@goodandready/dsh-kanban 0.2.21 → 0.2.22

package/lib/progress-dump.js

@@ -62,15 +62,22 @@ export function parseProgressDump(text) {
     const line = rawLine.trim()
     const lower = line.toLowerCase()
 
-    if (lower.startsWith('goal:') || lower.startsWith('\u0446\u0435\u043b\u044c:')) {
+    if (lower.startsWith('goal:') || lower.startsWith('цель:')) {
       currentKey = 'goal'
       const val = line.slice(line.indexOf(':') + 1).trim()
       if (val) sections.goal.push(val)
-    } else if (lower.startsWith('progress:') || lower.startsWith('\u043f\u0440\u043e\u0433\u0440\u0435\u0441\u0441:')) {
+    } else if (lower.startsWith('progress:') || lower.startsWith('done:') || lower.startsWith('прогресс:')) {
       currentKey = 'progress'
       const val = line.slice(line.indexOf(':') + 1).trim()
       if (val) sections.progress.push(val)
-    } else if (lower.startsWith('next:') || lower.startsWith('next steps:') || lower.startsWith('\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0448\u0430\u0433\u0438:') || lower.startsWith('\u0448\u0430\u0433\u0438:')) {
+    } else if (
+      lower.startsWith('next:') ||
+      lower.startsWith('next steps:') ||
+      lower.startsWith('next step:') ||
+      lower.startsWith('следующие шаги:') ||
+      lower.startsWith('шаги:') ||
+      lower.startsWith('дальше:')
+    ) {
       currentKey = 'next'
       const val = line.slice(line.indexOf(':') + 1).trim()
       if (val) sections.next.push(val)
@@ -98,16 +105,14 @@ export function parseProgressDump(text) {
  */
 export function formatProgressDump(dump) {
   if (!dump) return ''
+  const g = dump.goal || ''
+  const p = dump.progress || ''
+  const n = dump.next || ''
   return [
     BEGIN_MARKER,
-    'Goal:',
-    dump.goal || '—',
-    '',
-    'Progress:',
-    dump.progress || '—',
-    '',
-    'Next steps:',
-    dump.next || '—',
+    `Goal: ${g}`,
+    `Progress: ${p}`,
+    `Next steps: ${n}`,
     END_MARKER,
   ].join('\n')
 }

package/lib/routes.js

@@ -235,15 +235,30 @@ export function updateTask({ store, id, input }) {
     patch.permission = input.permission
     if (input.permission !== current.permission) {
       patch.permissionConfirmedAt = 0
+      patch.permissionConfirmedTier = ''
     }
   }
+  if (typeof input?.permissionConfirmedTier === 'string') {
+    patch.permissionConfirmedTier = input.permissionConfirmedTier
+  }
+  if (typeof input?.reasoningEffort === 'string') {
+    const val = input.reasoningEffort.trim().toLowerCase()
+    if (['', 'low', 'medium', 'high', 'default', 'none', 'minimal', 'thorough'].includes(val)) {
+      patch.reasoningEffort = val
+    }
+  }
+  if (typeof input?.forge === 'string') {
+    const val = input.forge.trim().toLowerCase()
+    if (val === 'github' || val === 'gitea') patch.forge = val
+  }
   return { task: store.updateTask(id, patch) }
 }
 
-export function confirmPermission({ store, id }) {
+export function confirmPermission({ store, id, tier }) {
   const task = store.getTask(id)
   if (task === undefined) return { error: 'task-not-found', status: 404 }
-  return { task: store.updateTask(id, { permissionConfirmedAt: Date.now() }) }
+  const effectiveTier = typeof tier === 'string' && tier ? tier : (task.permission || 'default')
+  return { task: store.updateTask(id, { permissionConfirmedAt: Date.now(), permissionConfirmedTier: effectiveTier }) }
 }
 
