@workflow-code/cli 0.2.4-20261011004.codex-cli-web → 0.2.4-20261011006.codex-cli-web

package/dist/{web-O6FZ5URK.js → web-KEM7Y2ZR.js}

@@ -1,29 +1,52 @@
 #!/usr/bin/env node
 import {
   assertLocalCliCoreCompatible
-} from "./chunk-T4FXQ7AQ.js";
+} from "./chunk-WN7VAGK6.js";
+import {
+  assertKanbanMethodJson,
+  consumeKanbanRelatedProjectRevisionStream,
+  createDefaultKanbanValues,
+  createInjectedKanbanParams,
+  createKanbanBridgeError,
+  createKanbanContentSecurityPolicy,
+  encodeKanbanAssetUrlPath,
+  injectKanbanBridge,
+  isSafeKanbanPublicAssetPath,
+  parseKanbanBridgeCall,
+  parseKanbanManifestText,
+  parseKanbanMethodDefinitions,
+  parseKanbanMethodInvocation,
+  readKanbanArtifactConfig,
+  readKanbanAssetMimeType,
+  sanitizeKanbanValues
+} from "./chunk-HLMW6LAQ.js";
 import "./chunk-J2JMC4MZ.js";
-import "./chunk-G7PZDTYW.js";
+import "./chunk-MNY562W5.js";
 import {
   clearCliAuthConfig,
   readCliAuthConfig,
   writeCliAuthConfig
 } from "./chunk-PGM3IPWA.js";
-import "./chunk-BP2VDZQV.js";
 import {
+  isWorkflowProjectDataStorageLocationAllowed,
+  readWorkflowProjectInfo,
+  resolveWorkflowRelatedProjectAccess
+} from "./chunk-P6K3NB5S.js";
+import {
+  getCurrentLocale,
   i18n
 } from "./chunk-7WEXRL5A.js";
 import "./chunk-NSPRIPOP.js";
 
 // src/web.ts
 import { spawn as spawn3 } from "child_process";
-import path5 from "path";
+import path8 from "path";
 
 // src/web/server.ts
 import { createServer } from "http";
-import { createHash, randomBytes, timingSafeEqual } from "crypto";
-import { mkdir, readFile as readFile2, rename, writeFile, realpath as realpath2 } from "fs/promises";
-import path3 from "path";
+import { createHash as createHash3, randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+import { mkdir as mkdir2, readFile as readFile5, rename as rename2, writeFile as writeFile2, realpath as realpath4 } from "fs/promises";
+import path6 from "path";
 import os from "os";
 import { spawn as spawn2 } from "child_process";
 
@@ -991,7 +1014,8 @@ var WorkflowController = class {
         this.confirmInput(record2, record2.submittingInput);
       }
       if (report.status === "failed") {
-        record2.error = report.result?.error?.message ?? "Workflow failed.";
+        const data = report.result?.data;
+        record2.error = report.result?.error?.message || (data && typeof data === "object" && "errMessage" in data && typeof data.errMessage === "string" ? data.errMessage : "") || "Workflow failed.";
       }
       if (record2.submittingInput && pending && report.status === "failed") {
         record2.status = "waiting_for_input";
@@ -1143,6 +1167,626 @@ var WorkflowController = class {
   }
 };
 
+// src/web/kanban-controller.ts
+import { randomUUID as randomUUID2, createHash as createHash2 } from "crypto";
+import { mkdir, readFile as readFile3, readdir as readdir2, rename, writeFile, stat as stat2 } from "fs/promises";
+import path3 from "path";
+import { watch } from "fs";
+
+// src/web/kanban-preview.ts
+import { randomBytes } from "crypto";
+import { lstat, realpath, readFile, stat } from "fs/promises";
+import path from "path";
+function injectTheme(html, nonce) {
+  const script = `<script nonce=${JSON.stringify(nonce)}>(() => {
+    addEventListener('message', event => {
+      const message = event.data;
+      if (event.source !== parent || message?.nonce !== ${JSON.stringify(nonce)} || message.type !== 'workflow-code:kanban-theme' || !['light', 'dark'].includes(message.theme)) return;
+      document.documentElement.dataset.theme = message.theme;
+      document.documentElement.style.colorScheme = message.theme;
+      dispatchEvent(new CustomEvent('workflow-code:kanban-theme-change', { detail: { theme: message.theme } }));
+    });
+  })();</script>`;
+  const head = /<head(?:\s[^>]*)?>/i.exec(html);
+  if (!head || head.index === void 0) {
+    return `${html}${script}`;
+  }
+  const index = head.index + head[0].length;
+  return `${html.slice(0, index)}${script}${html.slice(index)}`;
+}
+var KanbanPreview = class {
+  constructor(projectRoot, artifact, configuration) {
+    this.projectRoot = projectRoot;
+    this.artifact = artifact;
+    this.configuration = configuration;
+  }
+  projectRoot;
+  artifact;
+  configuration;
+  nonce = randomBytes(24).toString("base64url");
+  get url() {
+    return `/kanban/${this.nonce}/${encodeKanbanAssetUrlPath(this.artifact.entry)}`;
+  }
+  async asset(url) {
+    const prefix = `/kanban/${this.nonce}/`;
+    if (!url.pathname.startsWith(prefix)) {
+      return;
+    }
+    try {
+      const asset = decodeURIComponent(url.pathname.slice(prefix.length));
+      if (asset.includes("\\") || !isSafeKanbanPublicAssetPath(asset, this.artifact.entry)) {
+        return;
+      }
+      const projectRoot = await realpath(this.projectRoot);
+      let artifactRoot = projectRoot;
+      if (this.artifact.artifactDir !== ".") {
+        for (const segment of this.artifact.artifactDir.split("/")) {
+          artifactRoot = path.join(artifactRoot, segment);
+          if ((await lstat(artifactRoot)).isSymbolicLink()) {
+            return;
+          }
+        }
+      }
+      let filename = artifactRoot;
+      for (const segment of asset.split("/")) {
+        filename = path.join(filename, segment);
+        if ((await lstat(filename)).isSymbolicLink()) {
+          return;
+        }
+      }
+      const canonical = await realpath(filename), relative = path.relative(artifactRoot, canonical);
+      if (!relative || relative.startsWith(`..${path.sep}`) || relative === ".." || path.isAbsolute(relative)) {
+        return;
+      }
+      const info = await stat(canonical);
+      if (!info.isFile() || info.size > 20 * 1024 * 1024) {
+        return;
+      }
+      const headers = { "Content-Type": readKanbanAssetMimeType(asset), "Content-Security-Policy": `${createKanbanContentSecurityPolicy(this.nonce)}; form-action 'none'; frame-ancestors 'self' vscode-webview: vscode-file: https://*.vscode-cdn.net https://*.vscode-webview.net http://127.0.0.1:* http://localhost:*`, "Cache-Control": "no-store", "Access-Control-Allow-Origin": "*", "Referrer-Policy": "no-referrer", "X-Content-Type-Options": "nosniff" };
+      return { headers, content: asset === this.artifact.entry ? injectKanbanBridge(injectTheme(await readFile(canonical, "utf8"), this.nonce), this.configuration(), this.nonce) : await readFile(canonical) };
+    } catch {
+      return;
+    }
+  }
+};
+
+// src/web/kanban-methods.ts
+import { randomUUID } from "crypto";
+var KanbanMethodHub = class {
+  constructor(configuration, emit) {
+    this.configuration = configuration;
+    this.emit = emit;
+  }
+  configuration;
+  emit;
+  clients = /* @__PURE__ */ new Map();
+  instances = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  connect(clientId) {
