claude-code-kanban 7.6.1 → 7.8.0

package/lib/terminal.js

@@ -34,10 +34,11 @@ const WORKTREE_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 // Claude Code keeps a list in tasks/<id>/, so the id must stay one path segment.
 const TASK_LIST_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 const MODELS = new Set(['fable', 'opus', 'sonnet', 'haiku']);
+const EFFORTS = new Set(['low', 'medium', 'high', 'xhigh', 'max']);
 // Extra claude args reach the command line inside plain quotes (quoteArg), so a character
 // that ends or expands those quotes in any of the shells is refused.
 // biome-ignore lint/suspicious/noControlCharactersInRegex: refuses control characters on purpose
-const EXTRA_ARG_RE = /^[^\x00-\x1f\x7f'"%]*$/;
+const EXTRA_ARG_RE = /^[^\x00-\x1f\x7f"%]*$/;
 const MAX_EXTRA_ARGS = 64;
 const MAX_EXTRA_ARG = 4096;
 // cck sets these itself, or they would start something other than a new session.
@@ -47,6 +48,12 @@ const OWNED_FLAGS = new Set([
 ]);
 const MAX_PROMPT = 32 * 1024;
 const PROMPT_QUIET_MS = 400;
+const SUBMIT_POLL_MS = 1000;
+const SUBMIT_CHECKS = 5;
+const SUBMIT_RETRIES = 2;
+// The answer lines of Claude Code's folder-trust dialog, current and earlier wording. They tell the
+// board the dialog is up; the looser onTrustScreen only holds the prompt back, where a miss is worse.
+const TRUST_DIALOG = /Yes, I trust this folder|Do you trust the files in this folder\?/;
 // Watermarks from https://xtermjs.org/docs/guides/flowcontrol/ — pause the PTY while a
 // client lags, so a runaway process cannot grow the socket buffer without bound.
 const HIGH_WATER = 128 * 1024;
@@ -142,11 +149,11 @@ function resolveShell(value, which, platform = process.platform, env = process.e
 }
 
 // claudeArgs is null for a plain shell. Its items are fixed flags, a validated UUID, or
-// values that passed NAME_RE / WORKTREE_RE / EXTRA_ARG_RE, so plain quoting is enough to
-// keep a space from splitting an argument and nothing can break out of the quotes.
+// values that passed NAME_RE / WORKTREE_RE / EXTRA_ARG_RE. Those hold no " or %, so cmd's
+// double quotes hold them, and quotePrompt escapes the ' a path such as O'Brien can carry.
 function quoteArg(arg, family) {
   if (/^[A-Za-z0-9._-]+$/.test(arg)) return arg;
-  return family === 'cmd' ? `"${arg}"` : `'${arg}'`;
+  return family === 'cmd' ? `"${arg}"` : quotePrompt(arg, family);
 }
 
