claude-code-kanban 4.28.0 → 4.30.0

package/install.js

@@ -1,10 +1,9 @@
 #!/usr/bin/env node
 
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-const readline = require('readline');
-const { execSync } = require('child_process');
+const fs = require('node:fs');
+const path = require('node:path');
+const readline = require('node:readline');
+const { execSync } = require('node:child_process');
 const { getClaudeDir, claudeCliEnv, displayPath } = require('./lib/claude-dir');
 
 const CLAUDE_DIR = getClaudeDir();
@@ -205,7 +204,7 @@ async function runInstall({ pluginOnly = false } = {}) {
       console.log(`\n  StatusLine: ${dim('not configured')}`);
       if (await prompt(`    Set up context tracking statusline? [Y/n] `)) {
         settings.statusLine = { type: 'command', command: CTX_COMMAND };
-        fs.writeFileSync(SETTINGS_PATH, JSON.stringify(settings, null, 2) + '\n');
+        fs.writeFileSync(SETTINGS_PATH, `${JSON.stringify(settings, null, 2)}\n`);
         console.log(`    ${green('✓')} StatusLine configured`);
       } else {
         console.log(`    ${dim('Skipped')}`);
@@ -216,7 +215,7 @@ async function runInstall({ pluginOnly = false } = {}) {
       if (await prompt(`    Prepend context spy to existing statusline? [Y/n] `)) {
         settings.statusLine.type = 'command';
         settings.statusLine.command = `${CTX_COMMAND} | ${existing}`;
-        fs.writeFileSync(SETTINGS_PATH, JSON.stringify(settings, null, 2) + '\n');
+        fs.writeFileSync(SETTINGS_PATH, `${JSON.stringify(settings, null, 2)}\n`);
         console.log(`    ${green('✓')} StatusLine updated`);
       } else {
         console.log(`    ${dim('Skipped')}`);
@@ -294,7 +293,7 @@ async function runUninstall() {
       }
 
       if (changed) {
-        fs.writeFileSync(SETTINGS_PATH, JSON.stringify(settings, null, 2) + '\n');
+        fs.writeFileSync(SETTINGS_PATH, `${JSON.stringify(settings, null, 2)}\n`);
       }
     } catch {
       console.log(`  Settings: ${red('✗')} Could not parse settings.json`);

package/lib/approvals.js

@@ -17,7 +17,7 @@ function buildDecision(marker, body) {
   if (!marker || marker.status !== 'waiting') {
     return { error: 'No pending ask', status: 410 };
   }
-  const id = sanitizeRequestId(body && body.id);
+  const id = sanitizeRequestId(body?.id);
   if (!id) return { error: 'Invalid or missing request id', status: 400 };
   if (marker.id !== id) return { error: 'Ask superseded by a newer one', status: 409 };
 
@@ -68,7 +68,7 @@ const WAIT_SECONDS_MAX = 1800;
 // Small grace over the gate's own deadline so a race never 410s a live hook
 const LAPSE_GRACE_MS = 5000;
 function waitSecondsFrom(cfg) {
-  const raw = cfg && cfg.waitSeconds;
+  const raw = cfg?.waitSeconds;
   if (Number.isInteger(raw) && raw >= 0) return Math.min(raw, WAIT_SECONDS_MAX);
   return WAIT_SECONDS_DEFAULT;
 }

package/lib/contain.js

@@ -11,8 +11,8 @@
 // CANONICAL COPY: scripts/security-lib/contain.js in the claude-code-hub repo.
 // Run scripts/sync-security-lib.sh after editing.
 
-const path = require('path');
-const fs = require('fs');
+const path = require('node:path');
+const fs = require('node:fs');
 
 const IS_WIN = process.platform === 'win32';
 

package/lib/dispatch-groups.js

@@ -1,5 +1,6 @@
 // Transient session groups: `dispatch start --group` (or the starter's own group) puts
-// the started session and its starter together. A group lives while any member's claude
+// the started session in a group. The starter is not moved: it is only remembered, so its
+// later dispatches default to the same group. A group lives while any member's claude
 // runs, and for a grace period after; once none runs, only pinned members stay in it.
 // The map is on disk so a pinned group outlives a server restart.
 
