@goodandready/dsh-kanban 0.2.23 → 0.2.25

package/lib/client.js

@@ -571,12 +571,7 @@ window.__ModuleLoader__.load({
 
     async function api(path, options) {
       const timeoutMs = (options && options.timeout) || 20000
-      let timeoutSignal
-      try {
-        if (!options?.signal) {
-          timeoutSignal = createTimeoutSignal(timeoutMs)
-        }
-      } catch (_) {}
+      const timeoutSignal = !options?.signal ? createTimeoutSignal(timeoutMs) : undefined
 
       const fetchOpts = Object.assign({
         headers: { 'Content-Type': 'application/json' },

package/lib/config.js

@@ -138,7 +138,12 @@ export function rootOf(config, cwdOf = () => process.cwd()) {
 export function withDefaults(raw) {
   const out = {}
   for (const [key, fallback] of Object.entries(CONFIG_DEFAULTS)) {
-    const value = raw?.[key]
+    let value = raw?.[key]
+    if (value && typeof value === 'object' && typeof value.get === 'function') {
+      try {
+        value = value.get()
+      } catch { /* ignore */ }
+    }
     out[key] = typeof value === typeof fallback && value !== null ? value : fallback
   }
   return out

package/lib/import.js

@@ -66,12 +66,13 @@ export function issueMilestone(issue) {
  * Fields `branch`, `worktree`, `sessionId`, `model` are NOT populated here:
  * they are assigned later when work begins. The plugin does not create branches on import.
  */
-export function issueToTask(issue, { board = 'main', column = 'backlog', owner, repo, provider }) {
-  const p = provider || (typeof issue?.html_url === 'string' && issue.html_url.includes('github.com') ? 'github' : 'gitea')
+export function issueToTask(issue, { board = 'main', column = 'backlog', owner, repo, provider, forge }) {
+  const detectedForge = forge || (typeof issue?.html_url === 'string' && issue.html_url.includes('github.com') ? 'github' : 'gitea')
   return {
     board,
     column,
-    provider: p,
+    forge: detectedForge,
+    ...(provider && provider !== 'github' && provider !== 'gitea' ? { provider } : {}),
     title: typeof issue?.title === 'string' ? issue.title : '',
     body: typeof issue?.body === 'string' ? issue.body : '',
     labels: Array.isArray(issue?.labels)
@@ -96,10 +97,18 @@ export function issueToTask(issue, { board = 'main', column = 'backlog', owner,
  * Compared by owner-repo-number tuple to avoid colliding with issue #1 in another repo.
  * Existing issues are dimmed rather than hidden, as re-importing may be intentional.
  */
-export function markImported(issues, existing, { owner, repo }) {
+export function markImported(issues, existing, { owner, repo, forge }) {
+  const targetForge = forge || ''
   const seen = new Set(
     (existing ?? [])
-      .filter((t) => t.owner === owner && t.repo === repo && typeof t.issueNumber === 'number')
+      .filter((t) => {
+        if (t.owner !== owner || t.repo !== repo || typeof t.issueNumber !== 'number') return false
+        if (targetForge) {
+          const tf = t.forge || (typeof t.issueUrl === 'string' && t.issueUrl.includes('github.com') ? 'github' : 'gitea')
+          return tf === targetForge
+        }
+        return true
+      })
       .map((t) => t.issueNumber),
   )
   return (issues ?? []).map((issue) => ({ ...issue, imported: seen.has(issue?.number) }))
@@ -157,7 +166,7 @@ export async function listImportable({ gitea, store, owner, repo, board = 'main'
   if (state !== 'ready') return { error: `gitea-${state}`, status: 409 }
   const issues = await gitea.listIssues({ owner, repo, state: 'open', provider: forge || provider })
   const existing = store.listTasks({ board })
-  return { issues: markImported(issues, existing, { owner, repo }) }
+  return { issues: markImported(issues, existing, { owner, repo, forge: forge || provider }) }
 }
 
 /** Create a task from an issue. */
@@ -167,9 +176,15 @@ export async function importIssue({ gitea, store, owner, repo, issueNumber, boar
   if (typeof issueNumber !== 'number') return { error: 'issue-number-required', status: 400 }
   // Simple board is for non-issue tasks. Importing here would bring branches/PRs into columns unable to display them.
   if (store.boardKind(board) !== 'project') return { error: 'board-not-for-issues', status: 400 }
-  const issue = await gitea.getIssue({ owner, repo, index: issueNumber, provider: forge || provider })
+  const effectiveForge = forge || (provider === 'github' || provider === 'gitea' ? provider : undefined)
+  const effectiveProvider = (provider !== 'github' && provider !== 'gitea') ? provider : undefined
+  if (typeof store.findTaskByIssue === 'function') {
+    const existing = store.findTaskByIssue({ owner, repo, issueNumber, forge: effectiveForge })
+    if (existing) return { task: existing }
+  }
+  const issue = await gitea.getIssue({ owner, repo, index: issueNumber, provider: effectiveForge || effectiveProvider })
   if (issue === undefined || issue === null) return { error: 'issue-not-found', status: 404 }
-  return { task: store.createTask(issueToTask(issue, { board, column, owner, repo, forge: forge || provider })) }
+  return { task: store.createTask(issueToTask(issue, { board, column, owner, repo, forge: effectiveForge, provider: effectiveProvider })) }
 }
 
 /** Re-read issue and update task, preserving local state. */
@@ -222,13 +237,15 @@ export async function createProjectTask({
     targetRepo = wanted
   }
 
+  const effectiveForge = forge || (provider === 'github' || provider === 'gitea' ? provider : undefined)
+  const effectiveProvider = (provider !== 'github' && provider !== 'gitea') ? provider : undefined
   let issue
   try {
-    issue = await gitea.createIssue({ owner, repo: targetRepo, title: name, body, provider: forge || provider })
+    issue = await gitea.createIssue({ owner, repo: targetRepo, title: name, body, provider: effectiveForge || effectiveProvider })
   } catch (error) {
     // Repository may have already been created; avoid deleting on issue creation failure.
     return { error: 'issue-not-created', status: 502, detail: String(error?.message ?? error) }
   }
 
