dsh-taskboard 0.4.5 → 0.5.1

package/lib/host/routes.js

@@ -1,15 +1,22 @@
-import { asIsolation, asStatus, asUrgency, canTransition, checklistFromTexts, newCommentId, newTaskId, normalizeBody, normalizeChecklist, normalizeExecution, normalizeModel, normalizePrompt, normalizeTitle, summarize, syncClaim, validateLedgerImport } from "../shared/protocol.js";
+import { asBoardSettings, asIsolation, asStatus, asUrgency, canTransition, checklistFromTexts, defaultIsolationOf, newCommentId, newTaskId, normalizeBody, normalizeChecklist, normalizeExecution, normalizeModel, normalizePrompt, normalizeTitle, summarize, syncClaim, validateLedgerImport } from "../shared/protocol.js";
 import { WORKTREE_DIR, worktreePathOf } from "./git.js";
 import { ROUTE_PREFIX, SSE_PATH } from "../shared/api.js";
-import { join } from "node:path";
+import { ERR, ToolError } from "./tools.js";
+import { join, resolve, sep } from "node:path";
 import { readdir, rm } from "node:fs/promises";
 //#region src/host/routes.ts
 /** Heartbeat cadence for the SSE stream. */
 const HEARTBEAT_MS = 2e4;
+/** Max accepted JSON body bytes (S8: unbounded buffering is a local OOM vector). */
+const MAX_BODY_BYTES = 5 * 1024 * 1024;
+/** Route shapes (T2: compiled once at module load, not on every request). */
+const TASK_DIFF_RE = new RegExp(`^${ROUTE_PREFIX}/tasks/([^/]+)/diff$`);
+const TASK_RE = new RegExp(`^${ROUTE_PREFIX}/tasks/([^/]+)$`);
+const TASK_ACTION_RE = new RegExp(`^${ROUTE_PREFIX}/tasks/([^/]+)/([\\w-]+)$`);
 /** How long a workspace git-detection result stays cached (fail-soft). */
 const GIT_DETECT_TTL_MS = 6e4;
 /** Validate a template's task spec (routes-side, unknown → invalid_input). */
-function normalizeTemplateSpec(raw) {
+function normalizeTemplateSpec(raw, now) {
 	if (typeof raw !== "object" || raw === null) throw new Error("Error: invalid_input: task must be an object");
 	const e = raw;
 	const spec = {};
@@ -31,7 +38,7 @@ function normalizeTemplateSpec(raw) {
 	if (urgency !== void 0) spec.urgency = asUrgency(urgency);
 	if (isolation !== void 0) spec.isolation = asIsolation(isolation);
 	if (presetId !== void 0 && presetId.trim().length > 0) spec.presetId = presetId.trim();
-	if (e.execution !== void 0) spec.execution = normalizeExecution(e.execution, Date.now());
+	if (e.execution !== void 0) spec.execution = normalizeExecution(e.execution, now);
 	if (e.model !== void 0) spec.model = normalizeModel(e.model);
 	if (e.checklist !== void 0) {
 		if (!Array.isArray(e.checklist) || e.checklist.some((c) => typeof c !== "string")) throw new Error("Error: invalid_input: task.checklist must be an array of strings");
@@ -69,10 +76,19 @@ function fail(code, message) {
 		status: code === "invalid_input" || code === "invalid_transition" ? 400 : code === "not_found" ? 404 : code === "version_conflict" ? 409 : code === "forbidden" ? 403 : 500
 	};
 }
-/** Read one JSON body (null on parse failure). */
+/**
+* Read one JSON body (null on parse failure). S8: rejects bodies over
+* MAX_BODY_BYTES by throwing — the local, unauthenticated HTTP surface must
+* not be an unbounded memory sink.
