kanbaii 0.1.2 → 0.2.0

package/dist/server/routes/tasks.js

@@ -111,4 +111,3 @@ router.delete('/:taskId', (req, res) => {
     }
 });
 exports.default = router;
-//# sourceMappingURL=tasks.js.map

package/dist/server/routes/teams.d.ts

@@ -1,3 +1,2 @@
 declare const router: import("express-serve-static-core").Router;
 export default router;
-//# sourceMappingURL=teams.d.ts.map

package/dist/server/routes/teams.js

@@ -88,4 +88,3 @@ router.get('/workers', (_req, res) => {
     res.json({ ok: true, data: (0, workerPool_1.getPoolStatus)() });
 });
 exports.default = router;
-//# sourceMappingURL=teams.js.map

package/dist/server/routes/terminal.d.ts

@@ -1,3 +1,2 @@
 declare const router: import("express-serve-static-core").Router;
 export default router;
-//# sourceMappingURL=terminal.d.ts.map

package/dist/server/routes/terminal.js

@@ -82,4 +82,3 @@ router.post('/reset', (req, res) => {
     res.json({ ok: true });
 });
 exports.default = router;
-//# sourceMappingURL=terminal.js.map

package/dist/server/routes/voice.d.ts

@@ -1,3 +1,2 @@
 declare const router: import("express-serve-static-core").Router;
 export default router;
-//# sourceMappingURL=voice.d.ts.map

package/dist/server/routes/voice.js

@@ -64,4 +64,3 @@ router.post('/transcribe', express_2.default.raw({ type: '*/*', limit: '10mb' })
     apiReq.end();
 });
 exports.default = router;
-//# sourceMappingURL=voice.js.map

package/dist/server/routes/workItems.d.ts

@@ -1,3 +1,2 @@
 declare const router: import("express-serve-static-core").Router;
 export default router;
-//# sourceMappingURL=workItems.d.ts.map

package/dist/server/routes/workItems.js

@@ -82,6 +82,17 @@ router.patch('/:wiId', (req, res) => {
         throw err;
     }
 });
+// POST /api/projects/:slug/work-items/:wiId/reorder
+router.post('/:wiId/reorder', (req, res) => {
+    const { order } = req.body;
+    if (typeof order !== 'number')
+        return res.status(400).json({ ok: false, error: 'order (number) required' });
+    const item = workItemStore.reorderWorkItem(req.params.slug, req.params.wiId, order);
+    if (!item)
+        return res.status(404).json({ ok: false, error: 'Work item not found' });
+    (0, typedEmit_1.emit)('workItem:updated', { projectSlug: req.params.slug, workItem: item });
+    res.json({ ok: true, data: item });
+});
 // DELETE /api/projects/:slug/work-items/:wiId
 router.delete('/:wiId', (req, res) => {
     try {
@@ -97,4 +108,3 @@ router.delete('/:wiId', (req, res) => {
     }
 });
 exports.default = router;
-//# sourceMappingURL=workItems.js.map

package/dist/server/services/agentRegistry.d.ts

@@ -18,4 +18,3 @@ export declare function suggestAgent(taskTags: string[]): {
     score: number;
     matchCount: number;
 } | null;
-//# sourceMappingURL=agentRegistry.d.ts.map

package/dist/server/services/agentRegistry.js

@@ -147,4 +147,3 @@ function suggestAgent(taskTags) {
     }
     return best;
 }
-//# sourceMappingURL=agentRegistry.js.map

package/dist/server/services/authService.d.ts

@@ -22,4 +22,3 @@ export declare function login(username: string, password: string): {
 };
 export declare function verifyToken(token: string): TokenPayload | null;
 export declare function hasUsers(): boolean;
-//# sourceMappingURL=authService.d.ts.map

