kanban-system 1.0.0

package/server/kanban.cjs

@@ -0,0 +1,1152 @@
+#!/usr/bin/env node
+/**
+ * kanban-system — real-time multi-agent kanban dashboard + REST API.
+ *
+ *   ~/.claude/tasks/  →  file watch  →  SSE  →  browser auto-update
+ *   POST/PUT/DELETE /api/tasks       →  server-side CRUD
+ *   /api/agents                      →  agent registry (from agents/*.md)
+ *   /events                          →  SSE stream
+ *
+ * Config comes from <repo-root>/config.js (see config.example.js).
+ * Tasks live under ~/.claude/tasks/kanban/ (manual) and ~/.claude/tasks/<session>/.
+ *
+ * Run:  npm start   (or  node server/kanban.cjs)
+ */
+
+const config = require("../lib/config.cjs");
+
+const http = require("http");
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const { execSync, spawn } = require("child_process");
+
+const PORT = config.port;
+const PROJECT_NAME = config.projectName;
+const REPO_PATH = config.repoPath;          // the application repo this harness drives
+const HARNESS_ROOT = config.repoRoot;       // this kanban-system checkout
+const TASKS_DIR = path.join(os.homedir(), ".claude", "tasks");
+const KANBAN_DIR = path.join(TASKS_DIR, "kanban");
+const ACTIVITY_FILE = path.join(TASKS_DIR, "activity.jsonl");
+
+if (!fs.existsSync(KANBAN_DIR)) fs.mkdirSync(KANBAN_DIR, { recursive: true });
+
+const OPS_THREAD_FILE = path.join(TASKS_DIR, "data", "ops-thread.jsonl");
+const TELEGRAM_OFFSET_FILE = path.join(TASKS_DIR, "data", "telegram-offset.json");
+
+const SLACK_WEBHOOK = config.slack.webhookUrl;
+const SLACK_BOT_TOKEN = config.slack.botToken;
+const SLACK_APP_TOKEN = config.slack.appToken;
+const SLACK_CHANNEL_ID = config.slack.channelId;
+const SLACK_ADMIN_USERS = config.slack.adminUsers;
+const SLACK_COMMAND = config.slack.command;
+let slackApp = null;
+let slackAskActive = false;
+
+// ── Orchestrator chat prompt (optional, drives the in-UI chat panel) ─────────
+const ORCHESTRATOR_FILE = path.join(os.homedir(), ".claude", "orchestrator.md");
+const ORCHESTRATOR_LOG = path.join(os.homedir(), ".claude", "orchestrator-history.jsonl");
+
+function readOrchestratorPrompt() {
+  try { return fs.readFileSync(ORCHESTRATOR_FILE, "utf-8"); } catch { return ""; }
+}
+function readOrchestratorHistory(limit) {
+  if (!fs.existsSync(ORCHESTRATOR_LOG)) return "";
+  try {
+    const lines = fs.readFileSync(ORCHESTRATOR_LOG, "utf-8").trim().split("\n").filter(Boolean);
+    return lines.slice(-1 * (limit || 10)).map((line) => {
+      try { const e = JSON.parse(line); return "[" + e.ts + "] " + (e.role || "system") + ": " + e.content; }
+      catch { return ""; }
+    }).filter(Boolean).join("\n");
+  } catch { return ""; }
+}
+function appendOrchestratorHistory(role, content) {
+  const entry = { ts: new Date().toISOString(), role, content: content.slice(0, 500) };
+  try { fs.appendFileSync(ORCHESTRATOR_LOG, JSON.stringify(entry) + "\n"); } catch {}
+  try {
+    const lines = fs.readFileSync(ORCHESTRATOR_LOG, "utf-8").trim().split("\n");
+    if (lines.length > 600) fs.writeFileSync(ORCHESTRATOR_LOG, lines.slice(-500).join("\n") + "\n");
+  } catch {}
+}
+function extractAndSaveLearnings(text) {
+  const regex = /<!--\s*LEARN:\s*(.*?)\s*-->/g;
+  let match; const learnings = [];
+  while ((match = regex.exec(text)) !== null) learnings.push(match[1].trim());
+  if (!learnings.length) return;
+  try {
+    let content = fs.readFileSync(ORCHESTRATOR_FILE, "utf-8");
+    const marker = "## Learnings";
+    const idx = content.indexOf(marker);
+    if (idx >= 0) {
+      const ts = new Date().toISOString().slice(0, 10);
+      const additions = learnings.map((l) => "- [" + ts + "] " + l).join("\n");
+      let insertPos = content.indexOf("\n", idx + marker.length);
+      if (insertPos < 0) insertPos = content.length;
+      let afterMarker = content.indexOf("\n", insertPos + 1);
+      if (afterMarker < 0) afterMarker = content.length;
+      content = content.slice(0, afterMarker) + "\n" + additions + content.slice(afterMarker);
+      fs.writeFileSync(ORCHESTRATOR_FILE, content);
+    }
+  } catch {}
+}
+
+function buildChatSystemPrompt(tasks, projectName) {
+  const orchestratorPrompt = readOrchestratorPrompt();
+  const history = readOrchestratorHistory(5);
+  const taskDetail = tasks.map((t) => {
+    let line = "#" + t.id + " [" + t.status + "] " + t.subject;
+    if (t.agent) line += " (agent:" + t.agent + ")";
+    if (t.owner) line += " (owner:" + t.owner + ")";
+    if (t.priority === "high") line += " [HIGH]";
+    if (t.blockedBy && t.blockedBy.length) line += " blocked-by:" + t.blockedBy.join(",");
+    if (t.activeForm) line += " — " + t.activeForm;
+    return line;
+  }).join("\n");
+
+  let prompt = "";