+    if (!/^[a-zA-Z0-9-]{1,200}$/.test(clientId)) {
+      throw new Error("Invalid Kanban client.");
+    }
+    this.disconnect(clientId);
+    const connection = {};
+    this.clients.set(clientId, connection);
+    return () => {
+      if (this.clients.get(clientId) === connection) {
+        this.disconnect(clientId);
+      }
+    };
+  }
+  remove(instanceId) {
+    this.instances.delete(instanceId);
+    for (const [requestId, request] of this.pending) {
+      if (request.instanceId !== instanceId) {
+        continue;
+      }
+      request.finish(new Error("Kanban preview changed or closed."));
+      this.emit({ type: "kanban-method-cancel", requestId, instanceId });
+    }
+  }
+  disconnect(clientId) {
+    this.clients.delete(clientId);
+    for (const [instanceId, instance] of this.instances) {
+      if (instance.clientId === clientId) {
+        this.remove(instanceId);
+      }
+    }
+  }
+  publish(value) {
+    if (!this.clients.has(value.clientId) || typeof value.instanceId !== "string" || !value.instanceId || value.instanceId.length > 200 || value.configurationId !== this.configuration().id || typeof value.ready !== "boolean" || !["fullscreen", "phone", "tablet", "card"].includes(value.presentation?.mode)) {
+      throw new Error("Invalid Kanban method instance.");
+    }
+    const existing = this.instances.get(value.instanceId);
+    if (existing && existing.clientId !== value.clientId) {
+      throw new Error("Kanban method instance belongs to another client.");
+    }
+    this.instances.set(value.instanceId, {
+      ready: value.ready,
+      configurationId: value.configurationId,
+      configurationName: this.configuration().name,
+      presentation: value.presentation,
+      methods: parseKanbanMethodDefinitions(value.methods),
+      seen: Date.now(),
+      clientId: value.clientId
+    });
+  }
+  list() {
+    for (const [id, instance] of this.instances) {
+      if (Date.now() - instance.seen > 15e3) {
+        this.remove(id);
+      }
+    }
+    return [...this.instances].map(([instanceId, { seen: _, clientId: __, ...state }]) => ({ instanceId, ...state }));
+  }
+  async invoke(value) {
+    const call = parseKanbanMethodInvocation(value);
+    this.list();
+    const instance = this.instances.get(call.instanceId);
+    if (!instance?.ready || instance.configurationId !== call.configurationId || call.configurationId !== this.configuration().id) {
+      throw new Error("Kanban method instance changed. List instances again.");
+    }
+    if (!instance.methods.some((method) => method.name === call.method)) {
+      throw new Error("Kanban page did not register this method.");
+    }
+    if ([...this.pending.values()].filter((item) => item.instanceId === call.instanceId).length >= 4) {
+      throw new Error("Too many Kanban method calls.");
+    }
+    const requestId = randomUUID();
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        this.pending.get(requestId)?.finish(new Error("Kanban method timed out. Inspect state before retrying."));
+        this.emit({ type: "kanban-method-cancel", requestId, instanceId: call.instanceId });
+      }, 15e3);
+      this.pending.set(requestId, { instanceId: call.instanceId, finish: (error, result) => {
+        if (!this.pending.delete(requestId)) {
+          return;
+        }
+        clearTimeout(timer);
+        error ? reject(error) : resolve(result);
+      } });
+      this.emit({ type: "kanban-method-invoke", requestId, ...call });
+    });
+  }
+  reply(message) {
+    const request = this.pending.get(message.requestId);
+    if (!request || request.instanceId !== message.instanceId || this.instances.get(message.instanceId)?.clientId !== message.clientId) {
+      throw new Error("Kanban method request changed.");
+    }
+    if (message.ok === true) {
+      assertKanbanMethodJson(message.value);
+      request.finish(void 0, message.value);
+    } else {
+      request.finish(new Error(typeof message.error === "string" ? message.error.slice(0, 2e3) : "Kanban method failed."));
+    }
+  }
+  clear() {
+    this.instances.clear();
+    for (const [requestId, request] of this.pending) {
+      request.finish(new Error("Kanban preview changed or closed."));
+      this.emit({ type: "kanban-method-cancel", requestId, instanceId: request.instanceId });
+    }
+  }
+};
+
+// src/web/kanban-data.ts
+import { readFile as readFile2, readdir, realpath as realpath2 } from "fs/promises";
+import { createHash } from "crypto";
+import path2 from "path";
+var readKanbanProjectInfo = readWorkflowProjectInfo;
+var webProjectDataDirectory = (storageDir, projectDir) => path2.join(storageDir, createHash("sha256").update(projectDir).digest("hex").slice(0, 24));
+async function localKanbanRelatedProjects(project) {
+  const info = readWorkflowProjectInfo(JSON.parse(await readFile2(path2.join(project.folderPath, "package.json"), "utf8")));
+  const relations = info.relatedProjects;
+  const projects = /* @__PURE__ */ new Map();
+  if (!relations.length) {
+    return { info, projects };
+  }
+  const parent = path2.dirname(project.folderPath);
+  const directories = (await readdir(parent, { withFileTypes: true })).filter((item) => item.isDirectory() && !item.name.startsWith(".") && item.name !== "node_modules").slice(0, 500);
+  await Promise.all(directories.map(async (item) => {
+    try {
+      const folderPath = await realpath2(path2.join(parent, item.name));
+      const pkg = JSON.parse(await readFile2(path2.join(folderPath, "package.json"), "utf8"));
+      const relation = relations.find((relation2) => relation2.projectId.toLowerCase() === String(pkg.id).toLowerCase());
+      if (!relation) {
+        return;
+      }
+      const projectInfo = readWorkflowProjectInfo(pkg);
+      const access = resolveWorkflowRelatedProjectAccess({ consumerProjectId: project.id, consumerProjectInfo: info, targetProjectId: pkg.id, targetProjectInfo: projectInfo, alias: relation.alias });
+      if (access && isWorkflowProjectDataStorageLocationAllowed(projectInfo, "local")) {
+        if (projects.has(relation.alias)) {
+          throw new Error(`Duplicate related project UUID: ${pkg.id}`);
+        }
+        projects.set(relation.alias, { folderPath, id: pkg.id, projectInfo });
+      }
+    } catch (error) {
+      if (String(error).includes("Duplicate related project UUID")) {
+        throw error;
+      }
+    }
+  }));
+  return { info, projects };
+}
+
+// src/web/kanban-controller.ts
+var KanbanController = class {
+  constructor(project, runtime, storageDir, hooks) {
+    this.project = project;
+    this.runtime = runtime;
+    this.storageDir = storageDir;
+    this.hooks = hooks;
+    this.historyPath = path3.join(webProjectDataDirectory(storageDir, project.folderPath), "kanban.json");
