@goodandready/dsh-kanban 0.2.31 → 0.2.32

package/lib/board-tool.js

@@ -1,3 +1,4 @@
+import { verifyAndRecordGate } from './verification.js'
 //
 // JSON Schema:
 //
@@ -111,6 +112,20 @@ export function boardMoveDefinition({ store, config, eventHub }) {
             + `Pending: ${pendingRequired.map((i) => i.text).join('; ')}. `
             + 'Use `board_checklist` with verification evidence to complete required items.'
         }
+
+        // Automated Verification Gate (#372)
+        if (task.column !== 'review') {
+          const gateResult = await verifyAndRecordGate({
+            task,
+            config,
+            store,
+            agents: exec?.agents || exec?.agent?.parent,
+            createMessage: exec?.createMessage,
+          })
+          if (!gateResult.allowed) {
+            return `Cannot move card to review: verification command "${gateResult.verification.command}" failed with exit code ${gateResult.verification.exitCode}.\nErrors:\n${gateResult.verification.logSnippet}`
+          }
+        }
       }
       const move = resolveTransition(task.column, [{ column, source: 'tool', detail: detail ?? '' }])
       if (move === undefined) return `The card is already in ${task.column}.`

package/lib/client.js

@@ -932,6 +932,13 @@ window.__ModuleLoader__.load({
       'field.workspaceClaimBoundaries': 'Workspace claim boundaries',
       'field.autoSyncSessions': 'Auto-sync external chat sessions',
       'hint.autoSyncSessions': 'Automatically create board cards for standard DSH chat conversations.',
+      'field.verificationGateEnabled': 'Verification gate',
+      'hint.verificationGateEnabled': 'Run automated verification gate (e.g. npm test) before allowing cards to move to Review.',
+      'field.verificationCommand': 'Verification command',
+      'hint.verificationCommand': 'Default verification command to execute in task worktree before Review (default: npm test).',
+      'field.verificationTimeoutMs': 'Verification timeout (ms)',
+      'hint.verificationTimeoutMs': 'Timeout in milliseconds for verification gate execution (default: 120000).',
+      'panel.verificationFailed': 'Automated verification before Review failed',
       'hint.announceToAgent': 'Injects guidance section into the agent system prompt.',
       'task.runs': 'Execution History',
       'task.noRuns': 'No runs yet',
@@ -1215,6 +1222,8 @@ window.__ModuleLoader__.load({
       'diff.truncated': 'Diff truncated (exceeded limit)',
       'diff.show': 'Show diff',
       'diff.hide': 'Hide diff',
+      'diff.discard': 'Discard',
+      'diff.confirmDiscard': 'Discard changes to {file}?',
       'acceptance.acceptAndMerge': 'Accept & Merge (--no-ff)',
       'acceptance.merging': 'Merging...',
       'acceptance.title': 'Review Acceptance Gate',
@@ -1324,6 +1333,13 @@ window.__ModuleLoader__.load({
       'field.workspaceClaimBoundaries': '工作区认领边界',
       'field.autoSyncSessions': '自动同步外部聊天会话',
       'hint.autoSyncSessions': '自动将 DSH 的标准聊天会话同步为看板任务卡片。',
+      'field.verificationGateEnabled': '验证网关',
+      'hint.verificationGateEnabled': '在允许卡片移至评审前运行自动验证 (如 npm test)。',
+      'field.verificationCommand': '验证命令',
+      'hint.verificationCommand': '在工作区运行的默认验证命令 (默认: npm test)。',
+      'field.verificationTimeoutMs': '验证超时 (毫秒)',
+      'hint.verificationTimeoutMs': '验证执行的超时时间 (毫秒，默认 120000)。',
+      'panel.verificationFailed': '移至评审前的自动验证失败',
       'hint.announceToAgent': '向 Agent 系统提示词注入看板与进度协作说明。',
       'task.runs': '执行历史',
       'task.noRuns': '暂无执行记录',
@@ -1607,6 +1623,8 @@ window.__ModuleLoader__.load({
       'diff.truncated': 'Diff 超限已截断',
       'diff.show': '查看 diff',
       'diff.hide': '收起 diff',
+      'diff.discard': '放弃修改',
+      'diff.confirmDiscard': '确认放弃对 {file} 的修改吗？',
       'acceptance.acceptAndMerge': '验收并合并 (--no-ff)',
       'acceptance.merging': '合并中...',
       'acceptance.title': '评审验收网关',
@@ -1694,6 +1712,9 @@ window.__ModuleLoader__.load({
       { field: 'maxConcurrentSessions', kind: 'number', group: 'limits' },
       { field: 'workspaceClaimBoundaries', kind: 'bool', group: 'general' },
       { field: 'autoSyncSessions', kind: 'bool', group: 'sync' },
+      { field: 'verificationGateEnabled', kind: 'bool', group: 'general' },
+      { field: 'verificationCommand', kind: 'text', group: 'general' },
+      { field: 'verificationTimeoutMs', kind: 'number', group: 'general' },
     ]
 