+*/
 async function readBody(req) {
 	const chunks = [];
-	for await (const chunk of req) chunks.push(chunk);
+	let total = 0;
+	for await (const chunk of req) {
+		total += chunk.length;
+		if (total > MAX_BODY_BYTES) throw new Error("body too large");
+		chunks.push(chunk);
+	}
 	if (chunks.length === 0) return {};
 	try {
 		const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
@@ -92,6 +108,15 @@ function num(body, key) {
 	if (v === void 0) return void 0;
 	return typeof v === "number" && Number.isFinite(v) ? v : null;
 }
+/** Find a live task INSIDE a mutator (R1: guards run on the fresh draft). */
+function liveTaskAt(ledger, id) {
+	const index = ledger.tasks.findIndex((t) => t.id === id);
+	if (index < 0 || ledger.tasks[index].trashedAt !== void 0) throw new Error("Error: not_found: no such task");
+	return {
+		index,
+		task: ledger.tasks[index]
+	};
+}
 /** Normalize an agent preset id: trimmed, non-empty; empty string → undefined. */
 function normalizePresetId(raw) {
 	const t = (raw ?? "").trim();
@@ -100,6 +125,17 @@ function normalizePresetId(raw) {
 /** Map a thrown domain error to the envelope. */
 function toFail(error) {
 	const message = error instanceof Error ? error.message : String(error);
+	if (error instanceof ToolError) {
+		const mapped = error.code === ERR.workspaceMismatch ? "forbidden" : error.code;
+		if ([
+			"invalid_input",
+			"not_found",
+			"version_conflict",
+			"invalid_transition",
+			"forbidden",
+			"internal"
+		].includes(mapped)) return fail(mapped, message.slice(7 + error.code.length + 2));
+	}
 	const code = message.startsWith("Error: ") ? message.slice(7).split(":")[0] : void 0;
 	if (code !== void 0 && [
 		"invalid_input",
@@ -122,6 +158,12 @@ function registerTaskboardRoutes(ctx, options) {
 	const { store, workspaces } = options;
 	const subscribers = /* @__PURE__ */ new Set();
 	let heartbeat;
+	/** R4③: a cleanup/purge target must resolve INSIDE <ws>/.dsh-worktrees — string joining alone is never trusted with an rm. */
+	const insideWorktreeScope = (wsPath, target) => {
+		const scope = resolve(wsPath, WORKTREE_DIR);
+		const resolved = resolve(target);
+		return resolved === scope || resolved.startsWith(scope + sep);
+	};
 	const broadcast = (change) => {
 		const frame = `event: change\ndata: ${JSON.stringify({
 			revision: change.revision,
@@ -130,7 +172,7 @@ function registerTaskboardRoutes(ctx, options) {
 		})}\n\n`;
 		for (const res of subscribers) res.write(frame);
 	};
-	store.subscribe(broadcast);
+	const unsubscribeBroadcast = store.subscribe(broadcast);
 	const gitCache = /* @__PURE__ */ new Map();
 	const gitHinted = /* @__PURE__ */ new Set();
 	/** Whether <root>/.gitignore (missing file counts as missing) ignores our worktree dir. */
@@ -235,7 +277,7 @@ function registerTaskboardRoutes(ctx, options) {
 					});
 					return;
 				}
-				const diffMatch = pathname.match(new RegExp(`^${ROUTE_PREFIX}/tasks/([^/]+)/diff$`));
+				const diffMatch = pathname.match(TASK_DIFF_RE);
 				if (diffMatch !== null) {
 					try {
 						if (options.git === void 0) {
@@ -278,7 +320,15 @@ function registerTaskboardRoutes(ctx, options) {
 					});
 					return;
 				}
-				const taskMatch = pathname.match(new RegExp(`^${ROUTE_PREFIX}/tasks/([^/]+)$`));
+				if (pathname === `/dsh-taskboard/settings`) {
+					await store.load();
+					json(res, {
+						ok: true,
+						value: store.snapshot().settings ?? {}
+					});
+					return;
+				}
+				const taskMatch = pathname.match(TASK_RE);
 				if (taskMatch !== null) {
 					const task = store.get(taskMatch[1]);
 					if (task === void 0) {
@@ -297,7 +347,7 @@ function registerTaskboardRoutes(ctx, options) {
 				return;
 			}
 			if (req.method !== "POST") {
-				res.writeHead(405);
+				res.writeHead(405, { allow: "GET, POST" });
 				res.end();
 				return;
 			}
@@ -305,7 +355,13 @@ function registerTaskboardRoutes(ctx, options) {
 				json(res, fail("invalid_input", "content-type must be application/json").res, 415);
 				return;
 			}
-			const body = await readBody(req);