 // Free text, unlike quoteArg's input. Inside single quotes pwsh only reads a quote mark (it
@@ -182,9 +189,12 @@ function claudeArgsFor(mode, id, spec) {
   if (mode === 'new') {
     // claude takes --session-id with --resume only together with --fork-session.
     const fork = spec.forkOf ? ['--resume', spec.forkOf, '--fork-session'] : [];
-    const args = [...fork, '--session-id', id, ...(spec.extraArgs || [])];
+    // A plain resume keeps the transcript's id, so the PTY's own id is not passed on.
+    const own = spec.resume ? ['--resume', spec.resume] : ['--session-id', id];
+    const args = [...fork, ...own, ...(spec.extraArgs || [])];
     if (spec.name) args.push('--name', spec.name);
     if (spec.model) args.push('--model', spec.model);
+    if (spec.effort) args.push('--effort', spec.effort);
     // Last, because its value is optional and a following flag must not be taken for it.
     if (spec.worktree === true) args.push('-w');
     else if (spec.worktree) args.push('-w', spec.worktree);
@@ -196,7 +206,7 @@ function claudeArgsFor(mode, id, spec) {
 function extraArgsError(args) {
   if (!Array.isArray(args) || args.length > MAX_EXTRA_ARGS) return `claude args (at most ${MAX_EXTRA_ARGS})`;
   for (const a of args) {
-    if (typeof a !== 'string' || a.length > MAX_EXTRA_ARG || !EXTRA_ARG_RE.test(a)) return 'claude arg: no quotes, % or control characters';
+    if (typeof a !== 'string' || a.length > MAX_EXTRA_ARG || !EXTRA_ARG_RE.test(a)) return 'claude arg: no double quotes, % or control characters';
     const flag = a.split('=')[0];
     if (OWNED_FLAGS.has(flag)) return `claude arg: cck sets ${flag}`;
   }
@@ -207,6 +217,8 @@ function extraArgsError(args) {
 function parseNewSpec(msg) {
   const forkOf = msg.forkOf ?? null;
   if (forkOf !== null && (typeof forkOf !== 'string' || !UUID_RE.test(forkOf))) return 'session to fork';
+  const resume = msg.resume ?? null;
+  if (resume !== null && (typeof resume !== 'string' || !UUID_RE.test(resume) || forkOf)) return 'session to resume';
   if (!forkOf && (typeof msg.cwd !== 'string' || !msg.cwd)) return 'folder';
   const name = typeof msg.name === 'string' ? msg.name.trim() : '';
   if (name && !NAME_RE.test(name)) return 'name';
@@ -214,6 +226,8 @@ function parseNewSpec(msg) {
   if (typeof worktree !== 'boolean' && !(typeof worktree === 'string' && WORKTREE_RE.test(worktree))) return 'worktree name';
   const model = msg.model || null;
   if (model && !MODELS.has(model)) return 'model';
+  const effort = msg.effort || null;
+  if (effort && !EFFORTS.has(effort)) return 'effort';
   const taskList = msg.taskList || null;
   if (taskList && !(typeof taskList === 'string' && TASK_LIST_RE.test(taskList))) return 'task list id';
   const edit = msg.edit === true;
@@ -227,7 +241,8 @@ function parseNewSpec(msg) {
   const bad = extraArgsError(extraArgs);
   if (bad) return bad;
   if (forkOf && worktree) return 'worktree: a fork runs in its parent session folder';
-  return { cwd: forkOf ? null : msg.cwd, forkOf, name: name || null, worktree, model, taskList, prompt: prompt || null, extraArgs, edit };
+  const restore = msg.restore !== false;
+  return { cwd: forkOf ? null : msg.cwd, forkOf, resume, name: name || null, worktree, model, effort, taskList, prompt: prompt || null, extraArgs, edit, restore };
 }
 
 function samePath(a, b) {
@@ -258,7 +273,11 @@ function screenText(term) {
 // show tool posts to.
 function ptyEnv({ claudeDir, isDefaultDir, noFlicker, cckUrl, terminalId }) {
   const env = { ...process.env };
+  const inHub = !!env.CLAUDE_HUB;
   for (const k of STRIP_ENV) delete env[k];
+  // Claude Code reports TERM_PROGRAM as the metrics attribute terminal_type.
+  env.TERM_PROGRAM = inHub ? 'claude-code-hub' : 'claude-code-kanban';
+  delete env.TERM_PROGRAM_VERSION;
   if (isDefaultDir) delete env.CLAUDE_CONFIG_DIR;
   else env.CLAUDE_CONFIG_DIR = claudeDir;
   if (cckUrl) env.CCK_URL = cckUrl;
@@ -353,6 +372,7 @@ function createTerminalService(o) {
   const saveDelayMs = o.saveDelayMs ?? SAVE_DELAY_MS;
   const restoreGapMs = o.restoreGapMs ?? RESTORE_GAP_MS;
   const exitPollMs = o.exitPollMs ?? CLAUDE_EXIT_POLL_MS;
+  const submitPollMs = o.submitPollMs ?? SUBMIT_POLL_MS;
   const pidAlive = o.isPidAlive || isPidAlive;
   const exitTimer = setInterval(checkExits, exitPollMs);
   exitTimer.unref();
@@ -418,7 +438,7 @@ function createTerminalService(o) {
       if (savedTerminalIds[id]) terminalIds[id] = savedTerminalIds[id];
     }
     for (const s of sessions.values()) {
-      if (s.ended || s.claudeExitedAt || !RESTORABLE_MODES.has(s.mode)) continue;
+      if (s.ended || s.claudeExitedAt || !RESTORABLE_MODES.has(s.mode) || !s.restore) continue;
       ids.add(s.id);
       if (s.taskList) taskLists[s.id] = s.taskList;
       terminalIds[s.id] = s.terminalId;
@@ -475,13 +495,24 @@ function createTerminalService(o) {
 
   // Waits for claude to turn on bracketed paste (its input box is live), then for the
   // screen to settle. A folder-trust question also takes input, and Enter there would
-  // answer it, so the prompt waits for as long as that question is on screen.
+  // answer it, so the prompt waits for as long as that question is on screen. Once it is
+  // answered, claude turns paste off and redraws for seconds; text sent then is lost.
   function bracketed(text) {
     return `\x1b[200~${text.replace(/\r?\n/g, '\r')}\x1b[201~`;
   }
 