package/dist/server/services/authService.js

@@ -24,7 +24,12 @@ function generateSalt() {
 // ─── JWT-like tokens (simple HMAC-based, no jsonwebtoken dependency) ───
 function getSecret() {
     const auth = (0, settingsService_1.getSection)('auth');
-    return auth.secret || 'kanbaii-default-secret-change-me';
+    if (!auth.secret || auth.secret === 'kanbaii-default-secret-change-me') {
+        const generated = crypto_1.default.randomBytes(32).toString('hex');
+        (0, settingsService_1.updateSection)('auth', { secret: generated });
+        return generated;
+    }
+    return auth.secret;
 }
 function base64url(str) {
     return Buffer.from(str).toString('base64url');
@@ -73,6 +78,9 @@ function isAuthEnabled() {
     return (0, settingsService_1.getSection)('auth').enabled;
 }
 function register(username, password) {
+    if (password.length < 8) {
+        throw new Error('Password must be at least 8 characters');
+    }
     const users = readUsers();
     if (users.find(u => u.username === username)) {
         throw new Error('Username already exists');
@@ -121,4 +129,3 @@ function parseExpiry(str) {
         default: return 86400;
     }
 }
-//# sourceMappingURL=authService.js.map

package/dist/server/services/claudeUsage.d.ts

@@ -12,4 +12,3 @@ export declare function getCachedUsage(): ClaudeUsageData | null;
 export declare function fetchClaudeUsage(): Promise<void>;
 export declare function startPolling(intervalMs?: number): void;
 export declare function stopPolling(): void;
-//# sourceMappingURL=claudeUsage.d.ts.map

package/dist/server/services/claudeUsage.js

@@ -15,6 +15,9 @@ const typedEmit_1 = require("../lib/typedEmit");
 // ─── Cache ───
 let usageCache = null;
 let pollInterval = null;
+// ─── Backoff ───
+let _backoffMs = 0;
+const MAX_BACKOFF = 5 * 60 * 1000; // 5 minutes max
 function getCachedUsage() {
     return usageCache;
 }
@@ -77,7 +80,8 @@ function fetchClaudeUsage() {
             res.on('data', (c) => (data += c));
             res.on('end', () => {
                 if (res.statusCode === 429) {
-                    console.warn('[claude-usage] Rate limited (429), waiting for next poll');
+                    _backoffMs = Math.min((_backoffMs || 15000) * 2, MAX_BACKOFF);
+                    console.warn(`[claude-usage] Rate limited, backing off ${Math.round(_backoffMs / 1000)}s`);
                     resolve();
                     return;
                 }
@@ -122,6 +126,7 @@ function fetchClaudeUsage() {
                         });
                     }
                     usageCache = { entries, timestamp: new Date().toISOString() };
+                    _backoffMs = 0;
                     // Broadcast via Socket.IO
                     try {
                         (0, typedEmit_1.getIO)().emit('claude-usage', usageCache);
@@ -132,23 +137,43 @@ function fetchClaudeUsage() {
                 resolve();
             });
         });
-        req.on('error', (err) => { console.warn(`[claude-usage] Request error: ${err.message}`); resolve(); });
+        req.on('error', (err) => {
+            _backoffMs = Math.min((_backoffMs || 15000) * 2, MAX_BACKOFF);
+            console.warn(`[claude-usage] Request error: ${err.message}, backing off ${Math.round(_backoffMs / 1000)}s`);
+            resolve();
+        });
         req.setTimeout(15000, () => { console.warn('[claude-usage] Request timeout (15s)'); req.destroy(); resolve(); });
         req.end();
     });
 }
 // ─── Polling ───
+let _pollActive = false;
+let _pollTimer = null;
 function startPolling(intervalMs = 60000) {
-    if (pollInterval)
+    if (_pollActive)
         return;
-    fetchClaudeUsage(); // Immediate first fetch
-    pollInterval = setInterval(() => fetchClaudeUsage(), intervalMs);
-    console.log(`[claude-usage] Polling started (${intervalMs / 1000}s interval)`);
+    _pollActive = true;
+    console.log(`[claude-usage] Polling started (${intervalMs / 1000}s base interval)`);
+    const poll = async () => {
+        if (!_pollActive)
+            return;
+        await fetchClaudeUsage();
+        if (!_pollActive)
+            return;
+        const delay = _backoffMs > 0 ? _backoffMs : intervalMs;
+        _pollTimer = setTimeout(poll, delay);
+    };
+    poll(); // Immediate first fetch
 }
 function stopPolling() {
+    _pollActive = false;
+    if (_pollTimer) {
+        clearTimeout(_pollTimer);
+        _pollTimer = null;
+    }
+    // Legacy: clear interval reference if any
     if (pollInterval) {
         clearInterval(pollInterval);
         pollInterval = null;
     }
 }
-//# sourceMappingURL=claudeUsage.js.map