+			let body;
+			try {
+				body = await readBody(req);
+			} catch {
+				json(res, fail("invalid_input", `request body exceeds ${MAX_BODY_BYTES} bytes`).res, 413);
+				return;
+			}
 			if (body === null) {
 				json(res, fail("invalid_input", "body is not a JSON object").res, 400);
 				return;
@@ -317,10 +373,11 @@ function registerTaskboardRoutes(ctx, options) {
 					if (workspaces.get(workspaceId) === void 0) throw new Error("Error: not_found: unknown workspace");
 					const urgency = asUrgency(str(body, "urgency") ?? "");
 					const status = str(body, "status") === null ? "todo" : asStatus(str(body, "status"));
+					if (status !== "backlog" && status !== "todo") throw new Error("Error: invalid_transition: a new task must start as backlog or todo");
 					const execution = normalizeExecution(body.execution ?? {}, options.now());
 					const model = body.model === void 0 ? void 0 : checkModel(body.model, options.modelProviders);
 					const isolationRaw = str(body, "isolation");
-					const isolation = isolationRaw === null ? void 0 : asIsolation(isolationRaw);
+					const isolation = isolationRaw === null ? defaultIsolationOf(store.snapshot().settings) : asIsolation(isolationRaw);
 					const presetId = normalizePresetId(str(body, "presetId"));
 					let checklist = void 0;
 					if (body.checklist !== void 0) {
@@ -340,7 +397,7 @@ function registerTaskboardRoutes(ctx, options) {
 						blocked: false,
 						execution,
 						model,
-						...isolation !== void 0 ? { isolation } : {},
+						isolation,
 						...presetId !== void 0 ? { presetId } : {},
 						...checklist !== void 0 ? { checklist } : {},
 						version: 1,
@@ -365,7 +422,7 @@ function registerTaskboardRoutes(ctx, options) {
 				}
 				return;
 			}
-			const actionMatch = pathname.match(new RegExp(`^${ROUTE_PREFIX}/tasks/([^/]+)/([\\w-]+)$`));
+			const actionMatch = pathname.match(TASK_ACTION_RE);
 			if (actionMatch !== null) {
 				const id = actionMatch[1];
 				const action = actionMatch[2];
@@ -375,44 +432,46 @@ function registerTaskboardRoutes(ctx, options) {
 					if (action === "update") {
 						const ifVersion = num(body, "ifVersion");
 						if (ifVersion === void 0 || ifVersion === null) throw new Error("Error: version_conflict: ifVersion required");
-						if (ifVersion !== task.version) throw new Error(`Error: version_conflict: stale version ${ifVersion} (current ${task.version})`);
-						const next = structuredClone(task);
-						const title = str(body, "title");
-						if (title !== null) next.title = normalizeTitle(title);
-						const description = str(body, "description");
-						if (description !== null) next.description = description.trim();
-						const prompt = str(body, "prompt");
-						if (prompt !== null) next.prompt = normalizePrompt(prompt);
-						const urgency = str(body, "urgency");
-						if (urgency !== null) next.urgency = asUrgency(urgency);
-						const workspaceId = str(body, "workspaceId");
-						if (workspaceId !== null) {
-							if (workspaces.get(workspaceId) === void 0) throw new Error("Error: not_found: unknown workspace");
-							next.workspaceId = workspaceId;
-						}
-						if (typeof body.blocked === "boolean") next.blocked = body.blocked;
-						if (body.execution !== void 0) next.execution = normalizeExecution(body.execution, options.now());
-						if (body.model === null) next.model = void 0;
-						else if (body.model !== void 0) next.model = checkModel(body.model, options.modelProviders);
-						const isolationRaw = str(body, "isolation");
-						if (isolationRaw !== null) {
-							if (task.executions.length > 0 || task.status === "in_progress") throw new Error("Error: invalid_input: isolation 已锁定（任务已有执行记录），不可修改");
-							next.isolation = asIsolation(isolationRaw);
-						}
-						if (body.presetId === null) delete next.presetId;
-						else if (body.presetId !== void 0) next.presetId = normalizePresetId(str(body, "presetId"));
-						if (body.checklist === null) delete next.checklist;
-						else if (body.checklist !== void 0) {
