@goodandready/dsh-kanban 0.2.21 → 0.2.23

package/lib/outbound.js

@@ -19,22 +19,32 @@
  */
 export function planAssign(task, login) {
   if (typeof task?.issueNumber !== 'number') return []
-  return [{
+  const op = {
     kind: 'assign',
     owner: task.owner,
     repo: task.repo,
     index: task.issueNumber,
     login: typeof login === 'string' ? login : '',
-  }]
+  }
+  if (task.forge) op.provider = task.forge
+  else if (typeof task.issueUrl === 'string' && task.issueUrl.includes('github.com')) op.provider = 'github'
+  if (task.issueUrl) op.issueUrl = task.issueUrl
+  return [op]
 }
 
 export function planOutbound(task, column, config) {
   if (typeof task?.issueNumber !== 'number') return []
-  // Closing issue is the only mutation sent to Gitea: it is a concrete action,
-  // not redundant mirroring.
-  return column === 'done'
-    ? [{ kind: 'close', owner: task.owner, repo: task.repo, index: task.issueNumber }]
-    : []
+  if (column !== 'done') return []
+  const op = {
+    kind: 'close',
+    owner: task.owner,
+    repo: task.repo,
+    index: task.issueNumber,
+  }
+  if (task.forge) op.provider = task.forge
+  else if (typeof task.issueUrl === 'string' && task.issueUrl.includes('github.com')) op.provider = 'github'
+  if (task.issueUrl) op.issueUrl = task.issueUrl
+  return [op]
 }
 
 /**
@@ -71,13 +81,19 @@ export function createOutbox({ gitea, store, logger, maxAttempts = 4 }) {
       for (const item of pending) {
         try {
           if (item.op.kind === 'close') {
-            await gitea.closeIssue({ owner: item.op.owner, repo: item.op.repo, index: item.op.index })
+            const closePayload = { owner: item.op.owner, repo: item.op.repo, index: item.op.index }
+            if (item.op.provider) closePayload.provider = item.op.provider
+            if (item.op.issueUrl) closePayload.issueUrl = item.op.issueUrl
+            await gitea.closeIssue(closePayload)
           }
           if (item.op.kind === 'assign') {
-            await gitea.setAssignees({
+            const assignPayload = {
               owner: item.op.owner, repo: item.op.repo, index: item.op.index,
               logins: item.op.login === '' ? [] : [item.op.login],
-            })
+            }
+            if (item.op.provider) assignPayload.provider = item.op.provider
+            if (item.op.issueUrl) assignPayload.issueUrl = item.op.issueUrl
+            await gitea.setAssignees(assignPayload)
           }
           sent += 1
         } catch (error) {

package/lib/progress-dump.js

@@ -62,15 +62,22 @@ export function parseProgressDump(text) {
     const line = rawLine.trim()
     const lower = line.toLowerCase()
 
-    if (lower.startsWith('goal:') || lower.startsWith('\u0446\u0435\u043b\u044c:')) {
+    if (lower.startsWith('goal:') || lower.startsWith('цель:')) {
       currentKey = 'goal'
       const val = line.slice(line.indexOf(':') + 1).trim()
       if (val) sections.goal.push(val)
-    } else if (lower.startsWith('progress:') || lower.startsWith('\u043f\u0440\u043e\u0433\u0440\u0435\u0441\u0441:')) {
+    } else if (lower.startsWith('progress:') || lower.startsWith('done:') || lower.startsWith('прогресс:')) {
       currentKey = 'progress'
       const val = line.slice(line.indexOf(':') + 1).trim()
       if (val) sections.progress.push(val)
-    } else if (lower.startsWith('next:') || lower.startsWith('next steps:') || lower.startsWith('\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0448\u0430\u0433\u0438:') || lower.startsWith('\u0448\u0430\u0433\u0438:')) {
+    } else if (
+      lower.startsWith('next:') ||
+      lower.startsWith('next steps:') ||
+      lower.startsWith('next step:') ||
+      lower.startsWith('следующие шаги:') ||
+      lower.startsWith('шаги:') ||
+      lower.startsWith('дальше:')
+    ) {
       currentKey = 'next'
       const val = line.slice(line.indexOf(':') + 1).trim()
       if (val) sections.next.push(val)
@@ -98,16 +105,14 @@ export function parseProgressDump(text) {
  */
 export function formatProgressDump(dump) {
   if (!dump) return ''
+  const g = dump.goal || ''
+  const p = dump.progress || ''
+  const n = dump.next || ''
   return [
     BEGIN_MARKER,
-    'Goal:',
-    dump.goal || '—',
-    '',
-    'Progress:',
-    dump.progress || '—',
-    '',
-    'Next steps:',
-    dump.next || '—',
+    `Goal: ${g}`,
+    `Progress: ${p}`,
+    `Next steps: ${n}`,
     END_MARKER,
   ].join('\n')
 }

