@goodandready/dsh-kanban 0.2.20 → 0.2.22

package/lib/store.js

@@ -13,7 +13,7 @@ import { DatabaseSync } from 'node:sqlite'
 import { randomUUID } from 'node:crypto'
 import { mkdirSync, copyFileSync, readdirSync, unlinkSync, statSync, chmodSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
-import { keyBetween } from './order.js'
+import { keyBetween, generateNKeysBetween } from './order.js'
 import { DEFAULT_BOARDS, normalizeKind } from './config.js'
 
 const SCHEMA = `
@@ -103,7 +103,7 @@ const WRITABLE = [
   'labelColors', 'queuedAt', 'createdAt', 'author', 'assignee', 'milestone', 'priority', 'dueAt',
   'cron', 'nextRunAt', 'lastRunAt', 'progressDump', 'permission', 'reasoningEffort', 'permissionConfirmedAt',
   'runs', 'checklist', 'report', 'comments', 'rejectReason', 'rejectedAt', 'parentId', 'isEpic',
-  'workflowRunId', 'workflowStatus',
+  'workflowRunId', 'workflowStatus', 'permissionConfirmedTier', 'forge',
 ]
 
 /** Valid transition sources; unexpected values are rejected to preserve log integrity. */
@@ -242,6 +242,8 @@ export function openStore({ dir }) {
     ['provider', "TEXT NOT NULL DEFAULT 'gitea'"],
     ['workflowRunId', "TEXT NOT NULL DEFAULT ''"],
     ['workflowStatus', "TEXT NOT NULL DEFAULT ''"],
+    ['forge', "TEXT NOT NULL DEFAULT ''"],
+    ['permissionConfirmedTier', "TEXT NOT NULL DEFAULT ''"],
   ]) {
     try { db.exec(`ALTER TABLE tasks ADD COLUMN ${column} ${definition}`) } catch { /* column already exists */ }
   }
@@ -258,6 +260,35 @@ export function openStore({ dir }) {
   db.exec('CREATE INDEX IF NOT EXISTS tasks_parent_id ON tasks(parentId)')
   db.exec('CREATE INDEX IF NOT EXISTS tasks_updated ON tasks(updatedAt)')
   db.exec('CREATE INDEX IF NOT EXISTS tasks_archivable ON tasks(archivedAt, col, columnAt)')
+  try { db.exec("ALTER TABLE dismissed ADD COLUMN forge TEXT NOT NULL DEFAULT ''") } catch { /* already exists */ }
+  db.exec("CREATE INDEX IF NOT EXISTS tasks_forge_issue ON tasks(forge, owner, repo, issueNumber)")
+  db.exec("UPDATE tasks SET forge = 'github' WHERE (forge = '' OR forge IS NULL) AND issueUrl LIKE '%github.com%'")
+  db.exec("UPDATE tasks SET forge = 'gitea' WHERE (forge = '' OR forge IS NULL) AND (issueUrl NOT LIKE '%github.com%' OR issueUrl IS NULL)")
+  db.exec("CREATE TABLE IF NOT EXISTS meta (key TEXT PRIMARY KEY, val TEXT)")
+
+  // Fractional indexing migration (#345): ensure all existing tasks have compact keys
+  const orderMigrated = db.prepare("SELECT val FROM meta WHERE key = 'fractional_indexing_migrated'").get()
+  if (!orderMigrated) {
+    try {
+      db.exec('BEGIN TRANSACTION')
+      const groups = db.prepare('SELECT DISTINCT board, col FROM tasks').all()
+      const getTasksInCol = db.prepare('SELECT id, position FROM tasks WHERE board = ? AND col = ? ORDER BY position ASC, createdAt ASC')
+      const updatePos = db.prepare('UPDATE tasks SET position = ? WHERE id = ?')
+      for (const group of groups) {
+        const rows = getTasksInCol.all(group.board, group.col)
+        if (rows.length > 0) {
+          const newKeys = generateNKeysBetween(null, null, rows.length)
+          for (let i = 0; i < rows.length; i++) {
+            updatePos.run(newKeys[i], rows[i].id)
+          }
+        }
+      }
+      db.prepare("INSERT OR REPLACE INTO meta (key, val) VALUES ('fractional_indexing_migrated', '1')").run()
+      db.exec('COMMIT')
+    } catch (e) {
+      try { db.exec('ROLLBACK') } catch { /* ignore */ }
+    }
+  }
   db.exec('PRAGMA synchronous = NORMAL')
   try { db.exec('PRAGMA optimize') } catch { /* pragma optimize best-effort */ }
 