-  return { task: store.createTask(issueToTask(issue, { board, column: 'backlog', owner, repo: targetRepo, forge: forge || provider })) }
+  return { task: store.createTask(issueToTask(issue, { board, column: 'backlog', owner, repo: targetRepo, forge: effectiveForge, provider: effectiveProvider })) }
 }

package/lib/index.js

@@ -234,7 +234,7 @@ export function apply(ctx, config) {
     if (typeof settingsSvc?.describe !== 'function') return null
     try {
       const row = settingsSvc.describe().find((r) => r?.ns === SETTINGS_NAMESPACE)
-      if (!row || row.status !== 'ready' || !row.value) return null
+      if (!row || !row.value || (row.status !== undefined && row.status !== 'ready')) return null
       return withDefaults(row.value)
     } catch (err) {
       ctx.logger?.warn?.(`dsh-kanban: settings describe failed: ${err?.message || err}`)
@@ -268,14 +268,32 @@ export function apply(ctx, config) {
         }
       }
     }
+    const handleDocumentUpdated = (ns) => {
+      if (!ns || ns === SETTINGS_NAMESPACE) {
+        const served = readServedConfig()
+        if (served) {
+          effective = served
+          rearm()
+        }
+      }
+    }
+    const handleVolatileUpdate = (payload) => {
+      const served = readServedConfig()
+      if (served) {
+        effective = served
+        rearm()
+        return
+      }
+      applyPatch(payload)
+    }
     if (typeof ctx.effect === 'function') {
-      ctx.effect(() => ctx.on('loader/volatile-update', applyPatch))
+      ctx.effect(() => ctx.on('loader/volatile-update', handleVolatileUpdate))
       ctx.effect(() => ctx.on('config', applyPatch))
-      ctx.effect(() => ctx.on('settings/document-updated', applyPatch))
+      ctx.effect(() => ctx.on('settings/document-updated', handleDocumentUpdated))
     } else {
-      ctx.on('loader/volatile-update', applyPatch)
+      ctx.on('loader/volatile-update', handleVolatileUpdate)
       ctx.on('config', applyPatch)
-      ctx.on('settings/document-updated', applyPatch)
+      ctx.on('settings/document-updated', handleDocumentUpdated)
     }
   }
 
@@ -1142,6 +1160,9 @@ export function apply(ctx, config) {
             workspaceRegistry: ctx.get('workspaceRegistry'),
             force: input?.force === true,
             cleanupTaskWorktree,
+            config: getConfig(),
+            repoDir: rootOf(getConfig()).path,
+            cwdOf: () => rootOf(getConfig()).path,
           })
           writeJson(res, resObj.status, resObj.body)
           return
@@ -1209,6 +1230,9 @@ export function apply(ctx, config) {
         }
         if (req.method === 'POST' && action === 'report') {
           const resObj = handleTaskReport({ store, task: store.getTask(id), input })
+          if (resObj?.body?.task || resObj?.body?.report) {
+            eventHub.broadcast('task:change', { taskId: id, action: 'updated' })
+          }
           writeJson(res, resObj.status, resObj.body)
           return
         }
@@ -1219,6 +1243,9 @@ export function apply(ctx, config) {
         }
         if (req.method === 'POST' && action === 'comments') {
           const resObj = handleAddTaskComment({ store, task: store.getTask(id), input })
+          if (resObj?.body?.task || resObj?.status === 200) {
+            eventHub.broadcast('task:change', { taskId: id, action: 'updated', task: store.getTask(id) })
+          }
           writeJson(res, resObj.status, resObj.body)
           return
         }
@@ -1310,11 +1337,19 @@ export function apply(ctx, config) {
           return
         }
         if (req.method === 'POST' && action === 'archive') {
-          reply(res, setArchived({ store, id, archived: true }))
+          const resObj = setArchived({ store, id, archived: true })
+          if (resObj?.task) {
+            eventHub.broadcast('task:change', { taskId: id, action: 'archived' })
+          }
+          reply(res, resObj)
           return
         }
         if (req.method === 'POST' && action === 'restore') {
-          reply(res, setArchived({ store, id, archived: false }))
+          const resObj = setArchived({ store, id, archived: false })
+          if (resObj?.task) {
+            eventHub.broadcast('task:change', { taskId: id, action: 'restored' })
+          }
+          reply(res, resObj)
           return
         }
         if (req.method === 'POST' && action === 'queue') {
@@ -1330,11 +1365,19 @@ export function apply(ctx, config) {
           return
         }
         if (req.method === 'POST' && action === 'note') {
-          reply(res, appendNote({ store, id, input }))
+          const out = appendNote({ store, id, input })
+          if (out?.task || out?.text) {
+            eventHub.broadcast('task:change', { taskId: id, action: 'updated', task: store.getTask(id) })
+          }
+          reply(res, out)
           return
         }
-        if (req.method === 'PATCH' && action === undefined) {
-          reply(res, updateTask({ store, id, input }))
+        if (req.method === 'PATCH' && (action === undefined || action === '')) {
+          const resObj = updateTask({ store, id, input })
+          if (resObj?.task) {
+            eventHub.broadcast('task:change', { taskId: id, action: 'updated' })
+          }
+          reply(res, resObj)
           return
         }
         writeJson(res, 405, { error: 'method-not-allowed' })
@@ -1380,9 +1423,10 @@ export function apply(ctx, config) {
       try {
         const input = await readBody(req)
         reply(res, await importIssue({
-          gitea, store,
+          gitea: git, store,
           owner: input.owner, repo: input.repo, issueNumber: input.issueNumber,
           board: input.board ?? 'main', column: input.column ?? 'backlog',
+          forge: input.forge || input.provider,
         }))
       } catch (error) {
         writeJson(res, error?.status ?? 500, { error: 'bad-request' })

