@goodandready/dsh-kanban 0.2.24 → 0.2.26

package/lib/client.js

@@ -636,12 +636,12 @@ window.__ModuleLoader__.load({
               {
                 style: {
                   margin: '12px 0', padding: '14px', borderRadius: '8px',
-                  background: 'var(--dsw-alias-state-danger-bg, #ffebe9)',
-                  border: '1px solid var(--dsw-alias-state-danger-border, #ffc1c0)',
+                  background: 'var(--dsw-alias-state-error-secondary, #ffebe9)',
+                  border: '1px solid var(--dsw-alias-state-error-secondary, #ffc1c0)',
                 },
               },
               h('div', {
-                style: { fontWeight: 600, marginBottom: '6px', color: 'var(--dsw-alias-state-danger-primary, #cf222e)' },
+                style: { fontWeight: 600, marginBottom: '6px', color: 'var(--dsw-alias-state-error-primary, #cf222e)' },
               }, '⚠️ Kanban UI Error:'),
               h('div', {
                 style: { fontSize: '12px', wordBreak: 'break-all', color: 'var(--dsw-alias-label-primary)' },
@@ -691,7 +691,7 @@ window.__ModuleLoader__.load({
 
 
     const css =
-      '.dkb-section-card{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);border-radius:10px;padding:14px 16px;display:flex;flex-direction:column;gap:8px;margin-bottom:12px}' +'.dkb-section-title{font-size:14px;font-weight:600;color:var(--dsw-alias-label-primary);display:flex;align-items:center;justify-content:space-between;gap:8px;padding-bottom:4px;border-bottom:1px solid var(--dsw-alias-border-l2)}' +'.dkb-section-badge{font-size:11px;font-weight:500;padding:2px 8px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-secondary)}' +'.dkb-section-badge-ok{border-color:var(--dsw-alias-state-success-border,#34d399);color:var(--dsw-alias-state-success-primary,#059669);background:var(--dsw-alias-state-success-bg,rgba(16,185,129,0.1))}' +
+      '.dkb-section-card{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);border-radius:10px;padding:14px 16px;display:flex;flex-direction:column;gap:8px;margin-bottom:12px}' +'.dkb-section-title{font-size:14px;font-weight:600;color:var(--dsw-alias-label-primary);display:flex;align-items:center;justify-content:space-between;gap:8px;padding-bottom:4px;border-bottom:1px solid var(--dsw-alias-border-l2)}' +'.dkb-section-badge{font-size:11px;font-weight:500;padding:2px 8px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-secondary)}' +'.dkb-section-badge-ok{border-color:var(--dsw-alias-state-success-secondary,#34d399);color:var(--dsw-alias-state-success-primary,#059669);background:var(--dsw-alias-state-success-secondary,rgba(16,185,129,0.1))}' +
       '.dkb-card{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);border-radius:12px;list-style:none}' +
       '.dkb-cardOpen{background:var(--dsw-alias-bg-layer-2);border-color:var(--dsw-alias-label-dimmed)}' +
       '.dkb-page{padding:0}' +
@@ -714,7 +714,7 @@ window.__ModuleLoader__.load({
       '.dkb-footSplit{justify-content:space-between}' +
       '.dkb-footLeft{display:flex;align-items:center;gap:8px}' +
       '.dkb-note{min-width:0;flex:1;margin:0;font-size:12px;line-height:1.5;color:var(--dsw-alias-label-secondary)}' +
-      '.dkb-failed{min-width:0;color:var(--dsw-alias-label-error);flex:1;margin:0;font-size:12px;line-height:1.5}' +
+      '.dkb-failed{min-width:0;color:var(--dsw-alias-state-error-primary);flex:1;margin:0;font-size:12px;line-height:1.5}' +
       '.dkb-save{appearance:none;font:inherit;cursor:pointer;border:1px solid transparent;border-radius:8px;padding:5px 14px;font-size:13px;background:var(--dsw-alias-label-primary);color:var(--dsw-alias-bg-layer-3)}' +
       '.dkb-discard{appearance:none;font:inherit;cursor:pointer;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:5px 14px;font-size:13px;color:var(--dsw-alias-label-secondary);background:transparent}' +
       '.dkb-discard:disabled,.dkb-save:disabled{opacity:.4;cursor:default}' +
@@ -757,7 +757,7 @@ window.__ModuleLoader__.load({
       '.dkb-moveBtn:hover{color:var(--dsw-alias-label-primary)}' +
       '.dkb-taskCard:focus-visible{outline:2px solid var(--dsw-alias-border-l3);outline-offset:2px}' +
       '.dkb-sync{color:var(--dsw-alias-label-tertiary);white-space:nowrap;font-size:12px;flex:none}' +
-      '.dkb-syncBad{color:var(--dsw-alias-status-danger,#e5534b);cursor:help}' +
+      '.dkb-syncBad{color:var(--dsw-alias-state-error-primary,#e5534b);cursor:help}' +
       '.dkb-facet{position:relative;flex:none}' +
       '.dkb-facetHead{appearance:none;font:inherit;cursor:pointer;color:var(--dsw-alias-label-secondary);background:0 0;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:4px 10px;font-size:13px;white-space:nowrap}' +
       '.dkb-facetHead:hover{color:var(--dsw-alias-label-primary);background:var(--dsw-alias-interactive-bg-hover)}' +
@@ -792,7 +792,7 @@ window.__ModuleLoader__.load({
       '.dkb-count[data-col=review]{background:var(--dsw-alias-state-business-primary)}' +
       '.dkb-count[data-col=deploy]{background:var(--dsw-alias-state-business-primary)}' +
       '.dkb-count[data-col=done]{background:var(--dsw-alias-state-success-primary)}' +