+  // The folder and session names show on claude's main screen, so a "trust" in them is not the dialog.
   function onTrustScreen(s) {
-    return /\btrust\b/i.test(screenText(s.term));
+    let text = screenText(s.term);
+    for (const own of [path.basename(s.cwd), s.name]) if (own) text = text.split(own).join('');
+    return /\btrust\b/i.test(text);
+  }
+
+  // Checked only while the session's first prompt waits, so it ends for good once the prompt is sent.
+  function setAwaitingTrust(s, on) {
+    if (s.awaitingTrust === on) return;
+    s.awaitingTrust = on;
+    changed();
   }
 
   // `submit` is claude's prompt: wait for its input box, then press Enter. Without it the text
@@ -493,18 +524,47 @@ function createTerminalService(o) {
     let timer = null;
     const text = bracketed(raw);
     s.onOutput = (data) => {
-      if (!armed && data.includes('\x1b[?2004h')) armed = true;
-      if (!armed) return;
+      if (submit) {
+        const on = data.lastIndexOf('\x1b[?2004h');
+        const off = data.lastIndexOf('\x1b[?2004l');
+        if (on !== off) armed = on > off;
+      }
       clearTimeout(timer);
+      if (!armed) return;
       timer = setTimeout(() => {
-        if (s.exited || (submit && onTrustScreen(s))) return;
+        if (s.exited) return;
+        if (submit && onTrustScreen(s)) return setAwaitingTrust(s, TRUST_DIALOG.test(screenText(s.term)));
+        setAwaitingTrust(s, false);
         s.onOutput = null;
         s.pty.write(text);
-        if (submit) setTimeout(() => { if (!s.exited) s.pty.write('\r'); }, 100);
+        if (submit) setTimeout(() => submitPrompt(s), 100);
       }, PROMPT_QUIET_MS);
     };
   }
 
+  // claude sometimes drops the Enter after the paste and leaves the prompt typed but not sent.
+  // It bumps statusUpdatedAt in its registry entry when a turn starts, so while the entry stays
+  // idle and older than the Enter, Enter is pressed again. Only an idle entry gets it: a turn
+  // that started can show a permission dialog, and Enter there would pick its default.
+  function submitPrompt(s) {
+    if (s.exited) return;
+    let at = Date.now();
+    let checks = 0;
+    let retries = 0;
+    s.pty.write('\r');
+    s.submitTimer = setInterval(() => {
+      const entry = ownEntry(o.liveSessions(), s, s.startedAt);
+      const unsent = !s.exited && entry?.status === 'idle' && typeof entry.statusUpdatedAt === 'number' && entry.statusUpdatedAt < at;
+      if (!unsent || (++checks === SUBMIT_CHECKS && retries === SUBMIT_RETRIES)) return clearInterval(s.submitTimer);
+      if (checks < SUBMIT_CHECKS) return;
+      checks = 0;
+      retries++;
+      at = Date.now();
+      s.pty.write('\r');
+    }, submitPollMs);
+    s.submitTimer.unref();
+  }
+
   // The process a viewer types into: claude, found through its registry entry, or the shell.
   function inputPid(s, registry) {
     if (s.mode === 'shell') return s.pty.pid;
@@ -544,8 +604,10 @@ function createTerminalService(o) {
     if (moved) changed();
   }
 
+  // A resumed transcript keeps its own id, which is not the PTY's.
   function ownEntry(live, s, since) {
-    return live.find((l) => l.pid && l.sessionId === s.id && l.startedAt >= since - PICK_START_SLACK_MS);
+    const sid = s.resumeOf || s.id;
+    return live.find((l) => l.pid && l.sessionId === sid && l.startedAt >= since - PICK_START_SLACK_MS);
   }
 