package/lib/intake.js

@@ -41,7 +41,7 @@ export function watchedRepos({ config, owner }) {
  *
  * @returns {{take: boolean, why: string}} `why` states reason on rejection.
  */
-export function shouldTake({ store, owner, repo, issue }) {
+export function shouldTake({ store, owner, repo, issue, forge }) {
   const number = issue?.number
   if (typeof number !== 'number') return { take: false, why: 'missing-number' }
   // Pull request in Gitea is also an issue, but not a standalone board card:
@@ -50,10 +50,10 @@ export function shouldTake({ store, owner, repo, issue }) {
     return { take: false, why: 'pull-request-ignored' }
   }
   if (issue?.state === 'closed') return { take: false, why: 'issue-closed' }
-  if (store.findTaskByIssue({ owner, repo, issueNumber: number }) !== undefined) {
+  if (store.findTaskByIssue({ owner, repo, issueNumber: number, forge }) !== undefined) {
     return { take: false, why: 'already-exists' }
   }
-  if (store.isDismissed({ owner, repo, issueNumber: number })) {
+  if (store.isDismissed({ owner, repo, issueNumber: number, forge })) {
     return { take: false, why: 'tombstone-ignored' }
   }
   return { take: true, why: '' }

package/lib/launcher.js

@@ -163,7 +163,7 @@ export async function obtainAgent({
   agentPreset, permission, permissions, gitRunner, workspaceRegistry,
   reasoningEffort,
 }) {
-  const chosenPerm = permission || task?.permission || ''
+  const chosenPerm = permission || task?.permission || config?.sessionDefaultPermission || ""
   const effort = reasoningEffort || task?.reasoningEffort || undefined
   const agentOptions = { provider, model, ...(effort ? { reasoningEffort: effort } : {}) }
 
@@ -210,7 +210,17 @@ export async function obtainAgent({
   let workspaceId = task?.workspaceId || undefined
   let worktreeCreated = false
 
-  const isGit = await isGitRepo(cwd, gitRunner)
+  let isGit = false
+  try {
+    isGit = await isGitRepo(cwd, gitRunner)
+  } catch (err) {
+    if (config?.worktreeIsolation !== false) {
+      const error = new Error(`worktree-creation-failed: git probe failed: ${err?.message || err}`)
+      error.key = 'worktree-creation-failed'
+      error.status = 500
+      throw error
+    }
+  }
   if (config?.worktreeIsolation !== false && isGit) {
     let created
     try {
@@ -331,6 +341,9 @@ export async function runTask({
 }) {
   const effort = reasoningEffort || task?.reasoningEffort || undefined
 
+  // Gate check must reject unconfirmed elevated tasks before queueing or state changes (#328)
+  verifyPermissionGate({ task, permission, config })
+
   // Concurrency limit check (#214, #330)
   const maxConcurrent = typeof config?.maxConcurrentSessions === 'number' ? config.maxConcurrentSessions : 3
   if (maxConcurrent > 0) {
@@ -360,8 +373,6 @@ export async function runTask({
     }
   }
 
-  verifyPermissionGate({ task, permission, config })
-
   reserveSessionSlot(task.id)
   let taken
   try {
@@ -370,9 +381,6 @@ export async function runTask({
       agentPreset, permission, permissions, gitRunner, workspaceRegistry,
       reasoningEffort: effort,
     })
-  } finally {
-    releaseSessionSlot(task.id)
-  }
 
   if (task.queuedAt > 0 || task.queuedRequest) {
     store.updateTask(task.id, { queuedAt: 0, queuedRequest: '' })
@@ -455,6 +463,9 @@ export async function runTask({
   }
 
   return { sessionId: taken.sessionId, mode: revivalKind(taken.mode), task: current }
+  } finally {
+    releaseSessionSlot(task.id)
+  }
 }
 
 /** Build prompt text: custom user message if provided, otherwise standard template. */
@@ -552,9 +563,6 @@ export async function runBatch({
       agents, task: list[0], config, provider, model, mintSessionId, cwdOf, logger,
       agentPreset, permission, permissions,
     })
-  } finally {
-    releaseSessionSlot(list[0].id)
-  }
 
   await taken.agent.whenIdle()
   const own = typeof text === 'string' ? text.trim() : ''
@@ -598,6 +606,9 @@ export async function runBatch({
   })
 
   return { sessionId: taken.sessionId, mode: taken.mode, started: started.length, tasks: started }
+  } finally {
+    releaseSessionSlot(list[0].id)
+  }
 }
 
 /**
@@ -639,7 +650,7 @@ export function unqueueTask({ store, task }) {
   if (typeof task.queuedAt !== 'number' || task.queuedAt <= 0) {
     return { error: 'task-not-queued', status: 400 }
   }
-  store.updateTask(task.id, { queuedAt: 0, sessionId: null })
+  store.updateTask(task.id, { queuedAt: 0, sessionId: null, queuedRequest: '' })
   store.addTransition({
     taskId: task.id, fromCol: task.column, toCol: task.column, source: 'manual',
     detail: 'removed from queue; message already sent to agent',
@@ -652,7 +663,12 @@ export function unqueueTask({ store, task }) {
  */
 export function countActiveSessions({ store, agents }) {
   const sessions = liveSessions({ store, agents })
-  const activeCount = sessions.filter((s) => s.status === 'running' || s.status === 'busy' || s.status === 'thinking').length
+  const activeCount = sessions.filter((s) =>
+    s.status === 'running' ||
+    s.status === 'busy' ||
+    s.status === 'thinking' ||
+    s.tasks.some((t) => t.workflowActive)
+  ).length
   return activeCount + activeReservations.size
 }
 