-      '.dkb-countOver{background:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-label-inverse,#fff)}' +
+      '.dkb-countOver{background:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-label-primary-inverted,#fff)}' +
       '.dkb-overdue{border-color:var(--dsw-alias-state-error-primary)}' +
       '.dkb-dueOver{color:var(--dsw-alias-state-error-primary);font-weight:600}' +
       '.dkb-list{flex-direction:column;flex:1;gap:8px;min-height:0;padding:2px 8px 10px;display:flex;overflow-y:auto}' +
@@ -837,7 +837,7 @@ window.__ModuleLoader__.load({
       '.dkb-waiting{color:var(--dsw-alias-state-warn-primary);font-weight:600}' +
       '.dkb-waitDot{border-radius:50%;flex:none;width:8px;height:8px;background:var(--dsw-alias-state-warn-primary);display:inline-block}' +
       '.dkb-tag{white-space:nowrap;color:var(--dsw-alias-label-secondary);background:var(--dsw-alias-interactive-bg-hover);border:1px solid transparent;border-radius:999px;padding:1px 7px;font-size:11px;line-height:1.5;font-weight:500}' +
-      '.dkb-modal{position:absolute;inset:0;background:var(--dsw-alias-mask-bg,rgba(0,0,0,.4));display:flex;align-items:center;justify-content:center;padding:24px 24px 84px;box-sizing:border-box;z-index:70}' +
+      '.dkb-modal{position:absolute;inset:0;background:var(--dsw-alias-bg-mask-1,rgba(0,0,0,.4));display:flex;align-items:center;justify-content:center;padding:24px 24px 84px;box-sizing:border-box;z-index:70}' +
       '.dkb-panel{width:min(720px,100%);max-height:100%;background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;padding:16px;box-sizing:border-box;overflow-y:auto;display:flex;flex-direction:column;gap:12px}' +
       '@media (min-width: 960px){.dkb-panelWide{width:min(1100px,96%)}.dkb-drawerGrid{display:grid;grid-template-columns:300px 1fr;gap:20px;align-items:start}}' +
       '.dkb-drawerSidebar{display:flex;flex-direction:column;gap:12px;border-right:1px solid var(--dsw-alias-border-l2);padding-right:16px}' +
@@ -845,7 +845,7 @@ window.__ModuleLoader__.load({
       '.dkb-panelBody{white-space:pre-wrap;color:var(--dsw-alias-label-secondary);font-size:13px;line-height:1.5;margin:0}' +
       '.dkb-log{list-style:none;margin:0;padding:0;display:flex;flex-direction:column;gap:4px}' +
       '.dkb-logRow{color:var(--dsw-alias-label-secondary);font-size:12px}' +
-      '.dkb-dialog{position:absolute;inset:0;background:var(--dsw-alias-mask-bg,rgba(0,0,0,.4));display:flex;align-items:center;justify-content:center;z-index:80}' +
+      '.dkb-dialog{position:absolute;inset:0;background:var(--dsw-alias-bg-mask-1,rgba(0,0,0,.4));display:flex;align-items:center;justify-content:center;z-index:80}' +
       '.dkb-dialogBox{width:min(560px,94%);max-height:86%;overflow-y:auto;background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;padding:16px;display:flex;flex-direction:column;gap:10px}' +
       '.dkb-issue{appearance:none;font:inherit;text-align:left;cursor:pointer;background:0 0;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:8px 10px;color:var(--dsw-alias-label-primary);font-size:13px}' +
       '.dkb-issueUsed{opacity:.5}' +
@@ -859,11 +859,11 @@ window.__ModuleLoader__.load({
       '.dkb-quickFilterBar{display:flex;gap:6px;align-items:center;flex-wrap:wrap;padding:4px 0}' +
       '.dkb-filterChip{appearance:none;font:inherit;cursor:pointer;background:var(--dsw-alias-interactive-bg-hover);border:1px solid var(--dsw-alias-border-l2);border-radius:999px;padding:3px 10px;font-size:12px;color:var(--dsw-alias-label-secondary);transition:all .15s}' +
       '.dkb-filterChip:hover{background:var(--dsw-alias-interactive-bg-active);color:var(--dsw-alias-label-primary)}' +
-      '.dkb-filterChipActive{background:var(--dsw-alias-state-business-primary);color:var(--dsw-alias-label-inverse,#fff);border-color:transparent;font-weight:600}' +
-      '.dkb-epicTag{background:var(--dsw-alias-state-info-bg,#ddf4ff);color:var(--dsw-alias-state-info-primary,#0969da);font-weight:600}' +
+      '.dkb-filterChipActive{background:var(--dsw-alias-state-business-primary);color:var(--dsw-alias-label-primary-inverted,#fff);border-color:transparent;font-weight:600}' +
+      '.dkb-epicTag{background:color-mix(in srgb, var(--dsw-alias-state-business-primary) 12%, transparent);color:var(--dsw-alias-state-business-primary,#0969da);font-weight:600}' +
       '.dkb-progressBar{height:4px;background:var(--dsw-alias-border-l2);border-radius:2px;overflow:hidden;margin:4px 0}' +
       '.dkb-progressFill{height:100%;background:var(--dsw-alias-state-success-primary,#16a34a);transition:width .2s}' +
-      '.dkb-consolePre{background:var(--dsw-alias-bg-layer-1,#0d1117);color:var(--dsw-alias-state-info-primary,#58a6ff);border:1px solid var(--dsw-alias-border-l2);padding:12px;border-radius:8px;font-family:monospace;font-size:11px;max-height:260px;overflow-y:auto;white-space:pre-wrap}'
+      '.dkb-consolePre{background:var(--dsw-alias-bg-layer-1,#0d1117);color:var(--dsw-alias-state-business-primary,#58a6ff);border:1px solid var(--dsw-alias-border-l2);padding:12px;border-radius:8px;font-family:monospace;font-size:11px;max-height:260px;overflow-y:auto;white-space:pre-wrap}'
 
