@goodandready/dsh-kanban 0.2.25 → 0.2.27

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/lib/client.js CHANGED
@@ -636,12 +636,12 @@ window.__ModuleLoader__.load({
636
636
  {
637
637
  style: {
638
638
  margin: '12px 0', padding: '14px', borderRadius: '8px',
639
- background: 'var(--dsw-alias-state-danger-bg, #ffebe9)',
640
- border: '1px solid var(--dsw-alias-state-danger-border, #ffc1c0)',
639
+ background: 'var(--dsw-alias-state-error-secondary, #ffebe9)',
640
+ border: '1px solid var(--dsw-alias-state-error-secondary, #ffc1c0)',
641
641
  },
642
642
  },
643
643
  h('div', {
644
- style: { fontWeight: 600, marginBottom: '6px', color: 'var(--dsw-alias-state-danger-primary, #cf222e)' },
644
+ style: { fontWeight: 600, marginBottom: '6px', color: 'var(--dsw-alias-state-error-primary, #cf222e)' },
645
645
  }, '⚠️ Kanban UI Error:'),
646
646
  h('div', {
647
647
  style: { fontSize: '12px', wordBreak: 'break-all', color: 'var(--dsw-alias-label-primary)' },
@@ -691,7 +691,7 @@ window.__ModuleLoader__.load({
691
691
 