@@ -679,10 +695,12 @@ export function liveSessions({ store, agents }) {
     if (live.origin === 'subagent' || live.parentId !== undefined || live.meta?.origin === 'subagent' || live.isSubagent) {
       continue
     }
+    const isWorkflowActive = task.workflowStatus === 'running' || (typeof task.workflowRunId === 'string' && task.workflowRunId !== '' && task.workflowStatus !== 'completed' && task.workflowStatus !== 'failed' && task.workflowStatus !== 'cancelled')
     if (!byId.has(id)) byId.set(id, { sessionId: id, status: live.status, tasks: [] })
     byId.get(id).tasks.push({
       id: task.id, title: task.title, repo: task.repo, issueNumber: task.issueNumber,
       queued: typeof task.queuedAt === 'number' && task.queuedAt > 0,
+      workflowActive: isWorkflowActive,
     })
   }
   return [...byId.values()]
@@ -705,34 +723,36 @@ export async function dispatchNextQueuedTask({
   const queued = typeof store.listQueuedTasks === 'function' ? store.listQueuedTasks() : []
   if (queued.length === 0) return null
 
-  const nextTask = queued[0]
-  let queuedParams = {}
-  if (typeof nextTask.queuedRequest === 'string' && nextTask.queuedRequest) {
-    try { queuedParams = JSON.parse(nextTask.queuedRequest) } catch { /* ignore */ }
-  }
-  try {
-    return await runTask({
-      agents,
-      store,
-      task: nextTask,
-      config,
-      provider: queuedParams.provider || nextTask.provider || undefined,
-      model: queuedParams.model || nextTask.model || undefined,
-      permission: queuedParams.permission || nextTask.permission || undefined,
-      reasoningEffort: queuedParams.reasoningEffort || nextTask.reasoningEffort || undefined,
-      text: queuedParams.text || undefined,
-      agentPreset: queuedParams.agentPreset || agentPreset,
-      mintSessionId: mintSessionId || (() => `kanban-${nextTask.id}-${randomUUID()}`),
-      createMessage: createMessage || ((msg) => msg),
-      cwdOf,
-      logger,
-      permissions,
-      workspaceRegistry,
-      claimAs: claimAs || 'queue-dispatcher',
-      gitRunner,
-    })
-  } catch (err) {
-    logger?.warn?.(`dsh-kanban: failed to start queued task ${nextTask.id}: ${err?.message}`)
-    return null
+  for (const nextTask of queued) {
+    let queuedParams = {}
+    if (typeof nextTask.queuedRequest === 'string' && nextTask.queuedRequest) {
+      try { queuedParams = JSON.parse(nextTask.queuedRequest) } catch { /* ignore */ }
+    }
+    try {
+      return await runTask({
+        agents,
+        store,
+        task: nextTask,
+        config,
+        provider: queuedParams.provider || nextTask.provider || undefined,
+        model: queuedParams.model || nextTask.model || undefined,
+        permission: queuedParams.permission || nextTask.permission || undefined,
+        reasoningEffort: queuedParams.reasoningEffort || nextTask.reasoningEffort || undefined,
+        text: queuedParams.text || undefined,
+        agentPreset: queuedParams.agentPreset || agentPreset,
+        mintSessionId: mintSessionId || (() => `kanban-${nextTask.id}-${randomUUID()}`),
+        createMessage: createMessage || ((msg) => msg),
+        cwdOf,
+        logger,
+        permissions,
+        workspaceRegistry,
+        claimAs: claimAs || 'queue-dispatcher',
+        gitRunner,
+      })
+    } catch (err) {
+      logger?.warn?.(`dsh-kanban: failed to start queued task ${nextTask.id}: ${err?.message}`)
+      unqueueTask({ store, task: nextTask })
+    }
   }
+  return null
 }

package/lib/order.js

@@ -30,4 +30,19 @@ export function keyBetween(a, b) {
   return generateKeyBetween(a ?? null, b ?? null)
 }
 
+export function isValidOrderKey(key) {
+  if (typeof key !== 'string' || !key || /[^0-9a-zA-Z]/.test(key)) return false
+  try {
+    generateKeyBetween(null, key)
+    return true
+  } catch {
+    try {
+      generateKeyBetween(key, null)
+      return true
+    } catch {
+      return false
+    }
+  }
+}
+
 export { generateKeyBetween, generateNKeysBetween }

package/lib/progress-dump.js

@@ -62,21 +62,18 @@ export function parseProgressDump(text) {
     const line = rawLine.trim()
     const lower = line.toLowerCase()
 
-    if (lower.startsWith('goal:') || lower.startsWith('цель:')) {
+    if (lower.startsWith('goal:')) {
       currentKey = 'goal'
       const val = line.slice(line.indexOf(':') + 1).trim()
       if (val) sections.goal.push(val)
-    } else if (lower.startsWith('progress:') || lower.startsWith('done:') || lower.startsWith('прогресс:')) {
+    } else if (lower.startsWith('progress:') || lower.startsWith('done:')) {
       currentKey = 'progress'
       const val = line.slice(line.indexOf(':') + 1).trim()
       if (val) sections.progress.push(val)
     } else if (
       lower.startsWith('next:') ||
       lower.startsWith('next steps:') ||
-      lower.startsWith('next step:') ||
-      lower.startsWith('следующие шаги:') ||
-      lower.startsWith('шаги:') ||
-      lower.startsWith('дальше:')
+      lower.startsWith('next step:')
     ) {
       currentKey = 'next'
       const val = line.slice(line.indexOf(':') + 1).trim()