package/dist/server/services/costTracker.d.ts

@@ -41,4 +41,3 @@ export declare function listExecutions(opts?: {
 }): ExecutionRecord[];
 export declare function getSummary(projectSlug?: string): CostSummary;
 export declare function clearExecutions(projectSlug?: string): void;
-//# sourceMappingURL=costTracker.d.ts.map

package/dist/server/services/costTracker.js

@@ -116,4 +116,3 @@ function clearExecutions(projectSlug) {
         writeUsage({ executions: [] });
     }
 }
-//# sourceMappingURL=costTracker.js.map

package/dist/server/services/escalationService.d.ts

@@ -28,4 +28,3 @@ export declare function getEscalationStatus(): {
     responded: boolean;
 };
 export declare function clearEscalation(): void;
-//# sourceMappingURL=escalationService.d.ts.map

package/dist/server/services/escalationService.js

@@ -1,4 +1,7 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.setSourceOverride = setSourceOverride;
 exports.createEscalation = createEscalation;
@@ -6,6 +9,7 @@ exports.respondToEscalation = respondToEscalation;
 exports.getPendingEscalation = getPendingEscalation;
 exports.getEscalationStatus = getEscalationStatus;
 exports.clearEscalation = clearEscalation;
+const crypto_1 = __importDefault(require("crypto"));
 const typedEmit_1 = require("../lib/typedEmit");
 const telegramService_1 = require("./telegramService");
 const settingsService_1 = require("./settingsService");
@@ -18,7 +22,7 @@ function setSourceOverride(source) { sourceOverride = source; }
 // ─── API ───
 function createEscalation(data) {
     const escalation = {
-        id: `esc-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`,
+        id: `esc-${crypto_1.default.randomBytes(12).toString('hex')}`,
         source: sourceOverride || data.source,
         taskId: data.taskId,
         taskTitle: data.taskTitle,
@@ -118,4 +122,3 @@ function clearEscalation() {
     }
     timeoutHandles.clear();
 }
-//# sourceMappingURL=escalationService.js.map

package/dist/server/services/mcpConfig.d.ts

@@ -28,4 +28,3 @@ export declare function testServer(name: string): Promise<{
  * @param onlyKanbaii If true, only include the KANBAII escalation server (fast). Default: true.
  */
 export declare function generateMcpConfigForClaude(onlyKanbaii?: boolean): string | null;
-//# sourceMappingURL=mcpConfig.d.ts.map

package/dist/server/services/mcpConfig.js

@@ -122,7 +122,7 @@ async function testServer(name) {
         }, 3000);
         const proc = spawn(server.command, server.args || [], {
             env: { ...process.env, ...server.env },
-            shell: true,
+            windowsHide: true,
             stdio: ['pipe', 'pipe', 'pipe'],
         });
         proc.on('error', (err) => {
@@ -171,4 +171,3 @@ function generateMcpConfigForClaude(onlyKanbaii = true) {
     fs_1.default.writeFileSync(tmpFile, JSON.stringify({ mcpServers: mcpConfig }, null, 2), 'utf-8');
     return tmpFile;
 }
-//# sourceMappingURL=mcpConfig.js.map