 
 
@@ -2064,7 +2064,7 @@ window.__ModuleLoader__.load({
             : null,
           task.cron ? h('span', { className: 'dkb-tag', title: task.cron }, '⏰ cron') : null,
           task.progressDump ? h('span', { className: 'dkb-tag', title: 'PROGRESSDUMP' }, '📋 dump') : null,
-          task.rejectReason ? h('span', { className: 'dkb-tag', style: { background: 'var(--dsw-alias-state-danger-bg, #ffebe9)', color: 'var(--dsw-alias-state-danger-primary, #cf222e)', borderColor: 'var(--dsw-alias-state-danger-border, #ffc1c0)' }, title: task.rejectReason }, '↩ ' + t('acceptance.rejectedBadge')) : null,
+          task.rejectReason ? h('span', { className: 'dkb-tag', style: { background: 'var(--dsw-alias-state-error-secondary, #ffebe9)', color: 'var(--dsw-alias-state-error-primary, #cf222e)', borderColor: 'var(--dsw-alias-state-error-secondary, #ffc1c0)' }, title: task.rejectReason }, '↩ ' + t('acceptance.rejectedBadge')) : null,
           Array.isArray(task.checklist) && task.checklist.length > 0
             ? h('span', { className: 'dkb-tag', title: 'DoD Checklist' }, `☑ ${task.checklist.filter((i) => i.completed).length}/${task.checklist.length}`)
             : null,
@@ -3001,7 +3001,7 @@ window.__ModuleLoader__.load({
           openTask.permission && !openTask.permissionConfirmedAt
             ? h('div', {
                 className: 'dkb-warnBox',
-                style: { margin: '4px 0', padding: 10, background: 'var(--dsw-alias-state-warn-bg, #fff3cd)', border: '1px solid var(--dsw-alias-state-warn-border, #ffeeba)', borderRadius: 6 },
+                style: { margin: '4px 0', padding: 10, background: 'var(--dsw-alias-state-warn-secondary, #fff3cd)', border: '1px solid var(--dsw-alias-state-warn-secondary, #ffeeba)', borderRadius: 6 },
               },
                 h('div', { style: { marginBottom: 6, fontSize: 13, fontWeight: 500, color: 'var(--dsw-alias-state-warn-primary, #856404)' } },
                   t('task.permissionGateWarning', { permission: openTask.permission })),
@@ -3308,13 +3308,13 @@ window.__ModuleLoader__.load({
                 className: 'dkb-warnBox',
                 style: {
                   margin: '4px 0', padding: 10,
-                  background: 'var(--dsw-alias-state-danger-bg, #ffebe9)',
-                  border: '1px solid var(--dsw-alias-state-danger-border, #ffc1c0)',
+                  background: 'var(--dsw-alias-state-error-secondary, #ffebe9)',
+                  border: '1px solid var(--dsw-alias-state-error-secondary, #ffc1c0)',
                   borderRadius: 6,
                 },
               },
                 h('div', {
-                  style: { marginBottom: 4, fontSize: 13, fontWeight: 600, color: 'var(--dsw-alias-state-danger-primary, #cf222e)' },
+                  style: { marginBottom: 4, fontSize: 13, fontWeight: 600, color: 'var(--dsw-alias-state-error-primary, #cf222e)' },
                 }, '⚠️ ' + t('acceptance.rejectedAlert', { reason: openTask.rejectReason })),
               )
             : null,
@@ -3349,7 +3349,7 @@ window.__ModuleLoader__.load({
                           key: cm.hash,
                           style: { fontSize: 11, display: 'flex', gap: 6, opacity: 0.85, fontFamily: 'monospace' },
                         },
-                          h('span', { style: { color: 'var(--dsw-alias-label-link, #3b82f6)' } }, cm.hash),
+                          h('span', { style: { color: 'var(--dsw-alias-link, #3b82f6)' } }, cm.hash),
                           h('span', { style: { flex: 1, whiteSpace: 'nowrap', overflow: 'hidden', textOverflow: 'ellipsis' } }, cm.subject),
                           h('span', { style: { opacity: 0.6 } }, cm.date),
                         ))
@@ -3386,7 +3386,7 @@ window.__ModuleLoader__.load({
                     ? h('button', {
                         type: 'button', className: 'dkb-save',
                         disabled: merging,
-                        style: { background: 'var(--dsw-alias-state-success-primary, #16a34a)', color: 'var(--dsw-alias-label-inverse, #fff)' },
+                        style: { background: 'var(--dsw-alias-state-success-primary, #16a34a)', color: 'var(--dsw-alias-label-primary-inverted, #fff)' },
                         onClick: async () => {
                           try {
                             setMerging(true)
@@ -3416,7 +3416,7 @@ window.__ModuleLoader__.load({
                     ? h('button', {
                         type: 'button', className: 'dkb-save',
                         disabled: prCreating,
-                        style: { background: 'var(--dsw-alias-state-info-primary, #0969da)', color: 'var(--dsw-alias-label-inverse, #fff)' },
+                        style: { background: 'var(--dsw-alias-state-business-primary, #0969da)', color: 'var(--dsw-alias-label-primary-inverted, #fff)' },
                         onClick: async () => {
                           setPrCreating(true)
                           try {
@@ -3434,7 +3434,7 @@ window.__ModuleLoader__.load({
                   createdPr
                     ? h('a', {
                         className: 'dkb-save',
-                        style: { background: 'var(--dsw-alias-state-success-primary, #16a34a)', color: 'var(--dsw-alias-label-inverse, #fff)', textDecoration: 'none', display: 'inline-flex', alignItems: 'center' },
+                        style: { background: 'var(--dsw-alias-state-success-primary, #16a34a)', color: 'var(--dsw-alias-label-primary-inverted, #fff)', textDecoration: 'none', display: 'inline-flex', alignItems: 'center' },
                         href: createdPr.html_url,
                         target: '_blank', rel: 'noopener noreferrer',
                       }, '↗ ' + t('pr.view') + ` #${createdPr.number}`)