-							const items = normalizeChecklist(body.checklist);
-							if (items.length > 0) next.checklist = items;
-							else delete next.checklist;
-						}
-						next.version = task.version + 1;
-						next.updatedAt = options.now();
-						next.updatedBy = { kind: "user" };
+						let next;
 						await store.mutate("task-updated", (ledger) => {
-							const i = ledger.tasks.findIndex((t) => t.id === id);
-							ledger.tasks[i] = next;
+							const { index, task } = liveTaskAt(ledger, id);
+							if (ifVersion !== task.version) throw new Error(`Error: version_conflict: stale version ${ifVersion} (current ${task.version})`);
+							if (task.status === "archived") throw new Error("Error: invalid_transition: archived tasks are immutable");
+							next = structuredClone(task);
+							const title = str(body, "title");
+							if (title !== null) next.title = normalizeTitle(title);
+							const description = str(body, "description");
+							if (description !== null) next.description = description.trim();
+							const prompt = str(body, "prompt");
+							if (prompt !== null) next.prompt = normalizePrompt(prompt);
+							const urgency = str(body, "urgency");
+							if (urgency !== null) next.urgency = asUrgency(urgency);
+							const workspaceId = str(body, "workspaceId");
+							if (workspaceId !== null) {
+								if (workspaces.get(workspaceId) === void 0) throw new Error("Error: not_found: unknown workspace");
+								next.workspaceId = workspaceId;
+							}
+							if (typeof body.blocked === "boolean") next.blocked = body.blocked;
+							if (body.execution !== void 0) next.execution = normalizeExecution(body.execution, options.now());
+							if (body.model === null) next.model = void 0;
+							else if (body.model !== void 0) next.model = checkModel(body.model, options.modelProviders);
+							const isolationRaw = str(body, "isolation");
+							if (isolationRaw !== null) {
+								if (task.executions.length > 0 || task.status === "in_progress") throw new Error("Error: invalid_input: isolation 已锁定（任务已有执行记录），不可修改");
+								next.isolation = asIsolation(isolationRaw);
+							}
+							if (body.presetId === null) delete next.presetId;
+							else if (body.presetId !== void 0) next.presetId = normalizePresetId(str(body, "presetId"));
+							if (body.checklist === null) delete next.checklist;
+							else if (body.checklist !== void 0) {
+								const items = normalizeChecklist(body.checklist);
+								if (items.length > 0) next.checklist = items;
+								else delete next.checklist;
+							}
+							next.version = task.version + 1;
+							next.updatedAt = options.now();
+							next.updatedBy = { kind: "user" };
+							ledger.tasks[index] = next;
 							return [next];
 						});
 						json(res, {
@@ -425,19 +484,20 @@ function registerTaskboardRoutes(ctx, options) {
 						const ifVersion = num(body, "ifVersion");
 						const status = str(body, "status") ?? "";
 						if (ifVersion === void 0 || ifVersion === null) throw new Error("Error: version_conflict: ifVersion required");
-						if (ifVersion !== task.version) throw new Error(`Error: version_conflict: stale version ${ifVersion} (current ${task.version})`);
 						const to = asStatus(status);
-						if (!canTransition(task.status, to)) throw new Error(`Error: invalid_transition: illegal transition ${task.status} → ${to}`);
-						const next = structuredClone(task);
-						next.status = to;
-						next.version = task.version + 1;
-						next.updatedAt = options.now();
-						next.updatedBy = { kind: "user" };
-						if (task.status === "todo" && to === "in_progress") next.blocked = false;
-						syncClaim(next, to, options.now());
+						let next;
 						await store.mutate("task-moved", (ledger) => {
-							const i = ledger.tasks.findIndex((t) => t.id === id);
-							ledger.tasks[i] = next;
+							const { index, task } = liveTaskAt(ledger, id);
+							if (ifVersion !== task.version) throw new Error(`Error: version_conflict: stale version ${ifVersion} (current ${task.version})`);