package/dist/server/services/pluginLoader.d.ts

@@ -36,4 +36,3 @@ export interface PluginEntry {
 export declare function scanPlugins(): PluginEntry[];
 export declare function togglePlugin(name: string, enabled: boolean): void;
 export declare function runHook(hookName: keyof PluginHooks, ctx: any): Promise<void>;
-//# sourceMappingURL=pluginLoader.d.ts.map

package/dist/server/services/pluginLoader.js

@@ -41,6 +41,25 @@ function scanPlugins() {
     for (const file of files) {
         try {
             const fullPath = path_1.default.join(PLUGINS_DIR, file);
+            // Validate plugin is within plugins directory
+            const resolvedPath = path_1.default.resolve(fullPath);
+            if (!resolvedPath.startsWith(path_1.default.resolve(PLUGINS_DIR))) {
+                console.warn(`[plugins] Rejected plugin outside plugins dir: ${file}`);
+                continue;
+            }
+            // Check for dangerous patterns
+            const content = fs_1.default.readFileSync(fullPath, 'utf-8');
+            const dangerousPatterns = [
+                /child_process/,
+                /require\s*\(\s*['"]fs['"]\s*\)/,
+                /process\.exit/,
+                /eval\s*\(/,
+                /Function\s*\(/,
+            ];
+            const hasDangerous = dangerousPatterns.some(p => p.test(content));
+            if (hasDangerous) {
+                console.warn(`[plugins] Plugin ${file} uses restricted APIs — loading with warning`);
+            }
             // Clear require cache for hot-reload
             delete require.cache[require.resolve(fullPath)];
             const mod = require(fullPath);
@@ -90,4 +109,3 @@ async function runHook(hookName, ctx) {
 }
 // Initial scan
 scanPlugins();
-//# sourceMappingURL=pluginLoader.js.map

package/dist/server/services/projectStore.d.ts

@@ -4,4 +4,3 @@ export declare function getProject(slug: string): Project | null;
 export declare function createProject(input: unknown): Project;
 export declare function updateProject(slug: string, input: unknown): Project;
 export declare function deleteProject(slug: string): void;
-//# sourceMappingURL=projectStore.d.ts.map

package/dist/server/services/projectStore.js

@@ -12,6 +12,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const schemas_1 = require("../lib/schemas");
 const generateId_1 = require("../lib/generateId");
+const safePath_1 = require("../lib/safePath");
 const DATA_DIR = path_1.default.resolve(process.env.KANBAII_DATA_DIR || path_1.default.join(process.cwd(), 'data', 'projects'));
 function ensureDir(dir) {
     if (!fs_1.default.existsSync(dir)) {
@@ -19,7 +20,7 @@ function ensureDir(dir) {
     }
 }
 function projectDir(slug) {
-    return path_1.default.join(DATA_DIR, slug);
+    return (0, safePath_1.safePath)(DATA_DIR, slug);
 }
 function projectFile(slug) {
     return path_1.default.join(projectDir(slug), 'project.json');
@@ -120,4 +121,3 @@ function deleteProject(slug) {
     };
     writeProject(updated);
 }
-//# sourceMappingURL=projectStore.js.map

package/dist/server/services/schedulerService.d.ts

@@ -50,4 +50,3 @@ export declare function getSchedulerStatus(): {
     runningNow: number;
     nextDue: string | null;
 };
-//# sourceMappingURL=schedulerService.d.ts.map

package/dist/server/services/schedulerService.js

@@ -275,4 +275,3 @@ function getSchedulerStatus() {
         nextDue: next?.nextRun || null,
     };
 }
-//# sourceMappingURL=schedulerService.js.map