@@ -274,6 +305,35 @@ export function openStore({ dir }) {
        checklist, report, comments, rejectReason, rejectedAt, reasoningEffort, parentId, isEpic,
        workflowRunId, workflowStatus)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`),
+    restoreTask: db.prepare(`INSERT INTO tasks
+      (id, board, col, position, title, body, owner, repo, issueNumber, issueUrl, externalRef,
+       labels, branch, worktree, workspaceId, sessionId, model, provider, waiting, syncedAt,
+       labelColors, author, assignee, milestone, priority, dueAt, columnAt, createdAt, updatedAt,
+       cron, nextRunAt, lastRunAt, progressDump, permission, permissionConfirmedAt, permissionConfirmedTier, runs,
+       checklist, report, comments, rejectReason, rejectedAt, reasoningEffort, parentId, isEpic,
+       workflowRunId, workflowStatus, archivedAt, queuedAt, plan, forge)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        board=excluded.board, col=excluded.col, position=excluded.position, title=excluded.title,
+        body=excluded.body, owner=excluded.owner, repo=excluded.repo, issueNumber=excluded.issueNumber,
+        issueUrl=excluded.issueUrl, externalRef=excluded.externalRef, labels=excluded.labels,
+        branch=excluded.branch, worktree=excluded.worktree, workspaceId=excluded.workspaceId,
+        sessionId=excluded.sessionId, model=excluded.model, provider=excluded.provider,
+        waiting=excluded.waiting, syncedAt=excluded.syncedAt, labelColors=excluded.labelColors,
+        author=excluded.author, assignee=excluded.assignee, milestone=excluded.milestone,
+        priority=excluded.priority, dueAt=excluded.dueAt, columnAt=excluded.columnAt,
+        createdAt=excluded.createdAt, updatedAt=excluded.updatedAt, cron=excluded.cron,
+        nextRunAt=excluded.nextRunAt, lastRunAt=excluded.lastRunAt, progressDump=excluded.progressDump,
+        permission=excluded.permission, permissionConfirmedAt=excluded.permissionConfirmedAt,
+        permissionConfirmedTier=excluded.permissionConfirmedTier, runs=excluded.runs,
+        checklist=excluded.checklist, report=excluded.report, comments=excluded.comments,
+        rejectReason=excluded.rejectReason, rejectedAt=excluded.rejectedAt,
+        reasoningEffort=excluded.reasoningEffort, parentId=excluded.parentId, isEpic=excluded.isEpic,
+        workflowRunId=excluded.workflowRunId, workflowStatus=excluded.workflowStatus,
+        archivedAt=excluded.archivedAt, queuedAt=excluded.queuedAt, plan=excluded.plan, forge=excluded.forge`),
+    restoreTransition: db.prepare(`INSERT INTO transitions
+      (taskId, fromCol, toCol, source, detail, at)
+      VALUES (?, ?, ?, ?, ?, ?)`),
     boardById: db.prepare('SELECT * FROM boards WHERE id = ?'),
     insertBoard: db.prepare('INSERT INTO boards (id, title, kind, position, createdAt) VALUES (?, ?, ?, ?, ?)'),
     lastBoard: db.prepare('SELECT position FROM boards ORDER BY position DESC LIMIT 1'),
@@ -286,7 +346,9 @@ export function openStore({ dir }) {
       "SELECT * FROM tasks WHERE archivedAt = 0 AND col = 'done' AND columnAt > 0 AND columnAt <= ?"),
     dismiss: db.prepare('INSERT OR REPLACE INTO dismissed (owner, repo, issueNumber, at) VALUES (?, ?, ?, ?)'),
     isDismissed: db.prepare('SELECT 1 FROM dismissed WHERE owner = ? AND repo = ? AND issueNumber = ?'),
+    isDismissedWithForge: db.prepare(`SELECT 1 FROM dismissed WHERE owner = ? AND repo = ? AND issueNumber = ? AND (forge = ? OR (forge = '' AND ? = 'gitea'))`),
     byIssue: db.prepare('SELECT * FROM tasks WHERE owner = ? AND repo = ? AND issueNumber = ?'),
+    byIssueWithForge: db.prepare(`SELECT * FROM tasks WHERE owner = ? AND repo = ? AND issueNumber = ? AND (forge = ? OR (forge = '' AND ? = 'gitea'))`),
     byExternalRef: db.prepare('SELECT * FROM tasks WHERE externalRef = ? ORDER BY createdAt ASC LIMIT 1'),
     tasksBySession: db.prepare('SELECT * FROM tasks WHERE sessionId = ? LIMIT 1'),
     lastInColumn: db.prepare('SELECT position FROM tasks WHERE board = ? AND col = ? ORDER BY position DESC LIMIT 1'),
@@ -541,13 +603,103 @@ export function openStore({ dir }) {
       return this.updateTask(id, { comments })
     },
 
