sent to Gitea: it is a concrete action,
-  // not redundant mirroring.
-  return column === 'done'
-    ? [{ kind: 'close', owner: task.owner, repo: task.repo, index: task.issueNumber }]
-    : []
+  if (column !== 'done') return []
+  const op = {
+    kind: 'close',
+    owner: task.owner,
+    repo: task.repo,
+    index: task.issueNumber,
+  }
+  if (task.forge) op.provider = task.forge
+  else if (typeof task.issueUrl === 'string' && task.issueUrl.includes('github.com')) op.provider = 'github'
+  if (task.issueUrl) op.issueUrl = task.issueUrl
+  return [op]
 }
 
 /**
@@ -71,13 +81,19 @@ export function createOutbox({ gitea, store, logger, maxAttempts = 4 }) {
       for (const item of pending) {
         try {
           if (item.op.kind === 'close') {
-            await gitea.closeIssue({ owner: item.op.owner, repo: item.op.repo, index: item.op.index })
+            const closePayload = { owner: item.op.owner, repo: item.op.repo, index: item.op.index }
+            if (item.op.provider) closePayload.provider = item.op.provider
+            if (item.op.issueUrl) closePayload.issueUrl = item.op.issueUrl
+            await gitea.closeIssue(closePayload)
           }
           if (item.op.kind === 'assign') {
-            await gitea.setAssignees({
+            const assignPayload = {
               owner: item.op.owner, repo: item.op.repo, index: item.op.index,
               logins: item.op.login === '' ? [] : [item.op.login],
-            })
+            }
+            if (item.op.provider) assignPayload.provider = item.op.provider
+            if (item.op.issueUrl) assignPayload.issueUrl = item.op.issueUrl
+            await gitea.setAssignees(assignPayload)
           }
           sent += 1
         } catch (error) {
@@ -90,9 +106,10 @@ export function createOutbox({ gitea, store, logger, maxAttempts = 4 }) {
           dropped += 1
           logger?.warn?.(`dsh-kanban: Gitea delivery failed permanently: ${error?.message}`)
           try {
-            const task = store.getTask(item.taskId)
+            const currentStore = typeof store === 'function' ? store() : store
+            const task = currentStore?.getTask?.(item.taskId)
             if (task !== undefined) {
-              store.addTransition({
+              currentStore?.addTransition?.({
                 taskId: item.taskId,
                 fromCol: task.column,
                 toCol: task.column,

package/lib/progress-dump.js

@@ -62,15 +62,22 @@ export function parseProgressDump(text) {
     const line = rawLine.trim()
     const lower = line.toLowerCase()
 
-    if (lower.startsWith('goal:') || lower.startsWith('\u0446\u0435\u043b\u044c:')) {
+    if (lower.startsWith('goal:') || lower.startsWith('цель:')) {
       currentKey = 'goal'
       const val = line.slice(line.indexOf(':') + 1).trim()
       if (val) sections.goal.push(val)
-    } else if (lower.startsWith('progress:') || lower.startsWith('\u043f\u0440\u043e\u0433\u0440\u0435\u0441\u0441:')) {
+    } else if (lower.startsWith('progress:') || lower.startsWith('done:') || lower.startsWith('прогресс:')) {
       currentKey = 'progress'
       const val = line.slice(line.indexOf(':') + 1).trim()
       if (val) sections.progress.push(val)
-    } else if (lower.startsWith('next:') || lower.startsWith('next steps:') || lower.startsWith('\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0448\u0430\u0433\u0438:') || lower.startsWith('\u0448\u0430\u0433\u0438:')) {
+    } else if (
+      lower.startsWith('next:') ||
+      lower.startsWith('next steps:') ||
+      lower.startsWith('next step:') ||
+      lower.startsWith('следующие шаги:') ||
+      lower.startsWith('шаги:') ||
+      lower.startsWith('дальше:')
+    ) {
       currentKey = 'next'
       const val = line.slice(line.indexOf(':') + 1).trim()
       if (val) sections.next.push(val)
@@ -98,16 +105,14 @@ export function parseProgressDump(text) {
  */
 export function formatProgressDump(dump) {
   if (!dump) return ''
+  const g = dump.goal || ''
+  const p = dump.progress || ''
+  const n = dump.next || ''
   return [
     BEGIN_MARKER,
-    'Goal:',
-    dump.goal || '—',
-    '',
-    'Progress:',
-    dump.progress || '—',
-    '',
-    'Next steps:',
-    dump.next || '—',
+    `Goal: ${g}`,
+    `Progress: ${p}`,
+    `Next steps: ${n}`,
     END_MARKER,
   ].join('\n')
 }