package/lib/routes.js

@@ -238,9 +238,7 @@ export function updateTask({ store, id, input }) {
       patch.permissionConfirmedTier = ''
     }
   }
-  if (typeof input?.permissionConfirmedTier === 'string') {
-    patch.permissionConfirmedTier = input.permissionConfirmedTier
-  }
+
   if (typeof input?.reasoningEffort === 'string') {
     const val = input.reasoningEffort.trim().toLowerCase()
     if (['', 'low', 'medium', 'high', 'default', 'none', 'minimal', 'thorough'].includes(val)) {
@@ -414,7 +412,13 @@ export function importBoard({ store, input }) {
   const doImport = () => {
     for (const board of Array.isArray(input.boards) ? input.boards : []) {
       if (typeof board?.id !== 'string' || board.id === '') continue
-      store.createBoard({ id: board.id, title: board.title, kind: board.kind })
+      store.createBoard({
+        id: board.id,
+        title: board.title,
+        kind: board.kind,
+        position: board.position,
+        createdAt: board.createdAt,
+      })
     }
 
     for (const task of input.tasks) {
@@ -524,15 +528,23 @@ export function exportTasksCsv({ store, board = 'main' }) {
 /**
  * Clean up task worktree.
  */
-export async function handleCleanupWorktree({ store, task, workspaceRegistry, force, cleanupTaskWorktree }) {
+export async function handleCleanupWorktree({
+  store, task, workspaceRegistry, force, cleanupTaskWorktree,
+  config, repoDir, cwdOf, env,
+}) {
   if (!task) return { status: 404, body: { error: 'task-not-found' } }
   const out = await cleanupTaskWorktree({
     store,
     task,
     workspaceRegistry,
     force: force === true,
+    config,
+    repoDir,
+    cwdOf,
+    env,
   })
-  return { status: 200, body: out }
+  const status = out.status || (out.error ? (out.error === 'unfenced-worktree-path' ? 403 : 500) : 200)
+  return { status, body: out }
 }
 
 /**

package/lib/store.js

@@ -13,7 +13,7 @@ import { DatabaseSync } from 'node:sqlite'
 import { randomUUID } from 'node:crypto'
 import { mkdirSync, copyFileSync, readdirSync, unlinkSync, statSync, chmodSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
-import { keyBetween, generateNKeysBetween } from './order.js'
+import { keyBetween, generateNKeysBetween, isValidOrderKey } from './order.js'
 import { DEFAULT_BOARDS, normalizeKind } from './config.js'
 
 const SCHEMA = `
@@ -73,6 +73,9 @@ CREATE TABLE IF NOT EXISTS tasks (
   isEpic                INTEGER NOT NULL DEFAULT 0,
   workflowRunId         TEXT NOT NULL DEFAULT '',
   workflowStatus        TEXT NOT NULL DEFAULT '',
+  forge                 TEXT NOT NULL DEFAULT '',
+  permissionConfirmedTier TEXT NOT NULL DEFAULT '',
+  queuedRequest         TEXT NOT NULL DEFAULT '',
   updatedAt    INTEGER NOT NULL
 );
 CREATE INDEX IF NOT EXISTS tasks_board_col ON tasks(board, col, position);
@@ -91,8 +94,9 @@ CREATE TABLE IF NOT EXISTS dismissed (
   owner       TEXT NOT NULL,
   repo        TEXT NOT NULL,
   issueNumber INTEGER NOT NULL,
+  forge       TEXT NOT NULL DEFAULT '',
   at          INTEGER NOT NULL,
-  PRIMARY KEY (owner, repo, issueNumber)
+  PRIMARY KEY (owner, repo, issueNumber, forge)
 );
 `
 
@@ -103,7 +107,7 @@ const WRITABLE = [
   'labelColors', 'queuedAt', 'createdAt', 'author', 'assignee', 'milestone', 'priority', 'dueAt',
   'cron', 'nextRunAt', 'lastRunAt', 'progressDump', 'permission', 'reasoningEffort', 'permissionConfirmedAt',
   'runs', 'checklist', 'report', 'comments', 'rejectReason', 'rejectedAt', 'parentId', 'isEpic',
-  'workflowRunId', 'workflowStatus', 'permissionConfirmedTier', 'forge',
+  'workflowRunId', 'workflowStatus', 'permissionConfirmedTier', 'forge', 'queuedRequest',
 ]
 
 /** Valid transition sources; unexpected values are rejected to preserve log integrity. */
@@ -244,6 +248,7 @@ export function openStore({ dir }) {
     ['workflowStatus', "TEXT NOT NULL DEFAULT ''"],
     ['forge', "TEXT NOT NULL DEFAULT ''"],
     ['permissionConfirmedTier', "TEXT NOT NULL DEFAULT ''"],
+    ['queuedRequest', "TEXT NOT NULL DEFAULT ''"],
   ]) {
     try { db.exec(`ALTER TABLE tasks ADD COLUMN ${column} ${definition}`) } catch { /* column already exists */ }
   }
@@ -283,12 +288,35 @@ export function openStore({ dir }) {
           }
         }
       }
+      const boardRows = db.prepare('SELECT id, position FROM boards ORDER BY position ASC, id ASC').all()
+      if (boardRows.length > 0) {
+        const updateBoardPos = db.prepare('UPDATE boards SET position = ? WHERE id = ?')
+        const newBoardKeys = generateNKeysBetween(null, null, boardRows.length)
+        for (let i = 0; i < boardRows.length; i++) {
+          updateBoardPos.run(newBoardKeys[i], boardRows[i].id)
+        }
+      }
       db.prepare("INSERT OR REPLACE INTO meta (key, val) VALUES ('fractional_indexing_migrated', '1')").run()
       db.exec('COMMIT')
     } catch (e) {
       try { db.exec('ROLLBACK') } catch { /* ignore */ }
     }
   }
+  // Ensure board order keys are valid, even if fractional_indexing_migrated marker already exists (#345)
+  const boardRows = db.prepare('SELECT id, position FROM boards ORDER BY position ASC, id ASC').all()
+  if (boardRows.length > 0 && boardRows.some((b) => !isValidOrderKey(b.position))) {
+    try {
+      db.exec('BEGIN TRANSACTION')
+      const updateBoardPos = db.prepare('UPDATE boards SET position = ? WHERE id = ?')
+      const newBoardKeys = generateNKeysBetween(null, null, boardRows.length)
+      for (let i = 0; i < boardRows.length; i++) {
+        updateBoardPos.run(newBoardKeys[i], boardRows[i].id)
+      }
+      db.exec('COMMIT')
+    } catch {
+      try { db.exec('ROLLBACK') } catch { /* ignore */ }
+    }
+  }
   db.exec('PRAGMA synchronous = NORMAL')
   try { db.exec('PRAGMA optimize') } catch { /* pragma optimize best-effort */ }
 