+    this.methods = new KanbanMethodHub(() => this.configuration(), (message) => hooks.emit(message));
+  }
+  project;
+  runtime;
+  storageDir;
+  hooks;
+  workspace = { version: 1, revision: 0, configurations: [] };
+  params = [];
+  preview;
+  relatedProjectRevisions = [];
+  missingRelatedProjectAliases = [];
+  relatedProjectWarning = "";
+  pendingSave = Promise.resolve();
+  poll;
+  feed;
+  retry;
+  disposed = false;
+  generation = 0;
+  polling = false;
+  watcher;
+  refreshTimer;
+  refreshing;
+  requests = /* @__PURE__ */ new Set();
+  historyPath;
+  methods;
+  get current() {
+    return this.workspace.configurations.find((item) => item.id === this.workspace.activeConfigurationId);
+  }
+  configuration() {
+    const active = this.current;
+    return active ? { id: active.id, name: active.name, params: createInjectedKanbanParams(this.params, active.values) } : { id: "", name: "", params: {} };
+  }
+  state() {
+    return { ...this.workspace, params: this.params, configuration: this.configuration(), preview: { url: this.preview.url, nonce: this.preview.nonce }, relatedProjectRevisions: this.relatedProjectRevisions, missingRelatedProjectAliases: this.missingRelatedProjectAliases, relatedProjectWarning: this.relatedProjectWarning };
+  }
+  async initialize() {
+    try {
+      const saved = JSON.parse(await readFile3(this.historyPath, "utf8"));
+      if (saved.version !== 1 || !Array.isArray(saved.configurations) || saved.configurations.some((item) => typeof item.id !== "string" || typeof item.name !== "string" || !item.values || typeof item.values !== "object")) {
+        throw new Error("Invalid Kanban configuration history.");
+      }
+      this.workspace = { ...saved, revision: Number.isSafeInteger(saved.revision) ? saved.revision : 0 };
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
+    }
+    await this.refresh();
+    try {
+      this.watcher = watch(this.project.folderPath, { recursive: true }, (_event, filename) => {
+        const file = String(filename).replaceAll("\\", "/");
+        const data = path3.relative(this.project.folderPath, webProjectDataDirectory(this.storageDir, this.project.folderPath)).replaceAll("\\", "/");
+        if (!file || file.split("/").some((part) => part.startsWith(".") || part === "node_modules") || file.startsWith(`${data}/`)) {
+          return;
+        }
+        const artifact = this.project.kanban.artifactDir;
+        if (file !== "package.json" && file !== "kanban.json" && artifact !== "." && file !== artifact && !file.startsWith(`${artifact}/`)) {
+          return;
+        }
+        clearTimeout(this.refreshTimer);
+        this.refreshTimer = setTimeout(() => void this.refresh().catch((error) => this.hooks.log(String(error))), 400);
+      });
+      this.watcher.on("error", (error) => this.hooks.log(String(error)));
+    } catch (error) {
+      this.hooks.log(String(error));
+    }
+    this.poll = setInterval(() => {
+      if (!this.polling && this.project.projectInfo?.dataStorage?.mode !== "server") {
+        this.polling = true;
+        void this.updateLocalRevisions().catch((error) => this.hooks.log(String(error))).finally(() => {
+          this.polling = false;
+        });
+      }
+    }, 2e3);
+    this.poll.unref();
+  }
+  refresh() {
+    clearTimeout(this.refreshTimer);
+    return this.refreshing ??= this.load().finally(() => {
+      this.refreshing = void 0;
+    });
+  }
+  async load() {
+    const pkg = JSON.parse(await readFile3(path3.join(this.project.folderPath, "package.json"), "utf8"));
+    const artifact = readKanbanArtifactConfig(pkg);
+    this.project.kanban = artifact;
+    this.project.projectInfo = readKanbanProjectInfo(pkg);
+    try {
+      this.params = parseKanbanManifestText(await readFile3(path3.join(this.project.folderPath, "kanban.json"), "utf8")).params;
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
+      this.params = [];
+    }
+    this.project.fields = this.params;
+    for (const item of this.workspace.configurations) {
+      item.values = sanitizeKanbanValues(this.params, item.values);
+    }
+    if (!this.workspace.configurations.length && this.params.length) {
+      this.create();
+    }
+    this.workspace.activeConfigurationId = this.current?.id ?? this.workspace.configurations[0]?.id;
+    this.workspace.revision++;
+    this.newPreview();
+    await this.persist();
+    this.authenticationChanged();
+    await this.updateLocalRevisions();
+    this.hooks.changed();
+  }
+  newPreview() {
+    this.generation++;
+    this.methods.clear();
+    this.preview = new KanbanPreview(this.project.folderPath, this.project.kanban, () => this.configuration());
+  }
+  name() {
+    let index = 1;
+    while (this.workspace.configurations.some((item) => item.name === `\u914D\u7F6E ${index}`)) {
+      index++;
+    }
+    return `\u914D\u7F6E ${index}`;
+  }
+  create(values = createDefaultKanbanValues(this.params), name = this.name()) {
+    const date = (/* @__PURE__ */ new Date()).toISOString(), item = { id: randomUUID2(), name, values: { ...values }, createdAt: date, updatedAt: date };
+    this.workspace.configurations.push(item);
+    this.workspace.activeConfigurationId = item.id;
+    return item;
+  }
+  async persist() {
+    const content = JSON.stringify(this.workspace);
+    this.pendingSave = this.pendingSave.catch(() => void 0).then(async () => {
+      await mkdir(path3.dirname(this.historyPath), { recursive: true });
+      const temp = `${this.historyPath}.${process.pid}.tmp`;
+      await writeFile(temp, content, { mode: 384 });
+      await rename(temp, this.historyPath);
+    });
+    return this.pendingSave;
+  }
+  async handle(message) {
+    if (message.type === "kanban-method-state") {
+      if (message.nonce !== this.preview.nonce) {
+        throw new Error("Kanban preview changed.");
+      }
+      this.methods.publish(message);
+      return [];
+    }
+    if (message.type === "kanban-method-reply") {
+      this.methods.reply(message);
+      return [];
+    }
+    if (message.type === "kanban-methods") {
+      return [{ type: "kanban-methods-result", requestId: message.requestId, value: message.action === "list" ? this.methods.list() : message.action === "invoke" ? await this.methods.invoke(message.call) : (() => {
+        throw new Error("Invalid Kanban methods action.");
+      })() }];
+    }
+    if (message.type === "kanban-bridge") {
+      try {
+        if (message.nonce !== this.preview.nonce) {
+          throw Object.assign(new Error("Kanban preview changed."), { code: "KANBAN_BRIDGE_SESSION_INVALID" });
+        }
+        const value = await this.bridge(parseKanbanBridgeCall(message.call));
+        return [{ type: "kanban-bridge-result", requestId: message.requestId, ok: true, value }];