692
692
 
693
693
  const css =
694
- '.dkb-section-card{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);border-radius:10px;padding:14px 16px;display:flex;flex-direction:column;gap:8px;margin-bottom:12px}' +'.dkb-section-title{font-size:14px;font-weight:600;color:var(--dsw-alias-label-primary);display:flex;align-items:center;justify-content:space-between;gap:8px;padding-bottom:4px;border-bottom:1px solid var(--dsw-alias-border-l2)}' +'.dkb-section-badge{font-size:11px;font-weight:500;padding:2px 8px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-secondary)}' +'.dkb-section-badge-ok{border-color:var(--dsw-alias-state-success-border,#34d399);color:var(--dsw-alias-state-success-primary,#059669);background:var(--dsw-alias-state-success-bg,rgba(16,185,129,0.1))}' +
694
+ '.dkb-section-card{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);border-radius:10px;padding:14px 16px;display:flex;flex-direction:column;gap:8px;margin-bottom:12px}' +'.dkb-section-title{font-size:14px;font-weight:600;color:var(--dsw-alias-label-primary);display:flex;align-items:center;justify-content:space-between;gap:8px;padding-bottom:4px;border-bottom:1px solid var(--dsw-alias-border-l2)}' +'.dkb-section-badge{font-size:11px;font-weight:500;padding:2px 8px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-secondary)}' +'.dkb-section-badge-ok{border-color:var(--dsw-alias-state-success-secondary,#34d399);color:var(--dsw-alias-state-success-primary,#059669);background:var(--dsw-alias-state-success-secondary,rgba(16,185,129,0.1))}' +
695
695
  '.dkb-card{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);border-radius:12px;list-style:none}' +
696
696
  '.dkb-cardOpen{background:var(--dsw-alias-bg-layer-2);border-color:var(--dsw-alias-label-dimmed)}' +
697
697
  '.dkb-page{padding:0}' +
@@ -714,7 +714,7 @@ window.__ModuleLoader__.load({
714
714
  '.dkb-footSplit{justify-content:space-between}' +
715
715
  '.dkb-footLeft{display:flex;align-items:center;gap:8px}' +
716
716
  '.dkb-note{min-width:0;flex:1;margin:0;font-size:12px;line-height:1.5;color:var(--dsw-alias-label-secondary)}' +
717
- '.dkb-failed{min-width:0;color:var(--dsw-alias-label-error);flex:1;margin:0;font-size:12px;line-height:1.5}' +
717
+ '.dkb-failed{min-width:0;color:var(--dsw-alias-state-error-primary);flex:1;margin:0;font-size:12px;line-height:1.5}' +
718
718
  '.dkb-save{appearance:none;font:inherit;cursor:pointer;border:1px solid transparent;border-radius:8px;padding:5px 14px;font-size:13px;background:var(--dsw-alias-label-primary);color:var(--dsw-alias-bg-layer-3)}' +
719
719
  '.dkb-discard{appearance:none;font:inherit;cursor:pointer;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:5px 14px;font-size:13px;color:var(--dsw-alias-label-secondary);background:transparent}' +
720
720
  '.dkb-discard:disabled,.dkb-save:disabled{opacity:.4;cursor:default}' +
@@ -757,7 +757,7 @@ window.__ModuleLoader__.load({
757
757
  '.dkb-moveBtn:hover{color:var(--dsw-alias-label-primary)}' +
758
758
  '.dkb-taskCard:focus-visible{outline:2px solid var(--dsw-alias-border-l3);outline-offset:2px}' +
759
759
  '.dkb-sync{color:var(--dsw-alias-label-tertiary);white-space:nowrap;font-size:12px;flex:none}' +
760
- '.dkb-syncBad{color:var(--dsw-alias-status-danger,#e5534b);cursor:help}' +
760
+ '.dkb-syncBad{color:var(--dsw-alias-state-error-primary,#e5534b);cursor:help}' +
761
761
  '.dkb-facet{position:relative;flex:none}' +
762
762
  '.dkb-facetHead{appearance:none;font:inherit;cursor:pointer;color:var(--dsw-alias-label-secondary);background:0 0;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:4px 10px;font-size:13px;white-space:nowrap}' +
763
763
  '.dkb-facetHead:hover{color:var(--dsw-alias-label-primary);background:var(--dsw-alias-interactive-bg-hover)}' +
@@ -792,7 +792,7 @@ window.__ModuleLoader__.load({
792
792
  '.dkb-count[data-col=review]{background:var(--dsw-alias-state-business-primary)}' +
793
793
  '.dkb-count[data-col=deploy]{background:var(--dsw-alias-state-business-primary)}' +
794
794
  '.dkb-count[data-col=done]{background:var(--dsw-alias-state-success-primary)}' +
795
- '.dkb-countOver{background:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-label-inverse,#fff)}' +
795
+ '.dkb-countOver{background:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-label-primary-inverted,#fff)}' +
796
796
  '.dkb-overdue{border-color:var(--dsw-alias-state-error-primary)}' +
797
797
  '.dkb-dueOver{color:var(--dsw-alias-state-error-primary);font-weight:600}' +
798
798
  '.dkb-list{flex-direction:column;flex:1;gap:8px;min-height:0;padding:2px 8px 10px;display:flex;overflow-y:auto}' +
@@ -837,7 +837,7 @@ window.__ModuleLoader__.load({