+							if (!canTransition(task.status, to)) throw new Error(`Error: invalid_transition: illegal transition ${task.status} → ${to}`);
+							next = structuredClone(task);
+							next.status = to;
+							next.version = task.version + 1;
+							next.updatedAt = options.now();
+							next.updatedBy = { kind: "user" };
+							if (task.status === "todo" && to === "in_progress") next.blocked = false;
+							syncClaim(next, to, options.now());
+							ledger.tasks[index] = next;
 							return [next];
 						});
 						json(res, {
@@ -449,24 +509,25 @@ function registerTaskboardRoutes(ctx, options) {
 					if (action === "reject") {
 						const ifVersion = num(body, "ifVersion");
 						if (ifVersion === void 0 || ifVersion === null) throw new Error("Error: version_conflict: ifVersion required");
-						if (ifVersion !== task.version) throw new Error(`Error: version_conflict: stale version ${ifVersion} (current ${task.version})`);
-						if (!canTransition(task.status, "todo")) throw new Error(`Error: invalid_transition: illegal transition ${task.status} → todo`);
-						const next = structuredClone(task);
-						next.status = "todo";
-						next.version = task.version + 1;
-						next.updatedAt = options.now();
-						next.updatedBy = { kind: "user" };
-						syncClaim(next, "todo", options.now());
 						const commentText = str(body, "body") ?? "";
-						if (commentText.trim().length > 0) next.comments.push({
-							id: newCommentId(),
-							body: normalizeBody(commentText),
-							version: 1,
-							createdAt: options.now()
-						});
+						let next;
 						await store.mutate("task-moved", (ledger) => {
-							const i = ledger.tasks.findIndex((t) => t.id === id);
-							ledger.tasks[i] = next;
+							const { index, task } = liveTaskAt(ledger, id);
+							if (ifVersion !== task.version) throw new Error(`Error: version_conflict: stale version ${ifVersion} (current ${task.version})`);
+							if (!canTransition(task.status, "todo")) throw new Error(`Error: invalid_transition: illegal transition ${task.status} → todo`);
+							next = structuredClone(task);
+							next.status = "todo";
+							next.version = task.version + 1;
+							next.updatedAt = options.now();
+							next.updatedBy = { kind: "user" };
+							syncClaim(next, "todo", options.now());
+							if (commentText.trim().length > 0) next.comments.push({
+								id: newCommentId(),
+								body: normalizeBody(commentText),
+								version: 1,
+								createdAt: options.now()
+							});
+							ledger.tasks[index] = next;
 							return [next];
 						});
 						json(res, {
@@ -483,13 +544,14 @@ function registerTaskboardRoutes(ctx, options) {
 							version: 1,
 							createdAt: options.now()
 						};
-						const next = structuredClone(task);
-						next.comments.push(comment);
-						next.version = task.version + 1;
-						next.updatedAt = options.now();
 						await store.mutate("comment-added", (ledger) => {
-							const i = ledger.tasks.findIndex((t) => t.id === id);
-							ledger.tasks[i] = next;
+							const { index, task } = liveTaskAt(ledger, id);
+							if (task.status === "archived") throw new Error("Error: invalid_transition: archived tasks are immutable");
+							const next = structuredClone(task);
+							next.comments.push(comment);
+							next.version = task.version + 1;
+							next.updatedAt = options.now();
+							ledger.tasks[index] = next;
 							return [next];
 						});
 						json(res, {
@@ -505,16 +567,16 @@ function registerTaskboardRoutes(ctx, options) {
 								const ws = workspaces.get(task.workspaceId);
 								if (ws !== void 0) {
 									const path = worktreePathOf(ws.path, id);
+									if (!insideWorktreeScope(ws.path, path)) throw new Error("Error: invalid_input: 非法的清除路径（不在任务工作目录范围内）");
 									try {
-										await options.git.removeWorktree(ws.path, path);
-									} catch (error) {
-										const message = error instanceof Error ? error.message : String(error);