+      } catch (error) {
+        return [{ type: "kanban-bridge-result", requestId: message.requestId, ok: false, error: createKanbanBridgeError(error) }];
+      }
+    }
+    if (message.type === "kanban-refresh") {
+      await this.refresh();
+      return [{ type: "kanban-updated", requestId: message.requestId, kanban: this.state() }];
+    }
+    if (message.type !== "kanban-configuration") {
+      throw new Error(`Unsupported Kanban action: ${message.type}`);
+    }
+    if (message.revision !== this.workspace.revision) {
+      throw new Error("Kanban configuration changed. Try again.");
+    }
+    const action = String(message.action), item = this.workspace.configurations.find((item2) => item2.id === message.id);
+    if (!["create", "duplicate", "rename", "save", "select", "delete"].includes(action)) {
+      throw new Error("Unknown Kanban configuration action.");
+    }
+    if (action !== "create" && !item) {
+      throw new Error("Kanban configuration no longer exists.");
+    }
+    switch (action) {
+      case "create":
+        if (!this.params.length) {
+          throw new Error("The project does not define parameters.");
+        }
+        this.create();
+        this.newPreview();
+        break;
+      case "duplicate":
+        this.create(sanitizeKanbanValues(this.params, item.values), `${item.name} (copy)`);
+        this.newPreview();
+        break;
+      case "rename": {
+        if (typeof message.name !== "string" || !message.name.trim() || message.name.length > 200) {
+          throw new Error("Invalid configuration name.");
+        }
+        item.name = message.name.trim();
+        item.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+        break;
+      }
+      case "save": {
+        if (!message.values || typeof message.values !== "object" || Array.isArray(message.values) || Object.values(message.values).some((value) => typeof value !== "string")) {
+          throw new Error("Invalid Kanban parameters.");
+        }
+        item.values = sanitizeKanbanValues(this.params, message.values);
+        item.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+        break;
+      }
+      case "select":
+        this.workspace.activeConfigurationId = item.id;
+        this.newPreview();
+        break;
+      case "delete": {
+        if (this.workspace.configurations.length <= 1) {
+          throw new Error("The last configuration cannot be deleted.");
+        }
+        this.workspace.configurations = this.workspace.configurations.filter((value) => value !== item);
+        if (item.id === this.workspace.activeConfigurationId) {
+          this.workspace.activeConfigurationId = this.workspace.configurations[0].id;
+          this.newPreview();
+        }
+        break;
+      }
+    }
+    this.workspace.revision++;
+    await this.persist();
+    this.hooks.changed();
+    return [{ type: "kanban-updated", requestId: message.requestId, kanban: this.state() }];
+  }
+  async bridge(call) {
+    if (this.disposed) {
+      throw new Error("Kanban has closed.");
+    }
+    if (call.operation === "runtime.getLocale") {
+      return getCurrentLocale();
+    }
+    const generation = this.generation;
+    let result;
+    if (this.project.projectInfo?.dataStorage?.mode === "server" || call.operation.startsWith("files.")) {
+      const connection = this.hooks.connection();
+      if (!connection) {
+        throw Object.assign(new Error("Workflow Server login is required."), { code: call.operation.startsWith("files.") ? "KANBAN_FILE_UNAVAILABLE" : "KANBAN_BRIDGE_UNAVAILABLE" });
+      }
+      const abort = new AbortController();
+      this.requests.add(abort);
+      try {
+        const response = await fetch(`${connection.serverUrl}/api/workflows/${encodeURIComponent(this.project.id)}/kanban/bridge`, { method: "POST", headers: { Authorization: `Bearer ${connection.accessToken}`, "Content-Type": "application/json" }, body: JSON.stringify({ call }), redirect: "error", signal: AbortSignal.any([abort.signal, AbortSignal.timeout(call.operation.startsWith("files.") ? 12e4 : 15e3)]) });
+        const value = await response.json();
+        if (!response.ok || value.errCode !== 0) {
+          throw Object.assign(new Error("Kanban Server operation failed."), { code: call.operation.startsWith("files.") ? "KANBAN_FILE_UNAVAILABLE" : "KANBAN_DATA_OPERATION_FAILED" });
+        }
+        result = value.data ?? null;
+      } finally {
+        this.requests.delete(abort);
+      }
+    } else {
+      if (!this.runtime.kanbanBridge) {
+        throw new Error("Project Core does not support Kanban data.");
+      }
+      result = await this.runtime.kanbanBridge(this.project, call);
+    }
+    if (generation !== this.generation || this.disposed) {
+      throw Object.assign(new Error("Kanban preview changed."), { code: "KANBAN_BRIDGE_SESSION_INVALID" });
+    }
+    return result;
+  }
+  authenticationChanged() {
+    this.generation++;
+    this.methods.clear();
+    for (const request of this.requests) {
+      request.abort();
+    }
+    this.feed?.abort();
+    clearTimeout(this.retry);
+    this.relatedProjectRevisions = [];
+    this.relatedProjectWarning = "";
+    this.connectServerRevisions();
+  }
+  connectServerRevisions() {
+    if (this.project.projectInfo?.dataStorage?.mode !== "server" || this.disposed) {
+      return;
+    }
+    this.missingRelatedProjectAliases = [];
+    const connection = this.hooks.connection();
+    if (!connection) {
+      this.relatedProjectWarning = "\u8BF7\u767B\u5F55 Workflow Server \u4EE5\u8FDE\u63A5\u770B\u677F\u6570\u636E\u3002";
+      return;
+    }
+    const abort = this.feed = new AbortController();
+    void (async () => {
+      try {
+        const response = await fetch(`${connection.serverUrl}/api/workflows/${encodeURIComponent(this.project.id)}/kanban/related-project-revisions`, { headers: { Authorization: `Bearer ${connection.accessToken}` }, signal: abort.signal, redirect: "error" });
+        if (!response.ok || !response.body) {
+          throw new Error("Kanban related project updates are unavailable.");
+        }
+        const apply = (revisions) => {
+          if (!abort.signal.aborted) {
+            this.relatedProjectRevisions = revisions;
+            this.relatedProjectWarning = "";
+            this.hooks.changed();
+          }
+        };
+        await consumeKanbanRelatedProjectRevisionStream(response.body, { onSnapshot: (value) => apply(value.revisions), onRevision: (value) => apply([...this.relatedProjectRevisions.filter((item) => item.alias !== value.alias), value]), onUnavailable: () => {
+          throw new Error("Related projects are unavailable.");
+        } }, abort.signal);
+      } catch {