 /** Known priority values. Empty string indicates unprioritized. */
@@ -405,27 +420,22 @@ export function importBoard({ store, input }) {
     for (const task of input.tasks) {
       if (typeof task?.id !== 'string' || task.id === '') continue
       if (store.getTask(task.id) !== undefined) { skipped += 1; continue }
-      store.createTask({
-        id: task.id,
-        board: task.board ?? 'main',
-        column: task.column ?? 'backlog',
-        title: task.title ?? '',
-        body: task.body ?? '',
-        owner: task.owner, repo: task.repo,
-        issueNumber: task.issueNumber, issueUrl: task.issueUrl,
-        labels: Array.isArray(task.labels) ? task.labels : [],
-        branch: task.branch, worktree: task.worktree,
-        sessionId: task.sessionId, model: task.model, provider: task.provider,
-        waiting: task.waiting === true,
-        plan: task.plan ?? '',
-        labelColors: task.labelColors ?? {},
-        author: task.author ?? '',
-        priority: task.priority ?? '',
-        dueAt: typeof task.dueAt === 'number' ? task.dueAt : 0,
-        createdAt: task.createdAt,
-      })
+      if (typeof store.restoreTask === 'function') {
+        store.restoreTask(task)
+      } else {
+        store.createTask(task)
+      }
       imported += 1
     }
+
+    for (const trans of Array.isArray(input.transitions) ? input.transitions : []) {
+      if (typeof trans?.taskId !== 'string' || trans.taskId === '') continue
+      if (typeof store.restoreTransition === 'function') {
+        store.restoreTransition(trans)
+      } else if (typeof store.addTransition === 'function') {
+        store.addTransition(trans)
+      }
+    }
   }
 
   if (typeof store.withTransaction === 'function') {
@@ -464,7 +474,12 @@ export function exportTasksCsv({ store, board = 'main' }) {
 
   function escapeCsv(val) {
     if (val === null || val === undefined) return ''
-    const str = String(val)
+    let str = String(val)
+    // OWASP CSV Injection mitigation (#340)
+    const trimmed = str.replace(/^[\s\t\r\n]+/, '')
+    if (/^[=+\-@\t\r]/.test(str) || (trimmed.length > 0 && /^[=+\-@]/.test(trimmed))) {
+      str = `'${str}`
+    }
     if (str.includes(',') || str.includes('"') || str.includes('\n') || str.includes('\r')) {
       return `"${str.replace(/"/g, '""')}"`
     }
@@ -809,10 +824,11 @@ export function handleToggleChecklistItem({ store, task, input }) {
   let updatedItem
   if (typeof item === 'string') {
     const checked = input?.checked !== undefined ? Boolean(input.checked) : true
-    updatedItem = { text: item, done: checked }
+    updatedItem = { text: item, completed: checked, done: checked }
   } else {
-    const checked = input?.checked !== undefined ? Boolean(input.checked) : !item.done
-    updatedItem = { ...item, done: checked }
+    const isCurrentlyDone = item.completed !== undefined ? Boolean(item.completed) : Boolean(item.done)
+    const checked = input?.checked !== undefined ? Boolean(input.checked) : !isCurrentlyDone
+    updatedItem = { ...item, completed: checked, done: checked }
   }
   current[targetIndex] = updatedItem
   const updated = store.updateChecklist(task.id, current)

package/lib/store.js

@@ -13,7 +13,7 @@ import { DatabaseSync } from 'node:sqlite'
 import { randomUUID } from 'node:crypto'
 import { mkdirSync, copyFileSync, readdirSync, unlinkSync, statSync, chmodSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
-import { keyBetween } from './order.js'
+import { keyBetween, generateNKeysBetween } from './order.js'
 import { DEFAULT_BOARDS, normalizeKind } from './config.js'
 
 const SCHEMA = `
@@ -103,7 +103,7 @@ const WRITABLE = [
   'labelColors', 'queuedAt', 'createdAt', 'author', 'assignee', 'milestone', 'priority', 'dueAt',
   'cron', 'nextRunAt', 'lastRunAt', 'progressDump', 'permission', 'reasoningEffort', 'permissionConfirmedAt',
   'runs', 'checklist', 'report', 'comments', 'rejectReason', 'rejectedAt', 'parentId', 'isEpic',
-  'workflowRunId', 'workflowStatus',
+  'workflowRunId', 'workflowStatus', 'permissionConfirmedTier', 'forge',
 ]
 