@@ -303,16 +331,16 @@ export function openStore({ dir }) {
        labelColors, author, assignee, milestone, priority, dueAt, columnAt, createdAt, updatedAt,
        cron, nextRunAt, lastRunAt, progressDump, permission, permissionConfirmedAt, runs,
        checklist, report, comments, rejectReason, rejectedAt, reasoningEffort, parentId, isEpic,
-       workflowRunId, workflowStatus)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`),
+       workflowRunId, workflowStatus, forge, queuedRequest)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`),
     restoreTask: db.prepare(`INSERT INTO tasks
       (id, board, col, position, title, body, owner, repo, issueNumber, issueUrl, externalRef,
        labels, branch, worktree, workspaceId, sessionId, model, provider, waiting, syncedAt,
        labelColors, author, assignee, milestone, priority, dueAt, columnAt, createdAt, updatedAt,
        cron, nextRunAt, lastRunAt, progressDump, permission, permissionConfirmedAt, permissionConfirmedTier, runs,
        checklist, report, comments, rejectReason, rejectedAt, reasoningEffort, parentId, isEpic,
-       workflowRunId, workflowStatus, archivedAt, queuedAt, plan, forge)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+       workflowRunId, workflowStatus, archivedAt, queuedAt, plan, forge, queuedRequest)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT(id) DO UPDATE SET
         board=excluded.board, col=excluded.col, position=excluded.position, title=excluded.title,
         body=excluded.body, owner=excluded.owner, repo=excluded.repo, issueNumber=excluded.issueNumber,
@@ -330,7 +358,8 @@ export function openStore({ dir }) {
         rejectReason=excluded.rejectReason, rejectedAt=excluded.rejectedAt,
         reasoningEffort=excluded.reasoningEffort, parentId=excluded.parentId, isEpic=excluded.isEpic,
         workflowRunId=excluded.workflowRunId, workflowStatus=excluded.workflowStatus,
-        archivedAt=excluded.archivedAt, queuedAt=excluded.queuedAt, plan=excluded.plan, forge=excluded.forge`),
+        archivedAt=excluded.archivedAt, queuedAt=excluded.queuedAt, plan=excluded.plan, forge=excluded.forge,
+        queuedRequest=excluded.queuedRequest`),
     restoreTransition: db.prepare(`INSERT INTO transitions
       (taskId, fromCol, toCol, source, detail, at)
       VALUES (?, ?, ?, ?, ?, ?)`),
@@ -344,7 +373,7 @@ export function openStore({ dir }) {
     archived: db.prepare('SELECT * FROM tasks WHERE archivedAt > 0 ORDER BY archivedAt DESC'),
     archivable: db.prepare(
       "SELECT * FROM tasks WHERE archivedAt = 0 AND col = 'done' AND columnAt > 0 AND columnAt <= ?"),
-    dismiss: db.prepare('INSERT OR REPLACE INTO dismissed (owner, repo, issueNumber, at) VALUES (?, ?, ?, ?)'),
+    dismiss: db.prepare('INSERT OR REPLACE INTO dismissed (owner, repo, issueNumber, forge, at) VALUES (?, ?, ?, ?, ?)'),
     isDismissed: db.prepare('SELECT 1 FROM dismissed WHERE owner = ? AND repo = ? AND issueNumber = ?'),
     isDismissedWithForge: db.prepare(`SELECT 1 FROM dismissed WHERE owner = ? AND repo = ? AND issueNumber = ? AND (forge = ? OR (forge = '' AND ? = 'gitea'))`),
     byIssue: db.prepare('SELECT * FROM tasks WHERE owner = ? AND repo = ? AND issueNumber = ?'),
@@ -365,12 +394,19 @@ export function openStore({ dir }) {
       "SELECT COUNT(*) AS total, SUM(CASE WHEN col = 'done' THEN 1 ELSE 0 END) AS completed FROM tasks WHERE parentId = ? AND archivedAt = 0"),
   }
 
-  function ensureBoard(id, title, kind) {
+  function ensureBoard(id, title, kind, position, createdAt) {
     const found = q.boardById.get(id)
-    if (found !== undefined) return found
+    if (found !== undefined) {
+      if (position !== undefined || createdAt !== undefined || title !== undefined || kind !== undefined) {
+        db.prepare('UPDATE boards SET title = ?, kind = ?, position = ?, createdAt = ? WHERE id = ?')
+          .run(title ?? found.title, normalizeKind(kind ?? found.kind), position ?? found.position, createdAt ?? found.createdAt, id)
+      }
+      return q.boardById.get(id)
+    }
     const last = q.lastBoard.get()
-    const position = keyBetween(last?.position, undefined)
-    q.insertBoard.run(id, title, normalizeKind(kind), position, Date.now())
+    const pos = isValidOrderKey(position) ? position : keyBetween(last?.position, undefined)
+    const created = typeof createdAt === 'number' && createdAt > 0 ? createdAt : Date.now()
+    q.insertBoard.run(id, title, normalizeKind(kind), pos, created)
     return q.boardById.get(id)
   }
 