     function hintKey(spec) {
@@ -2068,6 +2089,11 @@ window.__ModuleLoader__.load({
           Array.isArray(task.checklist) && task.checklist.length > 0
             ? h('span', { className: 'dkb-tag', title: 'DoD Checklist' }, `☑ ${task.checklist.filter((i) => i.completed).length}/${task.checklist.length}`)
             : null,
+          task.report?.verification?.status === 'passed'
+            ? h('span', { className: 'dkb-tag', style: { background: 'var(--dsw-alias-state-success-secondary, #dafbe1)', color: 'var(--dsw-alias-state-success-primary, #1a7f37)', borderColor: 'var(--dsw-alias-state-success-secondary, #4ac26b)' }, title: task.report.verification.command || 'Tests passed' }, '✓ PASS')
+            : (task.report?.verification?.status === 'failed'
+              ? h('span', { className: 'dkb-tag', style: { background: 'var(--dsw-alias-state-error-secondary, #ffebe9)', color: 'var(--dsw-alias-state-error-primary, #cf222e)', borderColor: 'var(--dsw-alias-state-error-secondary, #ffc1c0)' }, title: task.report.verification.command || 'Tests failed' }, '✗ FAIL')
+              : null),
           task.report && task.report.summary
             ? h('span', { className: 'dkb-tag', title: 'Execution Report' }, '📄 report')
             : null,
@@ -2998,6 +3024,29 @@ window.__ModuleLoader__.load({
               t('panel.worktree', { path: openTask.worktree })
               + (openTask.branch ? ' (' + openTask.branch + ')' : ''))
             : null,
+          openTask.report?.verification?.status === 'failed'
+            ? h('div', {
+                style: {
+                  margin: '8px 0', padding: '10px 12px',
+                  background: 'var(--dsw-alias-state-error-secondary, #ffebe9)',
+                  border: '1px solid var(--dsw-alias-state-error-primary, #cf222e)',
+                  borderRadius: 8, fontSize: 12, display: 'flex', flexDirection: 'column', gap: 6,
+                },
+              },
+                h('div', { style: { fontWeight: 'bold', color: 'var(--dsw-alias-state-error-primary, #cf222e)' } },
+                  '✗ ' + (t('panel.verificationFailed') || 'Automated verification before Review failed') + (openTask.report.verification.command ? ' (' + openTask.report.verification.command + ')' : '')
+                ),
+                openTask.report.verification.log
+                  ? h('pre', {
+                      style: {
+                        margin: 0, padding: 6, maxHeight: 150, overflowY: 'auto',
+                        background: 'var(--dsw-alias-bg-layer-2)',
+                        fontSize: 11, fontFamily: 'monospace', borderRadius: 4, whiteSpace: 'pre-wrap',
+                      },
+                    }, openTask.report.verification.log)
+                  : null
+              )
+            : null,
           openTask.permission && !openTask.permissionConfirmedAt
             ? h('div', {
                 className: 'dkb-warnBox',
@@ -3357,17 +3406,74 @@ window.__ModuleLoader__.load({
                     : null,
                   diffLoading
                     ? h('div', { style: { fontSize: 12, opacity: 0.7 } }, 'Loading diff...')
-                    : diffData?.diff
-                      ? h('pre', {
-                          style: {
-                            margin: 0, padding: 8, maxHeight: 280, overflowY: 'auto',
-                            background: 'var(--dsw-alias-bg-layer-2)',
-                            color: 'var(--dsw-alias-label-primary)',
-                            fontSize: 11, fontFamily: 'monospace', borderRadius: 4, whiteSpace: 'pre-wrap',
-                            border: '1px solid var(--dsw-alias-border-l1)',
-                          },
-                        }, diffData.diff)
-                      : h('div', { style: { fontSize: 12, opacity: 0.7 } }, t('diff.empty'))
+                    : h('div', { style: { display: 'flex', flexDirection: 'column', gap: 6 } },
+                        diffData?.files && diffData.files.length > 0
+                          ? h('div', { style: { display: 'flex', flexDirection: 'column', gap: 4, margin: '2px 0' } },
+                              diffData.files.map((f) => h('div', {
+                                key: f.path,
+                                style: {
+                                  display: 'flex', alignItems: 'center', gap: 6, fontSize: 11,
+                                  padding: '3px 6px', background: 'var(--dsw-alias-bg-layer-2)',