package/lib/import.js

@@ -97,10 +97,18 @@ export function issueToTask(issue, { board = 'main', column = 'backlog', owner,
  * Compared by owner-repo-number tuple to avoid colliding with issue #1 in another repo.
  * Existing issues are dimmed rather than hidden, as re-importing may be intentional.
  */
-export function markImported(issues, existing, { owner, repo }) {
+export function markImported(issues, existing, { owner, repo, forge }) {
+  const targetForge = forge || ''
   const seen = new Set(
     (existing ?? [])
-      .filter((t) => t.owner === owner && t.repo === repo && typeof t.issueNumber === 'number')
+      .filter((t) => {
+        if (t.owner !== owner || t.repo !== repo || typeof t.issueNumber !== 'number') return false
+        if (targetForge) {
+          const tf = t.forge || (typeof t.issueUrl === 'string' && t.issueUrl.includes('github.com') ? 'github' : 'gitea')
+          return tf === targetForge
+        }
+        return true
+      })
       .map((t) => t.issueNumber),
   )
   return (issues ?? []).map((issue) => ({ ...issue, imported: seen.has(issue?.number) }))
@@ -158,7 +166,7 @@ export async function listImportable({ gitea, store, owner, repo, board = 'main'
   if (state !== 'ready') return { error: `gitea-${state}`, status: 409 }
   const issues = await gitea.listIssues({ owner, repo, state: 'open', provider: forge || provider })
   const existing = store.listTasks({ board })
-  return { issues: markImported(issues, existing, { owner, repo }) }
+  return { issues: markImported(issues, existing, { owner, repo, forge: forge || provider }) }
 }
 
 /** Create a task from an issue. */

package/lib/index.js

@@ -119,18 +119,6 @@ export const SETTINGS_NAMESPACE = 'dsh-kanban'
  * Scalar values only: client config API only writes scalar fields;
  * dictionaries or arrays here would make the settings card uneditable.
  */
-// Ensure .volatile() helper exists on Schemastery schema prototype
-try {
-  const schemaProto = Object.getPrototypeOf(z.boolean())
-  if (schemaProto && typeof schemaProto.volatile !== 'function') {
-    schemaProto.volatile = function () {
-      return typeof this.extra === 'function' ? this.extra('volatile', true) : this
-    }
-  }
-} catch {
-  // safe fallback
-}
-
 export const Config = z.object(Object.fromEntries(
   Object.entries(CONFIG_DEFAULTS).map(([field, fallback]) => {
     // Node type derived from default value type.
@@ -1243,6 +1231,9 @@ export function apply(ctx, config) {
         }
         if (req.method === 'POST' && action === 'comments') {
           const resObj = handleAddTaskComment({ store, task: store.getTask(id), input })
+          if (resObj?.body?.task || resObj?.status === 200) {
+            eventHub.broadcast('task:change', { taskId: id, action: 'updated', task: store.getTask(id) })
+          }
           writeJson(res, resObj.status, resObj.body)
           return
         }
@@ -1362,7 +1353,11 @@ export function apply(ctx, config) {
           return
         }
         if (req.method === 'POST' && action === 'note') {
-          reply(res, appendNote({ store, id, input }))
+          const out = appendNote({ store, id, input })
+          if (out?.task || out?.text) {
+            eventHub.broadcast('task:change', { taskId: id, action: 'updated', task: store.getTask(id) })
+          }
+          reply(res, out)
           return
         }
         if (req.method === 'PATCH' && (action === undefined || action === '')) {