   // claude writes its registry entry a moment after it starts, so the pid is polled for.
@@ -594,8 +656,8 @@ function createTerminalService(o) {
     term.loadAddon(serializer);
     const s = {
       id, terminalId, mode, cwd, pty: proc, term, serializer, sockets: new Set(), exited: false, ended: false, paused: false, startedAt: Date.now(),
-      name: spec?.name || null, worktree: spec?.worktree || false, taskList, onOutput: null, edit: !!spec?.edit,
-      forkOf: spec?.forkOf || null,
+      name: spec?.name || null, worktree: spec?.worktree || false, taskList, onOutput: null, awaitingTrust: false, edit: !!spec?.edit,
+      forkOf: spec?.forkOf || null, resumeOf: spec?.resume || null, restore: spec?.restore !== false,
     };
     if (s.edit) queueText(s, claudeCommand(shell, claudeArgs, spec.prompt), false);
     else if (spec?.prompt) queueText(s, spec.prompt, true);
@@ -613,6 +675,7 @@ function createTerminalService(o) {
       s.exited = true;
       clearInterval(s.pickTimer);
       clearInterval(s.boostTimer);
+      clearInterval(s.submitTimer);
       if (sessions.get(s.id) === s) sessions.delete(s.id);
       o.onExit?.(s.id);
       if (!s.ended) changed();
@@ -744,6 +807,9 @@ function createTerminalService(o) {
     if (mode === 'new') {
       spec = parseNewSpec(msg);
       if (typeof spec === 'string') return { code: 4002, status: 400, error: `invalid ${spec}` };
+      if (spec.resume && o.isLiveElsewhere(spec.resume)) {
+        return { code: 4006, status: 409, error: 'the session to resume is running in another terminal' };
+      }
       if (spec.edit && spec.prompt && shellFamily(shell) === 'cmd') {
         return { code: 4002, status: 400, error: 'cmd cannot take a typed prompt; clear the prompt or set the terminal shell to pwsh or gitbash' };
       }
@@ -756,7 +822,7 @@ function createTerminalService(o) {
       cwd = spec?.forkOf ? forkCwd : msg.cwd;
       if (spec?.forkOf && cwd === null) return { code: 4004, status: 404, error: 'unknown session to fork' };
       if (!spec?.forkOf && (typeof cwd !== 'string' || !(await o.isAllowedFolder(cwd)))) {
-        return { code: 4004, status: 403, error: 'folder is not a known project or a folder picked in this run' };
+        return { code: 4004, status: 404, error: 'folder does not exist' };
       }
     } else if (mode !== 'shell' && known === null) {
       return { code: 4004, status: 404, error: 'unknown session' };
@@ -803,7 +869,7 @@ function createTerminalService(o) {
   function list() {
     return [...sessions.values()].filter((s) => !s.ended).map((s) => ({
       id: s.id, terminalId: s.terminalId, mode: s.mode, cwd: s.cwd, pid: s.pty.pid, clients: s.sockets.size, startedAt: s.startedAt,
-      name: s.name, worktree: s.worktree, edit: s.edit, forkOf: s.forkOf,
+      name: s.name, worktree: s.worktree, edit: s.edit, forkOf: s.forkOf, claudeExited: !!s.claudeExitedAt, awaitingTrust: s.awaitingTrust,
     }));
   }
 
@@ -878,4 +944,4 @@ function createTerminalService(o) {
   return { token, handleUpgrade, clientConfig, list, claudePids, isRunning, end, authorized, startNew, paste, restore, shutdown, unavailableReason };
 }
 
-module.exports = { createTerminalService, readTerminalConfig, localUnavailableReason, refuseUpgrade, clientConfigFor, ptyEnv, shellArgs, claudeCommand, resolveShell, claudeArgsFor, parseNewSpec, findPickProcess, tokenMatches };
+module.exports = { MODELS,createTerminalService, readTerminalConfig, localUnavailableReason, refuseUpgrade, clientConfigFor, ptyEnv, shellArgs, claudeCommand, resolveShell, claudeArgsFor, parseNewSpec, findPickProcess, tokenMatches };