 /** Valid transition sources; unexpected values are rejected to preserve log integrity. */
@@ -242,6 +242,8 @@ export function openStore({ dir }) {
     ['provider', "TEXT NOT NULL DEFAULT 'gitea'"],
     ['workflowRunId', "TEXT NOT NULL DEFAULT ''"],
     ['workflowStatus', "TEXT NOT NULL DEFAULT ''"],
+    ['forge', "TEXT NOT NULL DEFAULT ''"],
+    ['permissionConfirmedTier', "TEXT NOT NULL DEFAULT ''"],
   ]) {
     try { db.exec(`ALTER TABLE tasks ADD COLUMN ${column} ${definition}`) } catch { /* column already exists */ }
   }
@@ -258,6 +260,35 @@ export function openStore({ dir }) {
   db.exec('CREATE INDEX IF NOT EXISTS tasks_parent_id ON tasks(parentId)')
   db.exec('CREATE INDEX IF NOT EXISTS tasks_updated ON tasks(updatedAt)')
   db.exec('CREATE INDEX IF NOT EXISTS tasks_archivable ON tasks(archivedAt, col, columnAt)')
+  try { db.exec("ALTER TABLE dismissed ADD COLUMN forge TEXT NOT NULL DEFAULT ''") } catch { /* already exists */ }
+  db.exec("CREATE INDEX IF NOT EXISTS tasks_forge_issue ON tasks(forge, owner, repo, issueNumber)")
+  db.exec("UPDATE tasks SET forge = 'github' WHERE (forge = '' OR forge IS NULL) AND issueUrl LIKE '%github.com%'")
+  db.exec("UPDATE tasks SET forge = 'gitea' WHERE (forge = '' OR forge IS NULL) AND (issueUrl NOT LIKE '%github.com%' OR issueUrl IS NULL)")
+  db.exec("CREATE TABLE IF NOT EXISTS meta (key TEXT PRIMARY KEY, val TEXT)")
+
+  // Fractional indexing migration (#345): ensure all existing tasks have compact keys
+  const orderMigrated = db.prepare("SELECT val FROM meta WHERE key = 'fractional_indexing_migrated'").get()
+  if (!orderMigrated) {
+    try {
+      db.exec('BEGIN TRANSACTION')
+      const groups = db.prepare('SELECT DISTINCT board, col FROM tasks').all()
+      const getTasksInCol = db.prepare('SELECT id, position FROM tasks WHERE board = ? AND col = ? ORDER BY position ASC, createdAt ASC')
+      const updatePos = db.prepare('UPDATE tasks SET position = ? WHERE id = ?')
+      for (const group of groups) {
+        const rows = getTasksInCol.all(group.board, group.col)
+        if (rows.length > 0) {
+          const newKeys = generateNKeysBetween(null, null, rows.length)
+          for (let i = 0; i < rows.length; i++) {
+            updatePos.run(newKeys[i], rows[i].id)
+          }
+        }
+      }
+      db.prepare("INSERT OR REPLACE INTO meta (key, val) VALUES ('fractional_indexing_migrated', '1')").run()
+      db.exec('COMMIT')
+    } catch (e) {
+      try { db.exec('ROLLBACK') } catch { /* ignore */ }
+    }
+  }
   db.exec('PRAGMA synchronous = NORMAL')
   try { db.exec('PRAGMA optimize') } catch { /* pragma optimize best-effort */ }
 
