@goodandready/dsh-kanban 0.2.24 → 0.2.25

package/lib/import.js

@@ -97,10 +97,18 @@ export function issueToTask(issue, { board = 'main', column = 'backlog', owner,
  * Compared by owner-repo-number tuple to avoid colliding with issue #1 in another repo.
  * Existing issues are dimmed rather than hidden, as re-importing may be intentional.
  */
-export function markImported(issues, existing, { owner, repo }) {
+export function markImported(issues, existing, { owner, repo, forge }) {
+  const targetForge = forge || ''
   const seen = new Set(
     (existing ?? [])
-      .filter((t) => t.owner === owner && t.repo === repo && typeof t.issueNumber === 'number')
+      .filter((t) => {
+        if (t.owner !== owner || t.repo !== repo || typeof t.issueNumber !== 'number') return false
+        if (targetForge) {
+          const tf = t.forge || (typeof t.issueUrl === 'string' && t.issueUrl.includes('github.com') ? 'github' : 'gitea')
+          return tf === targetForge
+        }
+        return true
+      })
       .map((t) => t.issueNumber),
   )
   return (issues ?? []).map((issue) => ({ ...issue, imported: seen.has(issue?.number) }))
@@ -158,7 +166,7 @@ export async function listImportable({ gitea, store, owner, repo, board = 'main'
   if (state !== 'ready') return { error: `gitea-${state}`, status: 409 }
   const issues = await gitea.listIssues({ owner, repo, state: 'open', provider: forge || provider })
   const existing = store.listTasks({ board })
-  return { issues: markImported(issues, existing, { owner, repo }) }
+  return { issues: markImported(issues, existing, { owner, repo, forge: forge || provider }) }
 }
 
 /** Create a task from an issue. */

package/lib/index.js

@@ -1243,6 +1243,9 @@ export function apply(ctx, config) {
         }
         if (req.method === 'POST' && action === 'comments') {
           const resObj = handleAddTaskComment({ store, task: store.getTask(id), input })
+          if (resObj?.body?.task || resObj?.status === 200) {
+            eventHub.broadcast('task:change', { taskId: id, action: 'updated', task: store.getTask(id) })
+          }
           writeJson(res, resObj.status, resObj.body)
           return
         }
@@ -1362,7 +1365,11 @@ export function apply(ctx, config) {
           return
         }
         if (req.method === 'POST' && action === 'note') {
-          reply(res, appendNote({ store, id, input }))
+          const out = appendNote({ store, id, input })
+          if (out?.task || out?.text) {
+            eventHub.broadcast('task:change', { taskId: id, action: 'updated', task: store.getTask(id) })
+          }
+          reply(res, out)
           return
         }
         if (req.method === 'PATCH' && (action === undefined || action === '')) {

package/lib/intake.js

@@ -41,7 +41,7 @@ export function watchedRepos({ config, owner }) {
  *
  * @returns {{take: boolean, why: string}} `why` states reason on rejection.
  */
-export function shouldTake({ store, owner, repo, issue }) {
+export function shouldTake({ store, owner, repo, issue, forge }) {
   const number = issue?.number
   if (typeof number !== 'number') return { take: false, why: 'missing-number' }
   // Pull request in Gitea is also an issue, but not a standalone board card:
@@ -50,10 +50,10 @@ export function shouldTake({ store, owner, repo, issue }) {
     return { take: false, why: 'pull-request-ignored' }
   }
   if (issue?.state === 'closed') return { take: false, why: 'issue-closed' }
-  if (store.findTaskByIssue({ owner, repo, issueNumber: number }) !== undefined) {
+  if (store.findTaskByIssue({ owner, repo, issueNumber: number, forge }) !== undefined) {
     return { take: false, why: 'already-exists' }
   }
-  if (store.isDismissed({ owner, repo, issueNumber: number })) {
+  if (store.isDismissed({ owner, repo, issueNumber: number, forge })) {
     return { take: false, why: 'tombstone-ignored' }
   }
   return { take: true, why: '' }

package/lib/launcher.js

@@ -163,7 +163,7 @@ export async function obtainAgent({
   agentPreset, permission, permissions, gitRunner, workspaceRegistry,
   reasoningEffort,
 }) {
-  const chosenPerm = permission || task?.permission || (typeof permissions?.set === 'function' ? (config?.sessionDefaultPermission || '') : '')
+  const chosenPerm = permission || task?.permission || config?.sessionDefaultPermission || ""
   const effort = reasoningEffort || task?.reasoningEffort || undefined
   const agentOptions = { provider, model, ...(effort ? { reasoningEffort: effort } : {}) }
 