@@ -24,28 +25,39 @@ function suggestGroupName(s) {
 
 /**
  * @param {object} o
- * @param {() => object|null} o.load returns `{sessions: {[id]: group}}` or null
+ * @param {() => object|null} o.load returns `{sessions: {[id]: group}, starters?: {[id]: starterId}}` or null
  * @param {(data: object) => void} o.save
  * @param {(id: string) => boolean} o.isAlive
  * @param {() => Set<string>} o.pinnedIds
  */
 function createGroupStore({ load, save, isAlive, pinnedIds, now = Date.now }) {
   const members = new Map();
+  const starterOf = new Map();
   const liveAt = new Map();
-  const saved = load()?.sessions;
-  if (saved && typeof saved === 'object') {
-    for (const [id, g] of Object.entries(saved)) if (isGroupName(g)) members.set(id, g);
+  const saved = load();
+  if (saved?.sessions && typeof saved.sessions === 'object') {
+    for (const [id, g] of Object.entries(saved.sessions)) if (isGroupName(g)) members.set(id, g);
+  }
+  if (saved?.starters && typeof saved.starters === 'object') {
+    for (const [id, s] of Object.entries(saved.starters)) if (members.has(id) && typeof s === 'string') starterOf.set(id, s);
   }
   for (const g of members.values()) liveAt.set(g, now());
 
-  const persist = () => save({ version: 1, sessions: Object.fromEntries(members) });
+  const persist = () =>
+    save({ version: 1, sessions: Object.fromEntries(members), starters: Object.fromEntries(starterOf) });
 
-  function join(group, ids) {
+  function join(group, ids, starter) {
     let changed = false;
     for (const id of ids) {
-      if (!id || members.get(id) === group) continue;
-      members.set(id, group);
-      changed = true;
+      if (!id) continue;
+      if (members.get(id) !== group) {
+        members.set(id, group);
+        changed = true;
+      }
+      if (starter && starterOf.get(id) !== starter) {
+        starterOf.set(id, starter);
+        changed = true;
+      }
     }
     liveAt.set(group, now());
     if (changed) persist();
@@ -70,6 +82,7 @@ function createGroupStore({ load, save, isAlive, pinnedIds, now = Date.now }) {
       for (const id of ids) {
         if (pinned.has(id)) continue;
         members.delete(id);
+        starterOf.delete(id);
         changed = true;
       }
       if (!ids.some((id) => pinned.has(id))) liveAt.delete(g);
@@ -77,9 +90,13 @@ function createGroupStore({ load, save, isAlive, pinnedIds, now = Date.now }) {
     if (changed) persist();
   }
 
+  // A starter is not a member; it defaults to the group of a session it started.
   function groupOf(id) {
     refresh();
-    return members.get(id) || null;
+    if (members.has(id)) return members.get(id);
+    let group = null;
+    for (const [child, starter] of starterOf) if (starter === id) group = members.get(child);
+    return group;
   }
 
   function snapshot() {

package/lib/dispatch.js

@@ -112,6 +112,7 @@ function createDispatchRegistry({ onSettle, now = Date.now } = {}) {
     if (!tokenMatches(r.cap, cap)) return { status: 403, error: 'wrong capability' };
     if (r.status !== 'running') return { status: 409, error: `already ${r.status}` };
     if (!OUTCOMES.has(outcome)) return { status: 400, error: 'outcome must be succeeded or failed' };
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: strips control characters on purpose
     const text = typeof summary === 'string' ? summary.replace(/[\x00-\x1f\x7f]/g, ' ').trim().slice(0, MAX_SUMMARY) : '';
     finish(r, outcome, text || null);
     return null;

package/lib/file-url.js

@@ -6,7 +6,7 @@
 // spelling `file:\\\C:\dir\a.md`. Both are normalized to a plain OS path so the
 // user does not have to hand-edit what their clipboard produced.
 