+        if (!abort.signal.aborted) {
+          this.relatedProjectWarning = "\u5173\u8054\u9879\u76EE\u66F4\u65B0\u8FDE\u63A5\u5DF2\u4E2D\u65AD\uFF0C\u6B63\u5728\u91CD\u8FDE\u3002";
+          this.hooks.changed();
+        }
+      }
+      if (!abort.signal.aborted && !this.disposed) {
+        this.retry = setTimeout(() => this.connectServerRevisions(), 5e3);
+        this.retry.unref();
+      }
+    })();
+  }
+  async updateLocalRevisions() {
+    if (this.project.projectInfo?.dataStorage?.mode === "server" || this.disposed) {
+      return;
+    }
+    const generation = this.generation, { info, projects } = await localKanbanRelatedProjects(this.project);
+    const missing = info.relatedProjects.filter((item) => !projects.has(item.alias)).map((item) => item.alias);
+    const revisions = await Promise.all([...projects].sort(([left], [right]) => left.localeCompare(right)).map(async ([alias, target]) => {
+      const hash = createHash2("sha256"), root = path3.join(webProjectDataDirectory(this.storageDir, target.folderPath), "kv");
+      const visit = async (directory) => {
+        for (const item of (await readdir2(directory, { withFileTypes: true }).catch(() => [])).sort((a, b) => a.name.localeCompare(b.name))) {
+          if (item.name.startsWith(".") || item.name.endsWith(".lock") || item.name.endsWith(".tmp")) {
+            continue;
+          }
+          const file = path3.join(directory, item.name);
+          if (item.isDirectory()) {
+            await visit(file);
+          } else if (item.isFile()) {
+            const info2 = await stat2(file).catch(() => void 0);
+            hash.update(`${file}:${info2?.size}:${info2?.mtimeMs}`);
+          }
+        }
+      };
+      await visit(root);
+      return { alias, revision: hash.digest("hex") };
+    }));
+    if (generation !== this.generation || this.disposed) {
+      return;
+    }
+    if (JSON.stringify([missing, revisions]) !== JSON.stringify([this.missingRelatedProjectAliases, this.relatedProjectRevisions])) {
+      this.missingRelatedProjectAliases = missing;
+      this.relatedProjectRevisions = revisions;
+      this.hooks.changed();
+    }
+  }
+  async close() {
+    this.disposed = true;
+    this.watcher?.close();
+    clearTimeout(this.refreshTimer);
+    this.methods.clear();
+    clearInterval(this.poll);
+    clearTimeout(this.retry);
+    this.feed?.abort();
+    for (const request of this.requests) {
+      request.abort();
+    }
+    await this.refreshing?.catch(() => void 0);
+    await this.pendingSave;
+  }
+};
+
 // src/web/resource-cards.ts
 var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 var string = (value) => typeof value === "string" && value.trim() ? value.trim() : void 0;
@@ -1249,8 +1893,8 @@ function conversationResourceCards(items, projectId, conversationId) {
 }
 
 // src/web/workflow-actions.ts
-import { readFile, realpath } from "fs/promises";
-import path from "path";
+import { readFile as readFile4, realpath as realpath3 } from "fs/promises";
+import path4 from "path";
 function createWorkflowActions(controller, runtime, project, revision, changed) {
   const states = /* @__PURE__ */ new Map();
   const epochs = /* @__PURE__ */ new Map();
@@ -1439,11 +2083,11 @@ function createWorkflowActions(controller, runtime, project, revision, changed)
           if (card.kind === "kv" || card.kind === "knowledge") {
             replies.push({ type: "preview", title: card.title, content: await runtime.readResource(project, run.scopeId, card.kind, card.target) });
           } else if (card.kind === "file") {
-            const root = await realpath(project.folderPath), filename = await realpath(path.resolve(root, card.target.filePath)), relative = path.relative(root, filename);
-            if (relative.startsWith("..") || path.isAbsolute(relative)) {
+            const root = await realpath3(project.folderPath), filename = await realpath3(path4.resolve(root, card.target.filePath)), relative = path4.relative(root, filename);
+            if (relative.startsWith("..") || path4.isAbsolute(relative)) {
               throw new Error("File is outside this project.");
             }
-            replies.push({ type: "preview", title: card.title, content: await readFile(filename, "utf8") });
+            replies.push({ type: "preview", title: card.title, content: await readFile4(filename, "utf8") });
           } else {
             throw new Error("This resource requires an editor host.");
           }
@@ -1460,25 +2104,25 @@ function createWorkflowActions(controller, runtime, project, revision, changed)
 // src/web/runtime.ts
 import { spawn } from "child_process";
 import { existsSync, readFileSync } from "fs";
-import path2 from "path";
+import path5 from "path";
 import { fileURLToPath } from "url";
 function cliRoot() {
-  let directory = path2.dirname(fileURLToPath(import.meta.url));
+  let directory = path5.dirname(fileURLToPath(import.meta.url));
   for (let depth = 0; depth < 8; depth++) {
     try {
-      if (JSON.parse(readFileSync(path2.join(directory, "package.json"), "utf8")).name === "@workflow-code/cli") {
+      if (JSON.parse(readFileSync(path5.join(directory, "package.json"), "utf8")).name === "@workflow-code/cli") {
         return directory;
       }
     } catch {
     }
-    directory = path2.dirname(directory);
+    directory = path5.dirname(directory);
   }
   throw new Error("Cannot locate the CLI installation.");
 }
 function createWebRuntime(projectDir, storageDir, connection) {
   const root = cliRoot();
-  const builtWorker = path2.join(root, "dist/web/worker.mjs");
-  const worker = existsSync(builtWorker) ? builtWorker : path2.join(root, "src/web/worker.mjs");
+  const builtWorker = path5.join(root, "dist/web/worker.mjs");
+  const worker = existsSync(builtWorker) ? builtWorker : path5.join(root, "src/web/worker.mjs");
   const children = /* @__PURE__ */ new Set();
   const active = /* @__PURE__ */ new Map();
   let disposed = false;
@@ -1500,7 +2144,7 @@ function createWebRuntime(projectDir, storageDir, connection) {
       WORKFLOW_SERVER_TOKEN: "",
       WORKFLOW_LLM_SERVER_URL: auth?.serverUrl ?? "",
       WORKFLOW_LLM_SERVER_TOKEN: auth?.accessToken ?? "",
-      WORKFLOW_CLI_AUTH_DIR: path2.join(storageDir, "runtime-auth")
+      WORKFLOW_CLI_AUTH_DIR: path5.join(storageDir, "runtime-auth")
     };
     for (const key of [
       "TSX_TSCONFIG_PATH",
@@ -1589,6 +2233,7 @@ function createWebRuntime(projectDir, storageDir, connection) {
   });
   return {
     available: true,
+    kanbanBridge: (project, call) => invoke({ method: "kanban-bridge", project, call }),
     inspect: (paths) => invoke({ method: "inspect", paths }),
     resolveParams: (project, request, entrypointId) => invoke({ method: "resolve", project, request, entrypointId }),