@@ -341,6 +341,9 @@ export async function runTask({
 }) {
   const effort = reasoningEffort || task?.reasoningEffort || undefined
 
+  // Gate check must reject unconfirmed elevated tasks before queueing or state changes (#328)
+  verifyPermissionGate({ task, permission, config })
+
   // Concurrency limit check (#214, #330)
   const maxConcurrent = typeof config?.maxConcurrentSessions === 'number' ? config.maxConcurrentSessions : 3
   if (maxConcurrent > 0) {
@@ -370,8 +373,6 @@ export async function runTask({
     }
   }
 
-  verifyPermissionGate({ task, permission, config })
-
   reserveSessionSlot(task.id)
   let taken
   try {
@@ -662,7 +663,12 @@ export function unqueueTask({ store, task }) {
  */
 export function countActiveSessions({ store, agents }) {
   const sessions = liveSessions({ store, agents })
-  const activeCount = sessions.filter((s) => s.status === 'running' || s.status === 'busy' || s.status === 'thinking').length
+  const activeCount = sessions.filter((s) =>
+    s.status === 'running' ||
+    s.status === 'busy' ||
+    s.status === 'thinking' ||
+    s.tasks.some((t) => t.workflowActive)
+  ).length
   return activeCount + activeReservations.size
 }
 
@@ -689,10 +695,12 @@ export function liveSessions({ store, agents }) {
     if (live.origin === 'subagent' || live.parentId !== undefined || live.meta?.origin === 'subagent' || live.isSubagent) {
       continue
     }
+    const isWorkflowActive = task.workflowStatus === 'running' || (typeof task.workflowRunId === 'string' && task.workflowRunId !== '' && task.workflowStatus !== 'completed' && task.workflowStatus !== 'failed' && task.workflowStatus !== 'cancelled')
     if (!byId.has(id)) byId.set(id, { sessionId: id, status: live.status, tasks: [] })
     byId.get(id).tasks.push({
       id: task.id, title: task.title, repo: task.repo, issueNumber: task.issueNumber,
       queued: typeof task.queuedAt === 'number' && task.queuedAt > 0,
+      workflowActive: isWorkflowActive,
     })
   }
   return [...byId.values()]
@@ -715,34 +723,36 @@ export async function dispatchNextQueuedTask({
   const queued = typeof store.listQueuedTasks === 'function' ? store.listQueuedTasks() : []
   if (queued.length === 0) return null
 
-  const nextTask = queued[0]
-  let queuedParams = {}
-  if (typeof nextTask.queuedRequest === 'string' && nextTask.queuedRequest) {
-    try { queuedParams = JSON.parse(nextTask.queuedRequest) } catch { /* ignore */ }
-  }
-  try {
-    return await runTask({
-      agents,
-      store,
-      task: nextTask,
-      config,
-      provider: queuedParams.provider || nextTask.provider || undefined,
-      model: queuedParams.model || nextTask.model || undefined,
-      permission: queuedParams.permission || nextTask.permission || undefined,
-      reasoningEffort: queuedParams.reasoningEffort || nextTask.reasoningEffort || undefined,
-      text: queuedParams.text || undefined,
-      agentPreset: queuedParams.agentPreset || agentPreset,
-      mintSessionId: mintSessionId || (() => `kanban-${nextTask.id}-${randomUUID()}`),
-      createMessage: createMessage || ((msg) => msg),
-      cwdOf,
-      logger,
-      permissions,
-      workspaceRegistry,
-      claimAs: claimAs || 'queue-dispatcher',
-      gitRunner,
-    })
-  } catch (err) {
-    logger?.warn?.(`dsh-kanban: failed to start queued task ${nextTask.id}: ${err?.message}`)
-    return null
+  for (const nextTask of queued) {
+    let queuedParams = {}
+    if (typeof nextTask.queuedRequest === 'string' && nextTask.queuedRequest) {
+      try { queuedParams = JSON.parse(nextTask.queuedRequest) } catch { /* ignore */ }
+    }
+    try {
+      return await runTask({
+        agents,
+        store,
+        task: nextTask,
+        config,
+        provider: queuedParams.provider || nextTask.provider || undefined,
+        model: queuedParams.model || nextTask.model || undefined,
+        permission: queuedParams.permission || nextTask.permission || undefined,
+        reasoningEffort: queuedParams.reasoningEffort || nextTask.reasoningEffort || undefined,
+        text: queuedParams.text || undefined,
+        agentPreset: queuedParams.agentPreset || agentPreset,
+        mintSessionId: mintSessionId || (() => `kanban-${nextTask.id}-${randomUUID()}`),
+        createMessage: createMessage || ((msg) => msg),
+        cwdOf,
+        logger,
+        permissions,
+        workspaceRegistry,
+        claimAs: claimAs || 'queue-dispatcher',
+        gitRunner,
+      })
+    } catch (err) {
+      logger?.warn?.(`dsh-kanban: failed to start queued task ${nextTask.id}: ${err?.message}`)
+      unqueueTask({ store, task: nextTask })
+    }
   }
+  return null
 }