package/lib/routes.js

@@ -235,15 +235,30 @@ export function updateTask({ store, id, input }) {
     patch.permission = input.permission
     if (input.permission !== current.permission) {
       patch.permissionConfirmedAt = 0
+      patch.permissionConfirmedTier = ''
     }
   }
+  if (typeof input?.permissionConfirmedTier === 'string') {
+    patch.permissionConfirmedTier = input.permissionConfirmedTier
+  }
+  if (typeof input?.reasoningEffort === 'string') {
+    const val = input.reasoningEffort.trim().toLowerCase()
+    if (['', 'low', 'medium', 'high', 'default', 'none', 'minimal', 'thorough'].includes(val)) {
+      patch.reasoningEffort = val
+    }
+  }
+  if (typeof input?.forge === 'string') {
+    const val = input.forge.trim().toLowerCase()
+    if (val === 'github' || val === 'gitea') patch.forge = val
+  }
   return { task: store.updateTask(id, patch) }
 }
 
-export function confirmPermission({ store, id }) {
+export function confirmPermission({ store, id, tier }) {
   const task = store.getTask(id)
   if (task === undefined) return { error: 'task-not-found', status: 404 }
-  return { task: store.updateTask(id, { permissionConfirmedAt: Date.now() }) }
+  const effectiveTier = typeof tier === 'string' && tier ? tier : (task.permission || 'default')
+  return { task: store.updateTask(id, { permissionConfirmedAt: Date.now(), permissionConfirmedTier: effectiveTier }) }
 }
 
 /** Known priority values. Empty string indicates unprioritized. */
@@ -405,27 +420,22 @@ export function importBoard({ store, input }) {
     for (const task of input.tasks) {
       if (typeof task?.id !== 'string' || task.id === '') continue
       if (store.getTask(task.id) !== undefined) { skipped += 1; continue }
-      store.createTask({
-        id: task.id,
-        board: task.board ?? 'main',
-        column: task.column ?? 'backlog',
-        title: task.title ?? '',
-        body: task.body ?? '',
-        owner: task.owner, repo: task.repo,
-        issueNumber: task.issueNumber, issueUrl: task.issueUrl,
-        labels: Array.isArray(task.labels) ? task.labels : [],
-        branch: task.branch, worktree: task.worktree,
-        sessionId: task.sessionId, model: task.model, provider: task.provider,
-        waiting: task.waiting === true,
-        plan: task.plan ?? '',
-        labelColors: task.labelColors ?? {},
-        author: task.author ?? '',
-        priority: task.priority ?? '',
-        dueAt: typeof task.dueAt === 'number' ? task.dueAt : 0,
-        createdAt: task.createdAt,
-      })
+      if (typeof store.restoreTask === 'function') {
+        store.restoreTask(task)
+      } else {
+        store.createTask(task)
+      }
       imported += 1
     }
+
+    for (const trans of Array.isArray(input.transitions) ? input.transitions : []) {
+      if (typeof trans?.taskId !== 'string' || trans.taskId === '') continue
+      if (typeof store.restoreTransition === 'function') {
+        store.restoreTransition(trans)
+      } else if (typeof store.addTransition === 'function') {
+        store.addTransition(trans)
+      }
+    }
   }
 
   if (typeof store.withTransaction === 'function') {
@@ -464,7 +474,12 @@ export function exportTasksCsv({ store, board = 'main' }) {
 