837
837
  '.dkb-waiting{color:var(--dsw-alias-state-warn-primary);font-weight:600}' +
838
838
  '.dkb-waitDot{border-radius:50%;flex:none;width:8px;height:8px;background:var(--dsw-alias-state-warn-primary);display:inline-block}' +
839
839
  '.dkb-tag{white-space:nowrap;color:var(--dsw-alias-label-secondary);background:var(--dsw-alias-interactive-bg-hover);border:1px solid transparent;border-radius:999px;padding:1px 7px;font-size:11px;line-height:1.5;font-weight:500}' +
840
- '.dkb-modal{position:absolute;inset:0;background:var(--dsw-alias-mask-bg,rgba(0,0,0,.4));display:flex;align-items:center;justify-content:center;padding:24px 24px 84px;box-sizing:border-box;z-index:70}' +
840
+ '.dkb-modal{position:absolute;inset:0;background:var(--dsw-alias-bg-mask-1,rgba(0,0,0,.4));display:flex;align-items:center;justify-content:center;padding:24px 24px 84px;box-sizing:border-box;z-index:70}' +
841
841
  '.dkb-panel{width:min(720px,100%);max-height:100%;background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;padding:16px;box-sizing:border-box;overflow-y:auto;display:flex;flex-direction:column;gap:12px}' +
842
842
  '@media (min-width: 960px){.dkb-panelWide{width:min(1100px,96%)}.dkb-drawerGrid{display:grid;grid-template-columns:300px 1fr;gap:20px;align-items:start}}' +
843
843
  '.dkb-drawerSidebar{display:flex;flex-direction:column;gap:12px;border-right:1px solid var(--dsw-alias-border-l2);padding-right:16px}' +
@@ -845,7 +845,7 @@ window.__ModuleLoader__.load({
845
845
  '.dkb-panelBody{white-space:pre-wrap;color:var(--dsw-alias-label-secondary);font-size:13px;line-height:1.5;margin:0}' +
846
846
  '.dkb-log{list-style:none;margin:0;padding:0;display:flex;flex-direction:column;gap:4px}' +
847
847
  '.dkb-logRow{color:var(--dsw-alias-label-secondary);font-size:12px}' +
848
- '.dkb-dialog{position:absolute;inset:0;background:var(--dsw-alias-mask-bg,rgba(0,0,0,.4));display:flex;align-items:center;justify-content:center;z-index:80}' +
848
+ '.dkb-dialog{position:absolute;inset:0;background:var(--dsw-alias-bg-mask-1,rgba(0,0,0,.4));display:flex;align-items:center;justify-content:center;z-index:80}' +
849
849
  '.dkb-dialogBox{width:min(560px,94%);max-height:86%;overflow-y:auto;background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;padding:16px;display:flex;flex-direction:column;gap:10px}' +
850
850
  '.dkb-issue{appearance:none;font:inherit;text-align:left;cursor:pointer;background:0 0;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:8px 10px;color:var(--dsw-alias-label-primary);font-size:13px}' +
851
851
  '.dkb-issueUsed{opacity:.5}' +
@@ -859,11 +859,11 @@ window.__ModuleLoader__.load({
859
859
  '.dkb-quickFilterBar{display:flex;gap:6px;align-items:center;flex-wrap:wrap;padding:4px 0}' +
860
860
  '.dkb-filterChip{appearance:none;font:inherit;cursor:pointer;background:var(--dsw-alias-interactive-bg-hover);border:1px solid var(--dsw-alias-border-l2);border-radius:999px;padding:3px 10px;font-size:12px;color:var(--dsw-alias-label-secondary);transition:all .15s}' +
861
861
  '.dkb-filterChip:hover{background:var(--dsw-alias-interactive-bg-active);color:var(--dsw-alias-label-primary)}' +
862
- '.dkb-filterChipActive{background:var(--dsw-alias-state-business-primary);color:var(--dsw-alias-label-inverse,#fff);border-color:transparent;font-weight:600}' +
863
- '.dkb-epicTag{background:var(--dsw-alias-state-info-bg,#ddf4ff);color:var(--dsw-alias-state-info-primary,#0969da);font-weight:600}' +
862
+ '.dkb-filterChipActive{background:var(--dsw-alias-state-business-primary);color:var(--dsw-alias-label-primary-inverted,#fff);border-color:transparent;font-weight:600}' +
863
+ '.dkb-epicTag{background:color-mix(in srgb, var(--dsw-alias-state-business-primary) 12%, transparent);color:var(--dsw-alias-state-business-primary,#0969da);font-weight:600}' +
864
864
  '.dkb-progressBar{height:4px;background:var(--dsw-alias-border-l2);border-radius:2px;overflow:hidden;margin:4px 0}' +
865
865
  '.dkb-progressFill{height:100%;background:var(--dsw-alias-state-success-primary,#16a34a);transition:width .2s}' +
866
- '.dkb-consolePre{background:var(--dsw-alias-bg-layer-1,#0d1117);color:var(--dsw-alias-state-info-primary,#58a6ff);border:1px solid var(--dsw-alias-border-l2);padding:12px;border-radius:8px;font-family:monospace;font-size:11px;max-height:260px;overflow-y:auto;white-space:pre-wrap}'
866
+ '.dkb-consolePre{background:var(--dsw-alias-bg-layer-1,#0d1117);color:var(--dsw-alias-state-business-primary,#58a6ff);border:1px solid var(--dsw-alias-border-l2);padding:12px;border-radius:8px;font-family:monospace;font-size:11px;max-height:260px;overflow-y:auto;white-space:pre-wrap}'
867
867
 