package/lib/routes.js

@@ -412,7 +412,13 @@ export function importBoard({ store, input }) {
   const doImport = () => {
     for (const board of Array.isArray(input.boards) ? input.boards : []) {
       if (typeof board?.id !== 'string' || board.id === '') continue
-      store.createBoard({ id: board.id, title: board.title, kind: board.kind })
+      store.createBoard({
+        id: board.id,
+        title: board.title,
+        kind: board.kind,
+        position: board.position,
+        createdAt: board.createdAt,
+      })
     }
 
     for (const task of input.tasks) {

package/lib/store.js

@@ -94,8 +94,9 @@ CREATE TABLE IF NOT EXISTS dismissed (
   owner       TEXT NOT NULL,
   repo        TEXT NOT NULL,
   issueNumber INTEGER NOT NULL,
+  forge       TEXT NOT NULL DEFAULT '',
   at          INTEGER NOT NULL,
-  PRIMARY KEY (owner, repo, issueNumber)
+  PRIMARY KEY (owner, repo, issueNumber, forge)
 );
 `
 
@@ -301,6 +302,21 @@ export function openStore({ dir }) {
       try { db.exec('ROLLBACK') } catch { /* ignore */ }
     }
   }
+  // Ensure board order keys are valid, even if fractional_indexing_migrated marker already exists (#345)
+  const boardRows = db.prepare('SELECT id, position FROM boards ORDER BY position ASC, id ASC').all()
+  if (boardRows.length > 0 && boardRows.some((b) => !isValidOrderKey(b.position))) {
+    try {
+      db.exec('BEGIN TRANSACTION')
+      const updateBoardPos = db.prepare('UPDATE boards SET position = ? WHERE id = ?')
+      const newBoardKeys = generateNKeysBetween(null, null, boardRows.length)
+      for (let i = 0; i < boardRows.length; i++) {
+        updateBoardPos.run(newBoardKeys[i], boardRows[i].id)
+      }
+      db.exec('COMMIT')
+    } catch {
+      try { db.exec('ROLLBACK') } catch { /* ignore */ }
+    }
+  }
   db.exec('PRAGMA synchronous = NORMAL')
   try { db.exec('PRAGMA optimize') } catch { /* pragma optimize best-effort */ }
 
@@ -357,7 +373,7 @@ export function openStore({ dir }) {
     archived: db.prepare('SELECT * FROM tasks WHERE archivedAt > 0 ORDER BY archivedAt DESC'),
     archivable: db.prepare(
       "SELECT * FROM tasks WHERE archivedAt = 0 AND col = 'done' AND columnAt > 0 AND columnAt <= ?"),
-    dismiss: db.prepare('INSERT OR REPLACE INTO dismissed (owner, repo, issueNumber, at) VALUES (?, ?, ?, ?)'),
+    dismiss: db.prepare('INSERT OR REPLACE INTO dismissed (owner, repo, issueNumber, forge, at) VALUES (?, ?, ?, ?, ?)'),
     isDismissed: db.prepare('SELECT 1 FROM dismissed WHERE owner = ? AND repo = ? AND issueNumber = ?'),
     isDismissedWithForge: db.prepare(`SELECT 1 FROM dismissed WHERE owner = ? AND repo = ? AND issueNumber = ? AND (forge = ? OR (forge = '' AND ? = 'gitea'))`),
     byIssue: db.prepare('SELECT * FROM tasks WHERE owner = ? AND repo = ? AND issueNumber = ?'),
@@ -378,12 +394,19 @@ export function openStore({ dir }) {
       "SELECT COUNT(*) AS total, SUM(CASE WHEN col = 'done' THEN 1 ELSE 0 END) AS completed FROM tasks WHERE parentId = ? AND archivedAt = 0"),
   }
 