   function escapeCsv(val) {
     if (val === null || val === undefined) return ''
-    const str = String(val)
+    let str = String(val)
+    // OWASP CSV Injection mitigation (#340)
+    const trimmed = str.replace(/^[\s\t\r\n]+/, '')
+    if (/^[=+\-@\t\r]/.test(str) || (trimmed.length > 0 && /^[=+\-@]/.test(trimmed))) {
+      str = `'${str}`
+    }
     if (str.includes(',') || str.includes('"') || str.includes('\n') || str.includes('\r')) {
       return `"${str.replace(/"/g, '""')}"`
     }
@@ -809,10 +824,11 @@ export function handleToggleChecklistItem({ store, task, input }) {
   let updatedItem
   if (typeof item === 'string') {
     const checked = input?.checked !== undefined ? Boolean(input.checked) : true
-    updatedItem = { text: item, done: checked }
+    updatedItem = { text: item, completed: checked, done: checked }
   } else {
-    const checked = input?.checked !== undefined ? Boolean(input.checked) : !item.done
-    updatedItem = { ...item, done: checked }
+    const isCurrentlyDone = item.completed !== undefined ? Boolean(item.completed) : Boolean(item.done)
+    const checked = input?.checked !== undefined ? Boolean(input.checked) : !isCurrentlyDone
+    updatedItem = { ...item, completed: checked, done: checked }
   }
   current[targetIndex] = updatedItem
   const updated = store.updateChecklist(task.id, current)

package/lib/store.js

@@ -13,7 +13,7 @@ import { DatabaseSync } from 'node:sqlite'
 import { randomUUID } from 'node:crypto'
 import { mkdirSync, copyFileSync, readdirSync, unlinkSync, statSync, chmodSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
-import { keyBetween } from './order.js'
+import { keyBetween, generateNKeysBetween } from './order.js'
 import { DEFAULT_BOARDS, normalizeKind } from './config.js'
 
 const SCHEMA = `
@@ -103,7 +103,7 @@ const WRITABLE = [
   'labelColors', 'queuedAt', 'createdAt', 'author', 'assignee', 'milestone', 'priority', 'dueAt',
   'cron', 'nextRunAt', 'lastRunAt', 'progressDump', 'permission', 'reasoningEffort', 'permissionConfirmedAt',
   'runs', 'checklist', 'report', 'comments', 'rejectReason', 'rejectedAt', 'parentId', 'isEpic',
-  'workflowRunId', 'workflowStatus',
+  'workflowRunId', 'workflowStatus', 'permissionConfirmedTier', 'forge',
 ]
 
 /** Valid transition sources; unexpected values are rejected to preserve log integrity. */
@@ -242,6 +242,8 @@ export function openStore({ dir }) {
     ['provider', "TEXT NOT NULL DEFAULT 'gitea'"],
     ['workflowRunId', "TEXT NOT NULL DEFAULT ''"],
     ['workflowStatus', "TEXT NOT NULL DEFAULT ''"],
+    ['forge', "TEXT NOT NULL DEFAULT ''"],
+    ['permissionConfirmedTier', "TEXT NOT NULL DEFAULT ''"],
   ]) {
     try { db.exec(`ALTER TABLE tasks ADD COLUMN ${column} ${definition}`) } catch { /* column already exists */ }
   }
@@ -258,6 +260,35 @@ export function openStore({ dir }) {
   db.exec('CREATE INDEX IF NOT EXISTS tasks_parent_id ON tasks(parentId)')
   db.exec('CREATE INDEX IF NOT EXISTS tasks_updated ON tasks(updatedAt)')
   db.exec('CREATE INDEX IF NOT EXISTS tasks_archivable ON tasks(archivedAt, col, columnAt)')
+  try { db.exec("ALTER TABLE dismissed ADD COLUMN forge TEXT NOT NULL DEFAULT ''") } catch { /* already exists */ }
+  db.exec("CREATE INDEX IF NOT EXISTS tasks_forge_issue ON tasks(forge, owner, repo, issueNumber)")
+  db.exec("UPDATE tasks SET forge = 'github' WHERE (forge = '' OR forge IS NULL) AND issueUrl LIKE '%github.com%'")
+  db.exec("UPDATE tasks SET forge = 'gitea' WHERE (forge = '' OR forge IS NULL) AND (issueUrl NOT LIKE '%github.com%' OR issueUrl IS NULL)")
+  db.exec("CREATE TABLE IF NOT EXISTS meta (key TEXT PRIMARY KEY, val TEXT)")
+
+  // Fractional indexing migration (#345): ensure all existing tasks have compact keys
+  const orderMigrated = db.prepare("SELECT val FROM meta WHERE key = 'fractional_indexing_migrated'").get()
+  if (!orderMigrated) {
+    try {
+      db.exec('BEGIN TRANSACTION')
+      const groups = db.prepare('SELECT DISTINCT board, col FROM tasks').all()
+      const getTasksInCol = db.prepare('SELECT id, position FROM tasks WHERE board = ? AND col = ? ORDER BY position ASC, createdAt ASC')
+      const updatePos = db.prepare('UPDATE tasks SET position = ? WHERE id = ?')
+      for (const group of groups) {
+        const rows = getTasksInCol.all(group.board, group.col)
+        if (rows.length > 0) {
+          const newKeys = generateNKeysBetween(null, null, rows.length)
+          for (let i = 0; i < rows.length; i++) {
+            updatePos.run(newKeys[i], rows[i].id)
+          }
+        }
+      }
+      db.prepare("INSERT OR REPLACE INTO meta (key, val) VALUES ('fractional_indexing_migrated', '1')").run()
+      db.exec('COMMIT')
+    } catch (e) {
+      try { db.exec('ROLLBACK') } catch { /* ignore */ }
+    }
+  }
   db.exec('PRAGMA synchronous = NORMAL')
   try { db.exec('PRAGMA optimize') } catch { /* pragma optimize best-effort */ }
 