+  prompt += orchestratorPrompt ? orchestratorPrompt + "\n\n"
+                               : "You are the Orchestrator for the " + projectName + " kanban board.\n\n";
+  prompt += "## Current Board State\n";
+  prompt += "Project: " + projectName + "\n";
+  prompt += "Application repo: " + REPO_PATH + "\n\n";
+  prompt += taskDetail + "\n\n";
+  if (history) prompt += "## Recent Orchestrator Decisions\n" + history + "\n\n";
+  return prompt;
+}
+
+function boardSummary(tasks) {
+  const pending = tasks.filter((t) => t.status === "pending");
+  const inProgress = tasks.filter((t) => t.status === "in_progress");
+  const completed = tasks.filter((t) => t.status === "completed");
+  const total = tasks.length;
+  const pct = total ? Math.round((completed.length / total) * 100) : 0;
+  let summary = `Board: ${completed.length} done / ${inProgress.length} in progress / ${pending.length} pending (${pct}%)`;
+  if (inProgress.length > 0) {
+    summary += "\nIn progress: " + inProgress.map((t) => `#${t.id} ${t.subject}${t.activeForm ? " — " + t.activeForm : ""}`).join(", ");
+  }
+  if (pending.length > 0 && pending.length <= 5) {
+    summary += "\nUp next: " + pending.map((t) => `#${t.id} ${t.subject}`).join(", ");
+  } else if (pending.length > 5) {
+    summary += "\nUp next: " + pending.slice(0, 3).map((t) => `#${t.id} ${t.subject}`).join(", ") + ` +${pending.length - 3} more`;
+  }
+  return summary;
+}
+
+function slackNotify(text) {
+  if (slackApp && SLACK_CHANNEL_ID) {
+    slackApp.client.chat.postMessage({ channel: SLACK_CHANNEL_ID, text }).catch(() => {});
+    return;
+  }
+  if (!SLACK_WEBHOOK) return;
+  const payload = JSON.stringify({ text });
+  const url = new URL(SLACK_WEBHOOK);
+  const req = require("https").request({
+    hostname: url.hostname, path: url.pathname + url.search, method: "POST",
+    headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(payload) },
+  });
+  req.on("error", () => {});
+  req.write(payload); req.end();
+}
+
+// ── Activity log ─────────────────────────────────────────────────────────────
+function logActivity(evt) {
+  const ts = new Date().toISOString();
+  const record = { ts, ...evt };
+  try { fs.appendFileSync(ACTIVITY_FILE, JSON.stringify(record) + "\n"); }
+  catch {
+    try { fs.mkdirSync(path.dirname(ACTIVITY_FILE), { recursive: true }); } catch {}
+    try { fs.appendFileSync(ACTIVITY_FILE, JSON.stringify(record) + "\n"); } catch {}
+  }
+  try {
+    const lines = fs.readFileSync(ACTIVITY_FILE, "utf-8").trim().split("\n");
+    if (lines.length > 1200) fs.writeFileSync(ACTIVITY_FILE, lines.slice(lines.length - 1000).join("\n") + "\n");
+  } catch {}
+  const msg = "data: " + JSON.stringify({ type: "activity", event: record }) + "\n\n";
+  for (const res of sseClients) { try { res.write(msg); } catch { sseClients.delete(res); } }
+
+  const summary = boardSummary(readAllTasks());
+  let slackMsg = "";
+  if (evt.type === "created") {
+    slackMsg = `New Task #${evt.taskId}: ${evt.subject}`;
+    if (evt.description) slackMsg += "\n> " + evt.description.split("\n")[0].slice(0, 120);
+    if (evt.priority === "high") slackMsg += "\nPriority: HIGH";
+    if (evt.owner) slackMsg += "\nAssigned: " + evt.owner;
+    if (evt.parentId) slackMsg += "\nSubtask of #" + evt.parentId;
+  } else if (evt.type === "started") {
+    slackMsg = `Task #${evt.taskId} Started: ${evt.subject}`;
+    if (evt.owner) slackMsg += "\n" + evt.owner;
+    if (evt.activeForm) slackMsg += "\n" + evt.activeForm;
+  } else if (evt.type === "completed") {
+    slackMsg = `Task #${evt.taskId} Done: ${evt.subject}`;
+    if (evt.reportSummary) slackMsg += "\n> " + evt.reportSummary.split("\n")[0].slice(0, 200);
+    if (evt.reportPath) slackMsg += "\nReport: " + evt.reportPath;
+  } else if (evt.type === "deleted") {
+    slackMsg = `Task #${evt.taskId} Deleted: ${evt.subject}`;
+  } else if (evt.type === "updated") {
+    slackMsg = `Task #${evt.taskId} Updated: ${evt.subject}`;
+    if (evt.detail) slackMsg += "\n> " + evt.detail;
+  }
+  if (slackMsg) slackNotify(slackMsg + "\n" + summary);
+}
+
+function readActivity(since, limit) {
+  if (!fs.existsSync(ACTIVITY_FILE)) return [];
+  try {
+    const lines = fs.readFileSync(ACTIVITY_FILE, "utf-8").trim().split("\n").filter(Boolean);
+    let events = lines.map((line) => { try { return JSON.parse(line); } catch { return null; } }).filter(Boolean);
+    if (since) events = events.filter((e) => e.ts > since);
+    events.reverse();
+    if (limit) events = events.slice(0, limit);
+    return events;
+  } catch { return []; }
+}
+
+// ── Task files ───────────────────────────────────────────────────────────────
+function readAllTasks() {
+  const tasks = [];