+    addTaskComment(id, comment) {
+      if (!comment || typeof comment !== 'object') return undefined
+      return this.addComment(id, {
+        author: comment.author,
+        role: comment.role,
+        text: comment.text || comment.body || '',
+      })
+    },
+
     updateChecklist(id, items) {
       const task = rowToTask(q.taskById.get(id))
       if (!task) return undefined
-      const list = Array.isArray(items) ? items : []
+      const list = (Array.isArray(items) ? items : []).map((item) => {
+        if (typeof item === 'string') return { text: item, completed: false, done: false }
+        const c = item.completed !== undefined ? Boolean(item.completed) : Boolean(item.done)
+        return { ...item, completed: c, done: c }
+      })
       return this.updateTask(id, { checklist: list })
     },
 
+    restoreTask(task) {
+      if (!task || !task.id) return undefined
+      const labels = JSON.stringify(Array.isArray(task.labels) ? task.labels : [])
+      const colors = JSON.stringify(task.labelColors && typeof task.labelColors === 'object' ? task.labelColors : {})
+      const runs = JSON.stringify(Array.isArray(task.runs) ? task.runs : [])
+      const checklist = JSON.stringify(Array.isArray(task.checklist) ? task.checklist : [])
+      const report = JSON.stringify(task.report && typeof task.report === 'object' ? task.report : {})
+      const comments = JSON.stringify(Array.isArray(task.comments) ? task.comments : [])
+      const forge = task.forge || (typeof task.issueUrl === 'string' && task.issueUrl.includes('github.com') ? 'github' : 'gitea')
+      q.restoreTask.run(
+        task.id,
+        task.board || 'main',
+        task.column || task.col || 'backlog',
+        task.position || keyBetween(undefined, undefined),
+        task.title || '',
+        task.body || '',
+        task.owner ?? null,
+        task.repo ?? null,
+        task.issueNumber ?? null,
+        task.issueUrl ?? null,
+        task.externalRef ?? null,
+        labels,
+        task.branch ?? null,
+        task.worktree ?? null,
+        task.workspaceId || '',
+        task.sessionId ?? null,
+        task.model ?? null,
+        task.provider ?? 'gitea',
+        task.waiting ? 1 : 0,
+        task.syncedAt || 0,
+        colors,
+        task.author || '',
+        task.assignee || '',
+        task.milestone || '',
+        task.priority || '',
+        task.dueAt || 0,
+        task.columnAt || task.createdAt || Date.now(),
+        task.createdAt || Date.now(),
+        task.updatedAt || Date.now(),
+        task.cron || '',
+        task.nextRunAt || 0,
+        task.lastRunAt || 0,
+        task.progressDump || '',
+        task.permission || '',
+        task.permissionConfirmedAt || 0,
+        task.permissionConfirmedTier || '',
+        runs,
+        checklist,
+        report,
+        comments,
+        task.rejectReason || '',
+        task.rejectedAt || 0,
+        task.reasoningEffort || '',
+        task.parentId || '',
+        task.isEpic ? 1 : 0,
+        task.workflowRunId || '',
+        task.workflowStatus || '',
+        task.archivedAt || 0,
+        task.queuedAt || 0,
+        task.plan || '',
+        forge,
+      )
+      return rowToTask(q.taskById.get(task.id))
+    },
+
+    restoreTransition(trans) {
+      if (!trans || !trans.taskId) return undefined
+      q.restoreTransition.run(
+        trans.taskId,
+        trans.fromCol ?? null,
+        trans.toCol || '',
+        trans.source || 'unknown',
+        trans.detail || '',
+        trans.at || Date.now(),
+      )
+    },
+
     setReport(id, reportData) {
       const task = rowToTask(q.taskById.get(id))
       if (!task) return undefined
@@ -612,12 +764,18 @@ export function openStore({ dir }) {
     },
 