-const { fileURLToPath } = require('url');
+const { fileURLToPath } = require('node:url');
 
 // Matches any number of leading slashes before a drive letter, so it re-spells both
 // the well-formed `file:///C:/dir` and `file://C:/dir`, where the parser reads C: as

package/lib/inline-assets.js

@@ -5,8 +5,8 @@
 //
 // Remote refs (https:, //cdn, data:) are left untouched: they already resolve.
 
-const path = require('path');
-const fs = require('fs').promises;
+const path = require('node:path');
+const fs = require('node:fs').promises;
 
 // Individually large assets are the ones that blow up as base64 (+33%), and the total
 // guards the modal: the whole document is handed to the client in one JSON response.

package/lib/linked-docs.js

@@ -0,0 +1,56 @@
+// Server copy of each session's linked docs. The browser keeps its own list in localStorage
+// and merges this one in when it connects, so a `link-doc` sent while no tab is open is not lost.
+// Newest first, capped like the browser list.
+
+const MAX_PER_SESSION = 20;
+
+// Same rule as `canonicalPath` in public/app.js: one Windows file is reached as `C:\a` and `c:/a`.
+function canonicalPath(p) {
+  const slashed = String(p).replace(/\\/g, '/');
+  return /^[A-Za-z]:/.test(slashed) ? slashed.toLowerCase() : slashed;
+}
+
+/**
+ * @param {object} o
+ * @param {() => object|null} o.load returns `{sessions: {[id]: string[]}}` or null
+ * @param {(data: object) => void} o.save
+ */
+function createLinkedDocStore({ load, save }) {
+  const bySession = new Map();
+  const saved = load()?.sessions;
+  if (saved && typeof saved === 'object') {
+    for (const [id, paths] of Object.entries(saved)) {
+      const clean = Array.isArray(paths) ? paths.filter((p) => typeof p === 'string' && p) : [];
+      if (clean.length) bySession.set(id, clean.slice(0, MAX_PER_SESSION));
+    }
+  }
+
+  const persist = () => save({ version: 1, sessions: Object.fromEntries(bySession) });
+
+  function link(sessionId, filePath) {
+    const key = canonicalPath(filePath);
+    const rest = (bySession.get(sessionId) || []).filter((p) => canonicalPath(p) !== key);
+    bySession.set(sessionId, [filePath, ...rest].slice(0, MAX_PER_SESSION));
+    persist();
+  }
+
+  // With no path, forgets every doc of the session. Returns whether anything was removed.
+  function unlink(sessionId, filePath) {
+    const paths = bySession.get(sessionId);
+    if (!paths) return false;
+    const key = filePath == null ? null : canonicalPath(filePath);
+    const rest = key === null ? [] : paths.filter((p) => canonicalPath(p) !== key);
+    if (rest.length === paths.length) return false;
+    if (rest.length) bySession.set(sessionId, rest);
+    else bySession.delete(sessionId);
+    persist();
+    return true;
+  }
+
+  const get = (sessionId) => [...(bySession.get(sessionId) || [])];
+  const all = () => Object.fromEntries([...bySession].map(([id, paths]) => [id, [...paths]]));
+
+  return { link, unlink, get, all };
+}
+
+module.exports = { createLinkedDocStore, canonicalPath, MAX_PER_SESSION };

package/lib/net-guard.js

@@ -245,7 +245,7 @@ function createNetGuard(config = {}) {
    * @param {{maxHeaderSize?: number, onUpgrade?: (req: any, socket: any, head: Buffer) => void}} [opts]
    */
   function listenLoopback(app, port, onReady, opts = {}) {
-    const http = require('http');
+    const http = require('node:http');
     const serverOpts = opts.maxHeaderSize ? { maxHeaderSize: opts.maxHeaderSize } : {};
     const makeServer = (handler) => {
       const s = http.createServer(serverOpts, handler);

package/lib/open-editor.js

@@ -21,9 +21,9 @@
 // npm packages and cannot import from each other. Run scripts/sync-security-lib.sh
 // after editing.
 