+  if (!fs.existsSync(TASKS_DIR)) return tasks;
+  try {
+    for (const session of fs.readdirSync(TASKS_DIR, { withFileTypes: true })) {
+      if (!session.isDirectory()) continue;
+      const sessionPath = path.join(TASKS_DIR, session.name);
+      const files = fs.readdirSync(sessionPath).filter((f) => f.endsWith(".json") && f !== ".lock");
+      for (const file of files) {
+        try {
+          const filePath = path.join(sessionPath, file);
+          const task = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+          task._session = session.name;
+          task._file = file;
+          task._mtime = fs.statSync(filePath).mtimeMs;
+          task._editable = session.name === "kanban";
+          tasks.push(task);
+        } catch {}
+      }
+    }
+  } catch {}
+  return tasks.sort((a, b) => (a.id || 0) - (b.id || 0));
+}
+
+function getNextId() {
+  const files = fs.existsSync(KANBAN_DIR) ? fs.readdirSync(KANBAN_DIR).filter((f) => f.endsWith(".json")) : [];
+  let max = 0;
+  for (const f of files) { const n = parseInt(f.replace(".json", ""), 10); if (n > max) max = n; }
+  return max + 1;
+}
+
+function createTask(data) {
+  const id = getNextId();
+  const now = new Date().toISOString();
+  const task = {
+    id: String(id),
+    subject: data.subject || data.title || "Untitled",
+    description: data.description || "",
+    status: data.status || "pending",
+    priority: data.priority || "medium",
+    agent: data.agent || "",
+    owner: data.owner || "",
+    activeForm: data.activeForm || "",
+    blockedBy: data.blockedBy || [],
+    blocks: data.blocks || [],
+    parentId: data.parentId || null,
+    reportPath: data.reportPath || null,
+    reportSummary: data.reportSummary || null,
+    metadata: data.metadata || {},
+    createdAt: now,
+    updatedAt: now,
+  };
+  fs.writeFileSync(path.join(KANBAN_DIR, id + ".json"), JSON.stringify(task, null, 2));
+  taskSnapshot.set(String(id), { status: task.status, subject: task.subject, owner: task.owner || "", reportSummary: "" });
+  logActivity({
+    type: "created", taskId: String(id), subject: task.subject,
+    agent: task.agent || task.owner || "", detail: task.priority === "high" ? "Priority: high" : "",
+    description: task.description, priority: task.priority, owner: task.owner, parentId: task.parentId,
+  });
+  try {
+    const line = "📋 #" + id + " " + (task.subject || "");
+    opsAppend("system", line, String(id));
+    telegramSend(line);
+  } catch {}
+  return task;
+}
+
+function findTaskFile(id) {
+  const kanbanPath = path.join(KANBAN_DIR, id + ".json");
+  if (fs.existsSync(kanbanPath)) return kanbanPath;
+  try {
+    for (const session of fs.readdirSync(TASKS_DIR, { withFileTypes: true })) {
+      if (!session.isDirectory()) continue;
+      const fp = path.join(TASKS_DIR, session.name, id + ".json");
+      if (fs.existsSync(fp)) return fp;
+    }
+  } catch {}
+  return null;
+}
+
+function updateTask(id, data) {
+  const filePath = findTaskFile(id);
+  if (!filePath) return null;
+  const task = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+  const now = new Date().toISOString();
+  const prevStatus = task.status;
+  let statusChanged = false;
+  if (data.status !== undefined && data.status !== task.status) {
+    statusChanged = true;
+    task.status = data.status;
+    if (data.status === "in_progress" && !task.startedAt) task.startedAt = now;
+    if (data.status === "completed") task.completedAt = now;
+  }
+  if (data.subject !== undefined) task.subject = data.subject;
+  if (data.description !== undefined) task.description = data.description;
+  if (data.priority !== undefined) task.priority = data.priority;
+  if (data.agent !== undefined) task.agent = data.agent;
+  if (data.owner !== undefined) task.owner = data.owner;
+  if (data.activeForm !== undefined) task.activeForm = data.activeForm;
+  if (data.blockedBy !== undefined) task.blockedBy = data.blockedBy;
+  if (data.blocks !== undefined) task.blocks = data.blocks;
+  if (data.reportPath !== undefined) task.reportPath = data.reportPath;
+  if (data.reportSummary !== undefined) task.reportSummary = data.reportSummary;
+  if (data.parentId !== undefined) task.parentId = data.parentId;
+  if (data.metadata !== undefined) task.metadata = Object.assign({}, task.metadata || {}, data.metadata);
+  task.updatedAt = now;
+  fs.writeFileSync(filePath, JSON.stringify(task, null, 2));
+  taskSnapshot.set(String(id), { status: task.status, subject: task.subject, owner: task.owner || "", reportSummary: task.reportSummary || "" });
+
+  if (statusChanged) {
+    if (data.status === "in_progress" && prevStatus === "pending") {