@@ -274,6 +305,35 @@ export function openStore({ dir }) {
        checklist, report, comments, rejectReason, rejectedAt, reasoningEffort, parentId, isEpic,
        workflowRunId, workflowStatus)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`),
+    restoreTask: db.prepare(`INSERT INTO tasks
+      (id, board, col, position, title, body, owner, repo, issueNumber, issueUrl, externalRef,
+       labels, branch, worktree, workspaceId, sessionId, model, provider, waiting, syncedAt,
+       labelColors, author, assignee, milestone, priority, dueAt, columnAt, createdAt, updatedAt,
+       cron, nextRunAt, lastRunAt, progressDump, permission, permissionConfirmedAt, permissionConfirmedTier, runs,
+       checklist, report, comments, rejectReason, rejectedAt, reasoningEffort, parentId, isEpic,
+       workflowRunId, workflowStatus, archivedAt, queuedAt, plan, forge)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        board=excluded.board, col=excluded.col, position=excluded.position, title=excluded.title,
+        body=excluded.body, owner=excluded.owner, repo=excluded.repo, issueNumber=excluded.issueNumber,
+        issueUrl=excluded.issueUrl, externalRef=excluded.externalRef, labels=excluded.labels,
+        branch=excluded.branch, worktree=excluded.worktree, workspaceId=excluded.workspaceId,
+        sessionId=excluded.sessionId, model=excluded.model, provider=excluded.provider,
+        waiting=excluded.waiting, syncedAt=excluded.syncedAt, labelColors=excluded.labelColors,
+        author=excluded.author, assignee=excluded.assignee, milestone=excluded.milestone,
+        priority=excluded.priority, dueAt=excluded.dueAt, columnAt=excluded.columnAt,
+        createdAt=excluded.createdAt, updatedAt=excluded.updatedAt, cron=excluded.cron,
+        nextRunAt=excluded.nextRunAt, lastRunAt=excluded.lastRunAt, progressDump=excluded.progressDump,
+        permission=excluded.permission, permissionConfirmedAt=excluded.permissionConfirmedAt,
+        permissionConfirmedTier=excluded.permissionConfirmedTier, runs=excluded.runs,
+        checklist=excluded.checklist, report=excluded.report, comments=excluded.comments,
+        rejectReason=excluded.rejectReason, rejectedAt=excluded.rejectedAt,
+        reasoningEffort=excluded.reasoningEffort, parentId=excluded.parentId, isEpic=excluded.isEpic,
+        workflowRunId=excluded.workflowRunId, workflowStatus=excluded.workflowStatus,
+        archivedAt=excluded.archivedAt, queuedAt=excluded.queuedAt, plan=excluded.plan, forge=excluded.forge`),
+    restoreTransition: db.prepare(`INSERT INTO transitions
+      (taskId, fromCol, toCol, source, detail, at)
+      VALUES (?, ?, ?, ?, ?, ?)`),
     boardById: db.prepare('SELECT * FROM boards WHERE id = ?'),
     insertBoard: db.prepare('INSERT INTO boards (id, title, kind, position, createdAt) VALUES (?, ?, ?, ?, ?)'),
     lastBoard: db.prepare('SELECT position FROM boards ORDER BY position DESC LIMIT 1'),
@@ -286,7 +346,9 @@ export function openStore({ dir }) {
       "SELECT * FROM tasks WHERE archivedAt = 0 AND col = 'done' AND columnAt > 0 AND columnAt <= ?"),
     dismiss: db.prepare('INSERT OR REPLACE INTO dismissed (owner, repo, issueNumber, at) VALUES (?, ?, ?, ?)'),
     isDismissed: db.prepare('SELECT 1 FROM dismissed WHERE owner = ? AND repo = ? AND issueNumber = ?'),
+    isDismissedWithForge: db.prepare(`SELECT 1 FROM dismissed WHERE owner = ? AND repo = ? AND issueNumber = ? AND (forge = ? OR (forge = '' AND ? = 'gitea'))`),
     byIssue: db.prepare('SELECT * FROM tasks WHERE owner = ? AND repo = ? AND issueNumber = ?'),
+    byIssueWithForge: db.prepare(`SELECT * FROM tasks WHERE owner = ? AND repo = ? AND issueNumber = ? AND (forge = ? OR (forge = '' AND ? = 'gitea'))`),
     byExternalRef: db.prepare('SELECT * FROM tasks WHERE externalRef = ? ORDER BY createdAt ASC LIMIT 1'),
     tasksBySession: db.prepare('SELECT * FROM tasks WHERE sessionId = ? LIMIT 1'),
     lastInColumn: db.prepare('SELECT position FROM tasks WHERE board = ? AND col = ? ORDER BY position DESC LIMIT 1'),
@@ -553,10 +615,91 @@ export function openStore({ dir }) {
     updateChecklist(id, items) {
       const task = rowToTask(q.taskById.get(id))
       if (!task) return undefined
-      const list = Array.isArray(items) ? items : []
+      const list = (Array.isArray(items) ? items : []).map((item) => {
+        if (typeof item === 'string') return { text: item, completed: false, done: false }
+        const c = item.completed !== undefined ? Boolean(item.completed) : Boolean(item.done)
+        return { ...item, completed: c, done: c }
+      })
       return this.updateTask(id, { checklist: list })
     },
 