868
868
 
869
869
 
@@ -2064,7 +2064,7 @@ window.__ModuleLoader__.load({
2064
2064
  : null,
2065
2065
  task.cron ? h('span', { className: 'dkb-tag', title: task.cron }, '⏰ cron') : null,
2066
2066
  task.progressDump ? h('span', { className: 'dkb-tag', title: 'PROGRESSDUMP' }, '📋 dump') : null,
2067
- task.rejectReason ? h('span', { className: 'dkb-tag', style: { background: 'var(--dsw-alias-state-danger-bg, #ffebe9)', color: 'var(--dsw-alias-state-danger-primary, #cf222e)', borderColor: 'var(--dsw-alias-state-danger-border, #ffc1c0)' }, title: task.rejectReason }, '↩ ' + t('acceptance.rejectedBadge')) : null,
2067
+ task.rejectReason ? h('span', { className: 'dkb-tag', style: { background: 'var(--dsw-alias-state-error-secondary, #ffebe9)', color: 'var(--dsw-alias-state-error-primary, #cf222e)', borderColor: 'var(--dsw-alias-state-error-secondary, #ffc1c0)' }, title: task.rejectReason }, '↩ ' + t('acceptance.rejectedBadge')) : null,
2068
2068
  Array.isArray(task.checklist) && task.checklist.length > 0
2069
2069
  ? h('span', { className: 'dkb-tag', title: 'DoD Checklist' }, `☑ ${task.checklist.filter((i) => i.completed).length}/${task.checklist.length}`)
2070
2070
  : null,
@@ -3001,7 +3001,7 @@ window.__ModuleLoader__.load({
3001
3001
  openTask.permission && !openTask.permissionConfirmedAt
3002
3002
  ? h('div', {
3003
3003
  className: 'dkb-warnBox',
3004
- style: { margin: '4px 0', padding: 10, background: 'var(--dsw-alias-state-warn-bg, #fff3cd)', border: '1px solid var(--dsw-alias-state-warn-border, #ffeeba)', borderRadius: 6 },
3004
+ style: { margin: '4px 0', padding: 10, background: 'var(--dsw-alias-state-warn-secondary, #fff3cd)', border: '1px solid var(--dsw-alias-state-warn-secondary, #ffeeba)', borderRadius: 6 },
3005
3005
  },
3006
3006
  h('div', { style: { marginBottom: 6, fontSize: 13, fontWeight: 500, color: 'var(--dsw-alias-state-warn-primary, #856404)' } },
3007
3007
  t('task.permissionGateWarning', { permission: openTask.permission })),
@@ -3308,13 +3308,13 @@ window.__ModuleLoader__.load({
3308
3308
  className: 'dkb-warnBox',
3309
3309
  style: {
3310
3310
  margin: '4px 0', padding: 10,
3311
- background: 'var(--dsw-alias-state-danger-bg, #ffebe9)',
3312
- border: '1px solid var(--dsw-alias-state-danger-border, #ffc1c0)',
3311
+ background: 'var(--dsw-alias-state-error-secondary, #ffebe9)',
3312
+ border: '1px solid var(--dsw-alias-state-error-secondary, #ffc1c0)',
3313
3313
  borderRadius: 6,
3314
3314
  },
3315
3315
  },
3316
3316
  h('div', {
3317
- style: { marginBottom: 4, fontSize: 13, fontWeight: 600, color: 'var(--dsw-alias-state-danger-primary, #cf222e)' },
3317
+ style: { marginBottom: 4, fontSize: 13, fontWeight: 600, color: 'var(--dsw-alias-state-error-primary, #cf222e)' },
3318
3318
  }, '⚠️ ' + t('acceptance.rejectedAlert', { reason: openTask.rejectReason })),
3319
3319
  )
3320
3320
  : null,
@@ -3349,7 +3349,7 @@ window.__ModuleLoader__.load({
3349
3349
  key: cm.hash,
3350
3350
  style: { fontSize: 11, display: 'flex', gap: 6, opacity: 0.85, fontFamily: 'monospace' },
3351
3351
  },
3352