+                                  borderRadius: 4, border: '1px solid var(--dsw-alias-border-l1)',
+                                },
+                              },
+                                h('span', {
+                                  style: {
+                                    fontWeight: 'bold', fontSize: 10, padding: '1px 4px', borderRadius: 3,
+                                    background: f.status === 'added' ? 'var(--dsw-alias-state-success-secondary, #dafbe1)'
+                                      : (f.status === 'deleted' ? 'var(--dsw-alias-state-error-secondary, #ffebe9)'
+                                      : 'var(--dsw-alias-state-warn-secondary, #fff8c5)'),
+                                    color: f.status === 'added' ? 'var(--dsw-alias-state-success-primary, #1a7f37)'
+                                      : (f.status === 'deleted' ? 'var(--dsw-alias-state-error-primary, #cf222e)'
+                                      : 'var(--dsw-alias-state-warn-primary, #9a6700)'),
+                                  },
+                                }, f.status === 'added' ? 'A' : (f.status === 'deleted' ? 'D' : (f.status === 'untracked' ? '?' : 'M'))),
+                                h('span', { style: { flex: 1, fontFamily: 'monospace', overflow: 'hidden', textOverflow: 'ellipsis' } }, f.path),
+                                (f.insertions || f.deletions)
+                                  ? h('span', { style: { fontSize: 10, fontFamily: 'monospace', opacity: 0.85 } },
+                                      f.insertions ? h('span', { style: { color: 'var(--dsw-alias-state-success-primary, #1a7f37)', marginRight: 4 } }, `+${f.insertions}`) : null,
+                                      f.deletions ? h('span', { style: { color: 'var(--dsw-alias-state-error-primary, #cf222e)' } }, `-${f.deletions}`) : null,
+                                    )
+                                  : null,
+                                h('button', {
+                                  type: 'button',
+                                  className: 'dkb-discard',
+                                  style: { padding: '1px 6px', fontSize: 10, cursor: 'pointer' },
+                                  title: t('diff.discard') || 'Discard',
+                                  onClick: async (e) => {
+                                    e.stopPropagation()
+                                    const confirmMsg = t('diff.confirmDiscard', { file: f.path }) || `Discard changes to ${f.path}?`
+                                    if (window.confirm(confirmMsg)) {
+                                      try {
+                                        await api('/task/' + encodeURIComponent(openTask.id) + '/discard', {
+                                          method: 'POST',
+                                          body: JSON.stringify({ file: f.path }),
+                                        })
+                                        await loadDiffAndCommits()
+                                        await load(board)
+                                      } catch (err) {
+                                        setError(t(err.key || err.error || 'error.unknown'))
+                                      }
+                                    }
+                                  },
+                                }, t('diff.discard') || 'Discard')
+                              ))
+                            )
+                          : null,
+                        diffData?.diff
+                          ? h('pre', {
+                              style: {
+                                margin: 0, padding: 8, maxHeight: 280, overflowY: 'auto',
+                                background: 'var(--dsw-alias-bg-layer-2)',
+                                color: 'var(--dsw-alias-label-primary)',
+                                fontSize: 11, fontFamily: 'monospace', borderRadius: 4, whiteSpace: 'pre-wrap',
+                                border: '1px solid var(--dsw-alias-border-l1)',
+                              },
+                            }, diffData.diff)
+                          : (!diffData?.files || diffData.files.length === 0
+                            ? h('div', { style: { fontSize: 12, opacity: 0.7 } }, t('diff.empty'))
+                            : null)
+                      )
                 ) : null
               )
             : null,