package/lib/intake.js

@@ -41,7 +41,7 @@ export function watchedRepos({ config, owner }) {
  *
  * @returns {{take: boolean, why: string}} `why` states reason on rejection.
  */
-export function shouldTake({ store, owner, repo, issue }) {
+export function shouldTake({ store, owner, repo, issue, forge }) {
   const number = issue?.number
   if (typeof number !== 'number') return { take: false, why: 'missing-number' }
   // Pull request in Gitea is also an issue, but not a standalone board card:
@@ -50,10 +50,10 @@ export function shouldTake({ store, owner, repo, issue }) {
     return { take: false, why: 'pull-request-ignored' }
   }
   if (issue?.state === 'closed') return { take: false, why: 'issue-closed' }
-  if (store.findTaskByIssue({ owner, repo, issueNumber: number }) !== undefined) {
+  if (store.findTaskByIssue({ owner, repo, issueNumber: number, forge }) !== undefined) {
     return { take: false, why: 'already-exists' }
   }
-  if (store.isDismissed({ owner, repo, issueNumber: number })) {
+  if (store.isDismissed({ owner, repo, issueNumber: number, forge })) {
     return { take: false, why: 'tombstone-ignored' }
   }
   return { take: true, why: '' }

package/lib/launcher.js

@@ -163,7 +163,7 @@ export async function obtainAgent({
   agentPreset, permission, permissions, gitRunner, workspaceRegistry,
   reasoningEffort,
 }) {
-  const chosenPerm = permission || task?.permission || (typeof permissions?.set === 'function' ? (config?.sessionDefaultPermission || '') : '')
+  const chosenPerm = permission || task?.permission || config?.sessionDefaultPermission || ""
   const effort = reasoningEffort || task?.reasoningEffort || undefined
   const agentOptions = { provider, model, ...(effort ? { reasoningEffort: effort } : {}) }
 
@@ -341,6 +341,9 @@ export async function runTask({
 }) {
   const effort = reasoningEffort || task?.reasoningEffort || undefined
 
+  // Gate check must reject unconfirmed elevated tasks before queueing or state changes (#328)
+  verifyPermissionGate({ task, permission, config })
+
   // Concurrency limit check (#214, #330)
   const maxConcurrent = typeof config?.maxConcurrentSessions === 'number' ? config.maxConcurrentSessions : 3
   if (maxConcurrent > 0) {
@@ -370,8 +373,6 @@ export async function runTask({
     }
   }
 
-  verifyPermissionGate({ task, permission, config })
-
   reserveSessionSlot(task.id)
   let taken
   try {
@@ -662,7 +663,12 @@ export function unqueueTask({ store, task }) {
  */
 export function countActiveSessions({ store, agents }) {
   const sessions = liveSessions({ store, agents })
-  const activeCount = sessions.filter((s) => s.status === 'running' || s.status === 'busy' || s.status === 'thinking').length
+  const activeCount = sessions.filter((s) =>
+    s.status === 'running' ||
+    s.status === 'busy' ||
+    s.status === 'thinking' ||
+    s.tasks.some((t) => t.workflowActive)
+  ).length
   return activeCount + activeReservations.size
 }
 
@@ -689,10 +695,12 @@ export function liveSessions({ store, agents }) {
     if (live.origin === 'subagent' || live.parentId !== undefined || live.meta?.origin === 'subagent' || live.isSubagent) {
       continue
     }
+    const isWorkflowActive = task.workflowStatus === 'running' || (typeof task.workflowRunId === 'string' && task.workflowRunId !== '' && task.workflowStatus !== 'completed' && task.workflowStatus !== 'failed' && task.workflowStatus !== 'cancelled')
     if (!byId.has(id)) byId.set(id, { sessionId: id, status: live.status, tasks: [] })
     byId.get(id).tasks.push({
       id: task.id, title: task.title, repo: task.repo, issueNumber: task.issueNumber,
       queued: typeof task.queuedAt === 'number' && task.queuedAt > 0,
+      workflowActive: isWorkflowActive,
     })
   }
   return [...byId.values()]
@@ -715,34 +723,36 @@ export async function dispatchNextQueuedTask({
   const queued = typeof store.listQueuedTasks === 'function' ? store.listQueuedTasks() : []
   if (queued.length === 0) return null
 
-  const nextTask = queued[0]
-  let queuedParams = {}
-  if (typeof nextTask.queuedRequest === 'string' && nextTask.queuedRequest) {
-    try { queuedParams = JSON.parse(nextTask.queuedRequest) } catch { /* ignore */ }
-  }
-  try {
-    return await runTask({
-      agents,
-      store,
-      task: nextTask,
-      config,
-      provider: queuedParams.provider || nextTask.provider || undefined,
-      model: queuedParams.model || nextTask.model || undefined,
-      permission: queuedParams.permission || nextTask.permission || undefined,
-      reasoningEffort: queuedParams.reasoningEffort || nextTask.reasoningEffort || undefined,
-      text: queuedParams.text || undefined,
-      agentPreset: queuedParams.agentPreset || agentPreset,
-      mintSessionId: mintSessionId || (() => `kanban-${nextTask.id}-${randomUUID()}`),
-      createMessage: createMessage || ((msg) => msg),
-      cwdOf,
-      logger,
-      permissions,
-      workspaceRegistry,
-      claimAs: claimAs || 'queue-dispatcher',
-      gitRunner,
-    })
-  } catch (err) {
-    logger?.warn?.(`dsh-kanban: failed to start queued task ${nextTask.id}: ${err?.message}`)
-    return null
+  for (const nextTask of queued) {
+    let queuedParams = {}
+    if (typeof nextTask.queuedRequest === 'string' && nextTask.queuedRequest) {
+      try { queuedParams = JSON.parse(nextTask.queuedRequest) } catch { /* ignore */ }
+    }
+    try {
+      return await runTask({
+        agents,
+        store,
+        task: nextTask,
+        config,
+        provider: queuedParams.provider || nextTask.provider || undefined,
+        model: queuedParams.model || nextTask.model || undefined,
+        permission: queuedParams.permission || nextTask.permission || undefined,
+        reasoningEffort: queuedParams.reasoningEffort || nextTask.reasoningEffort || undefined,
+        text: queuedParams.text || undefined,
+        agentPreset: queuedParams.agentPreset || agentPreset,
+        mintSessionId: mintSessionId || (() => `kanban-${nextTask.id}-${randomUUID()}`),
+        createMessage: createMessage || ((msg) => msg),
+        cwdOf,
+        logger,
+        permissions,
+        workspaceRegistry,
+        claimAs: claimAs || 'queue-dispatcher',
+        gitRunner,
+      })
+    } catch (err) {
+      logger?.warn?.(`dsh-kanban: failed to start queued task ${nextTask.id}: ${err?.message}`)
+      unqueueTask({ store, task: nextTask })
+    }
   }
+  return null
 }