     /** Whether an issue was previously dismissed. */
-    isDismissed({ owner, repo, issueNumber }) {
+    isDismissed({ owner, repo, issueNumber, forge }) {
+      if (forge) {
+        return q.isDismissedWithForge.get(owner, repo, issueNumber, forge, forge) !== undefined
+      }
       return q.isDismissed.get(owner, repo, issueNumber) !== undefined
     },
 
     /** Find task by issue to prevent duplicate import. */
-    findTaskByIssue({ owner, repo, issueNumber }) {
+    findTaskByIssue({ owner, repo, issueNumber, forge }) {
+      if (forge) {
+        return rowToTask(q.byIssueWithForge.get(owner, repo, issueNumber, forge, forge))
+      }
       return rowToTask(q.byIssue.get(owner, repo, issueNumber))
     },
 
@@ -658,8 +816,9 @@ export function openStore({ dir }) {
     },
 
     setArchived(id, archivedAt) {
+      const at = typeof archivedAt === 'boolean' ? (archivedAt ? Date.now() : 0) : (Number(archivedAt) || 0)
       db.prepare('UPDATE tasks SET archivedAt = ?, updatedAt = ? WHERE id = ?')
-        .run(archivedAt, Date.now(), id)
+        .run(at, Date.now(), id)
       return rowToTask(q.taskById.get(id))
     },
 

package/lib/sync.js

@@ -39,7 +39,7 @@ export async function withBackoff(fn, { retries = 2, baseMs = 50, maxMs = 500 }
  * Failures are not silently swallowed: incomplete observations (missing PRs or branches)
  * would lead to erroneous column transitions. If reading fails, the repository is skipped.
  */
-async function readRepo({ gitea, owner, repo }) {
+async function readRepo({ gitea, owner, repo, forge }) {
   const [pulls, branches] = await Promise.all([
     gitea.listPulls({ owner, repo, state: 'all' }),
     gitea.listBranches({ owner, repo }),
@@ -182,8 +182,9 @@ export async function syncAll({ gitea, store, logger, only, now = Date.now() })
   const tasks = store.listWatchable().filter((t) => (only ? only(t) : true))
   const byRepo = new Map()
   for (const task of tasks) {
-    const key = `${task.owner}/${task.repo}`
-    if (!byRepo.has(key)) byRepo.set(key, { owner: task.owner, repo: task.repo, tasks: [] })
+    const forge = task.forge || (typeof task.issueUrl === 'string' && task.issueUrl.includes('github.com') ? 'github' : 'gitea')
+    const key = `${forge}:${task.owner}/${task.repo}`
+    if (!byRepo.has(key)) byRepo.set(key, { forge, owner: task.owner, repo: task.repo, tasks: [] })
     byRepo.get(key).tasks.push(task)
   }
 
@@ -200,7 +201,7 @@ export async function syncAll({ gitea, store, logger, only, now = Date.now() })
   for (const group of byRepo.values()) {
     let repoState
     try {
-      repoState = await withBackoff(() => readRepo({ gitea, owner: group.owner, repo: group.repo }), { retries: 2, baseMs: 40 })
+      repoState = await withBackoff(() => readRepo({ gitea, owner: group.owner, repo: group.repo, forge: group.forge }), { retries: 2, baseMs: 40 })
     } catch (error) {
       failed += group.tasks.length
       reposFailed += 1
@@ -212,7 +213,7 @@ export async function syncAll({ gitea, store, logger, only, now = Date.now() })
     for (const task of group.tasks) {
       checked += 1
       try {
-        const issue = await gitea.getIssue({ owner: task.owner, repo: task.repo, index: task.issueNumber })
+        const issue = await gitea.getIssue({ owner: task.owner, repo: task.repo, index: task.issueNumber, provider: group.forge, issueUrl: task.issueUrl })
         const observation = observeTask(task, repoState, issue)
         const applied = applyObservation({
           store, task, observation, issue, remoteUpdatedAt: issue?.updated_at,

package/lib/transitions.js

@@ -1,3 +1,7 @@
+function escapeRegex(str) {
+  return String(str).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
 // Card auto-movement: derive column from observations and source priority.
 // Pure module without network, storage, or harness dependencies.
 // Observations arrive as data, verdicts return as values.
@@ -85,19 +89,19 @@ export function branchOfTask(task, branches) {
 