+    restoreTask(task) {
+      if (!task || !task.id) return undefined
+      const labels = JSON.stringify(Array.isArray(task.labels) ? task.labels : [])
+      const colors = JSON.stringify(task.labelColors && typeof task.labelColors === 'object' ? task.labelColors : {})
+      const runs = JSON.stringify(Array.isArray(task.runs) ? task.runs : [])
+      const checklist = JSON.stringify(Array.isArray(task.checklist) ? task.checklist : [])
+      const report = JSON.stringify(task.report && typeof task.report === 'object' ? task.report : {})
+      const comments = JSON.stringify(Array.isArray(task.comments) ? task.comments : [])
+      const forge = task.forge || (typeof task.issueUrl === 'string' && task.issueUrl.includes('github.com') ? 'github' : 'gitea')
+      q.restoreTask.run(
+        task.id,
+        task.board || 'main',
+        task.column || task.col || 'backlog',
+        task.position || keyBetween(undefined, undefined),
+        task.title || '',
+        task.body || '',
+        task.owner ?? null,
+        task.repo ?? null,
+        task.issueNumber ?? null,
+        task.issueUrl ?? null,
+        task.externalRef ?? null,
+        labels,
+        task.branch ?? null,
+        task.worktree ?? null,
+        task.workspaceId || '',
+        task.sessionId ?? null,
+        task.model ?? null,
+        task.provider ?? 'gitea',
+        task.waiting ? 1 : 0,
+        task.syncedAt || 0,
+        colors,
+        task.author || '',
+        task.assignee || '',
+        task.milestone || '',
+        task.priority || '',
+        task.dueAt || 0,
+        task.columnAt || task.createdAt || Date.now(),
+        task.createdAt || Date.now(),
+        task.updatedAt || Date.now(),
+        task.cron || '',
+        task.nextRunAt || 0,
+        task.lastRunAt || 0,
+        task.progressDump || '',
+        task.permission || '',
+        task.permissionConfirmedAt || 0,
+        task.permissionConfirmedTier || '',
+        runs,
+        checklist,
+        report,
+        comments,
+        task.rejectReason || '',
+        task.rejectedAt || 0,
+        task.reasoningEffort || '',
+        task.parentId || '',
+        task.isEpic ? 1 : 0,
+        task.workflowRunId || '',
+        task.workflowStatus || '',
+        task.archivedAt || 0,
+        task.queuedAt || 0,
+        task.plan || '',
+        forge,
+      )
+      return rowToTask(q.taskById.get(task.id))
+    },
+
+    restoreTransition(trans) {
+      if (!trans || !trans.taskId) return undefined
+      q.restoreTransition.run(
+        trans.taskId,
+        trans.fromCol ?? null,
+        trans.toCol || '',
+        trans.source || 'unknown',
+        trans.detail || '',
+        trans.at || Date.now(),
+      )
+    },
+
     setReport(id, reportData) {
       const task = rowToTask(q.taskById.get(id))
       if (!task) return undefined
@@ -621,12 +764,18 @@ export function openStore({ dir }) {
     },
 