@@ -274,6 +305,35 @@ export function openStore({ dir }) {
        checklist, report, comments, rejectReason, rejectedAt, reasoningEffort, parentId, isEpic,
        workflowRunId, workflowStatus)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`),
+    restoreTask: db.prepare(`INSERT INTO tasks
+      (id, board, col, position, title, body, owner, repo, issueNumber, issueUrl, externalRef,
+       labels, branch, worktree, workspaceId, sessionId, model, provider, waiting, syncedAt,
+       labelColors, author, assignee, milestone, priority, dueAt, columnAt, createdAt, updatedAt,
+       cron, nextRunAt, lastRunAt, progressDump, permission, permissionConfirmedAt, permissionConfirmedTier, runs,
+       checklist, report, comments, rejectReason, rejectedAt, reasoningEffort, parentId, isEpic,
+       workflowRunId, workflowStatus, archivedAt, queuedAt, plan, forge)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        board=excluded.board, col=excluded.col, position=excluded.position, title=excluded.title,
+        body=excluded.body, owner=excluded.owner, repo=excluded.repo, issueNumber=excluded.issueNumber,
+        issueUrl=excluded.issueUrl, externalRef=excluded.externalRef, labels=excluded.labels,
+        branch=excluded.branch, worktree=excluded.worktree, workspaceId=excluded.workspaceId,
+        sessionId=excluded.sessionId, model=excluded.model, provider=excluded.provider,
+        waiting=excluded.waiting, syncedAt=excluded.syncedAt, labelColors=excluded.labelColors,
+        author=excluded.author, assignee=excluded.assignee, milestone=excluded.milestone,
+        priority=excluded.priority, dueAt=excluded.dueAt, columnAt=excluded.columnAt,
+        createdAt=excluded.createdAt, updatedAt=excluded.updatedAt, cron=excluded.cron,
+        nextRunAt=excluded.nextRunAt, lastRunAt=excluded.lastRunAt, progressDump=excluded.progressDump,
+        permission=excluded.permission, permissionConfirmedAt=excluded.permissionConfirmedAt,
+        permissionConfirmedTier=excluded.permissionConfirmedTier, runs=excluded.runs,
+        checklist=excluded.checklist, report=excluded.report, comments=excluded.comments,
+        rejectReason=excluded.rejectReason, rejectedAt=excluded.rejectedAt,
+        reasoningEffort=excluded.reasoningEffort, parentId=excluded.parentId, isEpic=excluded.isEpic,
+        workflowRunId=excluded.workflowRunId, workflowStatus=excluded.workflowStatus,
+        archivedAt=excluded.archivedAt, queuedAt=excluded.queuedAt, plan=excluded.plan, forge=excluded.forge`),
+    restoreTransition: db.prepare(`INSERT INTO transitions
+      (taskId, fromCol, toCol, source, detail, at)
+      VALUES (?, ?, ?, ?, ?, ?)`),
     boardById: db.prepare('SELECT * FROM boards WHERE id = ?'),
     insertBoard: db.prepare('INSERT INTO boards (id, title, kind, position, createdAt) VALUES (?, ?, ?, ?, ?)'),
     lastBoard: db.prepare('SELECT position FROM boards ORDER BY position DESC LIMIT 1'),
@@ -286,7 +346,9 @@ export function openStore({ dir }) {
       "SELECT * FROM tasks WHERE archivedAt = 0 AND col = 'done' AND columnAt > 0 AND columnAt <= ?"),
     dismiss: db.prepare('INSERT OR REPLACE INTO dismissed (owner, repo, issueNumber, at) VALUES (?, ?, ?, ?)'),
     isDismissed: db.prepare('SELECT 1 FROM dismissed WHERE owner = ? AND repo = ? AND issueNumber = ?'),
+    isDismissedWithForge: db.prepare(`SELECT 1 FROM dismissed WHERE owner = ? AND repo = ? AND issueNumber = ? AND (forge = ? OR (forge = '' AND ? = 'gitea'))`),
     byIssue: db.prepare('SELECT * FROM tasks WHERE owner = ? AND repo = ? AND issueNumber = ?'),
+    byIssueWithForge: db.prepare(`SELECT * FROM tasks WHERE owner = ? AND repo = ? AND issueNumber = ? AND (forge = ? OR (forge = '' AND ? = 'gitea'))`),
     byExternalRef: db.prepare('SELECT * FROM tasks WHERE externalRef = ? ORDER BY createdAt ASC LIMIT 1'),
     tasksBySession: db.prepare('SELECT * FROM tasks WHERE sessionId = ? LIMIT 1'),
     lastInColumn: db.prepare('SELECT position FROM tasks WHERE board = ? AND col = ? ORDER BY position DESC LIMIT 1'),
@@ -553,10 +615,91 @@ export function openStore({ dir }) {
     updateChecklist(id, items) {
       const task = rowToTask(q.taskById.get(id))
       if (!task) return undefined
-      const list = Array.isArray(items) ? items : []
+      const list = (Array.isArray(items) ? items : []).map((item) => {
+        if (typeof item === 'string') return { text: item, completed: false, done: false }
+        const c = item.completed !== undefined ? Boolean(item.completed) : Boolean(item.done)
+        return { ...item, completed: c, done: c }
+      })
       return this.updateTask(id, { checklist: list })
     },
 