- h('span', { style: { color: 'var(--dsw-alias-label-link, #3b82f6)' } }, cm.hash),
3352
+ h('span', { style: { color: 'var(--dsw-alias-link, #3b82f6)' } }, cm.hash),
3353
3353
  h('span', { style: { flex: 1, whiteSpace: 'nowrap', overflow: 'hidden', textOverflow: 'ellipsis' } }, cm.subject),
3354
3354
  h('span', { style: { opacity: 0.6 } }, cm.date),
3355
3355
  ))
@@ -3386,7 +3386,7 @@ window.__ModuleLoader__.load({
3386
3386
  ? h('button', {
3387
3387
  type: 'button', className: 'dkb-save',
3388
3388
  disabled: merging,
3389
- style: { background: 'var(--dsw-alias-state-success-primary, #16a34a)', color: 'var(--dsw-alias-label-inverse, #fff)' },
3389
+ style: { background: 'var(--dsw-alias-state-success-primary, #16a34a)', color: 'var(--dsw-alias-label-primary-inverted, #fff)' },
3390
3390
  onClick: async () => {
3391
3391
  try {
3392
3392
  setMerging(true)
@@ -3416,7 +3416,7 @@ window.__ModuleLoader__.load({
3416
3416
  ? h('button', {
3417
3417
  type: 'button', className: 'dkb-save',
3418
3418
  disabled: prCreating,
3419
- style: { background: 'var(--dsw-alias-state-info-primary, #0969da)', color: 'var(--dsw-alias-label-inverse, #fff)' },
3419
+ style: { background: 'var(--dsw-alias-state-business-primary, #0969da)', color: 'var(--dsw-alias-label-primary-inverted, #fff)' },
3420
3420
  onClick: async () => {
3421
3421
  setPrCreating(true)
3422
3422
  try {
@@ -3434,7 +3434,7 @@ window.__ModuleLoader__.load({
3434
3434
  createdPr
3435
3435
  ? h('a', {
3436
3436
  className: 'dkb-save',
3437
- style: { background: 'var(--dsw-alias-state-success-primary, #16a34a)', color: 'var(--dsw-alias-label-inverse, #fff)', textDecoration: 'none', display: 'inline-flex', alignItems: 'center' },
3437
+ style: { background: 'var(--dsw-alias-state-success-primary, #16a34a)', color: 'var(--dsw-alias-label-primary-inverted, #fff)', textDecoration: 'none', display: 'inline-flex', alignItems: 'center' },
3438
3438
  href: createdPr.html_url,
3439
3439
  target: '_blank', rel: 'noopener noreferrer',
3440
3440
  }, '↗ ' + t('pr.view') + ` #${createdPr.number}`)
package/lib/index.js CHANGED
@@ -119,18 +119,6 @@ export const SETTINGS_NAMESPACE = 'dsh-kanban'
119
119
  * Scalar values only: client config API only writes scalar fields;
120
120
  * dictionaries or arrays here would make the settings card uneditable.
121
121
  */
122
- // Ensure .volatile() helper exists on Schemastery schema prototype
123
- try {
124
- const schemaProto = Object.getPrototypeOf(z.boolean())
125
- if (schemaProto && typeof schemaProto.volatile !== 'function') {
126
- schemaProto.volatile = function () {
127
- return typeof this.extra === 'function' ? this.extra('volatile', true) : this
128
- }
129
- }
130
- } catch {
131
- // safe fallback
132
- }
133
-
134
122
  export const Config = z.object(Object.fromEntries(
135
123
  Object.entries(CONFIG_DEFAULTS).map(([field, fallback]) => {
136
124
  // Node type derived from default value type.
package/lib/routes.js CHANGED
@@ -34,35 +34,61 @@ function isLoopbackAddress(addr) {
34
34
  export function isTrustedRequest(req) {
35
35
  if (!req || !req.headers) return false
36
36
 