   // Agent creates branch matching workflow conventions with issue number.
   // Look up by issue number rather than fixed string template.
-  if (typeof task?.issueNumber !== 'number') return undefined
-  const marker = String(task.issueNumber)
+  if (!Number.isSafeInteger(task?.issueNumber) || task.issueNumber <= 0) return undefined
+  const marker = escapeRegex(task.issueNumber)
   return names.find((n) => new RegExp(`(^|[^0-9])${marker}([^0-9]|$)`).test(n))
 }
 
 /** Pull requests related to task: matched by branch or issue reference. */
 export function pullsOfTask(task, pulls, branch) {
-  const number = typeof task?.issueNumber === 'number' ? task.issueNumber : undefined
+  const number = Number.isSafeInteger(task?.issueNumber) && task.issueNumber > 0 ? task.issueNumber : undefined
   return (pulls ?? []).filter((p) => {
     if (branch !== undefined && p?.head?.ref === branch) return true
     if (number === undefined) return false
     const haystack = `${p?.title ?? ''} ${p?.body ?? ''}`
-    return new RegExp(`#${number}([^0-9]|$)`).test(haystack)
+    return new RegExp(`#${escapeRegex(number)}([^0-9]|$)`).test(haystack)
   })
 }
 

package/lib/workflow-bridge.js

@@ -11,7 +11,14 @@
 //    - post summary to linked Gitea / GitHub issue.
 // 5. Cancel active workflow on card request.
 
-import { buildStartMessage, obtainAgent } from './launcher.js'
+import {
+  buildStartMessage,
+  obtainAgent,
+  verifyPermissionGate,
+  countActiveSessions,
+  reserveSessionSlot,
+  releaseSessionSlot,
+} from './launcher.js'
 import { applyMove } from './routes.js'
 import { defaultGitRunner } from './worktree.js'
 
@@ -120,18 +127,20 @@ export function resolvePreset({ role, availablePresets = [], defaultPreset = und
  * @returns {string}
  */
 export function buildWorkflowScript({ task, role }) {
-  const taskId = String(task?.id || 'unknown').replace(/["\\]/g, '')
-  const safeRole = String(role || 'backend').replace(/["\\]/g, '')
-  const issueNum = task?.issueNumber ? `#${task.issueNumber}` : taskId
+  const rawRole = String(role || 'backend')
+  const rawTaskId = String(task?.id || 'unknown')
+  const validIssue = Number.isSafeInteger(task?.issueNumber) && task.issueNumber > 0 ? task.issueNumber : undefined
+  const cardLabel = validIssue !== undefined ? `#${validIssue}` : rawTaskId
+  const logMsg = `Starting phase ${rawRole} for card ${cardLabel}`
 
   return [
-    `phase("${safeRole}");`,
-    `log("Starting phase ${safeRole} for card ${issueNum}");`,
+    `phase(${JSON.stringify(rawRole)});`,
+    `log(${JSON.stringify(logMsg)});`,
     `const prompt = args.prompt;`,
-    `const result = await agent(prompt, { label: "${safeRole}", phase: "${safeRole}" });`,
+    `const result = await agent(prompt, { label: ${JSON.stringify(rawRole)}, phase: ${JSON.stringify(rawRole)} });`,
     `return {`,
-    `  role: "${safeRole}",`,
-    `  taskId: "${taskId}",`,
+    `  role: ${JSON.stringify(rawRole)},`,
+    `  taskId: ${JSON.stringify(rawTaskId)},`,
     `  summary: typeof result === 'string' ? result : (result ? JSON.stringify(result) : '')`,
     `};`,
   ].join('\n')
@@ -167,11 +176,11 @@ export function buildWorkflowMeta({ task, role }) {
  */
 export function resolveTargetColumn(currentCol) {
   const col = String(currentCol || '').toLowerCase()
-  if (col === 'backlog' || col === 'ready' || col === 'progress') {
+  if (col === 'backlog' || col === 'ready' || col === 'progress' || col === 'in-progress') {
     return 'review'
   }
   if (col === 'review') {
-    return 'done'
+    return 'review'
   }
   return col || 'review'
 }
@@ -266,21 +275,40 @@ export class WorkflowBridge {
     })
 