package/dist/server/services/settingsService.d.ts

@@ -41,4 +41,3 @@ export declare function getSettings(): AppSettings;
 export declare function updateSettings(partial: Partial<AppSettings>): AppSettings;
 export declare function getSection<K extends keyof AppSettings>(key: K): AppSettings[K];
 export declare function updateSection<K extends keyof AppSettings>(key: K, value: Partial<AppSettings[K]>): AppSettings;
-//# sourceMappingURL=settingsService.d.ts.map

package/dist/server/services/settingsService.js

@@ -9,6 +9,7 @@ exports.getSection = getSection;
 exports.updateSection = updateSection;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
+const secretsEncryption_1 = require("../lib/secretsEncryption");
 const DATA_DIR = path_1.default.resolve(process.env.KANBAII_DATA_DIR || path_1.default.join(process.cwd(), 'data', 'projects'));
 const SETTINGS_FILE = path_1.default.join(DATA_DIR, '..', '.settings.json');
 const DEFAULTS = {
@@ -59,7 +60,27 @@ function getSettings() {
     try {
         if (fs_1.default.existsSync(SETTINGS_FILE)) {
             const saved = JSON.parse(fs_1.default.readFileSync(SETTINGS_FILE, 'utf-8'));
-            return deepMerge(DEFAULTS, saved);
+            const settings = deepMerge(DEFAULTS, saved);
+            // Auto-decrypt sensitive fields
+            if (settings.integrations.telegram.botToken) {
+                try {
+                    settings.integrations.telegram.botToken = (0, secretsEncryption_1.decrypt)(settings.integrations.telegram.botToken);
+                }
+                catch { }
+            }
+            if (settings.integrations.voice.openaiApiKey) {
+                try {
+                    settings.integrations.voice.openaiApiKey = (0, secretsEncryption_1.decrypt)(settings.integrations.voice.openaiApiKey);
+                }
+                catch { }
+            }
+            if (settings.auth.secret && (0, secretsEncryption_1.isEncrypted)(settings.auth.secret)) {
+                try {
+                    settings.auth.secret = (0, secretsEncryption_1.decrypt)(settings.auth.secret);
+                }
+                catch { }
+            }
+            return settings;
         }
     }
     catch { }
@@ -71,7 +92,18 @@ function updateSettings(partial) {
     const dir = path_1.default.dirname(SETTINGS_FILE);
     if (!fs_1.default.existsSync(dir))
         fs_1.default.mkdirSync(dir, { recursive: true });
-    fs_1.default.writeFileSync(SETTINGS_FILE, JSON.stringify(merged, null, 2), 'utf-8');
+    // Auto-encrypt sensitive fields before saving
+    const toSave = JSON.parse(JSON.stringify(merged)); // deep clone
+    if (toSave.integrations?.telegram?.botToken && !(0, secretsEncryption_1.isEncrypted)(toSave.integrations.telegram.botToken)) {
+        toSave.integrations.telegram.botToken = (0, secretsEncryption_1.encrypt)(toSave.integrations.telegram.botToken);
+    }
+    if (toSave.integrations?.voice?.openaiApiKey && !(0, secretsEncryption_1.isEncrypted)(toSave.integrations.voice.openaiApiKey)) {
+        toSave.integrations.voice.openaiApiKey = (0, secretsEncryption_1.encrypt)(toSave.integrations.voice.openaiApiKey);
+    }
+    if (toSave.auth?.secret && !(0, secretsEncryption_1.isEncrypted)(toSave.auth.secret)) {
+        toSave.auth.secret = (0, secretsEncryption_1.encrypt)(toSave.auth.secret);
+    }
+    fs_1.default.writeFileSync(SETTINGS_FILE, JSON.stringify(toSave, null, 2), 'utf-8');
     return merged;
 }
 function getSection(key) {
@@ -82,4 +114,3 @@ function updateSection(key, value) {
     current[key] = deepMerge(current[key], value);
     return updateSettings(current);
 }
-//# sourceMappingURL=settingsService.js.map