+      logActivity({ type: "started", taskId: String(id), subject: task.subject, agent: task.agent || task.owner || "", detail: task.activeForm || "", owner: task.owner, activeForm: task.activeForm, description: task.description });
+      try { const line = "▶️ #" + id + " " + (task.subject || ""); opsAppend("system", line, String(id)); telegramSend(line); } catch {}
+    } else if (data.status === "completed") {
+      logActivity({ type: "completed", taskId: String(id), subject: task.subject, agent: task.agent || task.owner || "", detail: task.reportSummary || "", reportSummary: task.reportSummary, reportPath: task.reportPath, parentId: task.parentId });
+      try {
+        const head = (task.reportSummary || "").split("\n")[0].slice(0, 240);
+        const line = "✅ #" + id + " 완료" + (head ? " — " + head : "");
+        opsAppend("system", line, String(id));
+        telegramSend(line);
+      } catch {}
+    } else {
+      logActivity({ type: "updated", taskId: String(id), subject: task.subject, agent: task.agent || task.owner || "", detail: prevStatus + " → " + data.status });
+    }
+  } else if (data.subject !== undefined || data.description !== undefined || data.owner !== undefined) {
+    logActivity({ type: "updated", taskId: String(id), subject: task.subject, agent: task.agent || task.owner || "", detail: "Fields updated" });
+  }
+
+  // Auto-execute: pending → in_progress with a description, when the `claude`
+  // CLI is on PATH and nothing else is running.
+  if (statusChanged && data.status === "in_progress" && prevStatus === "pending" && task.description && cliAvailable && !activeExec) {
+    setTimeout(() => spawnExecutor(task), 100);
+  }
+  return task;
+}
+
+function deleteTask(id) {
+  const filePath = findTaskFile(id);
+  if (!filePath) return false;
+  let taskData = {};
+  try { taskData = JSON.parse(fs.readFileSync(filePath, "utf-8")); } catch {}
+  fs.unlinkSync(filePath);
+  taskSnapshot.delete(String(id));
+  logActivity({ type: "deleted", taskId: String(id), subject: taskData.subject || "Unknown", agent: taskData.agent || taskData.owner || "", detail: "" });
+  return true;
+}
+
+// ── Agent registry — parse frontmatter of agents/*.md ────────────────────────
+const AGENTS_DIR = path.join(HARNESS_ROOT, "agents");
+
+function parseFrontmatter(md) {
+  const m = md.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
+  if (!m) return { meta: {}, body: md };
+  const meta = {};
+  const lines = m[1].split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line.trim() || line.startsWith("#") || /^\s/.test(line)) continue; // skip blanks/comments/indented continuations
+    const kv = line.match(/^([\w.-]+):\s*(.*)$/);
+    if (!kv) continue;
+    const key = kv[1];
+    let val = kv[2].trim();
+    // YAML block scalar: `key: >-` or `key: |` — gather indented lines that follow.
+    if (val === ">-" || val === ">" || val === "|" || val === "|-") {
+      const fold = val.startsWith(">");
+      const parts = [];
+      while (i + 1 < lines.length && (/^\s+\S/.test(lines[i + 1]) || lines[i + 1].trim() === "")) {
+        i++;
+        parts.push(lines[i].replace(/^\s+/, ""));
+      }
+      val = (fold ? parts.join(" ") : parts.join("\n")).trim();
+    } else if (val === "") {
+      // YAML block list:  key:\n  # comment\n  - a\n  - b
+      const items = [];
+      let j = i + 1;
+      while (j < lines.length) {
+        const next = lines[j];
+        if (/^\s*#/.test(next) || next.trim() === "") { j++; continue; }   // skip indented comments / blanks
+        if (/^\s*-\s/.test(next)) { items.push(next.replace(/^\s*-\s+/, "").trim()); j++; continue; }
+        break;
+      }
+      if (items.length) { val = items; i = j - 1; }
+    } else if (val.startsWith("[") && val.endsWith("]")) {
+      val = val.slice(1, -1).split(",").map((s) => s.trim().replace(/^["']|["']$/g, "")).filter(Boolean);
+    } else {
+      val = val.replace(/^["']|["']$/g, "");
+    }
+    meta[key] = val;
+  }
+  return { meta, body: m[2] };
+}
+
+function listAgents() {
+  if (!fs.existsSync(AGENTS_DIR)) return [];
+  return fs.readdirSync(AGENTS_DIR)
+    .filter((f) => f.endsWith(".md") && !f.startsWith("_"))
+    .map((f) => {
+      try {
+        const { meta } = parseFrontmatter(fs.readFileSync(path.join(AGENTS_DIR, f), "utf-8"));
+        return {
+          name: meta.name || f.replace(/\.md$/, ""),
+          file: f,
+          mission: meta.mission || "",
+          runner: meta.runner || "claude",
+          model: meta.model_default || "",
+          owns: meta.owns || [],
+          escalation: meta.escalation || "",
+        };
+      } catch { return null; }
+    })
+    .filter(Boolean);
+}
+
+function getAgentFull(name) {
+  if (!fs.existsSync(AGENTS_DIR)) return null;
+  for (const f of fs.readdirSync(AGENTS_DIR)) {