+    restoreTask(task) {
+      if (!task || !task.id) return undefined
+      const labels = JSON.stringify(Array.isArray(task.labels) ? task.labels : [])
+      const colors = JSON.stringify(task.labelColors && typeof task.labelColors === 'object' ? task.labelColors : {})
+      const runs = JSON.stringify(Array.isArray(task.runs) ? task.runs : [])
+      const checklist = JSON.stringify(Array.isArray(task.checklist) ? task.checklist : [])
+      const report = JSON.stringify(task.report && typeof task.report === 'object' ? task.report : {})
+      const comments = JSON.stringify(Array.isArray(task.comments) ? task.comments : [])
+      const forge = task.forge || (typeof task.issueUrl === 'string' && task.issueUrl.includes('github.com') ? 'github' : 'gitea')
+      q.restoreTask.run(
+        task.id,
+        task.board || 'main',
+        task.column || task.col || 'backlog',
+        task.position || keyBetween(undefined, undefined),
+        task.title || '',
+        task.body || '',
+        task.owner ?? null,
+        task.repo ?? null,
+        task.issueNumber ?? null,
+        task.issueUrl ?? null,
+        task.externalRef ?? null,
+        labels,
+        task.branch ?? null,
+        task.worktree ?? null,
+        task.workspaceId || '',
+        task.sessionId ?? null,
+        task.model ?? null,
+        task.provider ?? 'gitea',
+        task.waiting ? 1 : 0,
+        task.syncedAt || 0,
+        colors,
+        task.author || '',
+        task.assignee || '',
+        task.milestone || '',
+        task.priority || '',
+        task.dueAt || 0,
+        task.columnAt || task.createdAt || Date.now(),
+        task.createdAt || Date.now(),
+        task.updatedAt || Date.now(),
+        task.cron || '',
+        task.nextRunAt || 0,
+        task.lastRunAt || 0,
+        task.progressDump || '',
+        task.permission || '',
+        task.permissionConfirmedAt || 0,
+        task.permissionConfirmedTier || '',
+        runs,
+        checklist,
+        report,
+        comments,
+        task.rejectReason || '',
+        task.rejectedAt || 0,
+        task.reasoningEffort || '',
+        task.parentId || '',
+        task.isEpic ? 1 : 0,
+        task.workflowRunId || '',
+        task.workflowStatus || '',
+        task.archivedAt || 0,
+        task.queuedAt || 0,
+        task.plan || '',
+        forge,
+      )
+      return rowToTask(q.taskById.get(task.id))
+    },
+
+    restoreTransition(trans) {
+      if (!trans || !trans.taskId) return undefined
+      q.restoreTransition.run(
+        trans.taskId,
+        trans.fromCol ?? null,
+        trans.toCol || '',
+        trans.source || 'unknown',
+        trans.detail || '',
+        trans.at || Date.now(),
+      )
+    },
+
     setReport(id, reportData) {
       const task = rowToTask(q.taskById.get(id))
       if (!task) return undefined
@@ -621,12 +764,18 @@ export function openStore({ dir }) {
     },
 
     /** Whether an issue was previously dismissed. */
-    isDismissed({ owner, repo, issueNumber }) {
+    isDismissed({ owner, repo, issueNumber, forge }) {
+      if (forge) {
+        return q.isDismissedWithForge.get(owner, repo, issueNumber, forge, forge) !== undefined
+      }
       return q.isDismissed.get(owner, repo, issueNumber) !== undefined
     },
 
     /** Find task by issue to prevent duplicate import. */
-    findTaskByIssue({ owner, repo, issueNumber }) {
+    findTaskByIssue({ owner, repo, issueNumber, forge }) {
+      if (forge) {
+        return rowToTask(q.byIssueWithForge.get(owner, repo, issueNumber, forge, forge))
+      }
       return rowToTask(q.byIssue.get(owner, repo, issueNumber))
     },
 