package/lib/user-groups.js

@@ -0,0 +1,384 @@
+// User groups: named groups that hold projects and sessions, and may nest under another group.
+// The CLI and plugins change them one operation at a time; the board writes its copy whole with
+// `replace`. `groups` is one flat list; its order is the order of siblings. A member is in at
+// most one group. A group that `dispatch start --group` had to make is transient: the board
+// removes it once its Active view shows none of its sessions, unless the user keeps it (clears
+// the flag).
+
+const { randomUUID } = require('node:crypto');
+const groupTree = require('../public/group-tree');
+const { httpError } = require('./http-error');
+const { oneLine } = require('./one-line');
+
+const MAX_GROUPS = 1000;
+const MAX_MEMBERS = 500;
+const MAX_DEPTH = 8;
+const MAX_NAME = 120;
+const MAX_REF = 4096;
+const ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
+const TYPES = new Set(['project', 'session']);
+
+const fail = (status, message) => {
+  throw httpError(status, message);
+};
+
+const isRef = (s) => typeof s === 'string' && s.length > 0 && s.length <= MAX_REF;
+const cleanName = (name) => (typeof name === 'string' && oneLine(name, MAX_NAME)) || null;
+const memberKey = (m) => `${m.type}\0${m.ref}`;
+
+function cleanMember(m) {
+  if (!m || !TYPES.has(m.type) || !isRef(m.ref)) return null;
+  const out = { type: m.type, ref: m.ref };
+  if (m.type === 'session' && isRef(m.under)) out.under = m.under;
+  else if (m.type === 'session' && m.loose === true) out.loose = true;
+  if (m.type === 'session' && isRef(m.parent) && m.parent !== m.ref) out.parent = m.parent;
+  return out;
+}
+
+const sameMember = (a, b) => a.type === b.type && a.ref === b.ref;
+
+const groupHolding = (groups, member) => groups.find((g) => g.members.some((m) => sameMember(m, member)));
+const groupsNamed = (groups, name) => groups.filter((g) => g.name.toLowerCase() === name.toLowerCase());
+
+// Where the board shows a session (sgGroupForSession in public/app.js).
+const sessionGroup = (groups, { ref, project }) =>
+  groupHolding(groups, { type: 'session', ref }) || (project && groupHolding(groups, { type: 'project', ref: project })) || null;
+
+function wouldCycle(list, id, parent) {
+  let depth = 0;
+  for (let p = parent; p; p = list.find((g) => g.id === p)?.parent ?? null) {
+    if (p === id || ++depth >= MAX_DEPTH) return true;
+  }
+  return false;
+}
+
+// `taken` holds member keys already placed; a member found again is dropped, so the first group
+// that lists it keeps it.
+function readGroups(list, taken = new Set()) {
+  const out = [];
+  const seen = new Set();
+  for (const g of Array.isArray(list) ? list : []) {
+    if (!g || !ID_RE.test(g.id) || seen.has(g.id) || out.length >= MAX_GROUPS) continue;
+    seen.add(g.id);
+    const members = [];
+    for (const m of Array.isArray(g.members) ? g.members : []) {
+      const clean = cleanMember(m);
+      if (!clean || members.length >= MAX_MEMBERS || taken.has(memberKey(clean))) continue;
+      taken.add(memberKey(clean));
+      members.push(clean);
+    }
+    const group = { id: g.id, name: cleanName(g.name) || 'Group', parent: typeof g.parent === 'string' ? g.parent : null, members };
+    if (g.transient === true) group.transient = true;
+    out.push(group);
+  }
+  for (const g of out) {
+    if (g.parent && (!seen.has(g.parent) || g.parent === g.id)) g.parent = null;
+  }
+  for (const g of out) if (wouldCycle(out, g.id, g.parent)) g.parent = null;
+  return out;
+}
+
+/**
+ * @param {object} o
+ * @param {() => object|null|undefined} o.load `undefined` means keep what is in memory: the file has
+ *   not changed since the last load, or cannot be read
+ * @param {(data: object) => void} o.save throws when the groups must not or cannot be written
+ */
+function createUserGroupStore({ load, save, now = () => new Date().toISOString(), newId = randomUUID }) {
+  let groups = [];
+  let rev = 0;
+  let migratedAt = null;
+  // The last state read or saved. The changes edit `groups` in place, so a refused save puts it back.
+  let lastGood = {};
+
+  function apply(data) {
+    rev = Number.isSafeInteger(data.rev) && data.rev >= 0 ? data.rev : 0;
+    migratedAt = typeof data.groupsMigratedAt === 'string' ? data.groupsMigratedAt : null;
+    groups = readGroups(data.groups);
+  }
+
+  // Another board on the same config dir writes the same file. Returns whether the rev moved.
+  function reload() {
+    const saved = load();
+    if (saved === undefined) return false;
+    const before = rev;
+    lastGood = saved && typeof saved === 'object' ? saved : {};
+    apply(lastGood);