37
- // 1. Verify sec-fetch-site header (missing or cross-site rejected)
37
+ const remote = req.socket?.remoteAddress || req.connection?.remoteAddress
38
38
  const site = req.headers['sec-fetch-site']
39
- if (!site || site === 'cross-site') {
40
- return false
41
- }
42
- if (site !== 'same-origin' && site !== 'same-site' && site !== 'none') {
39
+
40
+ // 1. Explicit cross-site or same-site requests are rejected
41
+ if (site === 'cross-site' || site === 'same-site') {
43
42
  return false
44
43
  }
45
44
 
46
- // 2. Validate origin against host
47
- const origin = req.headers.origin
48
- if (origin !== undefined) {
49
- if (origin === 'null') return false
50
- try {
51
- const parsed = new URL(origin)
52
- const host = req.headers.host || ''
53
- if (parsed.host && parsed.host !== host) return false
54
- } catch {
45
+ // 2. Browser request with declared site:
46
+ // Must be same-origin or none (e.g. top-level navigation / bookmark / isolated subresource)
47
+ if (site === 'same-origin' || site === 'none') {
48
+ const origin = req.headers.origin
49
+ if (origin !== undefined) {
50
+ if (origin === 'null') return false
51
+ try {
52
+ const parsed = new URL(origin)
53
+ const host = req.headers.host || ''
54
+ if (parsed.host && parsed.host !== host) return false
55
+ } catch {
56
+ return false
57
+ }
58
+ }
59
+ // Remote client must be loopback if present
60
+ if (remote && !isLoopbackAddress(remote)) {
55
61
  return false
56
62
  }
63
+ return true
57
64
  }
58
65
 
59
- // 3. Verify loopback remoteAddress
60
- const remote = req.socket?.remoteAddress || req.connection?.remoteAddress
61
- if (remote && !isLoopbackAddress(remote)) {
62
- return false
66
+ // 3. Request without declared site:
67
+ // Allowed strictly for loopback remoteAddress (DSH Desktop Electron forwardWebRequest, local CLI, curl)
68
+ if (remote && isLoopbackAddress(remote)) {
69
+ const origin = req.headers.origin
70
+ if (origin !== undefined) {
71
+ if (origin === 'null') return false
72
+ try {
73
+ const parsed = new URL(origin)
74
+ const host = req.headers.host || ''
75
+ if (parsed.host && parsed.host !== host) return false
76
+ } catch {
77
+ return false
78
+ }
79
+ }
80
+ return true
81
+ }
82
+
83
+ // Fallback for test harnesses / mocks without socket where host header targets loopback
84
+ if (!remote && req.headers.host) {
85
+ const hostName = String(req.headers.host).split(':')[0]
86
+ if (isLoopbackAddress(hostName)) {
87
+ return true
88
+ }
63
89
  }
64
90
 
65
- return true
91
+ return false
66
92
  }
67
93
 
68
94
  /** Parse `/dsh-kanban/task/<id>[/<action>]`; returns undefined if non-matching. */
package/lib/worktree.js CHANGED
@@ -141,8 +141,6 @@ export async function isGitRepo(repoDir, gitRunner = defaultGitRunner) {
141
141
  if (
142
142
  msg.includes('not a git repo') ||
143
143
  msg.includes('not a git repository') ||
144
- msg.includes('не найден git репозиторий') ||
145
- msg.includes('не является git-репозиторием') ||
146
144
  (err?.code === 'ENOENT' && repoDir && !existsSync(repoDir))
147
145
  ) {
148
146
  return false
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@goodandready/dsh-kanban",
3
- "version": "0.2.25",
3
+ "version": "0.2.27",
4
4
  "description": "Visual Kanban board for DeepSeek Harness: Gitea and GitHub-backed tasks, workflow columns, and a dedicated agent session per task.",
5
5
  "type": "module",
6
6
  "main": "lib/index.js",