     run: (request, onEvent) => invoke({ method: "run", ...request }, onEvent),
@@ -1707,8 +2352,8 @@ async function inspectWebProject(runtime, projectDir, host) {
 
 // src/web/server.ts
 async function startWebServer(options) {
-  const projectDir = await realpath2(path3.resolve(options.projectDir));
-  const storageDir = path3.resolve(options.dataDir ?? path3.join(os.homedir(), ".workflow-code", "web"));
+  const projectDir = await realpath4(path6.resolve(options.projectDir));
+  const storageDir = path6.resolve(options.dataDir ?? path6.join(os.homedir(), ".workflow-code", "web"));
   const clients = /* @__PURE__ */ new Set();
   let connection;
   let account = { status: "signed-out", serverUrl: "http://localhost:7126", revision: 0 };
@@ -1738,26 +2383,29 @@ async function startWebServer(options) {
   if (!options.runtime) {
     assertLocalCliCoreCompatible(projectDir, descriptor.runtime.coreVersion);
   }
-  if (!["conversation", "workflow"].includes(descriptor.projectType)) {
+  if (!["conversation", "workflow", "kanban"].includes(descriptor.projectType)) {
     runtime.dispose();
-    throw new Error("workflow-code web currently supports Conversation and Workflow projects.");
+    throw new Error("Unsupported Workflow project type.");
   }
   const project = descriptor;
-  const key = createHash("sha256").update(project.assistant ? `assistant:${project.id}:${project.assistant.workdir}` : projectDir).digest("hex").slice(0, 24);
-  const historyPath = path3.join(storageDir, key, "conversations.json");
+  const key = createHash3("sha256").update(project.assistant ? `assistant:${project.id}:${project.assistant.workdir}` : projectDir).digest("hex").slice(0, 24);
+  const historyPath = path6.join(storageDir, key, "conversations.json");
   let saved = {};
-  try {
-    saved = JSON.parse(await readFile2(historyPath, "utf8"));
-  } catch (error) {
-    if (error.code !== "ENOENT") {
-      runtime.dispose();
-      throw new Error(`Cannot read conversation history: ${String(error)}`);
+  if (project.projectType !== "kanban") {
+    try {
+      saved = JSON.parse(await readFile5(historyPath, "utf8"));
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        runtime.dispose();
+        throw new Error(`Cannot read conversation history: ${String(error)}`);
+      }
     }
   }
   let pendingSave = Promise.resolve();
   let broadcastTimer;
   let authRevision = 0;
   const isWorkflow = project.projectType === "workflow";
+  const isKanban = project.projectType === "kanban";
   const parameterStates = /* @__PURE__ */ new Map();
   const parameterEpochs = /* @__PURE__ */ new Map();
   const publicFile = (file) => ({ ...file, previewUrl: `/api/file/${encodeURIComponent(file.id)}` });
@@ -1777,7 +2425,7 @@ async function startWebServer(options) {
   const state = () => publicValue(redactWorkflowData({
     type: "state",
     project,
-    ...isWorkflow ? workflowActions.state() : { sessions: controller.sessions, activeId: controller.activeId, running: controller.running, parameterValues: controller.current.parameterValues ?? {} },
+    ...isKanban ? { kanban: kanbanController.state() } : isWorkflow ? workflowActions.state() : { sessions: controller.sessions, activeId: controller.activeId, running: controller.running, parameterValues: controller.current.parameterValues ?? {} },
     account,
     authenticationRevision: authRevision
   }, [...sensitiveTokens]));
@@ -1795,27 +2443,27 @@ async function startWebServer(options) {
       }
     }, 30);
   };
-  const conversationController = isWorkflow ? void 0 : new ConversationController(project, runtime, saved, {
+  const conversationController = isWorkflow || isKanban ? void 0 : new ConversationController(project, runtime, saved, {
     changed: broadcast,
     log: (message) => process.stderr.write(`${message}
 `),
     save: (sessions, activeId) => {
       const content = JSON.stringify({ sessions, activeId });
       pendingSave = pendingSave.catch(() => void 0).then(async () => {
-        await mkdir(path3.dirname(historyPath), { recursive: true });
+        await mkdir2(path6.dirname(historyPath), { recursive: true });
         const temp = `${historyPath}.${process.pid}.tmp`;
-        await writeFile(temp, content, { mode: 384 });
-        await rename(temp, historyPath);
+        await writeFile2(temp, content, { mode: 384 });
+        await rename2(temp, historyPath);
       });
       return pendingSave;
     }
   });
   const controller = conversationController;
-  const runsPath = path3.join(storageDir, key, "runs.json");
+  const runsPath = path6.join(storageDir, key, "runs.json");
   let workspace;
   if (isWorkflow) {
     try {
-      workspace = JSON.parse(await readFile2(runsPath, "utf8"));
+      workspace = JSON.parse(await readFile5(runsPath, "utf8"));
       if (workspace?.version !== 1 || !Array.isArray(workspace.runs) || !workspace.drafts || typeof workspace.drafts !== "object") {
         throw new Error("Invalid Workflow history.");
       }
@@ -1835,15 +2483,32 @@ async function startWebServer(options) {
     save: (workspace2) => {
       const content = JSON.stringify(workspace2);
       pendingSave = pendingSave.catch(() => void 0).then(async () => {
-        await mkdir(path3.dirname(runsPath), { recursive: true });
+        await mkdir2(path6.dirname(runsPath), { recursive: true });
         const temp = `${runsPath}.${process.pid}.tmp`;
-        await writeFile(temp, content, { mode: 384 });
-        await rename(temp, runsPath);
+        await writeFile2(temp, content, { mode: 384 });
+        await rename2(temp, runsPath);
       });
       return pendingSave;
     }
   }) : void 0;
   const workflowActions = workflowController ? createWorkflowActions(workflowController, runtime, project, () => authRevision, broadcast) : void 0;
+  const kanbanController = isKanban ? new KanbanController(project, runtime, storageDir, { changed: broadcast, emit: (message) => {
+    for (const client of clients) {
+      client.write(`data: ${JSON.stringify(message)}
+
+`);
+    }
+  }, connection: () => connection, log: (message) => process.stderr.write(`${message}
+`) }) : void 0;
+  if (kanbanController) {
+    try {
+      await kanbanController.initialize();
+    } catch (error) {
+      await kanbanController.close();
+      runtime.dispose();
+      throw error;
+    }
+  }
   if (workflowController) {
     await workflowController.persist();
   }
@@ -1886,6 +2551,7 @@ ${token}`;
       authRevision++;
       parameterStates.clear();
       workflowActions?.invalidate();
+      kanbanController?.authenticationChanged();
       if (authenticationInitialized) {
         await stopForAuthentication();
       }
@@ -1911,6 +2577,7 @@ ${token}`;
           workflowActions?.invalidate();
         }
         connection = candidate;