+    return rev !== before;
+  }
+  reload();
+
+  const byId = (id) => groups.find((g) => g.id === id) || null;
+  const mustGet = (id) => byId(id) || fail(404, `no group ${id}`);
+  const groupOf = (member) => groupHolding(groups, member);
+  const byName = (name) => groupsNamed(groups, name);
+
+  const state = () => ({ version: 2, rev, groupsMigratedAt: migratedAt, groups });
+
+  function commit() {
+    rev++;
+    const data = structuredClone(state());
+    try {
+      save(data);
+    } catch (e) {
+      apply(lastGood);
+      throw e;
+    }
+    lastGood = data;
+    return state();
+  }
+
+  function checkParent(id, parent) {
+    if (parent == null) return null;
+    if (typeof parent !== 'string' || !byId(parent)) fail(400, `no parent group ${parent}`);
+    if (wouldCycle(groups, id, parent)) fail(400, 'parent would make a cycle or nest too deep');
+    return parent;
+  }
+
+  function moveBefore(list, item, before, same) {
+    const from = list.indexOf(item);
+    if (from >= 0) list.splice(from, 1);
+    const to = before == null ? -1 : list.findIndex((x) => same(x, before));
+    if (to >= 0) list.splice(to, 0, item);
+    else list.push(item);
+  }
+
+  function detach(keys) {
+    for (const g of groups) g.members = g.members.filter((m) => !keys.has(memberKey(m)));
+  }
+
+  function addGroup({ id, name, parent = null, before = null, members = [], transient = false }) {
+    if (groups.length >= MAX_GROUPS) fail(422, `at most ${MAX_GROUPS} groups`);
+    if (id != null && (!ID_RE.test(id) || byId(id))) fail(400, 'id must be unique, 1-64 of [A-Za-z0-9_-]');
+    const gid = id ?? newGroupId();
+    const clean = readGroups([{ id: gid, members }])[0].members;
+    const group = { id: gid, name: cleanName(name) || `Group ${groups.length + 1}`, parent: checkParent(gid, parent), members: clean };
+    if (transient) group.transient = true;
+    detach(new Set(clean.map(memberKey)));
+    groups.push(group);
+    moveBefore(groups, group, before, (g, id) => g.id === id);
+    return group;
+  }
+
+  function create(opts = {}) {
+    const group = addGroup(opts);
+    return { group: group.id, ...commit() };
+  }
+
+  const pathOf = (group) => {
+    const names = [];
+    for (let g = group; g; g = byId(g.parent)) names.unshift(g.name);
+    return names.join('/');
+  };
+
+  // A path names a top-level group, then a child at each step. `make` adds the missing steps, and
+  // `make.transient` marks the steps it adds.
+  function findPath(path, make, hint) {
+    const steps = path.split('/').map(cleanName);
+    if (steps.some((s) => !s)) fail(400, `group path "${path}" has an empty step`);
+    if (steps.length > MAX_DEPTH) fail(400, `a group path has at most ${MAX_DEPTH} steps`);
+    let parent = null;
+    let created = false;
+    for (const step of steps) {
+      const named = byName(step).filter((g) => g.parent === (parent?.id ?? null));
+      if (named.length > 1) fail(400, `${named.length} groups are named "${pathOf(named[0])}"; pass one id: ${named.map((g) => g.id).join(', ')}`);
+      if (named.length) parent = named[0];
+      else if (make) [parent, created] = [addGroup({ name: step, parent: parent?.id ?? null, transient: make.transient }), true];
+      else return fail(404, `no group "${parent ? `${pathOf(parent)}/` : ''}${step}"; ${hint}`);
+    }
+    return { group: parent, created };
+  }
+
+  // The CLI names a group the way the user sees it: by id, by name ignoring case, or by path.
+  function findGroup(key, make, hint = 'pass --create to make it, or see `group list`') {
+    if (!isRef(key) || !key.trim()) fail(400, 'group must be a group id, name or path');
+    const hit = byId(key);
+    if (hit) return { group: hit, created: false };
+    const name = cleanName(key);
+    const named = byName(name);
+    if (!named.length && key.includes('/')) return findPath(key, make, hint);
+    if (named.length > 1) fail(400, `${named.length} groups are named "${name}"; pass one id: ${named.map((g) => g.id).join(', ')}`);
+    if (named.length) return { group: named[0], created: false };
+    if (make) return { group: addGroup({ name, transient: make.transient }), created: true };
+    const known = groups.map((g) => g.name).join(', ');
+    return fail(404, `no group "${name}"${known ? ` (groups: ${known})` : ''}; ${hint}`);
+  }
+
+  // The group the board shows `peer` in: its own placement or its project's. A new group holds
+  // `peer` too.
+  function peerGroup(peer, make) {
+    const { ref, name } = peer;
+    const hit = sessionGroup(groups, peer);
+    if (hit) return { group: hit, created: false };