package/lib/config.js

@@ -76,6 +76,9 @@ export const CONFIG_DEFAULTS = {
   maxConcurrentSessions: 3,
   workspaceClaimBoundaries: true,
   autoSyncSessions: false,
+  verificationGateEnabled: true,
+  verificationCommand: 'npm test',
+  verificationTimeoutMs: 120000,
 }
 
 /** Field descriptions reused in schema and settings card. */
@@ -111,6 +114,9 @@ export const CONFIG_HINTS = {
   maxConcurrentSessions: 'Maximum number of simultaneous active agent sessions on the board.',
   workspaceClaimBoundaries: 'Enforce workspace ownership boundaries to prevent cross-workspace task execution.',
   autoSyncSessions: 'Automatically sync and attach live background agent sessions to cards.',
+  verificationGateEnabled: 'Run automated verification gate (e.g. npm test) before allowing cards to move to Review.',
+  verificationCommand: 'Default verification command to execute in task worktree before Review (default: npm test).',
+  verificationTimeoutMs: 'Timeout in milliseconds for verification gate execution (default: 120000).',
 }
 
 /** Setting key for column WIP limit; not all columns have limits. */

package/lib/index.js

@@ -1,3 +1,4 @@
+import { verifyAndRecordGate } from './verification.js'
 import { registerPluginUpdater } from './updater.js'
 // dsh-kanban — task board for DeepSeek Harness.
 //
@@ -34,6 +35,7 @@ import {
   exportTasksCsv,
   handleCleanupWorktree,
   handleTaskDiff,
+  handleTaskDiscard,
   handleTaskCommits,
   handleTaskMerge,
   handleTaskWorktreeStatus,
@@ -1151,8 +1153,31 @@ export function apply(ctx, config) {
       try {
         const input = await readBody(req)
         if (req.method === 'POST' && action === 'move') {
-          // Manual move dispatches stop command to agent prior to updating card column.
           const was = store.getTask(id)
+          if (was === undefined) { writeJson(res, 404, { error: 'task-not-found' }); return }
+
+          // Automated Verification Gate (#372): intercept transition to review
+          if (input.column === 'review' && was.column !== 'review') {
+            const gateResult = await verifyAndRecordGate({
+              task: was,
+              config: getConfig(),
+              store,
+              agents: ctx.agents,
+              createMessage: createUserMessage,
+            })
+            if (!gateResult.allowed) {
+              writeJson(res, 422, {
+                error: 'verification-failed',
+                command: gateResult.verification.command,
+                exitCode: gateResult.verification.exitCode,
+                log: gateResult.verification.logSnippet,
+                task: store.getTask(id),
+              })
+              return
+            }
+          }
+
+          // Manual move dispatches stop command to agent prior to updating card column.
           const acted = was !== undefined && input.column !== was.column
             ? dispatchMove({
               agents: ctx.agents, task: was, column: input.column,
@@ -1193,8 +1218,20 @@ export function apply(ctx, config) {
           writeJson(res, resObj.status, resObj.body)
           return
         }
+        if (req.method === 'POST' && action === 'discard') {
+          const resObj = await handleTaskDiscard({
+            task: store.getTask(id),
+            file: input?.file,
+            discardTaskFile,
+          })
+          if (resObj?.body?.success) {
+            eventHub.broadcast('task:change', { taskId: id, action: 'discard', file: input?.file })
+          }
+          writeJson(res, resObj.status, resObj.body)
+          return
+        }
         if (req.method === 'GET' && action === 'diff') {
-          const resObj = await handleTaskDiff({ task: store.getTask(id), getTaskDiff })
+          const resObj = await handleTaskDiff({ task: store.getTask(id), getTaskDiff, getTaskDiffInspector })
           writeJson(res, resObj.status, resObj.body)
           return
         }

package/lib/routes.js

@@ -773,12 +773,27 @@ export async function handleCleanupWorktree({
 /**
  * Get working copy diff for task.
  */
-export async function handleTaskDiff({ task, getTaskDiff }) {
+export async function handleTaskDiff({ task, getTaskDiff, getTaskDiffInspector }) {
   if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  if (typeof getTaskDiffInspector === 'function') {
+    const inspectorResult = await getTaskDiffInspector({ worktreePath: task.worktree })
+    return { status: 200, body: inspectorResult }
+  }
   const diffResult = await getTaskDiff({ worktreePath: task.worktree })
   return { status: 200, body: diffResult }
 }
 