+        kanbanController?.authenticationChanged();
         const savedConnection = !hostManaged && candidate.serverUrl === config.serverUrl.replace(/\/+$/, "") && candidate.accessToken === config.apiKey;
         account = { ...account, status: "authenticated", user: profile, expiresAt: result.data.principal?.expiresAt ?? (savedConnection ? config.expiresAt : void 0) };
       } catch (error) {
@@ -1918,6 +2585,7 @@ ${token}`;
           return;
         }
         connection = void 0;
+        kanbanController?.authenticationChanged();
         if (!changed) {
           authRevision++;
           parameterStates.clear();
@@ -1935,8 +2603,8 @@ ${token}`;
   const authPoll = setInterval(() => void refreshAuth().catch((error) => process.stderr.write(`${String(error)}
 `)), 5e3);
   authPoll.unref();
-  const capability = randomBytes(32).toString("hex");
-  const cookie = `workflow_web_${randomBytes(8).toString("hex")}`;
+  const capability = randomBytes2(32).toString("hex");
+  const cookie = `workflow_web_${randomBytes2(8).toString("hex")}`;
   let origin = "";
   const json = (response, status, value) => {
     response.writeHead(status, { "Content-Type": "application/json; charset=utf-8", "Cache-Control": "no-store" });
@@ -1984,6 +2652,9 @@ ${token}`;
     if (message.projectUri && message.projectUri !== project.uri) {
       throw new Error("Project changed.");
     }
+    if (kanbanController && !["ready", "login", "verify", "logout", "usage"].includes(message.type)) {
+      return kanbanController.handle(message);
+    }
     if (workflowActions && !["ready", "login", "verify", "logout", "usage"].includes(message.type)) {
       return publicValue(await workflowActions.handle(message));
     }
@@ -2152,13 +2823,13 @@ ${token}`;
         if (card.kind === "kv" || card.kind === "knowledge") {
           replies.push({ type: "preview", title: card.title, content: await runtime.readResource(project, current.id, card.kind, card.target) });
         } else if (card.kind === "file") {
-          const root = await realpath2(project.assistant?.workdir ?? projectDir);
-          const filename = await realpath2(path3.resolve(root, card.target.filePath));
-          const relative = path3.relative(root, filename);
-          if (relative === ".." || relative.startsWith(`..${path3.sep}`) || path3.isAbsolute(relative)) {
+          const root = await realpath4(project.assistant?.workdir ?? projectDir);
+          const filename = await realpath4(path6.resolve(root, card.target.filePath));
+          const relative = path6.relative(root, filename);
+          if (relative === ".." || relative.startsWith(`..${path6.sep}`) || path6.isAbsolute(relative)) {
             throw new Error("File is outside this project.");
           }
-          replies.push({ type: "preview", title: card.title, content: await readFile2(filename, "utf8") });
+          replies.push({ type: "preview", title: card.title, content: await readFile5(filename, "utf8") });
         } else {
           throw new Error("This resource requires an editor host.");
         }
@@ -2215,7 +2886,7 @@ ${token}`;
           await refreshAuth(true);
           break;
         }
-        login = spawn2(process.execPath, [path3.join(cliRoot(), "dist/index.js"), "workspace", "login", "--server", url.toString().replace(/\/$/, "")], { shell: false, stdio: ["ignore", "ignore", "pipe"] });
+        login = spawn2(process.execPath, [path6.join(cliRoot(), "dist/index.js"), "workspace", "login", "--server", url.toString().replace(/\/$/, "")], { shell: false, stdio: ["ignore", "ignore", "pipe"] });
         login.stderr?.on("data", (chunk) => process.stderr.write(chunk));
         login.once("error", (error) => {
           login = void 0;
@@ -2253,11 +2924,22 @@ ${token}`;
       response.setHeader("Referrer-Policy", "no-referrer");
       const host = new URL(`http://${request.headers.host ?? ""}`);
       const forwarded = !!options.host && ["127.0.0.1", "localhost", "[::1]"].includes(host.hostname) && !host.username && !host.password && host.pathname === "/" && !host.search && !host.hash;
-      if (request.headers.host !== new URL(origin).host && !forwarded || request.headers.origin && request.headers.origin !== (forwarded ? host.origin : origin)) {
+      const url = new URL(request.url ?? "/", origin);
+      const sandboxAsset = !!kanbanController && url.pathname.startsWith("/kanban/") && ["GET", "HEAD"].includes(request.method ?? "") && request.headers.origin === "null";
+      if (request.headers.host !== new URL(origin).host && !forwarded || request.headers.origin && request.headers.origin !== (forwarded ? host.origin : origin) && !sandboxAsset) {
         json(response, 403, { message: "Invalid request origin." });
         return;
       }
-      const url = new URL(request.url ?? "/", origin);
+      if (kanbanController && url.pathname.startsWith("/kanban/") && ["GET", "HEAD"].includes(request.method ?? "")) {
+        const asset = await kanbanController.preview.asset(url);
+        if (!asset) {
+          json(response, 404, { message: "Kanban asset not found." });
+          return;
+        }
+        response.writeHead(200, asset.headers);
+        response.end(request.method === "HEAD" ? void 0 : asset.content);
+        return;
+      }
       if (url.pathname === "/api/session" && request.method === "POST") {
         if (!authMatches(String(request.headers.authorization ?? "").replace(/^Bearer /, ""))) {
           json(response, 401, { message: "Invalid session." });
@@ -2284,6 +2966,7 @@ ${token}`;
           return;
         }
         if (url.pathname === "/api/events" && request.method === "GET") {
+          const disconnectKanban = kanbanController?.methods.connect(url.searchParams.get("clientId") ?? "");
           response.writeHead(200, { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", Connection: "keep-alive" });
           response.write(`data: ${JSON.stringify(state())}
 
@@ -2293,6 +2976,7 @@ ${token}`;
           response.once("close", () => {
             clearInterval(heartbeat);
             clients.delete(response);
+            disconnectKanban?.();
           });
           return;
         }
@@ -2302,8 +2986,9 @@ ${token}`;
           const operation = () => handleMessage(message).then((value2) => {
             messages = value2;
           });
-          const task = message.type === "resolve" || message.type === "ready" ? operation() : mutations.catch(() => void 0).then(operation);
-          if (message.type !== "resolve" && message.type !== "ready") {
+          const concurrent = ["resolve", "ready", "kanban-bridge", "kanban-method-state", "kanban-method-reply", "kanban-methods"].includes(message.type);
+          const task = concurrent ? operation() : mutations.catch(() => void 0).then(operation);