     const config = this.getConfig()
-    const taken = await obtainAgent({
-      agents: this.agents,
-      task,
-      config,
-      provider,
-      model,
-      mintSessionId,
-      cwdOf,
-      logger: this.logger,
-      agentPreset: preset,
-      permission,
-      permissions,
-      gitRunner,
-      workspaceRegistry,
-    })
+    verifyPermissionGate({ task, permission, config })
+
+    const maxConcurrent = typeof config?.maxConcurrentSessions === 'number' ? config.maxConcurrentSessions : 3
+    if (maxConcurrent > 0 && this.agents && this.store) {
+      const activeCount = countActiveSessions({ store: this.store, agents: this.agents })
+      if (activeCount >= maxConcurrent) {
+        const err = new Error('concurrent-limit-reached')
+        err.key = 'concurrent-limit-reached'
+        err.status = 429
+        throw err
+      }
+    }
+
+    reserveSessionSlot(task.id)
+    let taken
+    try {
+      taken = await obtainAgent({
+        agents: this.agents,
+        task,
+        config,
+        provider,
+        model,
+        mintSessionId,
+        cwdOf,
+        logger: this.logger,
+        agentPreset: preset,
+        permission,
+        permissions,
+        gitRunner,
+        workspaceRegistry,
+      })
+    } finally {
+      releaseSessionSlot(task.id)
+    }
 
     const promptText = typeof text === 'string' && text.trim() !== ''
       ? text.trim()
@@ -469,11 +497,13 @@ export class WorkflowBridge {
       }
 
       // Add comment to card
-      if (typeof this.store.addTaskComment === 'function' && summary) {
-        this.store.addTaskComment(taskId, {
-          author: 'workflow',
-          body: `🚀 **Workflow completed (${role}):**\n\n${summary}`,
-        })
+      if (summary) {
+        const text = `🚀 **Workflow completed (${role}):**\n\n${summary}`
+        if (typeof this.store?.addComment === 'function') {
+          this.store.addComment(taskId, { author: 'workflow', role: 'workflow', text })
+        } else if (typeof this.store?.addTaskComment === 'function') {
+          this.store.addTaskComment(taskId, { author: 'workflow', role: 'workflow', text, body: text })
+        }
       }
     } else {
       this.store.addTransition({

package/lib/worktree.js

@@ -30,10 +30,11 @@ export async function defaultGitRunner(args, cwd) {
       maxBuffer: 10 * 1024 * 1024,
       env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
     })
-    return { stdout: stdout.trim(), stderr: stderr.trim(), code: 0 }
+    return { stdout: stdout.trim(), stderr: stderr.trim(), code: 0, exitCode: 0 }
   } catch (err) {
     const error = new Error(`git ${args.join(' ')} failed: ${err.stderr || err.message}`)
     error.code = err.code || 1
+    error.exitCode = err.code || 1
     error.stdout = err.stdout ? String(err.stdout).trim() : ''
     error.stderr = err.stderr ? String(err.stderr).trim() : ''
     throw error
@@ -87,6 +88,22 @@ export function resolveWorktreeRoot(config, env = process.env, cwdOf = () => pro
 /**
  * Resolve canonical worktree path for task with path traversal protection.
  */
+export function isSafeBranchName(name) {
+  if (typeof name !== 'string') return false
+  const trimmed = name.trim()
+  if (trimmed === '' || trimmed.startsWith('-') || trimmed.startsWith('/') || trimmed.endsWith('/')) return false
+  if (trimmed.includes('..') || trimmed.includes('~') || trimmed.includes('^') || trimmed.includes(':') || trimmed.includes('?') || trimmed.includes('*') || trimmed.includes('[') || trimmed.includes('\\') || trimmed.includes('@{') || trimmed.endsWith('.lock')) return false
+  return /^[A-Za-z0-9_./-]+$/.test(trimmed)
+}
+
+export function isPathFenced(targetPath, rootPath) {
+  if (!targetPath || !rootPath) return false
+  const resolvedTarget = resolve(targetPath)
+  const resolvedRoot = resolve(rootPath)
+  const fence = resolvedRoot.endsWith(sep) || resolvedRoot.endsWith('/') ? resolvedRoot : resolvedRoot + sep
+  return resolvedTarget === resolvedRoot || resolvedTarget.startsWith(fence)
+}
+
 export function resolveTaskWorktreePath({ task, config, env, cwdOf }) {
   const root = resolveWorktreeRoot(config, env, cwdOf)
   const repoKey = safeRepoKey(task)
@@ -248,7 +265,7 @@ export async function checkWorktreeDirty({ worktreePath, gitRunner = defaultGitR
       .filter((line) => !isSubmoduleDrift(worktreePath, line))
     return { dirty: files.length > 0, files }
   } catch (error) {
-    return { dirty: false, files: [], error: String(error?.message ?? error) }
+    return { dirty: true, files: [], error: String(error?.message ?? error) }
   }
 }
 