package/dist/server/services/skillsRegistry.d.ts

@@ -15,4 +15,3 @@ export declare function toggleSkill(name: string, enabled: boolean): void;
  * Build a system prompt from all enabled skills for Claude CLI --append-system-prompt
  */
 export declare function buildSkillsPrompt(): string | null;
-//# sourceMappingURL=skillsRegistry.d.ts.map

package/dist/server/services/skillsRegistry.js

@@ -74,4 +74,3 @@ function buildSkillsPrompt() {
     const sections = enabled.map((s) => `## Skill: ${s.name}\n${s.description}\n\n${s.promptTemplate}`);
     return `# Active Skills\n\n${sections.join('\n\n---\n\n')}`;
 }
-//# sourceMappingURL=skillsRegistry.js.map

package/dist/server/services/soulStore.d.ts

@@ -43,4 +43,3 @@ export declare function getConfig(projectSlug: string): SoulConfig;
 export declare function updateConfig(projectSlug: string, config: Partial<SoulConfig>): SoulConfig;
 export declare function getHealth(projectSlug: string): HealthMetrics;
 export declare function updateHealth(projectSlug: string, metrics: Partial<HealthMetrics>): HealthMetrics;
-//# sourceMappingURL=soulStore.d.ts.map

package/dist/server/services/soulStore.js

@@ -215,4 +215,3 @@ function updateHealth(projectSlug, metrics) {
     updateDocument(projectSlug, 'HEALTH.md', healthMd);
     return updated;
 }
-//# sourceMappingURL=soulStore.js.map

package/dist/server/services/telegramService.d.ts

@@ -13,4 +13,3 @@ export declare function notifyRalphStarted(projectSlug: string, taskCount: numbe
 export declare function notifyRalphCompleted(projectSlug: string, completed: number, failed: number): void;
 export declare function notifyTeamsStarted(projectSlug: string, wiCount: number): void;
 export declare function notifyError(projectSlug: string, message: string): void;
-//# sourceMappingURL=telegramService.d.ts.map

package/dist/server/services/telegramService.js

@@ -141,4 +141,3 @@ function notifyTeamsStarted(projectSlug, wiCount) {
 function notifyError(projectSlug, message) {
     sendMessage(`🔴 *Error* on \`${projectSlug}\`\n${message}`).catch(() => { });
 }
-//# sourceMappingURL=telegramService.js.map

package/dist/server/services/terminalManager.d.ts

@@ -21,4 +21,3 @@ export declare function sendInput(projectSlug: string, data: string): void;
 export declare function resizeTerminal(projectSlug: string, cols: number, rows: number): void;
 export declare function killSession(projectSlug: string): void;
 export declare function resetSession(projectSlug: string): void;
-//# sourceMappingURL=terminalManager.d.ts.map

package/dist/server/services/terminalManager.js

@@ -34,7 +34,9 @@ function spawnPty(projectSlug, workingDir, opts) {
         throw new Error('node-pty not available. Install: npm install node-pty');
     const isWindows = process.platform === 'win32';
     const shell = isWindows ? 'cmd.exe' : '/bin/bash';
-    const claudeCmd = `claude${opts?.model ? ` --model ${opts.model}` : ''}`;
+    const validModels = ['opus', 'sonnet', 'haiku'];
+    const model = opts?.model && validModels.includes(opts.model) ? opts.model : undefined;
+    const claudeCmd = `claude${model ? ` --model ${model}` : ''}`;
     const shellArgs = isWindows ? ['/c', claudeCmd] : ['-c', claudeCmd];
     const cleanEnv = { ...process.env };
     delete cleanEnv.CLAUDECODE;
@@ -82,4 +84,3 @@ function resetSession(projectSlug) {
     killSession(projectSlug);
     sessions.delete(projectSlug);
 }
-//# sourceMappingURL=terminalManager.js.map

