claude-code-kanban 4.19.0 → 4.21.0

package/server.js

@@ -33,6 +33,7 @@ const {
   buildLoopInfoFromState
 } = require('./lib/parsers');
 const { inlineHtmlAssets } = require('./lib/inline-assets');
+const { buildDecision, decisionFileName, isDecisionFile, waitSecondsFrom, isLapsed } = require('./lib/approvals');
 
 if (process.argv.includes("--install") || process.argv.includes("--uninstall")) {
   const { runInstall, runUninstall } = require("./install");
@@ -94,6 +95,7 @@ const CCK_DIR = path.join(CLAUDE_DIR, '.cck');
 const AGENT_ACTIVITY_DIR = path.join(CCK_DIR, 'agent-activity');
 const CONTEXT_STATUS_DIR = path.join(CCK_DIR, 'context-status');
 const PINS_FILE = path.join(CCK_DIR, 'pins.json');
+const SERVER_INFO_FILE = path.join(CCK_DIR, 'server.json');
 // Harness-owned scratchpad root; the per-session dir under it is created lazily.
 const SCRATCHPAD_ROOT = path.join(os.tmpdir(), 'claude');
 
@@ -106,17 +108,27 @@ function readPins() {
   return {};
 }
 
-function writePins(pins) {
+function writeJsonAtomic(file, obj) {
   try {
     mkdirSync(CCK_DIR, { recursive: true });
-    const tmp = `${PINS_FILE}.${process.pid}.${Date.now()}.tmp`;
-    writeFileSync(tmp, JSON.stringify(pins, null, 2), 'utf8');
-    renameSync(tmp, PINS_FILE);
+    const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+    writeFileSync(tmp, JSON.stringify(obj, null, 2), 'utf8');
+    renameSync(tmp, file);
   } catch (e) {
-    console.error('Failed to write pins.json:', e.message);
+    console.error(`Failed to write ${path.basename(file)}:`, e.message);
   }
 }
 
+function writePins(pins) {
+  writeJsonAtomic(PINS_FILE, pins);
+}
+
+// Port discovery for out-of-process helpers (the postman monitor). The pid rides along
+// so a reader can tell a live server from a file left behind by a crashed one.
+function writeServerInfo(port) {
+  writeJsonAtomic(SERVER_INFO_FILE, { port, pid: process.pid });
+}
+
 // #region TIMINGS
 const PERMISSION_TTL_MS = 30 * 60 * 1000;
 const AGENT_TTL_MS = 60 * 60 * 1000;
@@ -157,6 +169,25 @@ function persistAgent(dir, agent) {
   fs.appendFile(file, JSON.stringify({ ...agent, event: 'server-update' }) + '\n', 'utf8').catch(() => {});
 }
 
+// Lapse math lives in lib/approvals (kept in sync with the gate's own parse);
+// this only reads the config, cached so the polled session list doesn't re-read
+// it per hit (marker stays visible for the badge until TTL).
+const APPROVALS_CONFIG_FILE = path.join(CCK_DIR, 'approvals.json');
+let approvalsWaitCache = { ts: 0, ms: 30 * 1000 };
+function approvalsWaitMs() {
+  if (Date.now() - approvalsWaitCache.ts < 10 * 1000) return approvalsWaitCache.ms;
+  let cfg = null;
+  try {
+    cfg = JSON.parse(readFileSync(APPROVALS_CONFIG_FILE, 'utf8'));
+  } catch (e) { /* missing config — gate default */ }
+  approvalsWaitCache = { ts: Date.now(), ms: waitSecondsFrom(cfg) * 1000 };
+  return approvalsWaitCache.ms;
+}
+
+function isWaitingLapsed(data) {
+  return isLapsed(data.timestamp, approvalsWaitMs());
+}
+
 function checkWaitingForUser(agentDir, logMtime) {
   try {
     const data = JSON.parse(readFileSync(path.join(agentDir, '_waiting.json'), 'utf8'));
@@ -166,6 +197,7 @@ function checkWaitingForUser(agentDir, logMtime) {
       if (age >= PERMISSION_TTL_MS) return null;
       // After grace period, check if session resumed activity (user already responded)
       if (logMtime && age >= WAITING_RESOLVE_GRACE_MS && logMtime > waitTime + WAITING_RESOLVE_GRACE_MS) return null;
+      if (isWaitingLapsed(data)) return { ...data, lapsed: true };
       return data;
     }
   } catch (e) { /* skip — missing or invalid */ }
@@ -562,6 +594,13 @@ function getCustomTaskDir(sessionId) {
   return null;
 }
 