@@ -262,12 +279,24 @@ export async function removeTaskWorktree({
   force = false,
   deleteBranch = true,
   gitRunner = defaultGitRunner,
+  rootPath,
 }) {
   if (!worktreePath || !existsSync(worktreePath)) {
     return { removed: false, reason: 'not-found' }
   }
 
+  if (rootPath && !isPathFenced(worktreePath, rootPath)) {
+    return { removed: false, error: 'unfenced-worktree-path' }
+  }
+
   const dirtyCheck = await checkWorktreeDirty({ worktreePath, gitRunner })
+  if (dirtyCheck.error) {
+    return {
+      removed: false,
+      error: 'worktree-status-error',
+      detail: dirtyCheck.error,
+    }
+  }
   if (dirtyCheck.dirty && !force) {
     return {
       removed: false,
@@ -333,11 +362,26 @@ export async function cleanupTaskWorktree({
   force = false,
   deleteBranch = true,
   gitRunner = defaultGitRunner,
+  config,
+  env,
+  cwdOf,
 }) {
   const current = typeof task === 'object' && task !== null ? task : store?.getTask?.(task)
   if (!current) return { error: 'task-not-found', status: 404 }
   if (!current.worktree) return { noop: true, removed: false }
 
+  const root = resolveWorktreeRoot(config, env, cwdOf)
+  const candidateRoots = [
+    root,
+    repoDir,
+    typeof cwdOf === 'function' ? cwdOf() : process.cwd(),
+    process.cwd(),
+  ].filter(Boolean)
+  const isFenced = candidateRoots.some((c) => isPathFenced(current.worktree, c))
+  if (!isFenced) {
+    return { error: 'unfenced-worktree-path', status: 403 }
+  }
+
   const targetRepoDir = repoDir || current.worktree
   const result = await removeTaskWorktree({
     repoDir: targetRepoDir,
@@ -395,21 +439,21 @@ export async function getTaskDiff({ worktreePath, baseRef, gitRunner = defaultGi
   let diffOut = ''
   if (base) {
     const res = await gitRunner(['diff', `${base}...HEAD`], worktreePath)
-    if (res.exitCode === 0) {
+    if ((res?.exitCode ?? res?.code ?? 0) === 0) {
       diffOut = res.stdout
     }
   }
 
   // Include uncommitted changes (unstaged + staged)
   const unstaged = await gitRunner(['diff', 'HEAD'], worktreePath)
-  if (unstaged.exitCode === 0 && unstaged.stdout.trim() !== '') {
+  if ((unstaged?.exitCode ?? unstaged?.code ?? 0) === 0 && unstaged.stdout.trim() !== '') {
     diffOut = diffOut ? `${diffOut}\n\n# Uncommitted Changes:\n${unstaged.stdout}` : unstaged.stdout
   }
 
   // Fallback to plain git diff if base...HEAD produced no output
   if (!diffOut.trim()) {
     const fallback = await gitRunner(['diff'], worktreePath)
-    if (fallback.exitCode === 0) diffOut = fallback.stdout
+    if ((fallback?.exitCode ?? fallback?.code ?? 0) === 0) diffOut = fallback.stdout
   }
 