@@ -667,8 +816,9 @@ export function openStore({ dir }) {
     },
 
     setArchived(id, archivedAt) {
+      const at = typeof archivedAt === 'boolean' ? (archivedAt ? Date.now() : 0) : (Number(archivedAt) || 0)
       db.prepare('UPDATE tasks SET archivedAt = ?, updatedAt = ? WHERE id = ?')
-        .run(archivedAt, Date.now(), id)
+        .run(at, Date.now(), id)
       return rowToTask(q.taskById.get(id))
     },
 

package/lib/sync.js

@@ -39,7 +39,7 @@ export async function withBackoff(fn, { retries = 2, baseMs = 50, maxMs = 500 }
  * Failures are not silently swallowed: incomplete observations (missing PRs or branches)
  * would lead to erroneous column transitions. If reading fails, the repository is skipped.
  */
-async function readRepo({ gitea, owner, repo }) {
+async function readRepo({ gitea, owner, repo, forge }) {
   const [pulls, branches] = await Promise.all([
     gitea.listPulls({ owner, repo, state: 'all' }),
     gitea.listBranches({ owner, repo }),
@@ -182,8 +182,9 @@ export async function syncAll({ gitea, store, logger, only, now = Date.now() })
   const tasks = store.listWatchable().filter((t) => (only ? only(t) : true))
   const byRepo = new Map()
   for (const task of tasks) {
-    const key = `${task.owner}/${task.repo}`
-    if (!byRepo.has(key)) byRepo.set(key, { owner: task.owner, repo: task.repo, tasks: [] })
+    const forge = task.forge || (typeof task.issueUrl === 'string' && task.issueUrl.includes('github.com') ? 'github' : 'gitea')
+    const key = `${forge}:${task.owner}/${task.repo}`
+    if (!byRepo.has(key)) byRepo.set(key, { forge, owner: task.owner, repo: task.repo, tasks: [] })
     byRepo.get(key).tasks.push(task)
   }
 
@@ -200,7 +201,7 @@ export async function syncAll({ gitea, store, logger, only, now = Date.now() })
   for (const group of byRepo.values()) {
     let repoState
     try {
-      repoState = await withBackoff(() => readRepo({ gitea, owner: group.owner, repo: group.repo }), { retries: 2, baseMs: 40 })
+      repoState = await withBackoff(() => readRepo({ gitea, owner: group.owner, repo: group.repo, forge: group.forge }), { retries: 2, baseMs: 40 })
     } catch (error) {
       failed += group.tasks.length
       reposFailed += 1
@@ -212,7 +213,7 @@ export async function syncAll({ gitea, store, logger, only, now = Date.now() })
     for (const task of group.tasks) {
       checked += 1
       try {
-        const issue = await gitea.getIssue({ owner: task.owner, repo: task.repo, index: task.issueNumber })
+        const issue = await gitea.getIssue({ owner: task.owner, repo: task.repo, index: task.issueNumber, provider: group.forge, issueUrl: task.issueUrl })
         const observation = observeTask(task, repoState, issue)
         const applied = applyObservation({
           store, task, observation, issue, remoteUpdatedAt: issue?.updated_at,

package/lib/workflow-bridge.js

@@ -11,7 +11,14 @@
 //    - post summary to linked Gitea / GitHub issue.
 // 5. Cancel active workflow on card request.
 
-import { buildStartMessage, obtainAgent } from './launcher.js'
+import {
+  buildStartMessage,
+  obtainAgent,
+  verifyPermissionGate,
+  countActiveSessions,
+  reserveSessionSlot,
+  releaseSessionSlot,
+} from './launcher.js'
 import { applyMove } from './routes.js'
 import { defaultGitRunner } from './worktree.js'
 