package/lib/routes.js

@@ -171,6 +171,12 @@ export function buildBoard({ store, config, board = 'main', repo, liveOf, sync,
 export function applyMove({ store, config, id, column, beforeId, afterId, source = 'manual', detail = '' }) {
   const before = store.getTask(id)
   if (before === undefined) return { error: 'task-not-found', status: 404 }
+  if (column !== undefined && column !== null) {
+    const allowed = columnsOf(store.boardKind(before.board))
+    if (!allowed.includes(column)) {
+      return { error: 'invalid-column', status: 400 }
+    }
+  }
   const task = store.moveTask(id, { column, beforeId, afterId })
   if (task.column !== before.column) {
     store.addTransition({
@@ -229,15 +235,30 @@ export function updateTask({ store, id, input }) {
     patch.permission = input.permission
     if (input.permission !== current.permission) {
       patch.permissionConfirmedAt = 0
+      patch.permissionConfirmedTier = ''
+    }
+  }
+  if (typeof input?.permissionConfirmedTier === 'string') {
+    patch.permissionConfirmedTier = input.permissionConfirmedTier
+  }
+  if (typeof input?.reasoningEffort === 'string') {
+    const val = input.reasoningEffort.trim().toLowerCase()
+    if (['', 'low', 'medium', 'high', 'default', 'none', 'minimal', 'thorough'].includes(val)) {
+      patch.reasoningEffort = val
     }
   }
+  if (typeof input?.forge === 'string') {
+    const val = input.forge.trim().toLowerCase()
+    if (val === 'github' || val === 'gitea') patch.forge = val
+  }
   return { task: store.updateTask(id, patch) }
 }
 
-export function confirmPermission({ store, id }) {
+export function confirmPermission({ store, id, tier }) {
   const task = store.getTask(id)
   if (task === undefined) return { error: 'task-not-found', status: 404 }
-  return { task: store.updateTask(id, { permissionConfirmedAt: Date.now() }) }
+  const effectiveTier = typeof tier === 'string' && tier ? tier : (task.permission || 'default')
+  return { task: store.updateTask(id, { permissionConfirmedAt: Date.now(), permissionConfirmedTier: effectiveTier }) }
 }
 
 /** Known priority values. Empty string indicates unprioritized. */
@@ -399,27 +420,22 @@ export function importBoard({ store, input }) {
     for (const task of input.tasks) {
       if (typeof task?.id !== 'string' || task.id === '') continue
       if (store.getTask(task.id) !== undefined) { skipped += 1; continue }
-      store.createTask({
-        id: task.id,
-        board: task.board ?? 'main',
-        column: task.column ?? 'backlog',
-        title: task.title ?? '',
-        body: task.body ?? '',
-        owner: task.owner, repo: task.repo,
-        issueNumber: task.issueNumber, issueUrl: task.issueUrl,
-        labels: Array.isArray(task.labels) ? task.labels : [],
-        branch: task.branch, worktree: task.worktree,
-        sessionId: task.sessionId, model: task.model, provider: task.provider,
-        waiting: task.waiting === true,
-        plan: task.plan ?? '',
-        labelColors: task.labelColors ?? {},
-        author: task.author ?? '',
-        priority: task.priority ?? '',
-        dueAt: typeof task.dueAt === 'number' ? task.dueAt : 0,
-        createdAt: task.createdAt,
-      })
+      if (typeof store.restoreTask === 'function') {
+        store.restoreTask(task)
+      } else {
+        store.createTask(task)
+      }
       imported += 1
     }
+
+    for (const trans of Array.isArray(input.transitions) ? input.transitions : []) {
+      if (typeof trans?.taskId !== 'string' || trans.taskId === '') continue
+      if (typeof store.restoreTransition === 'function') {
+        store.restoreTransition(trans)
+      } else if (typeof store.addTransition === 'function') {
+        store.addTransition(trans)
+      }
+    }
   }
 
   if (typeof store.withTransaction === 'function') {
@@ -458,7 +474,12 @@ export function exportTasksCsv({ store, board = 'main' }) {
 
   function escapeCsv(val) {
     if (val === null || val === undefined) return ''
-    const str = String(val)
+    let str = String(val)
+    // OWASP CSV Injection mitigation (#340)
+    const trimmed = str.replace(/^[\s\t\r\n]+/, '')
+    if (/^[=+\-@\t\r]/.test(str) || (trimmed.length > 0 && /^[=+\-@]/.test(trimmed))) {
+      str = `'${str}`
+    }
     if (str.includes(',') || str.includes('"') || str.includes('\n') || str.includes('\r')) {
       return `"${str.replace(/"/g, '""')}"`
     }
@@ -803,10 +824,11 @@ export function handleToggleChecklistItem({ store, task, input }) {
   let updatedItem
   if (typeof item === 'string') {
     const checked = input?.checked !== undefined ? Boolean(input.checked) : true
-    updatedItem = { text: item, done: checked }
+    updatedItem = { text: item, completed: checked, done: checked }
   } else {
-    const checked = input?.checked !== undefined ? Boolean(input.checked) : !item.done
-    updatedItem = { ...item, done: checked }
+    const isCurrentlyDone = item.completed !== undefined ? Boolean(item.completed) : Boolean(item.done)
+    const checked = input?.checked !== undefined ? Boolean(input.checked) : !isCurrentlyDone
+    updatedItem = { ...item, completed: checked, done: checked }
   }
   current[targetIndex] = updatedItem
   const updated = store.updateChecklist(task.id, current)