@@ -440,8 +476,8 @@ export function openStore({ dir }) {
       return q.boards.all()
     },
 
-    createBoard({ id, title, kind }) {
-      return ensureBoard(id, title ?? id, kind)
+    createBoard({ id, title, kind, position, createdAt }) {
+      return ensureBoard(id, title ?? id, kind, position, createdAt)
     },
 
     /** Board kind. Unrecognized kinds default to 'project'. */
@@ -529,6 +565,8 @@ export function openStore({ dir }) {
         input.isEpic ? 1 : 0,
         input.workflowRunId ?? '',
         input.workflowStatus ?? '',
+        input.forge ?? '',
+        input.queuedRequest ?? '',
       )
       return rowToTask(q.taskById.get(id))
     },
@@ -631,12 +669,17 @@ export function openStore({ dir }) {
       const checklist = JSON.stringify(Array.isArray(task.checklist) ? task.checklist : [])
       const report = JSON.stringify(task.report && typeof task.report === 'object' ? task.report : {})
       const comments = JSON.stringify(Array.isArray(task.comments) ? task.comments : [])
-      const forge = task.forge || (typeof task.issueUrl === 'string' && task.issueUrl.includes('github.com') ? 'github' : 'gitea')
+      const forge = typeof task.forge === 'string'
+        ? task.forge
+        : (typeof task.issueUrl === 'string' && task.issueUrl.includes('github.com') ? 'github' : (task.owner && task.repo && task.issueNumber ? 'gitea' : ''))
+      const targetBoard = task.board || 'main'
+      const targetCol = task.column || task.col || 'backlog'
+      const position = isValidOrderKey(task.position) ? task.position : positionFor(targetBoard, targetCol, undefined, undefined)
       q.restoreTask.run(
         task.id,
-        task.board || 'main',
-        task.column || task.col || 'backlog',
-        task.position || keyBetween(undefined, undefined),
+        targetBoard,
+        targetCol,
+        position,
         task.title || '',
         task.body || '',
         task.owner ?? null,
@@ -650,7 +693,7 @@ export function openStore({ dir }) {
         task.workspaceId || '',
         task.sessionId ?? null,
         task.model ?? null,
-        task.provider ?? 'gitea',
+        task.provider !== undefined ? task.provider : null,
         task.waiting ? 1 : 0,
         task.syncedAt || 0,
         colors,
@@ -684,6 +727,7 @@ export function openStore({ dir }) {
         task.queuedAt || 0,
         task.plan || '',
         forge,
+        task.queuedRequest || '',
       )
       return rowToTask(q.taskById.get(task.id))
     },
@@ -755,10 +799,10 @@ export function openStore({ dir }) {
     },
 
     deleteTask(id) {
-      // Record deleted Gitea tasks as dismissed to prevent the intake loop from re-importing them.
+      // Record deleted tasks as dismissed to prevent the intake loop from re-importing them.
       const task = q.taskById.get(id)
       if (task?.owner && task?.repo && typeof task.issueNumber === 'number') {
-        q.dismiss.run(task.owner, task.repo, task.issueNumber, Date.now())
+        q.dismiss.run(task.owner, task.repo, task.issueNumber, task.forge || '', Date.now())
       }
       q.deleteTask.run(id)
     },

package/lib/sync.js

@@ -40,9 +40,10 @@ export async function withBackoff(fn, { retries = 2, baseMs = 50, maxMs = 500 }
  * would lead to erroneous column transitions. If reading fails, the repository is skipped.
  */
 async function readRepo({ gitea, owner, repo, forge }) {
+  const provider = forge || undefined
   const [pulls, branches] = await Promise.all([
-    gitea.listPulls({ owner, repo, state: 'all' }),
-    gitea.listBranches({ owner, repo }),
+    gitea.listPulls({ owner, repo, state: 'all', provider }),
+    gitea.listBranches({ owner, repo, provider }),
   ])
   return { pulls, branches }
 }

package/lib/workflow-bridge.js

@@ -489,7 +489,7 @@ export class WorkflowBridge {
             repo: task.repo,
             index: task.issueNumber,
             body: commentBody,
-            provider: task.provider,
+            provider: task.forge || (typeof task.issueUrl === 'string' && task.issueUrl.includes('github.com') ? 'github' : 'gitea'),
           })
         } catch (err) {
           this.logger?.warn?.(`dsh-kanban: failed to comment on issue ${task.repo}#${task.issueNumber}: ${err.message}`)

package/lib/worktree.js

@@ -28,7 +28,7 @@ export async function defaultGitRunner(args, cwd) {
     const { stdout, stderr } = await execFileAsync('git', args, {
       cwd,
       maxBuffer: 10 * 1024 * 1024,
-      env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+      env: { ...process.env, GIT_TERMINAL_PROMPT: '0', LC_ALL: 'C' },
     })
     return { stdout: stdout.trim(), stderr: stderr.trim(), code: 0, exitCode: 0 }
   } catch (err) {
@@ -136,8 +136,18 @@ export async function isGitRepo(repoDir, gitRunner = defaultGitRunner) {
   try {
     const res = await gitRunner(['rev-parse', '--is-inside-work-tree'], repoDir)
     return res.stdout?.trim() === 'true'
-  } catch {
-    return false
+  } catch (err) {
+    const msg = String(err?.stderr || err?.message || '').toLowerCase()
+    if (
+      msg.includes('not a git repo') ||
+      msg.includes('not a git repository') ||
+      msg.includes('не найден git репозиторий') ||
+      msg.includes('не является git-репозиторием') ||
+      (err?.code === 'ENOENT' && repoDir && !existsSync(repoDir))
+    ) {
+      return false
+    }
+    throw err
   }
 }
 