+    if (!f.endsWith(".md")) continue;
+    const raw = fs.readFileSync(path.join(AGENTS_DIR, f), "utf-8");
+    const { meta, body } = parseFrontmatter(raw);
+    if ((meta.name || f.replace(/\.md$/, "")) === name) return { name, file: f, meta, body, raw };
+  }
+  return null;
+}
+
+// ── SSE ──────────────────────────────────────────────────────────────────────
+const sseClients = new Set();
+let lastHash = "";
+function broadcast(data) {
+  const hash = JSON.stringify(data.tasks?.map((t) => t.status + t.id + (t.updatedAt || "")));
+  if (hash === lastHash) return;
+  lastHash = hash;
+  const msg = "data: " + JSON.stringify(data) + "\n\n";
+  for (const res of sseClients) { try { res.write(msg); } catch { sseClients.delete(res); } }
+}
+function broadcastRaw(data) {
+  const msg = "data: " + JSON.stringify(data) + "\n\n";
+  for (const res of sseClients) { try { res.write(msg); } catch { sseClients.delete(res); } }
+}
+
+// ── Ops Thread (Telegram mirror) ─────────────────────────────────────────────
+// Append-only chat log between the operator (you) and the agents, persisted as
+// JSONL and broadcast over SSE. Optionally mirrored to Telegram: outbound via
+// sendMessage, inbound via getUpdates long-poll. Both halves are best-effort —
+// missing token / chatId just disables that half; the panel still works locally.
+const TELEGRAM = config.telegram || {};
+let telegramOffset = 0;
+let telegramPollerHandle = null;
+
+function opsAppend(role, text, taskId, opts) {
+  const msg = {
+    id: Date.now().toString(36) + Math.random().toString(36).slice(2, 8),
+    ts: new Date().toISOString(),
+    role: role || "system",
+    text: String(text == null ? "" : text),
+    taskId: taskId != null ? String(taskId) : null,
+    source: (opts && opts.source) || "kanban",
+  };
+  try {
+    fs.mkdirSync(path.dirname(OPS_THREAD_FILE), { recursive: true });
+    fs.appendFileSync(OPS_THREAD_FILE, JSON.stringify(msg) + "\n");
+  } catch (e) {
+    console.error("[ops-thread] append failed:", e && e.code ? e.code : e);
+  }
+  try {
+    const lines = fs.readFileSync(OPS_THREAD_FILE, "utf-8").trim().split("\n");
+    if (lines.length > 2400) fs.writeFileSync(OPS_THREAD_FILE, lines.slice(-2000).join("\n") + "\n");
+  } catch {}
+  broadcastRaw({ type: "ops.message", message: msg });
+  return msg;
+}
+
+function readOpsThread(since) {
+  if (!fs.existsSync(OPS_THREAD_FILE)) return [];
+  try {
+    let msgs = fs.readFileSync(OPS_THREAD_FILE, "utf-8").trim().split("\n").filter(Boolean)
+      .map((l) => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
+    if (since) {
+      let idx = -1;
+      for (let i = 0; i < msgs.length; i++) {
+        if (msgs[i].id === since || (msgs[i].ts && msgs[i].ts > since)) { idx = i; break; }
+      }
+      if (idx < 0) msgs = [];
+      else if (msgs[idx].id === since) msgs = msgs.slice(idx + 1);
+      else msgs = msgs.slice(idx);
+    }
+    if (msgs.length > 500) msgs = msgs.slice(-500);
+    return msgs;
+  } catch { return []; }
+}
+
+function telegramHttp(method, params) {
+  return new Promise((resolve) => {
+    if (!TELEGRAM.botToken) return resolve({ ok: false, error: "no token" });
+    const body = JSON.stringify(params || {});
+    const req = require("https").request({
+      hostname: "api.telegram.org",
+      path: `/bot${TELEGRAM.botToken}/${method}`,
+      method: "POST",
+      headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) },
+      timeout: 30000,
+    }, (res) => {
+      let data = "";
+      res.on("data", (c) => data += c);
+      res.on("end", () => { try { resolve(JSON.parse(data)); } catch { resolve({ ok: false, error: "parse" }); } });
+    });
+    req.on("error", (e) => resolve({ ok: false, error: String(e && e.code || e.message || e) }));
+    req.on("timeout", () => { try { req.destroy(); } catch {} resolve({ ok: false, error: "timeout" }); });
+    req.write(body); req.end();
+  });
+}
+
+function telegramSend(text) {
+  if (!TELEGRAM.botToken || !TELEGRAM.chatId) return;
+  telegramHttp("sendMessage", { chat_id: TELEGRAM.chatId, text: String(text == null ? "" : text), disable_web_page_preview: true })
+    .then((r) => { if (!r.ok) console.error("[telegram] send failed:", r.error || r.description); });
+}
+
+function loadTelegramOffset() {
+  try { telegramOffset = JSON.parse(fs.readFileSync(TELEGRAM_OFFSET_FILE, "utf-8")).offset || 0; } catch { telegramOffset = 0; }
+}
+function saveTelegramOffset() {
+  try { fs.mkdirSync(path.dirname(TELEGRAM_OFFSET_FILE), { recursive: true }); fs.writeFileSync(TELEGRAM_OFFSET_FILE, JSON.stringify({ offset: telegramOffset })); } catch {}
+}
+
+function telegramChatAllowed(chatId) {
+  const id = String(chatId);