+          if (!concurrent) {
             mutations = task;
           }
           await task;
@@ -2312,7 +2997,7 @@ ${token}`;
         }
         if (url.pathname.startsWith("/api/file/") && request.method === "GET") {
           const file = await runtime.readFile(project, decodeURIComponent(url.pathname.slice("/api/file/".length)));
-          const bytes = await readFile2(file.path);
+          const bytes = await readFile5(file.path);
           const safeType = /^(?:image\/(?:png|jpeg|gif|webp|avif)|audio\/[a-z0-9.+-]+|video\/[a-z0-9.+-]+)$/.test(file.reference.mimeType);
           response.writeHead(200, { "Content-Type": safeType ? file.reference.mimeType : "application/octet-stream", "Content-Disposition": `${safeType ? "inline" : "attachment"}; filename*=UTF-8''${encodeURIComponent(file.reference.name)}`, "Cache-Control": "no-store" });
           response.end(bytes);
@@ -2332,19 +3017,21 @@ ${token}`;
       }
       if (url.pathname === "/") {
         const ancestors = options.host ? "'self' vscode-webview: vscode-file: https://*.vscode-cdn.net https://*.vscode-webview.net http://127.0.0.1:* http://localhost:*" : "'self' vscode-webview:";
-        response.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", "Content-Security-Policy": `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: http:; font-src 'self'; connect-src 'self'; media-src 'self' blob:; object-src 'none'; base-uri 'none'; frame-ancestors ${ancestors}; form-action 'self'` });
-        const ui = isWorkflow ? "workflow-workspace" : "workflow-ui";
+        response.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", "Content-Security-Policy": `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: http:; font-src 'self'; connect-src 'self'; media-src 'self' blob:; frame-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors ${ancestors}; form-action 'self'` });
+        const ui = isKanban ? "kanban-workspace" : isWorkflow ? "workflow-workspace" : "workflow-ui";
         response.end(`<!doctype html><html lang="zh-CN" data-theme="${options.theme ?? "auto"}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="workflow-project" content="${key}"><title>Workflow</title><link rel="stylesheet" href="/assets/codicons/codicon.css"><link rel="stylesheet" href="/assets/${ui}.css"><link rel="stylesheet" href="/assets/theme.css"></head><body data-surface="${options.host?.surface ?? "editor"}"><div id="app"></div><script src="/assets/${ui}.js" defer></script></body></html>`);
         return;
       }
       const assets = { "/assets/workflow-ui.js": "application/javascript", "/assets/workflow-ui.css": "text/css", "/assets/theme.css": "text/css", "/assets/codicons/codicon.css": "text/css", "/assets/codicons/codicon.ttf": "font/ttf" };
       assets["/assets/workflow-workspace.js"] = "application/javascript";
       assets["/assets/workflow-workspace.css"] = "text/css";
+      assets["/assets/kanban-workspace.js"] = "application/javascript";
+      assets["/assets/kanban-workspace.css"] = "text/css";
       if (!assets[url.pathname]) {
         json(response, 404, { message: "Not found." });
         return;
       }
-      const content = await readFile2(path3.join(cliRoot(), "dist/web", url.pathname.slice("/assets/".length)));
+      const content = await readFile5(path6.join(cliRoot(), "dist/web", url.pathname.slice("/assets/".length)));
       response.writeHead(200, { "Content-Type": assets[url.pathname], "Cache-Control": "no-cache" });
       response.end(content);
     })().catch((error) => {
@@ -2367,6 +3054,7 @@ ${token}`;
     clearInterval(authPoll);
     conversationController?.dispose();
     workflowController?.dispose();
+    await kanbanController?.close();
     runtime.dispose();
     throw error;
   }
@@ -2378,6 +3066,7 @@ ${token}`;
     project,
     controller,
     workflowController,
+    kanbanController,
     setHostConnection: async (value) => {
       authEpoch++;
       authCheck?.abort();
@@ -2397,6 +3086,7 @@ ${token}`;
       conversationController?.dispose();
       workflowController?.dispose();
       runtime.dispose();
+      await kanbanController?.close();
       for (const client of clients) {
         client.end();
       }
@@ -2414,7 +3104,7 @@ ${token}`;
 import { createInterface } from "readline";
 
 // src/web/host-config.ts
-import path4 from "path";
+import path7 from "path";
 function parseHostConnection(value) {
   if (value === null || value === void 0) {
     return;
@@ -2438,11 +3128,11 @@ function parseHostConfiguration(value) {
     throw new Error("Invalid web host configuration.");
   }
   const assistant = configuration.assistant;
-  if (assistant && (typeof assistant.workdir !== "string" || !path4.isAbsolute(assistant.workdir) || !Array.isArray(assistant.roots) || !assistant.roots.length || assistant.roots.length > 100 || assistant.standalone !== void 0 && typeof assistant.standalone !== "boolean" || assistant.roots.some((root) => typeof root.uri !== "string" || typeof root.name !== "string" || typeof root.folderPath !== "string" || !path4.isAbsolute(root.folderPath)) || !assistant.roots.some((root) => root.folderPath === assistant.workdir))) {
+  if (assistant && (typeof assistant.workdir !== "string" || !path7.isAbsolute(assistant.workdir) || !Array.isArray(assistant.roots) || !assistant.roots.length || assistant.roots.length > 100 || assistant.standalone !== void 0 && typeof assistant.standalone !== "boolean" || assistant.roots.some((root) => typeof root.uri !== "string" || typeof root.name !== "string" || typeof root.folderPath !== "string" || !path7.isAbsolute(root.folderPath)) || !assistant.roots.some((root) => root.folderPath === assistant.workdir))) {
     throw new Error("Invalid assistant workspace.");
   }
   const assistantProjectDir = configuration.assistantProjectDir;
-  if (configuration.surface === "assistant" && (!assistant || typeof assistantProjectDir !== "string" || !path4.isAbsolute(assistantProjectDir))) {
+  if (configuration.surface === "assistant" && (!assistant || typeof assistantProjectDir !== "string" || !path7.isAbsolute(assistantProjectDir))) {
     throw new Error("A dedicated assistant project and its workspace are required.");
   }
   if (configuration.surface !== "assistant" && (assistant || assistantProjectDir !== void 0)) {
@@ -2483,12 +3173,12 @@ function parseWebArgs(argv) {
         }
         options.theme = value;
       } else {
-        options.dataDir = path5.resolve(value);
+        options.dataDir = path8.resolve(value);
       }
     } else if (arg.startsWith("-") || projectSet) {
       throw new Error(`Unknown web argument: ${arg}`);
     } else {
-      options.projectDir = path5.resolve(arg);
+      options.projectDir = path8.resolve(arg);
       projectSet = true;
     }
   }