package/lib/routes.js

@@ -34,35 +34,61 @@ function isLoopbackAddress(addr) {
 export function isTrustedRequest(req) {
   if (!req || !req.headers) return false
 
-  // 1. Verify sec-fetch-site header (missing or cross-site rejected)
+  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress
   const site = req.headers['sec-fetch-site']
-  if (!site || site === 'cross-site') {
-    return false
-  }
-  if (site !== 'same-origin' && site !== 'same-site' && site !== 'none') {
+
+  // 1. Explicit cross-site or same-site requests are rejected
+  if (site === 'cross-site' || site === 'same-site') {
     return false
   }
 
-  // 2. Validate origin against host
-  const origin = req.headers.origin
-  if (origin !== undefined) {
-    if (origin === 'null') return false
-    try {
-      const parsed = new URL(origin)
-      const host = req.headers.host || ''
-      if (parsed.host && parsed.host !== host) return false
-    } catch {
+  // 2. Browser request with declared site:
+  // Must be same-origin or none (e.g. top-level navigation / bookmark / isolated subresource)
+  if (site === 'same-origin' || site === 'none') {
+    const origin = req.headers.origin
+    if (origin !== undefined) {
+      if (origin === 'null') return false
+      try {
+        const parsed = new URL(origin)
+        const host = req.headers.host || ''
+        if (parsed.host && parsed.host !== host) return false
+      } catch {
+        return false
+      }
+    }
+    // Remote client must be loopback if present
+    if (remote && !isLoopbackAddress(remote)) {
       return false
     }
+    return true
   }
 
-  // 3. Verify loopback remoteAddress
-  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress
-  if (remote && !isLoopbackAddress(remote)) {
-    return false
+  // 3. Request without declared site:
+  // Allowed strictly for loopback remoteAddress (DSH Desktop Electron forwardWebRequest, local CLI, curl)
+  if (remote && isLoopbackAddress(remote)) {
+    const origin = req.headers.origin
+    if (origin !== undefined) {
+      if (origin === 'null') return false
+      try {
+        const parsed = new URL(origin)
+        const host = req.headers.host || ''
+        if (parsed.host && parsed.host !== host) return false
+      } catch {
+        return false
+      }
+    }
+    return true
   }
 
-  return true
+  // Fallback for test harnesses / mocks without socket where host header targets loopback 
+  if (!remote && req.headers.host) {
+    const hostName = String(req.headers.host).split(':')[0]
+    if (isLoopbackAddress(hostName)) {
+      return true
+    }
+  }
+
+  return false
 }
 
 /** Parse `/dsh-kanban/task/<id>[/<action>]`; returns undefined if non-matching. */
@@ -412,7 +438,13 @@ export function importBoard({ store, input }) {
   const doImport = () => {
     for (const board of Array.isArray(input.boards) ? input.boards : []) {
       if (typeof board?.id !== 'string' || board.id === '') continue
-      store.createBoard({ id: board.id, title: board.title, kind: board.kind })
+      store.createBoard({
+        id: board.id,
+        title: board.title,
+        kind: board.kind,
+        position: board.position,
+        createdAt: board.createdAt,
+      })
     }
 
     for (const task of input.tasks) {

package/lib/store.js

@@ -94,8 +94,9 @@ CREATE TABLE IF NOT EXISTS dismissed (
   owner       TEXT NOT NULL,
   repo        TEXT NOT NULL,
   issueNumber INTEGER NOT NULL,
+  forge       TEXT NOT NULL DEFAULT '',
   at          INTEGER NOT NULL,
-  PRIMARY KEY (owner, repo, issueNumber)
+  PRIMARY KEY (owner, repo, issueNumber, forge)
 );
 `
 
@@ -301,6 +302,21 @@ export function openStore({ dir }) {
       try { db.exec('ROLLBACK') } catch { /* ignore */ }
     }
   }
+  // Ensure board order keys are valid, even if fractional_indexing_migrated marker already exists (#345)
+  const boardRows = db.prepare('SELECT id, position FROM boards ORDER BY position ASC, id ASC').all()
+  if (boardRows.length > 0 && boardRows.some((b) => !isValidOrderKey(b.position))) {
+    try {
+      db.exec('BEGIN TRANSACTION')
+      const updateBoardPos = db.prepare('UPDATE boards SET position = ? WHERE id = ?')
+      const newBoardKeys = generateNKeysBetween(null, null, boardRows.length)
+      for (let i = 0; i < boardRows.length; i++) {
+        updateBoardPos.run(newBoardKeys[i], boardRows[i].id)
+      }
+      db.exec('COMMIT')
+    } catch {
+      try { db.exec('ROLLBACK') } catch { /* ignore */ }
+    }
+  }
   db.exec('PRAGMA synchronous = NORMAL')
   try { db.exec('PRAGMA optimize') } catch { /* pragma optimize best-effort */ }
 