+  if (TELEGRAM.allowedChatIds && TELEGRAM.allowedChatIds.length) return TELEGRAM.allowedChatIds.map(String).includes(id);
+  if (TELEGRAM.chatId) return String(TELEGRAM.chatId) === id;
+  return false;
+}
+
+async function telegramPollOnce() {
+  const r = await telegramHttp("getUpdates", { offset: telegramOffset + 1, timeout: 25, allowed_updates: ["message"] });
+  if (!r || !r.ok || !Array.isArray(r.result)) return { updates: 0, error: r && r.error };
+  let updates = 0;
+  for (const u of r.result) {
+    if (u.update_id > telegramOffset) telegramOffset = u.update_id;
+    const m = u.message;
+    if (!m || !m.text) continue;
+    if (!telegramChatAllowed(m.chat && m.chat.id)) continue;
+    opsAppend("operator", m.text, null, { source: "telegram" });
+    updates++;
+  }
+  if (updates) saveTelegramOffset();
+  return { updates };
+}
+
+function startTelegramPoller() {
+  if (telegramPollerHandle) return;
+  if (!TELEGRAM.botToken || !TELEGRAM.chatId || !TELEGRAM.pollEnabled) return;
+  loadTelegramOffset();
+  const tick = async () => {
+    try { await telegramPollOnce(); }
+    catch (e) { console.error("[telegram] poll error:", e && e.message); await new Promise((r) => setTimeout(r, 5000)); }
+    telegramPollerHandle = setTimeout(tick, TELEGRAM.pollIntervalMs || 1500);
+  };
+  telegramPollerHandle = setTimeout(tick, 100);
+  console.log("  Telegram: poller started (chat=" + TELEGRAM.chatId + ")");
+}
+
+// ── Claude CLI auto-executor (optional) ──────────────────────────────────────
+let cliAvailable = false;
+function checkClaudeCLI() {
+  if (process.env.CLAUDECODE) { console.log("  CLI: unavailable (nested session)"); return; }
+  try { execSync("which claude", { encoding: "utf-8", timeout: 5000 }); cliAvailable = true; }
+  catch { cliAvailable = false; }
+}
+
+let activeExec = null; // { process, taskId, output }
+
+// Hard rules every auto-executed task must follow. Prepended to the prompt so
+// the spawned CLI inherits them without an external CLAUDE.md hop. Keep this
+// short — it costs every auto-exec turn.
+const EXECUTOR_GUARDRAILS = [
+  "## Hard rules (must follow)",
+  "- NEVER include `Co-Authored-By` lines or any Claude/Anthropic/Codex attribution in git commit messages, PR descriptions, or any committed text. This applies to every commit you create, including amends.",
+  "- NEVER run destructive git operations (force-push, reset --hard, branch -D, push --no-verify) without an explicit user request.",
+  "- NEVER commit `.env`, `config.js`, or any secret. Both are gitignored — keep it that way.",
+  "- Stay inside the agent's `owns` globs (selvedge boundaries).",
+  "- When you finish, set the task to `in_review` with a `reportSummary` and (if a code change was made) a `reportPath` pointing at the commit/PR — do not self-mark `completed`.",
+  "",
+].join("\n");
+
+function spawnExecutor(task) {
+  if (!cliAvailable || activeExec) return;
+  const taskId = String(task.id);
+  const prompt = EXECUTOR_GUARDRAILS + "## Task\n" + task.subject + "\n\n" + (task.description || "(no description)") + "\n\nWorking directory: " + REPO_PATH;
+  const execEnv = Object.assign({}, process.env);
+  delete execEnv.ANTHROPIC_API_KEY;
+  const proc = spawn("claude", ["-p", "--verbose", "--output-format", "stream-json", "--model", "sonnet", "--no-session-persistence"], {
+    cwd: REPO_PATH, env: execEnv, stdio: ["pipe", "pipe", "pipe"],
+  });
+  activeExec = { process: proc, taskId, output: "" };
+  broadcastRaw({ type: "exec_start", taskId, subject: task.subject });
+  logActivity({ type: "started", taskId, subject: task.subject, detail: "Auto-execute started" });
+  proc.stdin.write(prompt); proc.stdin.end();
+
+  let buffer = "";
+  proc.stdout.on("data", (data) => {
+    buffer += data.toString();
+    const lines = buffer.split("\n");
+    buffer = lines.pop();
+    for (const line of lines) {
+      if (!line.trim()) continue;
+      try {
+        const json = JSON.parse(line);
+        let text = "";
+        if (json.type === "assistant" && json.subtype === "text") text = json.text || "";
+        else if (json.type === "assistant" && json.message && json.message.content) {
+          json.message.content.forEach((c) => { if (c.type === "text") text += c.text; });
+        } else if (json.type === "content_block_delta" && json.delta) text = json.delta.text || "";
+        if (text && activeExec) { activeExec.output += text; broadcastRaw({ type: "exec", taskId, chunk: text }); }
+      } catch {}
+    }
+  });
+  proc.stderr.on("data", (data) => broadcastRaw({ type: "exec_error", taskId, chunk: data.toString() }));
+  proc.on("close", (code) => {
+    const output = activeExec ? activeExec.output : "";
+    activeExec = null;