-  function ensureBoard(id, title, kind) {
+  function ensureBoard(id, title, kind, position, createdAt) {
     const found = q.boardById.get(id)
-    if (found !== undefined) return found
+    if (found !== undefined) {
+      if (position !== undefined || createdAt !== undefined || title !== undefined || kind !== undefined) {
+        db.prepare('UPDATE boards SET title = ?, kind = ?, position = ?, createdAt = ? WHERE id = ?')
+          .run(title ?? found.title, normalizeKind(kind ?? found.kind), position ?? found.position, createdAt ?? found.createdAt, id)
+      }
+      return q.boardById.get(id)
+    }
     const last = q.lastBoard.get()
-    const position = keyBetween(last?.position, undefined)
-    q.insertBoard.run(id, title, normalizeKind(kind), position, Date.now())
+    const pos = isValidOrderKey(position) ? position : keyBetween(last?.position, undefined)
+    const created = typeof createdAt === 'number' && createdAt > 0 ? createdAt : Date.now()
+    q.insertBoard.run(id, title, normalizeKind(kind), pos, created)
     return q.boardById.get(id)
   }
 
@@ -453,8 +476,8 @@ export function openStore({ dir }) {
       return q.boards.all()
     },
 
-    createBoard({ id, title, kind }) {
-      return ensureBoard(id, title ?? id, kind)
+    createBoard({ id, title, kind, position, createdAt }) {
+      return ensureBoard(id, title ?? id, kind, position, createdAt)
     },
 
     /** Board kind. Unrecognized kinds default to 'project'. */
@@ -646,7 +669,9 @@ export function openStore({ dir }) {
       const checklist = JSON.stringify(Array.isArray(task.checklist) ? task.checklist : [])
       const report = JSON.stringify(task.report && typeof task.report === 'object' ? task.report : {})
       const comments = JSON.stringify(Array.isArray(task.comments) ? task.comments : [])
-      const forge = task.forge || (typeof task.issueUrl === 'string' && task.issueUrl.includes('github.com') ? 'github' : 'gitea')
+      const forge = typeof task.forge === 'string'
+        ? task.forge
+        : (typeof task.issueUrl === 'string' && task.issueUrl.includes('github.com') ? 'github' : (task.owner && task.repo && task.issueNumber ? 'gitea' : ''))
       const targetBoard = task.board || 'main'
       const targetCol = task.column || task.col || 'backlog'
       const position = isValidOrderKey(task.position) ? task.position : positionFor(targetBoard, targetCol, undefined, undefined)
@@ -774,10 +799,10 @@ export function openStore({ dir }) {
     },
 
     deleteTask(id) {
-      // Record deleted Gitea tasks as dismissed to prevent the intake loop from re-importing them.
+      // Record deleted tasks as dismissed to prevent the intake loop from re-importing them.
       const task = q.taskById.get(id)
       if (task?.owner && task?.repo && typeof task.issueNumber === 'number') {
-        q.dismiss.run(task.owner, task.repo, task.issueNumber, Date.now())
+        q.dismiss.run(task.owner, task.repo, task.issueNumber, task.forge || '', Date.now())
       }
       q.deleteTask.run(id)
     },

package/lib/sync.js

@@ -40,9 +40,10 @@ export async function withBackoff(fn, { retries = 2, baseMs = 50, maxMs = 500 }
  * would lead to erroneous column transitions. If reading fails, the repository is skipped.
  */
 async function readRepo({ gitea, owner, repo, forge }) {
+  const provider = forge || undefined
   const [pulls, branches] = await Promise.all([
-    gitea.listPulls({ owner, repo, state: 'all' }),
-    gitea.listBranches({ owner, repo }),
+    gitea.listPulls({ owner, repo, state: 'all', provider }),
+    gitea.listBranches({ owner, repo, provider }),
   ])
   return { pulls, branches }
 }