-										if (message.includes("未提交修改")) throw new Error(`Error: invalid_input: ${message}；请先处理这些改动（提交、续跑或手动保存）再物理清除任务`);
-										if (/not a working tree|not a working-tree/i.test(message)) await rm(path, {
+										if (await options.git.removeWorktree(ws.path, path) === "unregistered") await rm(path, {
 											recursive: true,
 											force: true
 										});
-										else throw new Error(`Error: invalid_input: ${message}`);
+									} catch (error) {
+										const message = error instanceof Error ? error.message : String(error);
+										if (error.code === "dirty-worktree" || message.includes("未提交修改")) throw new Error(`Error: invalid_input: ${message}；请先处理这些改动（提交、续跑或手动保存）再物理清除任务`);
+										throw new Error(`Error: invalid_input: ${message}`);
 									}
 									if (task.branch !== void 0) try {
 										await options.git.deleteBranch(ws.path, task.branch);
@@ -533,13 +595,17 @@ function registerTaskboardRoutes(ctx, options) {
 						}
 						const ifVersion = num(body, "ifVersion");
 						if (ifVersion === void 0 || ifVersion === null) throw new Error("Error: version_conflict: ifVersion required");
-						if (ifVersion !== task.version) throw new Error(`Error: version_conflict: stale version ${ifVersion} (current ${task.version})`);
-						const next = structuredClone(task);
-						next.trashedAt = options.now();
-						next.version = task.version + 1;
 						await store.mutate("task-deleted", (ledger) => {
-							const i = ledger.tasks.findIndex((t) => t.id === id);
-							ledger.tasks[i] = next;
+							const { index, task } = liveTaskAt(ledger, id);
+							if (ifVersion !== task.version) throw new Error(`Error: version_conflict: stale version ${ifVersion} (current ${task.version})`);
+							if (task.executions.some((e) => e.outcome === "running")) throw new Error("Error: invalid_input: 任务有正在运行的执行，请先取消或等它结束再删除");
+							const next = structuredClone(task);
+							next.trashedAt = options.now();
+							next.version = task.version + 1;
+							delete next.claimedBy;
+							delete next.claimedAt;
+							next.blocked = false;
+							ledger.tasks[index] = next;
 							return [next];
 						});
 						json(res, {
@@ -620,13 +686,13 @@ function registerTaskboardRoutes(ctx, options) {
 							version: 1,
 							createdAt: options.now()
 						};
-						const next = structuredClone(task);
-						next.comments.push(mergedComment);
-						next.version = task.version + 1;
-						next.updatedAt = options.now();
 						await store.mutate("comment-added", (ledger) => {
-							const i = ledger.tasks.findIndex((t) => t.id === id);
-							ledger.tasks[i] = next;
+							const { index, task: fresh } = liveTaskAt(ledger, id);
+							const next = structuredClone(fresh);
+							next.comments.push(mergedComment);
+							next.version = fresh.version + 1;
+							next.updatedAt = options.now();
+							ledger.tasks[index] = next;
 							return [next];
 						});
 						json(res, {
@@ -647,8 +713,12 @@ function registerTaskboardRoutes(ctx, options) {
 						const ws = workspaces.get(task.workspaceId);
 						if (ws === void 0) throw new Error("Error: not_found: unknown workspace");
 						const path = worktreePathOf(ws.path, id);
+						if (!insideWorktreeScope(ws.path, path)) throw new Error("Error: invalid_input: 非法的清除路径（不在任务工作目录范围内）");
 						try {
-							await options.git.removeWorktree(ws.path, path);
+							if (await options.git.removeWorktree(ws.path, path) === "unregistered") await rm(path, {
+								recursive: true,
+								force: true
+							});
 						} catch (error) {
 							throw new Error(`Error: invalid_input: ${error instanceof Error ? error.message : String(error)}`);
 						}
@@ -690,15 +760,14 @@ function registerTaskboardRoutes(ctx, options) {
 					if (ws === void 0) throw new Error("Error: not_found: unknown workspace");
 					if (store.get(taskId) !== void 0) throw new Error("Error: invalid_input: 任务仍在看板中，请从任务详情页删除其 worktree");
 					const path = worktreePathOf(ws.path, taskId);
+					if (!insideWorktreeScope(ws.path, path)) throw new Error("Error: invalid_input: 非法的清除路径（不在任务工作目录范围内）");