     /** Whether an issue was previously dismissed. */
-    isDismissed({ owner, repo, issueNumber }) {
+    isDismissed({ owner, repo, issueNumber, forge }) {
+      if (forge) {
+        return q.isDismissedWithForge.get(owner, repo, issueNumber, forge, forge) !== undefined
+      }
       return q.isDismissed.get(owner, repo, issueNumber) !== undefined
     },
 
     /** Find task by issue to prevent duplicate import. */
-    findTaskByIssue({ owner, repo, issueNumber }) {
+    findTaskByIssue({ owner, repo, issueNumber, forge }) {
+      if (forge) {
+        return rowToTask(q.byIssueWithForge.get(owner, repo, issueNumber, forge, forge))
+      }
       return rowToTask(q.byIssue.get(owner, repo, issueNumber))
     },
 
@@ -667,8 +816,9 @@ export function openStore({ dir }) {
     },
 
     setArchived(id, archivedAt) {
+      const at = typeof archivedAt === 'boolean' ? (archivedAt ? Date.now() : 0) : (Number(archivedAt) || 0)
       db.prepare('UPDATE tasks SET archivedAt = ?, updatedAt = ? WHERE id = ?')
-        .run(archivedAt, Date.now(), id)
+        .run(at, Date.now(), id)
       return rowToTask(q.taskById.get(id))
     },
 

package/lib/sync.js

@@ -39,7 +39,7 @@ export async function withBackoff(fn, { retries = 2, baseMs = 50, maxMs = 500 }
  * Failures are not silently swallowed: incomplete observations (missing PRs or branches)
  * would lead to erroneous column transitions. If reading fails, the repository is skipped.
  */
-async function readRepo({ gitea, owner, repo }) {
+async function readRepo({ gitea, owner, repo, forge }) {
   const [pulls, branches] = await Promise.all([
     gitea.listPulls({ owner, repo, state: 'all' }),
     gitea.listBranches({ owner, repo }),
@@ -182,8 +182,9 @@ export async function syncAll({ gitea, store, logger, only, now = Date.now() })
   const tasks = store.listWatchable().filter((t) => (only ? only(t) : true))
   const byRepo = new Map()
   for (const task of tasks) {
-    const key = `${task.owner}/${task.repo}`
-    if (!byRepo.has(key)) byRepo.set(key, { owner: task.owner, repo: task.repo, tasks: [] })
+    const forge = task.forge || (typeof task.issueUrl === 'string' && task.issueUrl.includes('github.com') ? 'github' : 'gitea')
+    const key = `${forge}:${task.owner}/${task.repo}`
+    if (!byRepo.has(key)) byRepo.set(key, { forge, owner: task.owner, repo: task.repo, tasks: [] })
     byRepo.get(key).tasks.push(task)
   }
 