+// Where a session's task files live. The custom-list and team lookups can both miss, and
+// the fallback is the plain per-session dir -- every route that touches a task file needs
+// that same resolution, so it lives in one place.
+function taskDirFor(sessionId) {
+  return getCustomTaskDir(sessionId) || path.join(TASKS_DIR, sessionId);
+}
+
 function getTaskCounts(sessionPath) {
   const cached = taskCountsCache.get(sessionPath);
   if (cached) return cached;
@@ -1409,8 +1448,7 @@ app.get('/api/projects', (req, res) => {
 // API: Get tasks for a session
 app.get('/api/sessions/:sessionId', async (req, res) => {
   try {
-    const customDir = getCustomTaskDir(req.params.sessionId);
-    const sessionPath = customDir || path.join(TASKS_DIR, req.params.sessionId);
+    const sessionPath = taskDirFor(req.params.sessionId);
 
     if (!existsSync(sessionPath)) {
       return res.status(404).json({ error: 'Session not found' });
@@ -2032,6 +2070,31 @@ app.post('/api/sessions/:sessionId/waiting/discard', (req, res) => {
   }
 });
 
+// UI-driven approvals: answers the ask approval-gate.sh is blocking on by
+// writing _decision-<id>.json next to the marker. The hook consumes and deletes
+// both files; a write for a hook that already gave up is accepted anyway (D13)
+// and left for cleanupAgentActivity's sweep.
+app.post('/api/sessions/:sessionId/waiting/respond', (req, res) => {
+  const sessionId = resolveSessionId(req.params.sessionId);
+  const dir = path.join(AGENT_ACTIVITY_DIR, sessionId);
+  let marker = null;
+  try { marker = JSON.parse(readFileSync(path.join(dir, '_waiting.json'), 'utf8')); }
+  catch (e) { /* missing or invalid → buildDecision reports 410 */ }
+  // The gate stopped polling after waitSeconds — an orphaned decision file would
+  // sit unconsumed while the card pretends the click worked.
+  if (marker && isWaitingLapsed(marker)) {
+    return res.status(410).json({ error: 'Ask lapsed — answer it in the terminal' });
+  }
+  const result = buildDecision(marker, req.body || {});
+  if (result.error) return res.status(result.status).json({ error: result.error });
+  try {
+    writeJsonAtomic(path.join(dir, decisionFileName(marker.id)), result.decision);
+    res.json({ ok: true });
+  } catch (e) {
+    res.status(500).json({ error: 'Failed to write decision' });
+  }
+});
+
 app.post('/api/sessions/:sessionId/agents/:agentId/stop', (req, res) => {
   const sessionId = resolveSessionId(req.params.sessionId);
   const agentId = sanitizeAgentId(req.params.agentId);
@@ -2636,13 +2699,54 @@ app.get('/api/tasks/all', async (req, res) => {
   }
 });
 
+const { enqueueSessionEvent, formatTaskMoved, handleSessionEvents } = require('./lib/session-events');
+app.get('/api/sessions/:sessionId/events', handleSessionEvents);
+
+// API: Create a task
+app.post('/api/tasks/:sessionId', async (req, res) => {
+  try {
+    const { sessionId } = req.params;
+    const subject = (req.body.subject || '').trim();
+    if (!subject) return res.status(400).json({ error: 'Subject is required' });
+
+    const sessionDir = taskDirFor(sessionId);
+    if (!existsSync(sessionDir)) mkdirSync(sessionDir, { recursive: true });
+
+    // Ids are the agent's own numbering scheme, so a hand-made task has to keep counting
+    // from the highest one on disk -- reusing a number would overwrite that task's file.
+    const ids = readdirSync(sessionDir)
+      .filter((f) => f.endsWith('.json'))
+      .map((f) => parseInt(path.basename(f, '.json'), 10))
+      .filter((n) => Number.isInteger(n));
+    const id = String(Math.max(0, ...ids) + 1);
+
+    const task = {
+      id,
+      subject,
+      description: (req.body.description || '').trim(),
+      activeForm: subject,
+      status: 'pending',
+      blocks: [],
+      blockedBy: [],
+    };
+
+    // No doorbell here, unlike a move: the user typed this task, so telling their session
+    // about it would only repeat what they just said. Dragging it to In Progress rings.
+    await fs.writeFile(path.join(sessionDir, `${id}.json`), JSON.stringify(task, null, 2));
+    res.json({ success: true, task });
+  } catch (error) {
+    console.error('Error creating task:', error);
+    res.status(500).json({ error: 'Failed to create task' });
+  }
+});
+
 // API: Update task fields (subject, description)
 app.put('/api/tasks/:sessionId/:taskId', async (req, res) => {
   try {
     const { sessionId, taskId } = req.params;
     const { subject, description } = req.body;
 
-    const sessionDir = getCustomTaskDir(sessionId) || path.join(TASKS_DIR, sessionId);
+    const sessionDir = taskDirFor(sessionId);
     const taskPath = path.join(sessionDir, `${taskId}.json`);
 
     if (!existsSync(taskPath)) {
@@ -2650,6 +2754,7 @@ app.put('/api/tasks/:sessionId/:taskId', async (req, res) => {
     }
 
     const task = JSON.parse(await fs.readFile(taskPath, 'utf8'));
+    const prevStatus = task.status;
 
     if (subject !== undefined) task.subject = subject;
     if (description !== undefined) task.description = description;
@@ -2657,6 +2762,17 @@ app.put('/api/tasks/:sessionId/:taskId', async (req, res) => {
 
     await fs.writeFile(taskPath, JSON.stringify(task, null, 2));
 