+    if (code === 0) {
+      updateTask(taskId, { status: "in_review", reportSummary: output.slice(0, 500) });
+      broadcastRaw({ type: "exec_done", taskId, exitCode: 0 });
+    } else {
+      updateTask(taskId, { status: "pending" });
+      broadcastRaw({ type: "exec_done", taskId, exitCode: code });
+      logActivity({ type: "updated", taskId, subject: task.subject || "", detail: "Exec failed (exit " + code + ")" });
+    }
+  });
+}
+function stopExec() {
+  if (!activeExec) return null;
+  const taskId = activeExec.taskId;
+  try { activeExec.process.kill(); } catch {}
+  activeExec = null;
+  updateTask(taskId, { status: "pending" });
+  broadcastRaw({ type: "exec_done", taskId, exitCode: -1, stopped: true });
+  logActivity({ type: "updated", taskId, subject: "", detail: "Execution stopped by user" });
+  return taskId;
+}
+
+// ── Slack bot (Socket Mode) — optional ───────────────────────────────────────
+async function initSlackBot() {
+  if (!SLACK_BOT_TOKEN || !SLACK_APP_TOKEN) { console.log("  Slack Bot: disabled (no tokens)"); return; }
+  try {
+    const { App } = require("@slack/bolt");
+    slackApp = new App({ token: SLACK_BOT_TOKEN, appToken: SLACK_APP_TOKEN, socketMode: true });
+
+    slackApp.command(SLACK_COMMAND, async ({ command, ack, respond, client }) => {
+      await ack();
+      const parts = (command.text || "").trim().split(/\s+/);
+      const sub = (parts[0] || "").toLowerCase();
+      const restText = parts.slice(1).join(" ");
+      switch (sub) {
+        case "board":
+        case "": {
+          await respond({ blocks: buildBoardBlocks(readAllTasks()), text: PROJECT_NAME + " kanban", response_type: "ephemeral" });
+          break;
+        }
+        case "list": {
+          await respond({ blocks: buildTaskListBlocks(readAllTasks()), response_type: "ephemeral" });
+          break;
+        }
+        case "add": {
+          if (!restText) await client.views.open({ trigger_id: command.trigger_id, view: buildAddTaskModal() });
+          else { const task = createTask({ subject: restText }); await respond({ text: `Task #${task.id} created: ${task.subject}`, response_type: "in_channel" }); }
+          break;
+        }
+        case "ask": {
+          if (!restText) { await respond({ text: "Usage: `" + SLACK_COMMAND + " ask <question>`", response_type: "ephemeral" }); break; }
+          if (slackAskActive) { await respond({ text: "Another ask is in progress. Please wait.", response_type: "ephemeral" }); break; }
+          if (!cliAvailable) { await respond({ text: "Claude CLI not available.", response_type: "ephemeral" }); break; }
+          await respond({ text: `Asking Claude: ${restText}`, response_type: "ephemeral" });
+          handleSlackAsk(restText, command.channel_id, client);
+          break;
+        }
+        case "exec": {
+          if (SLACK_ADMIN_USERS.length > 0 && !SLACK_ADMIN_USERS.includes(command.user_id)) { await respond({ text: "Permission denied.", response_type: "ephemeral" }); break; }
+          const execId = restText.replace("#", "");
+          if (!execId) { await respond({ text: "Usage: `" + SLACK_COMMAND + " exec <task_id>`", response_type: "ephemeral" }); break; }
+          if (!cliAvailable) { await respond({ text: "Claude CLI not available.", response_type: "ephemeral" }); break; }
+          if (activeExec) { await respond({ text: "Already executing task #" + activeExec.taskId + ".", response_type: "ephemeral" }); break; }
+          const taskToExec = readAllTasks().find((t) => String(t.id) === execId);
+          if (!taskToExec) { await respond({ text: `Task #${execId} not found.`, response_type: "ephemeral" }); break; }
+          if (taskToExec.status === "pending") updateTask(execId, { status: "in_progress" });
+          if (!activeExec) spawnExecutor(taskToExec);
+          await respond({ text: `Executing task #${execId}: ${taskToExec.subject}`, response_type: "in_channel" });
+          break;
+        }
+        case "stop": {
+          const stoppedId = stopExec();
+          await respond(stoppedId ? { text: `Stopped execution of task #${stoppedId}.`, response_type: "in_channel" } : { text: "No active execution.", response_type: "ephemeral" });
+          break;
+        }
+        default:
+          await respond({ text: "Unknown: `" + sub + "`\nAvailable: `board` `list` `add` `ask` `exec` `stop`", response_type: "ephemeral" });
+      }
+    });
+
+    slackApp.action(/^task_(start|complete|delete)_/, async ({ action, ack, respond, body }) => {
+      await ack();
+      const match = action.action_id.match(/^task_(start|complete|delete)_(.+)$/);
+      if (!match) return;
+      const actionType = match[1]; const taskId = match[2];