@@ -200,7 +201,7 @@ export async function syncAll({ gitea, store, logger, only, now = Date.now() })
   for (const group of byRepo.values()) {
     let repoState
     try {
-      repoState = await withBackoff(() => readRepo({ gitea, owner: group.owner, repo: group.repo }), { retries: 2, baseMs: 40 })
+      repoState = await withBackoff(() => readRepo({ gitea, owner: group.owner, repo: group.repo, forge: group.forge }), { retries: 2, baseMs: 40 })
     } catch (error) {
       failed += group.tasks.length
       reposFailed += 1
@@ -212,7 +213,7 @@ export async function syncAll({ gitea, store, logger, only, now = Date.now() })
     for (const task of group.tasks) {
       checked += 1
       try {
-        const issue = await gitea.getIssue({ owner: task.owner, repo: task.repo, index: task.issueNumber })
+        const issue = await gitea.getIssue({ owner: task.owner, repo: task.repo, index: task.issueNumber, provider: group.forge, issueUrl: task.issueUrl })
         const observation = observeTask(task, repoState, issue)
         const applied = applyObservation({
           store, task, observation, issue, remoteUpdatedAt: issue?.updated_at,

package/lib/updater.js

@@ -47,7 +47,7 @@ export function isTrustedUpdateRequest(request) {
   const remote = request.socket?.remoteAddress
   if (!isLoopback(remote) && !isPrivateLan(remote)) return false
   const site = header(request, 'sec-fetch-site')
-  if (site !== undefined && site !== 'same-origin') return false
+  if (!site || (site !== 'same-origin' && site !== 'same-site' && site !== 'none')) return false
   const origin = header(request, 'origin')
   const host = header(request, 'host')
   if (origin === undefined || host === undefined) return false

package/lib/workflow-bridge.js

@@ -11,7 +11,14 @@
 //    - post summary to linked Gitea / GitHub issue.
 // 5. Cancel active workflow on card request.
 
-import { buildStartMessage, obtainAgent } from './launcher.js'
+import {
+  buildStartMessage,
+  obtainAgent,
+  verifyPermissionGate,
+  countActiveSessions,
+  reserveSessionSlot,
+  releaseSessionSlot,
+} from './launcher.js'
 import { applyMove } from './routes.js'
 import { defaultGitRunner } from './worktree.js'
 
@@ -169,11 +176,11 @@ export function buildWorkflowMeta({ task, role }) {
  */
 export function resolveTargetColumn(currentCol) {
   const col = String(currentCol || '').toLowerCase()
-  if (col === 'backlog' || col === 'ready' || col === 'progress') {
+  if (col === 'backlog' || col === 'ready' || col === 'progress' || col === 'in-progress') {
     return 'review'
   }
   if (col === 'review') {
-    return 'done'
+    return 'review'
   }
   return col || 'review'
 }
@@ -268,21 +275,40 @@ export class WorkflowBridge {
     })
 
     const config = this.getConfig()
-    const taken = await obtainAgent({
-      agents: this.agents,
-      task,
-      config,
-      provider,
-      model,
-      mintSessionId,
-      cwdOf,
-      logger: this.logger,
-      agentPreset: preset,
-      permission,
-      permissions,
-      gitRunner,
-      workspaceRegistry,
-    })
+    verifyPermissionGate({ task, permission, config })
+
+    const maxConcurrent = typeof config?.maxConcurrentSessions === 'number' ? config.maxConcurrentSessions : 3
+    if (maxConcurrent > 0 && this.agents && this.store) {
+      const activeCount = countActiveSessions({ store: this.store, agents: this.agents })
+      if (activeCount >= maxConcurrent) {
+        const err = new Error('concurrent-limit-reached')
+        err.key = 'concurrent-limit-reached'
+        err.status = 429
+        throw err
+      }
+    }
+
+    reserveSessionSlot(task.id)
+    let taken
+    try {
+      taken = await obtainAgent({
+        agents: this.agents,
+        task,
+        config,
+        provider,
+        model,
+        mintSessionId,
+        cwdOf,
+        logger: this.logger,
+        agentPreset: preset,
+        permission,
+        permissions,
+        gitRunner,
+        workspaceRegistry,
+      })
+    } finally {
+      releaseSessionSlot(task.id)
+    }
 
     const promptText = typeof text === 'string' && text.trim() !== ''
       ? text.trim()