@@ -357,7 +373,7 @@ export function openStore({ dir }) {
     archived: db.prepare('SELECT * FROM tasks WHERE archivedAt > 0 ORDER BY archivedAt DESC'),
     archivable: db.prepare(
       "SELECT * FROM tasks WHERE archivedAt = 0 AND col = 'done' AND columnAt > 0 AND columnAt <= ?"),
-    dismiss: db.prepare('INSERT OR REPLACE INTO dismissed (owner, repo, issueNumber, at) VALUES (?, ?, ?, ?)'),
+    dismiss: db.prepare('INSERT OR REPLACE INTO dismissed (owner, repo, issueNumber, forge, at) VALUES (?, ?, ?, ?, ?)'),
     isDismissed: db.prepare('SELECT 1 FROM dismissed WHERE owner = ? AND repo = ? AND issueNumber = ?'),
     isDismissedWithForge: db.prepare(`SELECT 1 FROM dismissed WHERE owner = ? AND repo = ? AND issueNumber = ? AND (forge = ? OR (forge = '' AND ? = 'gitea'))`),
     byIssue: db.prepare('SELECT * FROM tasks WHERE owner = ? AND repo = ? AND issueNumber = ?'),
@@ -378,12 +394,19 @@ export function openStore({ dir }) {
       "SELECT COUNT(*) AS total, SUM(CASE WHEN col = 'done' THEN 1 ELSE 0 END) AS completed FROM tasks WHERE parentId = ? AND archivedAt = 0"),
   }
 
-  function ensureBoard(id, title, kind) {
+  function ensureBoard(id, title, kind, position, createdAt) {
     const found = q.boardById.get(id)
-    if (found !== undefined) return found
+    if (found !== undefined) {
+      if (position !== undefined || createdAt !== undefined || title !== undefined || kind !== undefined) {
+        db.prepare('UPDATE boards SET title = ?, kind = ?, position = ?, createdAt = ? WHERE id = ?')
+          .run(title ?? found.title, normalizeKind(kind ?? found.kind), position ?? found.position, createdAt ?? found.createdAt, id)
+      }
+      return q.boardById.get(id)
+    }
     const last = q.lastBoard.get()
-    const position = keyBetween(last?.position, undefined)
-    q.insertBoard.run(id, title, normalizeKind(kind), position, Date.now())
+    const pos = isValidOrderKey(position) ? position : keyBetween(last?.position, undefined)
+    const created = typeof createdAt === 'number' && createdAt > 0 ? createdAt : Date.now()
+    q.insertBoard.run(id, title, normalizeKind(kind), pos, created)
     return q.boardById.get(id)
   }
 
@@ -453,8 +476,8 @@ export function openStore({ dir }) {
       return q.boards.all()
     },
 
-    createBoard({ id, title, kind }) {
-      return ensureBoard(id, title ?? id, kind)
+    createBoard({ id, title, kind, position, createdAt }) {
+      return ensureBoard(id, title ?? id, kind, position, createdAt)
     },
 
     /** Board kind. Unrecognized kinds default to 'project'. */
@@ -646,7 +669,9 @@ export function openStore({ dir }) {
       const checklist = JSON.stringify(Array.isArray(task.checklist) ? task.checklist : [])
       const report = JSON.stringify(task.report && typeof task.report === 'object' ? task.report : {})
       const comments = JSON.stringify(Array.isArray(task.comments) ? task.comments : [])
-      const forge = task.forge || (typeof task.issueUrl === 'string' && task.issueUrl.includes('github.com') ? 'github' : 'gitea')
+      const forge = typeof task.forge === 'string'
+        ? task.forge
+        : (typeof task.issueUrl === 'string' && task.issueUrl.includes('github.com') ? 'github' : (task.owner && task.repo && task.issueNumber ? 'gitea' : ''))
       const targetBoard = task.board || 'main'
       const targetCol = task.column || task.col || 'backlog'
       const position = isValidOrderKey(task.position) ? task.position : positionFor(targetBoard, targetCol, undefined, undefined)
@@ -774,10 +799,10 @@ export function openStore({ dir }) {
     },
 
     deleteTask(id) {
-      // Record deleted Gitea tasks as dismissed to prevent the intake loop from re-importing them.
+      // Record deleted tasks as dismissed to prevent the intake loop from re-importing them.
       const task = q.taskById.get(id)
       if (task?.owner && task?.repo && typeof task.issueNumber === 'number') {
-        q.dismiss.run(task.owner, task.repo, task.issueNumber, Date.now())
+        q.dismiss.run(task.owner, task.repo, task.issueNumber, task.forge || '', Date.now())
       }
       q.deleteTask.run(id)
     },