+/**
+ * Discard file changes in task worktree (#371).
+ */
+export async function handleTaskDiscard({ task, file, discardTaskFile }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  if (!file || typeof file !== 'string') return { status: 400, body: { error: 'file-required' } }
+  if (!task.worktree) return { status: 400, body: { error: 'no-worktree' } }
+  const result = await discardTaskFile({ worktreePath: task.worktree, file })
+  return { status: result.success ? 200 : 400, body: result }
+}
+
 /**
  * Get commit list for task.
  */

package/lib/store.js

@@ -108,6 +108,7 @@ const WRITABLE = [
   'cron', 'nextRunAt', 'lastRunAt', 'progressDump', 'permission', 'reasoningEffort', 'permissionConfirmedAt',
   'runs', 'checklist', 'report', 'comments', 'rejectReason', 'rejectedAt', 'parentId', 'isEpic',
   'workflowRunId', 'workflowStatus', 'permissionConfirmedTier', 'forge', 'queuedRequest',
+  'verificationCommand', 'verificationStatus',
 ]
 
 /** Valid transition sources; unexpected values are rejected to preserve log integrity. */
@@ -249,6 +250,8 @@ export function openStore({ dir }) {
     ['forge', "TEXT NOT NULL DEFAULT ''"],
     ['permissionConfirmedTier', "TEXT NOT NULL DEFAULT ''"],
     ['queuedRequest', "TEXT NOT NULL DEFAULT ''"],
+    ['verificationCommand', "TEXT NOT NULL DEFAULT ''"],
+    ['verificationStatus', "TEXT NOT NULL DEFAULT ''"],
   ]) {
     try { db.exec(`ALTER TABLE tasks ADD COLUMN ${column} ${definition}`) } catch { /* column already exists */ }
   }