package/lib/worktree.js

@@ -28,7 +28,7 @@ export async function defaultGitRunner(args, cwd) {
     const { stdout, stderr } = await execFileAsync('git', args, {
       cwd,
       maxBuffer: 10 * 1024 * 1024,
-      env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+      env: { ...process.env, GIT_TERMINAL_PROMPT: '0', LC_ALL: 'C' },
     })
     return { stdout: stdout.trim(), stderr: stderr.trim(), code: 0, exitCode: 0 }
   } catch (err) {
@@ -137,13 +137,13 @@ export async function isGitRepo(repoDir, gitRunner = defaultGitRunner) {
     const res = await gitRunner(['rev-parse', '--is-inside-work-tree'], repoDir)
     return res.stdout?.trim() === 'true'
   } catch (err) {
-    const msg = String(err?.stderr || err?.message || '')
+    const msg = String(err?.stderr || err?.message || '').toLowerCase()
     if (
-      err?.exitCode === 128 ||
-      err?.code === 128 ||
       msg.includes('not a git repo') ||
       msg.includes('not a git repository') ||
-      err?.code === 'ENOENT'
+      msg.includes('не найден git репозиторий') ||
+      msg.includes('не является git-репозиторием') ||
+      (err?.code === 'ENOENT' && repoDir && !existsSync(repoDir))
     ) {
       return false
     }
@@ -394,6 +394,45 @@ export async function cleanupTaskWorktree({
     return { error: 'unfenced-worktree-path', status: 403 }
   }
 
+  // 1. Verify worktree cleanliness (force must not bypass dirty worktree ban #341)
+  const dirtyCheck = await checkWorktreeDirty({ worktreePath: current.worktree, gitRunner })
+  if (dirtyCheck.error) {
+    return { error: 'worktree-status-error', detail: dirtyCheck.error }
+  }
+  if (dirtyCheck.dirty) {
+    store?.addTransition?.({
+      taskId: current.id,
+      fromCol: current.column,
+      toCol: current.column,
+      source: 'session',
+      detail: `cleanup deferred: uncommitted files detected: ${dirtyCheck.files.slice(0, 3).join(', ')}`,
+    })
+    return { error: 'worktree-dirty', files: dirtyCheck.files }
+  }
+
+  // 2. Ownership fencing: ensure worktree is registered in repository before removal (#315)
+  let baseRepo = repoDir
+  if (!baseRepo && current?.repo) {
+    const root = typeof config?.defaultProjectRoot === 'string' && config.defaultProjectRoot.trim() !== ''
+      ? config.defaultProjectRoot.trim()
+      : (typeof cwdOf === 'function' ? cwdOf() : process.cwd())
+    baseRepo = resolve(join(root, current.repo))
+  }
+  if (!baseRepo) {
+    const rev = await gitRunner(['rev-parse', '--git-common-dir'], current.worktree)
+    if ((rev?.exitCode ?? rev?.code ?? 0) === 0 && rev?.stdout?.trim()) {
+      const cd = rev.stdout.trim()
+      baseRepo = cd.endsWith('/.git') ? cd.slice(0, -5) : cd
+    }
+  }
+  if (baseRepo) {
+    const registered = await listWorktrees(baseRepo, gitRunner)
+    const norm = resolve(current.worktree)
+    if (!registered.some((p) => resolve(p) === norm)) {
+      return { error: 'worktree-not-registered', status: 403 }
+    }
+  }
+
   const targetRepoDir = repoDir || current.worktree
   const result = await removeTaskWorktree({
     repoDir: targetRepoDir,
@@ -567,6 +606,15 @@ export async function mergeTaskWorktree({
     return { success: false, merged: false, error: 'main-repo-not-found' }
   }
 
+  // Repository ownership fence: main repository name must match task.repo (#315)
+  if (task.repo) {
+    const expectedRepo = task.repo.trim()
+    const baseName = basename(mainRepoDir)
+    if (baseName !== expectedRepo && !mainRepoDir.endsWith('/' + expectedRepo) && !mainRepoDir.endsWith(sep + expectedRepo)) {
+      return { success: false, merged: false, error: 'foreign-repository-mismatch' }
+    }
+  }
+
   const registered = await listWorktrees(mainRepoDir, gitRunner)
   const normTaskWorktree = resolve(task.worktree)
   if (!registered.some((p) => resolve(p) === normTaskWorktree)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-kanban",
-  "version": "0.2.24",
+  "version": "0.2.25",
   "description": "Visual Kanban board for DeepSeek Harness: Gitea and GitHub-backed tasks, workflow columns, and a dedicated agent session per task.",
   "type": "module",
   "main": "lib/index.js",
@@ -18,10 +18,6 @@
     "README.ru.md",
     "LICENSE"
   ],
-  "scripts": {
-    "test": "node --test test/*.test.mjs",
-    "compat": "node tools/compat.mjs"
-  },
   "keywords": [
     "dsh",
     "dsh-plugin",
@@ -93,5 +89,9 @@
     "@deepseek-ai/dsh-tools": {
       "optional": true
     }
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mjs",
+    "compat": "node tools/compat.mjs"
   }
-}
+}