+    if (!make) return fail(404, `session ${ref.slice(0, 8)} is in no group; pass --create to make one`);
+    return { group: addGroup({ name, members: [{ type: 'session', ref }] }), created: true };
+  }
+
+  // A session placed with no `under` or `loose` shows in its project's block when the group holds
+  // its project, else on the group's own level, as the board's context menu places it.
+  // `peer` ({ref, project, name}) puts the session in the group of that session.
+  // `parent` names the session the board shows it under; null clears it.
+  function groupSession(ref, { group, peer, parent, create: make = false } = {}) {
+    // Checked before findGroup, which may add the group.
+    if (!isRef(ref)) fail(400, 'session id is required');
+    if (parent != null && (!isRef(parent) || parent === ref)) fail(400, 'parent must be a different session');
+    const member = { type: 'session', ref, parent };
+    const left = groupOf(member)?.name ?? null;
+    if (peer) {
+      if (!isRef(peer.ref) || peer.ref === ref) fail(400, 'the other session must be a different session');
+    } else if (group == null) {
+      return { group: null, left, ...(left === null ? state() : ungroup(member)) };
+    }
+    const { group: hit, created } = peer ? peerGroup(peer, make) : findGroup(group, make);
+    return { ...groupRef(hit), created, left, ...place(hit.id, member) };
+  }
+
+  // `dispatch start --group`: the started session joins the group, and the groups of the path
+  // that had to be made are transient.
+  function joinDispatch(key, ref) {
+    if (!isRef(ref)) fail(400, 'session id is required');
+    const { group } = findGroup(key, { transient: true });
+    const { rev: saved } = place(group.id, { type: 'session', ref });
+    return { ...groupRef(group), transient: !!group.transient, rev: saved };
+  }
+
+  // A renamed group is the user's: it stays after its sessions end.
+  function update(id, { name, parent, before } = {}) {
+    const group = mustGet(id);
+    const nextName = name === undefined ? group.name : cleanName(name) || fail(400, 'name must be a non-empty string');
+    const nextParent = parent === undefined ? group.parent : checkParent(id, parent);
+    if (before != null && !byId(before)) fail(400, `no group ${before}`);
+    if (name !== undefined) delete group.transient;
+    group.name = nextName;
+    group.parent = nextParent;
+    if (before !== undefined) moveBefore(groups, group, before, (g, id) => g.id === id);
+    return commit();
+  }
+
+  function remove(id) {
+    const group = mustGet(id);
+    for (const g of groups) if (g.parent === id) g.parent = group.parent;
+    groups = groups.filter((g) => g !== group);
+    return commit();
+  }
+
+  const describe = (g) => ({ id: g.id, name: g.name, path: pathOf(g) });
+  const groupRef = (g) => ({ group: g.id, name: g.name, path: pathOf(g) });
+
+  const userGroupByKey = (key) => findGroup(key, false, 'see `group list`').group;
+
+  // `transient` marks the groups of the path that had to be made.
+  function createPath(path, transient = false) {
+    const { group, created } = findGroup(path, { transient });
+    if (!created) fail(400, `group "${pathOf(group)}" exists (${group.id})`);
+    return { ...groupRef(group), rev: commit().rev };
+  }
+
+  function rename(key, name) {
+    const group = userGroupByKey(key);
+    const { rev: saved } = update(group.id, { name });
+    return { ...groupRef(group), rev: saved };
+  }
+
+  function removeByKey(key) {
+    const group = userGroupByKey(key);
+    return { removed: describe(group), ungrouped: group.members.length, rev: remove(group.id).rev };
+  }
+
+  // A parent that holds only empty groups goes with them.
+  function prune({ dryRun = false, isLive }) {
+    const doomed = cascade((g) => !g.members.some(isLive));
+    const removed = groups.filter((g) => doomed.has(g)).map(describe);
+    if (dryRun || !doomed.size) return { removed, dryRun, rev };
+    groups = groups.filter((g) => !doomed.has(g));
+    return { removed, dryRun, rev: commit().rev };
+  }
+
+  const cascade = (goes) => groupTree.cascade(groups, goes);
+
+  const subtree = (g) => [g, ...groups.filter((c) => c.parent === g.id).flatMap(subtree)];
+  const isSession = (m) => m.type === 'session';
+
+  function dropSessions(scope, drop) {
+    const emptied = new Set();
+    let members = 0;
+    for (const g of scope) {
+      const kept = g.members.filter((m) => !isSession(m) || !drop(m));
+      if (kept.length === g.members.length) continue;
+      members += g.members.length - kept.length;
+      g.members = kept;
+      if (!kept.length) emptied.add(g);
+    }
+    return { members, emptied };