package/lib/verification.js

@@ -0,0 +1,242 @@
+import { spawn } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+
+/**
+ * Run verification gate command for task before moving to review (#372).
+ *
+ * @param {object} options
+ * @param {object} options.task
+ * @param {object|Function} options.config
+ * @param {string} [options.worktreePath]
+ * @param {Function} [options.spawnRunner]
+ * @returns {Promise<{
+ *   passed: boolean,
+ *   skipped?: boolean,
+ *   skipReason?: string,
+ *   command: string,
+ *   exitCode: number,
+ *   stdout: string,
+ *   stderr: string,
+ *   logSnippet: string,
+ *   durationMs: number
+ * }>}
+ */
+export async function runVerificationGate({
+  task,
+  config,
+  worktreePath,
+  spawnRunner = spawn,
+}) {
+  const cfg = typeof config === 'function' ? config() : (config || {})
+  const enabled = cfg.verificationGateEnabled !== false
+  const customCmd = typeof task?.verificationCommand === 'string' && task.verificationCommand.trim() !== ''
+    ? task.verificationCommand.trim()
+    : ''
+  const defaultCmd = typeof cfg.verificationCommand === 'string' && cfg.verificationCommand.trim() !== ''
+    ? cfg.verificationCommand.trim()
+    : 'npm test'
+  const command = customCmd || defaultCmd
+  const timeoutMs = Number(task?.verificationTimeoutMs || cfg.verificationTimeoutMs) || 120000
+
+  const cwd = worktreePath || task?.worktree
+  if (!cwd || !existsSync(cwd)) {
+    return {
+      passed: true,
+      skipped: true,
+      skipReason: 'worktree-not-found',
+      command,
+      exitCode: 0,
+      stdout: '',
+      stderr: '',
+      logSnippet: '',
+      durationMs: 0,
+    }
+  }
+
+  // If gate is disabled and no task-specific command was configured, skip
+  if (!enabled && !customCmd) {
+    return {
+      passed: true,
+      skipped: true,
+      skipReason: 'gate-disabled',
+      command,
+      exitCode: 0,
+      stdout: '',
+      stderr: '',
+      logSnippet: '',
+      durationMs: 0,
+    }
+  }
+
+  // If using default 'npm test' but no package.json exists in worktree, skip safely
+  if (!customCmd && defaultCmd === 'npm test') {
+    const pkgPath = join(cwd, 'package.json')
+    if (!existsSync(pkgPath)) {
+      return {
+        passed: true,
+        skipped: true,
+        skipReason: 'no-package-json',
+        command,
+        exitCode: 0,
+        stdout: '',
+        stderr: '',
+        logSnippet: '',
+        durationMs: 0,
+      }
+    }
+  }
+
+  const start = Date.now()
+  return new Promise((resolve) => {
+    let stdout = ''
+    let stderr = ''
+    let timedOut = false
+    const MAX_OUTPUT = 64 * 1024
+
+    const proc = spawnRunner('bash', ['-lc', command], {
+      cwd,
+      timeout: timeoutMs,
+      env: {
+        ...process.env,
+        CI: 'true',
+        DEBIAN_FRONTEND: 'noninteractive',
+      },
+    })
+
+    const timer = setTimeout(() => {
+      timedOut = true
+      try { proc.kill('SIGTERM') } catch { /* ignore */ }
+    }, timeoutMs)
+
+    proc.stdout?.on('data', (chunk) => {
+      if (stdout.length < MAX_OUTPUT) {
+        stdout += chunk.toString('utf8')
+      }
+    })
+
+    proc.stderr?.on('data', (chunk) => {
+      if (stderr.length < MAX_OUTPUT) {
+        stderr += chunk.toString('utf8')
+      }
+    })
+
+    proc.on('error', (err) => {
+      clearTimeout(timer)
+      const durationMs = Date.now() - start