-const { spawn } = require('child_process');
-const path = require('path');
-const fs = require('fs');
+const { spawn } = require('node:child_process');
+const path = require('node:path');
+const fs = require('node:fs');
 
 const IS_WIN = process.platform === 'win32';
 
@@ -37,6 +37,7 @@ const VSCODE_FAMILY = new Set([
 // escape it. Inside "..." cmd treats & | < > ^ ( ) as literal, so only these
 // matter: '"' ends the quoted run, '%' triggers variable expansion whose value
 // could itself contain a quote. Neither is legal in an NTFS path anyway.
+// biome-ignore lint/suspicious/noControlCharactersInRegex: NUL is one of the rejected characters
 const WIN_CMD_FORBIDDEN = /["%\r\n\u0000]/;
 
 function fail(message, status) {
@@ -168,6 +169,7 @@ function resolveEditor() {
  */
 function assertOpenTarget(value, label = 'path') {
   if (typeof value !== 'string' || !value.trim()) throw fail(`${label} must be a non-empty string`, 400);
+  // biome-ignore lint/suspicious/noControlCharactersInRegex: NUL is one of the rejected characters
   if (/[\r\n\u0000]/.test(value)) throw fail(`${label} contains invalid characters`, 400);
   const resolved = path.resolve(value);
   if (!fs.existsSync(resolved)) throw fail(`${label} does not exist`, 404);

package/lib/parent-cache.js

@@ -0,0 +1,58 @@
+const fs = require('node:fs');
+const path = require('node:path');
+const { countTranscriptsBornBefore } = require('./parsers');
+
+// Verdicts of lookupParentSession in server.js. A verdict depends on the child's head and on
+// the transcripts of its folder born before it, because only those can be its parent. So a new
+// transcript cannot change it, but a replaced child or parent, a compact anchor seen later, or
+// an older transcript moved into the folder can. Each entry records these and is checked on use.
+const verdicts = new Map();
+let dirty = false;
+
+function getParentVerdict(sessionId, meta) {
+  const v = verdicts.get(sessionId);
+  if (!v || !meta?.jsonlPath || v.childPath !== meta.jsonlPath) return null;
+  if (v.logicalParentUuid !== (meta.logicalParentUuid || null)) return null;
+  try {
+    const self = fs.statSync(v.childPath);
+    if (self.ino !== v.childIno) return null;
+    if (v.parentIno !== null && fs.statSync(v.result.parentJsonlPath).ino !== v.parentIno) return null;
+    if (countTranscriptsBornBefore(path.dirname(v.childPath), self.birthtimeMs) !== v.olderCount) return null;
+  } catch (_) {
+    return null;
+  }
+  return v.result;
+}
+
+// self: the child's stat from the lookup. parentIno: null when no parent was found.
+function setParentVerdict(sessionId, meta, self, parentIno, result) {
+  verdicts.set(sessionId, {
+    childPath: meta.jsonlPath,
+    childIno: self.ino,
+    logicalParentUuid: meta.logicalParentUuid || null,
+    parentIno,
+    olderCount: countTranscriptsBornBefore(path.dirname(meta.jsonlPath), self.birthtimeMs),
+    result,
+  });
+  dirty = true;
+}
+
+const parentVerdictsDirty = () => dirty;
+
+function exportParentVerdicts() {
+  dirty = false;
+  return [...verdicts].filter(([, v]) => fs.existsSync(v.childPath));
+}
+
+function importParentVerdicts(entries) {
+  if (!Array.isArray(entries)) return;
+  const num = (x) => typeof x === 'number';
+  for (const pair of entries) {
+    const v = Array.isArray(pair) ? pair[1] : null;
+    if (typeof pair?.[0] !== 'string' || !v || typeof v.childPath !== 'string' || !num(v.childIno) || !num(v.olderCount)) continue;
+    if (!(v.parentIno === null || num(v.parentIno)) || typeof v.result?.relation !== 'string') continue;
+    verdicts.set(pair[0], v);
+  }
+}
+
+module.exports = { getParentVerdict, setParentVerdict, parentVerdictsDirty, exportParentVerdicts, importParentVerdicts };