   // Count affected files
@@ -445,10 +489,10 @@ export async function getTaskCommits({ worktreePath, baseRef, gitRunner = defaul
 
   const range = base ? `${base}..HEAD` : '-n 20'
   const logRes = await gitRunner(['log', range, '--pretty=format:%h%x09%an%x09%ad%x09%s', '--date=short'], worktreePath)
-  if (logRes.exitCode !== 0 || !logRes.stdout.trim()) {
+  if ((logRes?.exitCode ?? logRes?.code ?? 0) !== 0 || !logRes.stdout.trim()) {
     // Fallback to last 10 commits
     const fallback = await gitRunner(['log', '-n', '10', '--pretty=format:%h%x09%an%x09%ad%x09%s', '--date=short'], worktreePath)
-    if (fallback.exitCode !== 0 || !fallback.stdout.trim()) return []
+    if ((fallback?.exitCode ?? fallback?.code ?? 0) !== 0 || !fallback.stdout.trim()) return []
     return fallback.stdout.trim().split('\n').map(parseCommitLine).filter(Boolean)
   }
 
@@ -479,8 +523,15 @@ export async function mergeTaskWorktree({
     return { success: false, merged: false, error: 'no-worktree-or-branch' }
   }
 
+  if (targetBranch && !isSafeBranchName(targetBranch)) {
+    return { success: false, merged: false, error: 'invalid-target-branch' }
+  }
+
   // 1. Verify worktree cleanliness
   const dirtyCheck = await checkWorktreeDirty({ worktreePath: task.worktree, gitRunner })
+  if (dirtyCheck.error) {
+    return { success: false, merged: false, error: 'worktree-status-error', detail: dirtyCheck.error }
+  }
   if (dirtyCheck.dirty) {
     return { success: false, merged: false, error: 'worktree-dirty', files: dirtyCheck.files }
   }
@@ -488,7 +539,7 @@ export async function mergeTaskWorktree({
   // 2. Locate main repository root
   let mainRepoDir = ''
   const revParse = await gitRunner(['rev-parse', '--git-common-dir'], task.worktree)
-  if (revParse.exitCode === 0 && revParse.stdout.trim()) {
+  if ((revParse?.exitCode ?? revParse?.code ?? 0) === 0 && revParse.stdout.trim()) {
     const commonDir = revParse.stdout.trim()
     mainRepoDir = commonDir.endsWith('/.git') ? commonDir.slice(0, -5) : commonDir
   }
@@ -499,16 +550,19 @@ export async function mergeTaskWorktree({
 
   // 3. Resolve target merge branch
   let target = targetBranch
+  if (target && !isSafeBranchName(target)) {
+    return { success: false, merged: false, error: 'invalid-target-branch' }
+  }
   if (!target) {
     target = await determineBaseRef(mainRepoDir, gitRunner)
   }
-  if (!target) target = 'main'
+  if (!target || !isSafeBranchName(target)) target = 'main'
 
   // 4. Switch or verify target branch in main repository
   const currentBranch = await gitRunner(['branch', '--show-current'], mainRepoDir)
   if (currentBranch.stdout.trim() !== target) {
-    const checkoutRes = await gitRunner(['checkout', target], mainRepoDir)
-    if (checkoutRes.exitCode !== 0) {
+    const checkoutRes = await gitRunner(['checkout', '--', target], mainRepoDir)
+    if ((checkoutRes?.exitCode ?? checkoutRes?.code ?? 0) !== 0) {
       return { success: false, merged: false, error: 'checkout-target-failed', detail: checkoutRes.stderr }
     }
   }
@@ -516,7 +570,7 @@ export async function mergeTaskWorktree({
   // 5. Execute git merge --no-ff
   const mergeMsg = `Merge branch '${task.branch}' for task ${task.id}`
   const mergeRes = await gitRunner(['merge', '--no-ff', task.branch, '-m', mergeMsg], mainRepoDir)
-  if (mergeRes.exitCode !== 0) {
+  if ((mergeRes?.exitCode ?? mergeRes?.code ?? 0) !== 0) {
     // Roll back merge on conflict
     await gitRunner(['merge', '--abort'], mainRepoDir)
     return { success: false, merged: false, error: 'merge-conflict', detail: mergeRes.stderr || mergeRes.stdout }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-kanban",
-  "version": "0.2.20",
+  "version": "0.2.22",
   "description": "Visual Kanban board for DeepSeek Harness: Gitea and GitHub-backed tasks, workflow columns, and a dedicated agent session per task.",
   "type": "module",
   "main": "lib/index.js",