 					try {
-						await options.git.removeWorktree(ws.path, path);
-					} catch (error) {
-						const message = error instanceof Error ? error.message : String(error);
-						if (/not a working tree|not a working-tree/i.test(message)) await rm(path, {
+						if (await options.git.removeWorktree(ws.path, path) === "unregistered") await rm(path, {
 							recursive: true,
 							force: true
 						});
-						else throw new Error(`Error: invalid_input: ${message}`);
+					} catch (error) {
+						throw new Error(`Error: invalid_input: ${error instanceof Error ? error.message : String(error)}`);
 					}
 					json(res, {
 						ok: true,
@@ -715,7 +784,8 @@ function registerTaskboardRoutes(ctx, options) {
 			}
 			if (pathname === `/dsh-taskboard/import/preview`) {
 				try {
-					const plan = validateLedgerImport(body, new Set(store.snapshot().tasks.map((t) => t.id)), options.now());
+					const known = new Set(store.snapshot().tasks.map((t) => t.id));
+					const plan = validateLedgerImport(body, known, options.now());
 					json(res, {
 						ok: true,
 						value: { plan: {
@@ -748,14 +818,21 @@ function registerTaskboardRoutes(ctx, options) {
 					let backupFile;
 					if (mode === "replace" && store.snapshot().tasks.length > 0) backupFile = await store.backup();
 					let replacedTotal;
-					await store.mutate("task-created", (ledger) => {
+					await store.mutate("ledger-replaced", (ledger) => {
 						if (mode === "replace") {
+							if (ledger.tasks.some((t) => t.executions.some((e) => e.outcome === "running"))) throw new Error("Error: invalid_input: 有任务正在执行，不能整册替换（请先取消或等待结束）");
 							replacedTotal = ledger.tasks.length;
 							ledger.tasks = structuredClone(imported);
+							if (plan.settings !== void 0) ledger.settings = structuredClone(plan.settings);
+							else delete ledger.settings;
 							return ledger.tasks;
 						}
 						const byId = new Map(ledger.tasks.map((t) => [t.id, t]));
-						for (const task of imported) byId.set(task.id, structuredClone(task));
+						for (const task of imported) {
+							const existing = byId.get(task.id);
+							if (existing !== void 0 && existing.executions.some((e) => e.outcome === "running")) throw new Error(`Error: invalid_input: 任务 ${task.id} 正在执行，不能被导入覆盖`);
+							byId.set(task.id, structuredClone(task));
+						}
 						ledger.tasks = [...byId.values()];
 						return structuredClone(imported);
 					});
@@ -797,7 +874,7 @@ function registerTaskboardRoutes(ctx, options) {
 						value: await options.templates.upsert({
 							id: str(body, "id") ?? void 0,
 							name,
-							task: normalizeTemplateSpec(body.task)
+							task: normalizeTemplateSpec(body.task, options.now())
 						})
 					}, 201);
 				} catch (error) {
@@ -806,6 +883,23 @@ function registerTaskboardRoutes(ctx, options) {
 				}
 				return;
 			}
+			if (pathname === `/dsh-taskboard/settings/update`) {
+				try {
+					const next = asBoardSettings(body);
+					await store.mutate("settings-updated", (ledger) => {
+						ledger.settings = next;
+						return [];
+					});
+					json(res, {
+						ok: true,
+						value: next
+					});
+				} catch (error) {
+					const f = toFail(error);
+					json(res, f.res, f.status);
+				}
+				return;
+			}
 			res.writeHead(404);
 			res.end();
 		} catch (error) {
@@ -822,6 +916,9 @@ function registerTaskboardRoutes(ctx, options) {
 		res.write("retry: 2000\n\n");
 		res.write(`event: hello\ndata: ${JSON.stringify({ revision: store.snapshot().revision })}\n\n`);
 		subscribers.add(res);
+		res.on("error", () => {
+			subscribers.delete(res);
+		});
 		if (heartbeat === void 0) heartbeat = setInterval(() => {
 			for (const current of subscribers) current.write(": ping\n\n");
 		}, HEARTBEAT_MS);
@@ -843,6 +940,7 @@ function registerTaskboardRoutes(ctx, options) {
 		handler: sse
 	})];
 	return () => {
+		unsubscribeBroadcast();
 		for (const dispose of disposers) dispose();
 		if (heartbeat !== void 0) clearInterval(heartbeat);
 		for (const res of subscribers) res.end();