package/lib/sync.js

@@ -40,9 +40,10 @@ export async function withBackoff(fn, { retries = 2, baseMs = 50, maxMs = 500 }
  * would lead to erroneous column transitions. If reading fails, the repository is skipped.
  */
 async function readRepo({ gitea, owner, repo, forge }) {
+  const provider = forge || undefined
   const [pulls, branches] = await Promise.all([
-    gitea.listPulls({ owner, repo, state: 'all' }),
-    gitea.listBranches({ owner, repo }),
+    gitea.listPulls({ owner, repo, state: 'all', provider }),
+    gitea.listBranches({ owner, repo, provider }),
   ])
   return { pulls, branches }
 }

package/lib/worktree.js

@@ -28,7 +28,7 @@ export async function defaultGitRunner(args, cwd) {
     const { stdout, stderr } = await execFileAsync('git', args, {
       cwd,
       maxBuffer: 10 * 1024 * 1024,
-      env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+      env: { ...process.env, GIT_TERMINAL_PROMPT: '0', LC_ALL: 'C' },
     })
     return { stdout: stdout.trim(), stderr: stderr.trim(), code: 0, exitCode: 0 }
   } catch (err) {
@@ -137,13 +137,11 @@ export async function isGitRepo(repoDir, gitRunner = defaultGitRunner) {
     const res = await gitRunner(['rev-parse', '--is-inside-work-tree'], repoDir)
     return res.stdout?.trim() === 'true'
   } catch (err) {
-    const msg = String(err?.stderr || err?.message || '')
+    const msg = String(err?.stderr || err?.message || '').toLowerCase()
     if (
-      err?.exitCode === 128 ||
-      err?.code === 128 ||
       msg.includes('not a git repo') ||
       msg.includes('not a git repository') ||
-      err?.code === 'ENOENT'
+      (err?.code === 'ENOENT' && repoDir && !existsSync(repoDir))
     ) {
       return false
     }
@@ -394,6 +392,45 @@ export async function cleanupTaskWorktree({
     return { error: 'unfenced-worktree-path', status: 403 }
   }
 
+  // 1. Verify worktree cleanliness (force must not bypass dirty worktree ban #341)
+  const dirtyCheck = await checkWorktreeDirty({ worktreePath: current.worktree, gitRunner })
+  if (dirtyCheck.error) {
+    return { error: 'worktree-status-error', detail: dirtyCheck.error }
+  }
+  if (dirtyCheck.dirty) {
+    store?.addTransition?.({
+      taskId: current.id,
+      fromCol: current.column,
+      toCol: current.column,
+      source: 'session',
+      detail: `cleanup deferred: uncommitted files detected: ${dirtyCheck.files.slice(0, 3).join(', ')}`,
+    })
+    return { error: 'worktree-dirty', files: dirtyCheck.files }
+  }
+
+  // 2. Ownership fencing: ensure worktree is registered in repository before removal (#315)
+  let baseRepo = repoDir
+  if (!baseRepo && current?.repo) {
+    const root = typeof config?.defaultProjectRoot === 'string' && config.defaultProjectRoot.trim() !== ''
+      ? config.defaultProjectRoot.trim()
+      : (typeof cwdOf === 'function' ? cwdOf() : process.cwd())
+    baseRepo = resolve(join(root, current.repo))
+  }
+  if (!baseRepo) {
+    const rev = await gitRunner(['rev-parse', '--git-common-dir'], current.worktree)
+    if ((rev?.exitCode ?? rev?.code ?? 0) === 0 && rev?.stdout?.trim()) {
+      const cd = rev.stdout.trim()
+      baseRepo = cd.endsWith('/.git') ? cd.slice(0, -5) : cd
+    }
+  }
+  if (baseRepo) {
+    const registered = await listWorktrees(baseRepo, gitRunner)
+    const norm = resolve(current.worktree)
+    if (!registered.some((p) => resolve(p) === norm)) {
+      return { error: 'worktree-not-registered', status: 403 }
+    }
+  }
+
   const targetRepoDir = repoDir || current.worktree
   const result = await removeTaskWorktree({
     repoDir: targetRepoDir,
@@ -567,6 +604,15 @@ export async function mergeTaskWorktree({
     return { success: false, merged: false, error: 'main-repo-not-found' }
   }
 
+  // Repository ownership fence: main repository name must match task.repo (#315)
+  if (task.repo) {
+    const expectedRepo = task.repo.trim()
+    const baseName = basename(mainRepoDir)
+    if (baseName !== expectedRepo && !mainRepoDir.endsWith('/' + expectedRepo) && !mainRepoDir.endsWith(sep + expectedRepo)) {
+      return { success: false, merged: false, error: 'foreign-repository-mismatch' }
+    }
+  }
+
   const registered = await listWorktrees(mainRepoDir, gitRunner)
   const normTaskWorktree = resolve(task.worktree)
   if (!registered.some((p) => resolve(p) === normTaskWorktree)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-kanban",
-  "version": "0.2.24",
+  "version": "0.2.26",
   "description": "Visual Kanban board for DeepSeek Harness: Gitea and GitHub-backed tasks, workflow columns, and a dedicated agent session per task.",
   "type": "module",
   "main": "lib/index.js",
@@ -18,10 +18,6 @@
     "README.ru.md",
     "LICENSE"
   ],
-  "scripts": {
-    "test": "node --test test/*.test.mjs",
-    "compat": "node tools/compat.mjs"
-  },
   "keywords": [
     "dsh",
     "dsh-plugin",
@@ -93,5 +89,9 @@
     "@deepseek-ai/dsh-tools": {
       "optional": true
     }
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mjs",
+    "compat": "node tools/compat.mjs"
   }
-}
+}