package/dist/server/services/workItemStore.d.ts

@@ -20,15 +20,21 @@ export declare function deleteTask(projectSlug: string, wiIdOrSlug: string, task
  */
 export declare function activateWorkItemIfNeeded(projectSlug: string, wiIdOrSlug: string): WorkItem | null;
 /**
- * Check if all tasks in a work item are in 'review' or 'done' columns
- * (nothing left in backlog, todo, in-progress). If so, move status to 'review'.
- * Only promotes from 'active' → 'review', never from 'review' or 'done'.
+ * Auto-sync work item status based on task distribution:
+ * - active → review: when all tasks are in review or done (nothing in backlog/todo/in-progress)
+ * - review → done: when ALL tasks are in done column
+ * - review → active: if tasks move back to pending columns
  */
+export declare function syncWorkItemStatus(projectSlug: string, wiIdOrSlug: string): WorkItem | null;
+/** @deprecated Use syncWorkItemStatus instead */
 export declare function promoteWorkItemIfComplete(projectSlug: string, wiIdOrSlug: string): WorkItem | null;
+/**
+ * Reorder a work item within its status column.
+ */
+export declare function reorderWorkItem(projectSlug: string, wiIdOrSlug: string, newOrder: number): WorkItem | null;
 export declare function getTaskCounts(wi: WorkItem): Record<TaskColumnName, number>;
 export declare function getProgress(wi: WorkItem): {
     completed: number;
     total: number;
     percent: number;
 };
-//# sourceMappingURL=workItemStore.d.ts.map