+      stderr += '\n' + (err.message || String(err))
+      resolve({
+        passed: false,
+        command,
+        exitCode: 1,
+        stdout,
+        stderr,
+        logSnippet: (stdout + '\n' + stderr).trim().slice(-4000),
+        durationMs,
+      })
+    })
+
+    proc.on('close', (code, signal) => {
+      clearTimeout(timer)
+      const durationMs = Date.now() - start
+      if (timedOut || signal === 'SIGTERM') {
+        stderr += `\n[Verification Gate] Execution timed out after ${timeoutMs}ms.`
+      }
+      const exitCode = typeof code === 'number' ? code : (timedOut ? 124 : 1)
+      const passed = exitCode === 0
+      const logSnippet = (stdout + '\n' + stderr).trim().slice(-4000)
+      resolve({
+        passed,
+        command,
+        exitCode,
+        stdout,
+        stderr,
+        logSnippet,
+        durationMs,
+      })
+    })
+  })
+}
+
+/**
+ * Send failure prompt to agent session if active.
+ */
+export function sendVerificationFailurePrompt({ agents, task, createMessage, command, exitCode, logSnippet }) {
+  const sessionId = typeof task?.sessionId === 'string' ? task.sessionId : ''
+  if (!sessionId || !agents) return false
+  let agent
+  try { agent = agents.get(sessionId) } catch { agent = undefined }
+  if (!agent || typeof agent.followup !== 'function') return false
+
+  const text = "Automated verification before Review failed (" + command + ", exit code " + exitCode + ").\nFix the test failures:\n\n```\n" + logSnippet + "\n```"
+  try {
+    const msg = typeof createMessage === 'function'
+      ? createMessage({
+          content: [{ type: 'text', text }],
+          source: { kind: 'dsh-kanban', plugin: 'dsh-kanban', form: 'verification-failure' },
+        })
+      : { content: [{ type: 'text', text }] }
+    agent.followup(msg)
+    return true
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Check and run verification gate before move to review, recording outcome.
+ *
+ * @returns {Promise<{ allowed: boolean, verification: object }>}
+ */
+export async function verifyAndRecordGate({
+  task,
+  config,
+  store,
+  agents,
+  createMessage,
+  spawnRunner,
+}) {
+  const vRes = await runVerificationGate({ task, config, spawnRunner })
+  if (vRes.skipped) {
+    return { allowed: true, verification: vRes }
+  }
+
+  const currentReport = typeof task.report === 'object' && task.report ? { ...task.report } : {}
+  currentReport.verification = {
+    status: vRes.passed ? 'passed' : 'failed',
+    command: vRes.command,
+    exitCode: vRes.exitCode,
+    durationMs: vRes.durationMs,
+    verifiedAt: Date.now(),
+    log: vRes.logSnippet,
+  }
+
+  if (store) {
+    store.setReport(task.id, currentReport)
+    store.updateTask(task.id, {
+      verificationStatus: vRes.passed ? 'passed' : 'failed',
+    })
+
+    if (!vRes.passed) {
+      store.addComment(task.id, {
+        author: 'system',
+        role: 'system',
+        text: `[Verification Gate Failed]: \`${vRes.command}\` exited with code ${vRes.exitCode}.\n\`\`\`\n${vRes.logSnippet.slice(-2000)}\n\`\`\``,
+      })
+    }
+  }
+
+  if (!vRes.passed) {
+    sendVerificationFailurePrompt({
+      agents,
+      task,
+      createMessage,
+      command: vRes.command,
+      exitCode: vRes.exitCode,
+      logSnippet: vRes.logSnippet,
+    })
+    return { allowed: false, verification: vRes }
+  }
+
+  return { allowed: true, verification: vRes }
+}