@@ -169,11 +176,11 @@ export function buildWorkflowMeta({ task, role }) {
  */
 export function resolveTargetColumn(currentCol) {
   const col = String(currentCol || '').toLowerCase()
-  if (col === 'backlog' || col === 'ready' || col === 'progress') {
+  if (col === 'backlog' || col === 'ready' || col === 'progress' || col === 'in-progress') {
     return 'review'
   }
   if (col === 'review') {
-    return 'done'
+    return 'review'
   }
   return col || 'review'
 }
@@ -268,21 +275,40 @@ export class WorkflowBridge {
     })
 
     const config = this.getConfig()
-    const taken = await obtainAgent({
-      agents: this.agents,
-      task,
-      config,
-      provider,
-      model,
-      mintSessionId,
-      cwdOf,
-      logger: this.logger,
-      agentPreset: preset,
-      permission,
-      permissions,
-      gitRunner,
-      workspaceRegistry,
-    })
+    verifyPermissionGate({ task, permission, config })
+
+    const maxConcurrent = typeof config?.maxConcurrentSessions === 'number' ? config.maxConcurrentSessions : 3
+    if (maxConcurrent > 0 && this.agents && this.store) {
+      const activeCount = countActiveSessions({ store: this.store, agents: this.agents })
+      if (activeCount >= maxConcurrent) {
+        const err = new Error('concurrent-limit-reached')
+        err.key = 'concurrent-limit-reached'
+        err.status = 429
+        throw err
+      }
+    }
+
+    reserveSessionSlot(task.id)
+    let taken
+    try {
+      taken = await obtainAgent({
+        agents: this.agents,
+        task,
+        config,
+        provider,
+        model,
+        mintSessionId,
+        cwdOf,
+        logger: this.logger,
+        agentPreset: preset,
+        permission,
+        permissions,
+        gitRunner,
+        workspaceRegistry,
+      })
+    } finally {
+      releaseSessionSlot(task.id)
+    }
 
     const promptText = typeof text === 'string' && text.trim() !== ''
       ? text.trim()

package/lib/worktree.js

@@ -30,10 +30,11 @@ export async function defaultGitRunner(args, cwd) {
       maxBuffer: 10 * 1024 * 1024,
       env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
     })
-    return { stdout: stdout.trim(), stderr: stderr.trim(), code: 0 }
+    return { stdout: stdout.trim(), stderr: stderr.trim(), code: 0, exitCode: 0 }
   } catch (err) {
     const error = new Error(`git ${args.join(' ')} failed: ${err.stderr || err.message}`)
     error.code = err.code || 1
+    error.exitCode = err.code || 1
     error.stdout = err.stdout ? String(err.stdout).trim() : ''
     error.stderr = err.stderr ? String(err.stderr).trim() : ''
     throw error
@@ -264,7 +265,7 @@ export async function checkWorktreeDirty({ worktreePath, gitRunner = defaultGitR
       .filter((line) => !isSubmoduleDrift(worktreePath, line))
     return { dirty: files.length > 0, files }
   } catch (error) {
-    return { dirty: false, files: [], error: String(error?.message ?? error) }
+    return { dirty: true, files: [], error: String(error?.message ?? error) }
   }
 }
 
@@ -289,6 +290,13 @@ export async function removeTaskWorktree({
   }
 
   const dirtyCheck = await checkWorktreeDirty({ worktreePath, gitRunner })
+  if (dirtyCheck.error) {
+    return {
+      removed: false,
+      error: 'worktree-status-error',
+      detail: dirtyCheck.error,
+    }
+  }
   if (dirtyCheck.dirty && !force) {
     return {
       removed: false,
@@ -431,21 +439,21 @@ export async function getTaskDiff({ worktreePath, baseRef, gitRunner = defaultGi
   let diffOut = ''
   if (base) {
     const res = await gitRunner(['diff', `${base}...HEAD`], worktreePath)
-    if (res.exitCode === 0) {
+    if ((res?.exitCode ?? res?.code ?? 0) === 0) {
       diffOut = res.stdout
     }
   }
 
   // Include uncommitted changes (unstaged + staged)
   const unstaged = await gitRunner(['diff', 'HEAD'], worktreePath)
-  if (unstaged.exitCode === 0 && unstaged.stdout.trim() !== '') {
+  if ((unstaged?.exitCode ?? unstaged?.code ?? 0) === 0 && unstaged.stdout.trim() !== '') {
     diffOut = diffOut ? `${diffOut}\n\n# Uncommitted Changes:\n${unstaged.stdout}` : unstaged.stdout
   }
 