package/dist/server/services/workItemStore.js

@@ -13,7 +13,9 @@ exports.updateTask = updateTask;
 exports.moveTask = moveTask;
 exports.deleteTask = deleteTask;
 exports.activateWorkItemIfNeeded = activateWorkItemIfNeeded;
+exports.syncWorkItemStatus = syncWorkItemStatus;
 exports.promoteWorkItemIfComplete = promoteWorkItemIfComplete;
+exports.reorderWorkItem = reorderWorkItem;
 exports.getTaskCounts = getTaskCounts;
 exports.getProgress = getProgress;
 const fs_1 = __importDefault(require("fs"));
@@ -22,12 +24,13 @@ const types_1 = require("../../shared/types");
 const schemas_1 = require("../lib/schemas");
 const generateId_1 = require("../lib/generateId");
 const types_2 = require("../../shared/types");
+const safePath_1 = require("../lib/safePath");
 const DATA_DIR = path_1.default.resolve(process.env.KANBAII_DATA_DIR || path_1.default.join(process.cwd(), 'data', 'projects'));
 function workItemsDir(projectSlug) {
-    return path_1.default.join(DATA_DIR, projectSlug, 'work-items');
+    return (0, safePath_1.safePath)(DATA_DIR, projectSlug, 'work-items');
 }
-function workItemFile(projectSlug, wiSlug) {
-    return path_1.default.join(workItemsDir(projectSlug), `${wiSlug}.json`);
+function workItemFile(projectSlug, slug) {
+    return (0, safePath_1.safePath)(DATA_DIR, projectSlug, 'work-items', `${slug}.json`);
 }
 function ensureDir(dir) {
     if (!fs_1.default.existsSync(dir)) {
@@ -95,7 +98,7 @@ function listWorkItems(projectSlug) {
         if (wi)
             items.push(wi);
     }
-    return items.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
+    return items.sort((a, b) => (a.order ?? 999) - (b.order ?? 999) || b.updatedAt.localeCompare(a.updatedAt));
 }
 function getWorkItem(projectSlug, idOrSlug) {
     return findWorkItemByIdOrSlug(projectSlug, idOrSlug);
@@ -245,7 +248,10 @@ function moveTask(projectSlug, wiIdOrSlug, taskId, input) {
     targetCol.splice(insertIdx, 0, task);
     wi.updatedAt = now;
     writeWorkItem(projectSlug, wi);
-    return wi;
+    // Auto-sync work item status based on task distribution
+    syncWorkItemStatus(projectSlug, wiIdOrSlug);
+    // Re-read after potential status change
+    return findWorkItemByIdOrSlug(projectSlug, wiIdOrSlug) || wi;
 }
 function deleteTask(projectSlug, wiIdOrSlug, taskId) {
     const wi = findWorkItemByIdOrSlug(projectSlug, wiIdOrSlug);
@@ -276,30 +282,62 @@ function activateWorkItemIfNeeded(projectSlug, wiIdOrSlug) {
     return wi;
 }
 /**
- * Check if all tasks in a work item are in 'review' or 'done' columns
- * (nothing left in backlog, todo, in-progress). If so, move status to 'review'.
- * Only promotes from 'active' → 'review', never from 'review' or 'done'.
+ * Auto-sync work item status based on task distribution:
+ * - active → review: when all tasks are in review or done (nothing in backlog/todo/in-progress)
+ * - review → done: when ALL tasks are in done column
+ * - review → active: if tasks move back to pending columns
  */
-function promoteWorkItemIfComplete(projectSlug, wiIdOrSlug) {
+function syncWorkItemStatus(projectSlug, wiIdOrSlug) {
     const wi = findWorkItemByIdOrSlug(projectSlug, wiIdOrSlug);
     if (!wi)
         return null;
-    if (wi.status !== 'active')
+    if (wi.status === 'planning' || wi.status === 'done')
+        return wi;
+    const backlog = wi.columns['backlog'].length;
+    const todo = wi.columns['todo'].length;
+    const inProgress = wi.columns['in-progress'].length;
+    const review = wi.columns['review'].length;
+    const done = wi.columns['done'].length;
+    const total = backlog + todo + inProgress + review + done;
+    const pending = backlog + todo + inProgress;
+    if (total === 0)
         return wi;
-    const pendingCount = wi.columns['backlog'].length +
-        wi.columns['todo'].length +
-        wi.columns['in-progress'].length;
-    const totalTasks = pendingCount +
-        wi.columns['review'].length +
-        wi.columns['done'].length;
-    // Only promote if there are tasks and none are pending
-    if (totalTasks > 0 && pendingCount === 0) {
-        wi.status = 'review';
+    let newStatus = wi.status;
+    if (done === total) {
+        // ALL tasks done → work item done
+        newStatus = 'done';
+    }
+    else if (pending === 0) {
+        // No pending tasks (all in review/done) → work item review
+        newStatus = 'review';
+    }
+    else if (wi.status === 'review' && pending > 0) {
+        // Tasks moved back to pending → revert to active
+        newStatus = 'active';
+    }
+    if (newStatus !== wi.status) {
+        wi.status = newStatus;
         wi.updatedAt = new Date().toISOString();
         writeWorkItem(projectSlug, wi);
     }
     return wi;
 }
+/** @deprecated Use syncWorkItemStatus instead */
+function promoteWorkItemIfComplete(projectSlug, wiIdOrSlug) {
+    return syncWorkItemStatus(projectSlug, wiIdOrSlug);
+}
+/**
+ * Reorder a work item within its status column.
+ */
+function reorderWorkItem(projectSlug, wiIdOrSlug, newOrder) {
+    const wi = findWorkItemByIdOrSlug(projectSlug, wiIdOrSlug);
+    if (!wi)
+        return null;
+    wi.order = newOrder;
+    wi.updatedAt = new Date().toISOString();
+    writeWorkItem(projectSlug, wi);
+    return wi;
+}
 // --- Utilities ---
 function getTaskCounts(wi) {
     const counts = {};
@@ -317,4 +355,3 @@ function getProgress(wi) {
     }
     return { completed, total, percent: total === 0 ? 0 : Math.round((completed / total) * 100) };
 }
-//# sourceMappingURL=workItemStore.js.map