package/lib/worktree.js

@@ -13,7 +13,7 @@
 
 import { execFile } from 'node:child_process'
 import { promisify } from 'node:util'
-import { existsSync, readFileSync, readdirSync } from 'node:fs'
+import { existsSync, readFileSync, readdirSync, rmSync } from 'node:fs'
 import { basename, relative } from 'node:path'
 import { isAbsolute, join, resolve, sep } from 'node:path'
 
@@ -752,3 +752,164 @@ export async function prepareMultiRepoMirror({ task, workspacePath, gitRunner =
 
   return { mirrors, errors: errors.length > 0 ? errors : undefined }
 }
+
+
+/**
+ * Diff inspector returning structured files list with numstat counts (#371).
+ *
+ * @param {{worktreePath: string, baseRef?: string, gitRunner?: Function}} options
+ * @returns {Promise<{
+ *   worktree: boolean,
+ *   baseRef: string,
+ *   files: Array<{path: string, status: string, insertions: number, deletions: number}>,
+ *   diff: string,
+ *   truncated: boolean,
+ *   filesChanged: number
+ * }>}
+ */
+export async function getTaskDiffInspector({ worktreePath, baseRef, gitRunner = defaultGitRunner }) {
+  if (!worktreePath) return { worktree: false, files: [], diff: '', filesChanged: 0, truncated: false }
+  const isRepo = await isGitRepo(worktreePath, gitRunner)
+  if (!isRepo) return { worktree: false, files: [], diff: '', filesChanged: 0, truncated: false }
+
+  let base = baseRef
+  if (!base) {
+    base = await determineBaseRef(worktreePath, gitRunner)
+  }
+
+  // 1. Map files from status --porcelain=v1 -u
+  const statusRes = await gitRunner(['status', '--porcelain=v1', '-u'], worktreePath)
+  const statusLines = (statusRes?.stdout || '').trim().split('\n').filter(Boolean)
+  const filesMap = new Map()
+
+  for (const line of statusLines) {
+    const code = line.slice(0, 2)
+    let filePath = line.slice(3).trim()
+    if (filePath.includes(' -> ')) {
+      filePath = filePath.split(' -> ')[1].trim()
+    }
+    if (filePath.startsWith('"') && filePath.endsWith('"')) {
+      filePath = filePath.slice(1, -1)
+    }
+
+    let status = 'modified'
+    if (code === '??') status = 'untracked'
+    else if (code.includes('A')) status = 'added'
+    else if (code.includes('D')) status = 'deleted'
+    else if (code.includes('R')) status = 'renamed'
+    else if (code.includes('M')) status = 'modified'
+
+    filesMap.set(filePath, { path: filePath, status, insertions: 0, deletions: 0 })
+  }
+
+  // 2. Line counts from git diff --numstat
+  if (base) {
+    const numstatBase = await gitRunner(['diff', '--numstat', `${base}...HEAD`], worktreePath)
+    if ((numstatBase?.exitCode ?? numstatBase?.code ?? 0) === 0) {
+      for (const line of (numstatBase.stdout || '').trim().split('\n').filter(Boolean)) {
+        const parts = line.split('\t')
+        if (parts.length >= 3) {
+          const ins = parseInt(parts[0], 10) || 0
+          const del = parseInt(parts[1], 10) || 0
+          let p = parts[2].trim()
+          if (p.includes(' => ')) {
+            p = p.replace(/.*=>\s*/, '').replace(/[{}]/g, '').trim()
+          }
+          if (p.startsWith('"') && p.endsWith('"')) p = p.slice(1, -1)
+          const existing = filesMap.get(p)
+          if (existing) {
+            existing.insertions += ins
+            existing.deletions += del
+          } else {
+            filesMap.set(p, { path: p, status: 'modified', insertions: ins, deletions: del })
+          }
+        }
+      }
+    }
+  }
+
+  const numstatHead = await gitRunner(['diff', '--numstat', 'HEAD'], worktreePath)
+  if ((numstatHead?.exitCode ?? numstatHead?.code ?? 0) === 0) {
+    for (const line of (numstatHead.stdout || '').trim().split('\n').filter(Boolean)) {
+      const parts = line.split('\t')
+      if (parts.length >= 3) {
+        const ins = parseInt(parts[0], 10) || 0
+        const del = parseInt(parts[1], 10) || 0
+        let p = parts[2].trim()
+        if (p.includes(' => ')) {
+          p = p.replace(/.*=>\s*/, '').replace(/[{}]/g, '').trim()
+        }
+        if (p.startsWith('"') && p.endsWith('"')) p = p.slice(1, -1)
+        const existing = filesMap.get(p)
+        if (existing) {
+          existing.insertions += ins
+          existing.deletions += del
+        } else {
+          filesMap.set(p, { path: p, status: 'modified', insertions: ins, deletions: del })
+        }
+      }
+    }
+  }
+
+  // 3. Diff content (with 500 KB ceiling per #371)
+  const diffRes = await getTaskDiff({ worktreePath, baseRef: base, gitRunner })
+  const files = Array.from(filesMap.values())
+
+  return {
+    worktree: true,
+    baseRef: base || '',
+    files,
+    diff: diffRes.diff,
+    truncated: diffRes.truncated,
+    filesChanged: files.length > 0 ? files.length : diffRes.filesChanged,
+  }
+}
+
+/**
+ * Discard changes to a specific file in task worktree safely (#371).
+ *
+ * @param {{worktreePath: string, file: string, gitRunner?: Function}} options
+ * @returns {Promise<{success: boolean, file?: string, tracked?: boolean, error?: string}>}
+ */
+export async function discardTaskFile({ worktreePath, file, gitRunner = defaultGitRunner }) {
+  if (!worktreePath || !file || typeof file !== 'string') {
+    return { success: false, error: 'invalid-parameters' }
+  }
+
+  // Path fencing check: prevent directory traversal or outside deletion
+  if (isAbsolute(file) || file.includes('..')) {
+    return { success: false, error: 'path-traversal-detected' }
+  }
+
+  const fullPath = resolve(worktreePath, file)
+  const rootResolved = resolve(worktreePath)
+  if (!fullPath.startsWith(rootResolved + sep) && fullPath !== rootResolved) {
+    return { success: false, error: 'path-outside-worktree' }
+  }
+
+  // Check if file is tracked by git
+  let isTracked = false
+  try {
+    const lsRes = await gitRunner(['ls-files', '--error-unmatch', file], worktreePath)
+    isTracked = (lsRes?.exitCode ?? lsRes?.code ?? 0) === 0
+  } catch {
+    isTracked = false
+  }
+
+  if (isTracked) {
+    // Restore staged and unstaged
+    await gitRunner(['restore', '--staged', '--worktree', '--', file], worktreePath)
+    await gitRunner(['checkout', 'HEAD', '--', file], worktreePath)
+    return { success: true, file, tracked: true }
+  } else {
+    // Untracked file: remove safely
+    try {
+      if (existsSync(fullPath)) {
+        rmSync(fullPath, { recursive: true, force: true })
+      }
+      return { success: true, file, tracked: false }
+    } catch (e) {
+      return { success: false, error: e?.message || 'failed-to-delete-untracked-file' }
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-kanban",
-  "version": "0.2.31",
+  "version": "0.2.32",
   "description": "Visual Kanban board for DeepSeek Harness: Gitea and GitHub-backed tasks, workflow columns, and a dedicated agent session per task.",
   "type": "module",
   "main": "lib/index.js",