@@ -371,17 +381,58 @@ export async function cleanupTaskWorktree({
   if (!current.worktree) return { noop: true, removed: false }
 
   const root = resolveWorktreeRoot(config, env, cwdOf)
+  const customRoot = typeof config?.worktreeRoot === 'string' && config.worktreeRoot.trim() !== ''
+    ? root
+    : undefined
   const candidateRoots = [
     root,
     repoDir,
-    typeof cwdOf === 'function' ? cwdOf() : process.cwd(),
-    process.cwd(),
+    typeof cwdOf === 'function' ? cwdOf() : (!customRoot && !repoDir ? process.cwd() : undefined),
   ].filter(Boolean)
-  const isFenced = candidateRoots.some((c) => isPathFenced(current.worktree, c))
+  const isFenced = candidateRoots.length === 0 || candidateRoots.some((c) => isPathFenced(current.worktree, c))
   if (!isFenced) {
     return { error: 'unfenced-worktree-path', status: 403 }
   }
 
+  // 1. Verify worktree cleanliness (force must not bypass dirty worktree ban #341)
+  const dirtyCheck = await checkWorktreeDirty({ worktreePath: current.worktree, gitRunner })
+  if (dirtyCheck.error) {
+    return { error: 'worktree-status-error', detail: dirtyCheck.error }
+  }
+  if (dirtyCheck.dirty) {
+    store?.addTransition?.({
+      taskId: current.id,
+      fromCol: current.column,
+      toCol: current.column,
+      source: 'session',
+      detail: `cleanup deferred: uncommitted files detected: ${dirtyCheck.files.slice(0, 3).join(', ')}`,
+    })
+    return { error: 'worktree-dirty', files: dirtyCheck.files }
+  }
+
+  // 2. Ownership fencing: ensure worktree is registered in repository before removal (#315)
+  let baseRepo = repoDir
+  if (!baseRepo && current?.repo) {
+    const root = typeof config?.defaultProjectRoot === 'string' && config.defaultProjectRoot.trim() !== ''
+      ? config.defaultProjectRoot.trim()
+      : (typeof cwdOf === 'function' ? cwdOf() : process.cwd())
+    baseRepo = resolve(join(root, current.repo))
+  }
+  if (!baseRepo) {
+    const rev = await gitRunner(['rev-parse', '--git-common-dir'], current.worktree)
+    if ((rev?.exitCode ?? rev?.code ?? 0) === 0 && rev?.stdout?.trim()) {
+      const cd = rev.stdout.trim()
+      baseRepo = cd.endsWith('/.git') ? cd.slice(0, -5) : cd
+    }
+  }
+  if (baseRepo) {
+    const registered = await listWorktrees(baseRepo, gitRunner)
+    const norm = resolve(current.worktree)
+    if (!registered.some((p) => resolve(p) === norm)) {
+      return { error: 'worktree-not-registered', status: 403 }
+    }
+  }
+
   const targetRepoDir = repoDir || current.worktree
   const result = await removeTaskWorktree({
     repoDir: targetRepoDir,
@@ -392,15 +443,22 @@ export async function cleanupTaskWorktree({
     gitRunner,
   })
 
-  if (result.error === 'worktree-dirty') {
-    store?.addTransition?.({
-      taskId: current.id,
-      fromCol: current.column,
-      toCol: current.column,
-      source: 'session',
-      detail: `cleanup deferred: uncommitted files detected: ${result.files.slice(0, 3).join(', ')}`,
-    })
-    return { error: 'worktree-dirty', files: result.files }
+  if (result.error) {
+    if (result.error === 'worktree-dirty') {
+      store?.addTransition?.({
+        taskId: current.id,
+        fromCol: current.column,
+        toCol: current.column,
+        source: 'session',
+        detail: `cleanup deferred: uncommitted files detected: ${result.files.slice(0, 3).join(', ')}`,
+      })
+      return { error: 'worktree-dirty', files: result.files }
+    }
+    return { success: false, removed: false, error: result.error, detail: result.detail }
+  }
+
+  if (!result.removed) {
+    return { success: false, removed: false, reason: result.reason }
   }
 
   if (workspaceRegistry && current.workspaceId) {
@@ -548,6 +606,21 @@ export async function mergeTaskWorktree({
     return { success: false, merged: false, error: 'main-repo-not-found' }
   }
 
+  // Repository ownership fence: main repository name must match task.repo (#315)
+  if (task.repo) {
+    const expectedRepo = task.repo.trim()
+    const baseName = basename(mainRepoDir)
+    if (baseName !== expectedRepo && !mainRepoDir.endsWith('/' + expectedRepo) && !mainRepoDir.endsWith(sep + expectedRepo)) {
+      return { success: false, merged: false, error: 'foreign-repository-mismatch' }
+    }
+  }
+
+  const registered = await listWorktrees(mainRepoDir, gitRunner)
+  const normTaskWorktree = resolve(task.worktree)
+  if (!registered.some((p) => resolve(p) === normTaskWorktree)) {
+    return { success: false, merged: false, error: 'worktree-not-registered' }
+  }
+
   // 3. Resolve target merge branch
   let target = targetBranch
   if (target && !isSafeBranchName(target)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-kanban",
-  "version": "0.2.23",
+  "version": "0.2.25",
   "description": "Visual Kanban board for DeepSeek Harness: Gitea and GitHub-backed tasks, workflow columns, and a dedicated agent session per task.",
   "type": "module",
   "main": "lib/index.js",
@@ -18,10 +18,6 @@
     "README.ru.md",
     "LICENSE"
   ],
-  "scripts": {
-    "test": "node --test test/*.test.mjs",
-    "compat": "node tools/compat.mjs"
-  },
   "keywords": [
     "dsh",
     "dsh-plugin",
@@ -93,5 +89,9 @@
     "@deepseek-ai/dsh-tools": {
       "optional": true
     }
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mjs",
+    "compat": "node tools/compat.mjs"
   }
-}
+}