+  }
+
+  // A group that was empty before the sweep stays: the user may have made it to fill later.
+  function expire(isDead) {
+    const { members, emptied } = dropSessions(groups, isDead);
+    if (!members) return { members: 0, groups: 0, rev };
+    const gone = cascade((g) => emptied.has(g));
+    groups = groups.filter((g) => !gone.has(g));
+    return { members, groups: gone.size, rev: commit().rev };
+  }
+
+  // `groups` counts every group after the clean, so the caller can show them without asking again.
+  function clean({ group, dryRun = false, isVisible }) {
+    const scope = group == null ? groups : subtree(mustGet(group));
+    const hidden = (m) => isSession(m) && !isVisible(m);
+    const countHidden = (g) => g.members.filter(hidden).length;
+    const dropped = dryRun ? scope.reduce((n, g) => n + countHidden(g), 0) : dropSessions(scope, hidden).members;
+    const counts = groups.map((g) => ({ ...describe(g), members: g.members.length, hidden: countHidden(g) }));
+    return { groups: counts, dropped, dryRun, rev: dropped && !dryRun ? commit().rev : rev };
+  }
+
+  // `supersede` names session members to drop with the move: the sessions of a project being
+  // moved, which only the caller can list. With no `parent`, a move inside the group keeps it.
+  function place(id, { type, ref, under, loose, parent, before = null, supersede = [] } = {}) {
+    const group = mustGet(id);
+    const kept = parent === undefined ? group.members.find((m) => sameMember(m, { type, ref }))?.parent : parent;
+    const member = cleanMember({ type, ref, under, loose, parent: kept }) || fail(400, 'type must be project or session, with a ref');
+    if (group.members.filter((m) => !sameMember(m, member)).length >= MAX_MEMBERS) fail(422, `at most ${MAX_MEMBERS} members`);
+    const keys = new Set([memberKey(member)]);
+    for (const sid of Array.isArray(supersede) ? supersede : []) if (isRef(sid)) keys.add(memberKey({ type: 'session', ref: sid }));
+    detach(keys);
+    moveBefore(group.members, member, before, sameMember);
+    return commit();
+  }
+
+  function ungroup({ type, ref } = {}) {
+    const member = cleanMember({ type, ref }) || fail(400, 'type must be project or session, with a ref');
+    detach(new Set([memberKey(member)]));
+    return commit();
+  }
+
+  // The board edits its own copy and writes it whole; `rev` must be the one it last read.
+  function replace({ rev: base, groups: list } = {}) {
+    if (base !== rev) fail(409, 'groups changed since rev; read them again');
+    groups = readGroups(list);
+    return commit();
+  }
+
+  // The board's groups from before the server kept them. Only the first import is taken; a later
+  // one changes nothing. A member the server already holds stays where it is.
+  function importLocal({ groups: list } = {}) {
+    if (migratedAt) return { imported: false, ...state() };
+    const taken = new Set(groups.flatMap((g) => g.members.map(memberKey)));
+    for (const g of readGroups(list, taken)) {
+      if (groups.length >= MAX_GROUPS) break;
+      groups.push({ ...g, id: byId(g.id) ? newGroupId() : g.id, parent: null });
+    }
+    migratedAt = now();
+    return { imported: true, ...commit() };
+  }
+
+  function newGroupId() {
+    let id;
+    do id = newId();
+    while (byId(id));
+    return id;
+  }
+
+  return { state, reload, create, update, remove, place, ungroup, replace, importLocal, groupSession, joinDispatch, createPath, rename, removeByKey, prune, expire, clean };
+}
+
+module.exports = { createUserGroupStore };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-kanban",
-  "version": "7.6.1",
+  "version": "7.8.0",
   "description": "A web-based Kanban board for viewing Claude Code tasks with agent teams support",
   "main": "server.js",
   "type": "commonjs",
@@ -11,6 +11,7 @@
     "start": "node server.js",
     "dev": "node --watch server.js",
     "test": "node --test test/*.test.js",
+    "test:swarm": "npm --prefix extensions/swarm/plugin/plugins/swarm test",
     "validate:schemas": "node test/validate-live-schemas.js",
     "prepare": "husky"
   },
@@ -55,6 +56,7 @@
     "cli.js",
     "install.js",
     "plugin/**/*",
+    "kanbot/**/*",
     "lib/**/*",
     "public/**/*",
     "skill-guides/**/*"

package/plugin/plugins/claude-code-kanban/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "claude-code-kanban",
-  "version": "3.5.0",
+  "version": "3.7.4",
   "description": "claude-code-kanban dashboard integration: agent activity tracking, context and cost tracking, board moves and reviews delivered to the session, and skills to drive the board from a session"
 }