   // Fallback to plain git diff if base...HEAD produced no output
   if (!diffOut.trim()) {
     const fallback = await gitRunner(['diff'], worktreePath)
-    if (fallback.exitCode === 0) diffOut = fallback.stdout
+    if ((fallback?.exitCode ?? fallback?.code ?? 0) === 0) diffOut = fallback.stdout
   }
 
   // Count affected files
@@ -481,10 +489,10 @@ export async function getTaskCommits({ worktreePath, baseRef, gitRunner = defaul
 
   const range = base ? `${base}..HEAD` : '-n 20'
   const logRes = await gitRunner(['log', range, '--pretty=format:%h%x09%an%x09%ad%x09%s', '--date=short'], worktreePath)
-  if (logRes.exitCode !== 0 || !logRes.stdout.trim()) {
+  if ((logRes?.exitCode ?? logRes?.code ?? 0) !== 0 || !logRes.stdout.trim()) {
     // Fallback to last 10 commits
     const fallback = await gitRunner(['log', '-n', '10', '--pretty=format:%h%x09%an%x09%ad%x09%s', '--date=short'], worktreePath)
-    if (fallback.exitCode !== 0 || !fallback.stdout.trim()) return []
+    if ((fallback?.exitCode ?? fallback?.code ?? 0) !== 0 || !fallback.stdout.trim()) return []
     return fallback.stdout.trim().split('\n').map(parseCommitLine).filter(Boolean)
   }
 
@@ -521,6 +529,9 @@ export async function mergeTaskWorktree({
 
   // 1. Verify worktree cleanliness
   const dirtyCheck = await checkWorktreeDirty({ worktreePath: task.worktree, gitRunner })
+  if (dirtyCheck.error) {
+    return { success: false, merged: false, error: 'worktree-status-error', detail: dirtyCheck.error }
+  }
   if (dirtyCheck.dirty) {
     return { success: false, merged: false, error: 'worktree-dirty', files: dirtyCheck.files }
   }
@@ -528,7 +539,7 @@ export async function mergeTaskWorktree({
   // 2. Locate main repository root
   let mainRepoDir = ''
   const revParse = await gitRunner(['rev-parse', '--git-common-dir'], task.worktree)
-  if (revParse.exitCode === 0 && revParse.stdout.trim()) {
+  if ((revParse?.exitCode ?? revParse?.code ?? 0) === 0 && revParse.stdout.trim()) {
     const commonDir = revParse.stdout.trim()
     mainRepoDir = commonDir.endsWith('/.git') ? commonDir.slice(0, -5) : commonDir
   }
@@ -551,7 +562,7 @@ export async function mergeTaskWorktree({
   const currentBranch = await gitRunner(['branch', '--show-current'], mainRepoDir)
   if (currentBranch.stdout.trim() !== target) {
     const checkoutRes = await gitRunner(['checkout', '--', target], mainRepoDir)
-    if (checkoutRes.exitCode !== 0) {
+    if ((checkoutRes?.exitCode ?? checkoutRes?.code ?? 0) !== 0) {
       return { success: false, merged: false, error: 'checkout-target-failed', detail: checkoutRes.stderr }
     }
   }
@@ -559,7 +570,7 @@ export async function mergeTaskWorktree({
   // 5. Execute git merge --no-ff
   const mergeMsg = `Merge branch '${task.branch}' for task ${task.id}`
   const mergeRes = await gitRunner(['merge', '--no-ff', task.branch, '-m', mergeMsg], mainRepoDir)
-  if (mergeRes.exitCode !== 0) {
+  if ((mergeRes?.exitCode ?? mergeRes?.code ?? 0) !== 0) {
     // Roll back merge on conflict
     await gitRunner(['merge', '--abort'], mainRepoDir)
     return { success: false, merged: false, error: 'merge-conflict', detail: mergeRes.stderr || mergeRes.stdout }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-kanban",
-  "version": "0.2.21",
+  "version": "0.2.22",
   "description": "Visual Kanban board for DeepSeek Harness: Gitea and GitHub-backed tasks, workflow columns, and a dedicated agent session per task.",
   "type": "module",
   "main": "lib/index.js",