+    // Ring the session only for a move. The direction has to ride in the line because
+    // the write above destroyed the old status -- nothing downstream can recover it, and
+    // which way a task moved is what decides whether to start work or stop it.
+    if (task.status !== prevStatus) {
+      // The route param is a task *directory*, which for a shared list or team board is
+      // not a session id -- and the postman polls with its own session id, so an unresolved
+      // name would queue the line where nobody drains it.
+      const line = formatTaskMoved(taskId, prevStatus, task);
+      for (const sid of resolveSessionsForTaskDir(sessionId)) enqueueSessionEvent(sid, line);
+    }
+
     res.json({ success: true, task });
   } catch (error) {
     console.error('Error updating task:', error);
@@ -2668,7 +2784,7 @@ app.put('/api/tasks/:sessionId/:taskId', async (req, res) => {
 app.delete('/api/tasks/:sessionId/:taskId', async (req, res) => {
   try {
     const { sessionId, taskId } = req.params;
-    const sessionPath = getCustomTaskDir(sessionId) || path.join(TASKS_DIR, sessionId);
+    const sessionPath = taskDirFor(sessionId);
     const taskPath = path.join(sessionPath, `${taskId}.json`);
 
     if (!existsSync(taskPath)) {
@@ -2964,27 +3080,27 @@ watcher.on('all', (event, filePath) => {
 
     taskCountsCache.delete(path.join(TASKS_DIR, dirName));
 
-    if (isUUID(dirName)) {
-      broadcast({ type: 'update', event, sessionId: dirName, file: path.basename(filePath) });
-    } else {
-      broadcastToMappedSessions(dirName, event, filePath);
-    }
+    broadcastToMappedSessions(dirName, event, filePath);
   }
 });
 
-function broadcastToMappedSessions(taskListName, event, filePath) {
+// Which sessions own a task directory. Usually the dir name IS the session id, but a
+// shared list or a team dir is one directory several sessions map onto -- so anything
+// addressing a session from a task path has to fan out the same way. One resolver for
+// both readers of that mapping: the SSE broadcast and the doorbell.
+function resolveSessionsForTaskDir(name) {
+  if (isUUID(name)) return [name];
   const { listToSessions } = loadAllTaskMaps();
-  const map = listToSessions[taskListName];
-  if (map) {
-    for (const sid of Object.keys(map)) {
-      broadcast({ type: 'update', event, sessionId: sid, file: path.basename(filePath) });
-    }
-    return;
-  }
-  // Fallback: check if taskListName is a team name
-  const cfg = loadTeamConfig(taskListName);
-  if (cfg?.leadSessionId) {
-    broadcast({ type: 'update', event, sessionId: cfg.leadSessionId, file: path.basename(filePath) });
+  const map = listToSessions[name];
+  if (map) return Object.keys(map);
+  // Fallback: check if name is a team name
+  const cfg = loadTeamConfig(name);
+  return cfg?.leadSessionId ? [cfg.leadSessionId] : [];
+}
+
+function broadcastToMappedSessions(taskListName, event, filePath) {
+  for (const sid of resolveSessionsForTaskDir(taskListName)) {
+    broadcast({ type: 'update', event, sessionId: sid, file: path.basename(filePath) });
   }
 }
 
@@ -3176,6 +3292,18 @@ async function cleanupAgentActivity() {
         const age = now - stat.mtimeMs;
         if ((contents.length === 0 && age > AGENT_STALE_MS) || age > CLEANUP_MAX_AGE_MS) {
           await fs.rm(dirPath, { recursive: true, force: true });
+          continue;
+        }
+        // Orphaned decision files: a terminal deny fires no hook event (D13), so a
+        // board answer for an already-gone gate is never consumed. The gate waits at
+        // most PERMISSION_TTL_MS, so anything older is unclaimable.
+        for (const f of contents) {
+          if (!isDecisionFile(f)) continue;
+          const fp = path.join(dirPath, f);
+          try {
+            const fst = await fs.stat(fp);
+            if (now - fst.mtimeMs > PERMISSION_TTL_MS) await fs.rm(fp, { force: true });
+          } catch (e) { /* ignore per-file errors */ }
         }
       } catch (e) { /* ignore per-folder errors */ }
     }
@@ -3213,6 +3341,9 @@ async function prewarmCaches() {
 
   const onReady = (actualPort) => {
     console.log(`Claude Task Kanban running at http://localhost:${actualPort}`);
+    // The port is configurable and falls back to a random one when taken, so the postman
+    // monitor cannot assume it -- publish the live one where it can read it.
+    writeServerInfo(actualPort);
     const warning = net.exposureWarning();
     if (warning) console.log(warning);