+      const userName = (body.user && body.user.name) || (body.user && body.user.id) || "someone";
+      if (actionType === "start") {
+        const task = updateTask(taskId, { status: "in_progress" });
+        await respond(task ? { text: "Task #" + taskId + " started by " + userName + ": " + task.subject, response_type: "in_channel", replace_original: false } : { text: "Task #" + taskId + " not found.", response_type: "ephemeral" });
+      } else if (actionType === "complete") {
+        const task = updateTask(taskId, { status: "completed" });
+        await respond(task ? { text: "Task #" + taskId + " completed by " + userName + ": " + task.subject, response_type: "in_channel", replace_original: false } : { text: "Task #" + taskId + " not found.", response_type: "ephemeral" });
+      } else {
+        const task = readAllTasks().find((t) => String(t.id) === taskId);
+        const ok = deleteTask(taskId);
+        await respond(ok ? { text: "Task #" + taskId + " deleted by " + userName + (task ? ": " + task.subject : ""), response_type: "in_channel", replace_original: false } : { text: "Task #" + taskId + " not found.", response_type: "ephemeral" });
+      }
+    });
+
+    slackApp.view("add_task_modal", async ({ ack, view }) => {
+      await ack();
+      const vals = view.state.values;
+      const subject = vals.subject_block.subject_input.value || "";
+      const description = (vals.desc_block && vals.desc_block.desc_input && vals.desc_block.desc_input.value) || "";
+      const priority = (vals.priority_block && vals.priority_block.priority_select && vals.priority_block.priority_select.selected_option && vals.priority_block.priority_select.selected_option.value) || "medium";
+      if (subject) {
+        const task = createTask({ subject, description, priority });
+        if (SLACK_CHANNEL_ID) slackApp.client.chat.postMessage({ channel: SLACK_CHANNEL_ID, text: "Task #" + task.id + " created via Slack: " + task.subject }).catch(() => {});
+      }
+    });
+
+    await slackApp.start();
+    console.log("  Slack Bot: connected (Socket Mode)");
+  } catch (e) {
+    console.log("  Slack Bot: failed — " + e.message);
+    slackApp = null;
+  }
+}
+
+function buildBoardBlocks(tasks) {
+  const pending = tasks.filter((t) => t.status === "pending");
+  const inProgress = tasks.filter((t) => t.status === "in_progress");
+  const completed = tasks.filter((t) => t.status === "completed");
+  const total = tasks.length;
+  const pct = total ? Math.round((completed.length / total) * 100) : 0;
+  const filled = Math.round(pct / 5);
+  let bar = ""; for (let i = 0; i < 20; i++) bar += i < filled ? "█" : "░";
+  const blocks = [
+    { type: "header", text: { type: "plain_text", text: PROJECT_NAME + " kanban" } },
+    { type: "section", text: { type: "mrkdwn", text: "*" + completed.length + "* done  ·  *" + inProgress.length + "* in progress  ·  *" + pending.length + "* pending  ·  *" + total + "* total\n`" + bar + "` " + pct + "%" } },
+  ];
+  if (inProgress.length > 0) {
+    blocks.push({ type: "divider" }, { type: "section", text: { type: "mrkdwn", text: ":arrows_counterclockwise:  *In Progress* (" + inProgress.length + ")" } });
+    for (const t of inProgress) {
+      let line = "> *#" + t.id + "*  " + t.subject;
+      if (t.owner) line += "  —  " + t.owner;
+      if (t.activeForm) line += "\n>       _" + t.activeForm + "_";
+      blocks.push({ type: "section", text: { type: "mrkdwn", text: line } });
+    }
+  }
+  if (pending.length > 0) {
+    blocks.push({ type: "divider" }, { type: "section", text: { type: "mrkdwn", text: ":hourglass_flowing_sand:  *Pending* (" + pending.length + ")" } });
+    const showPending = pending.length > 8 ? pending.slice(0, 6) : pending;
+    const lines = showPending.map((p) => { let pl = "*#" + p.id + "*  " + p.subject; if (p.priority === "high") pl += "  :red_circle:"; if (p.owner) pl += "  —  " + p.owner; return pl; });
+    blocks.push({ type: "section", text: { type: "mrkdwn", text: lines.join("\n") } });
+    if (pending.length > 8) blocks.push({ type: "context", elements: [{ type: "mrkdwn", text: "+" + (pending.length - 6) + " more — `" + SLACK_COMMAND + " list`" }] });
+  }
+  const recentDone = completed.slice(-3);
+  if (recentDone.length > 0) {
+    blocks.push({ type: "divider" }, { type: "section", text: { type: "mrkdwn", text: ":white_check_mark:  *Recently Done*" } });
+    blocks.push({ type: "context", elements: [{ type: "mrkdwn", text: recentDone.map((d) => "~#" + d.id + "  " + d.subject + "~").join("\n") }] });
+  }
+  blocks.push({ type: "divider" }, { type: "context", elements: [{ type: "mrkdwn", text: ":keyboard:  `" + SLACK_COMMAND + " list` · `" + SLACK_COMMAND + " add` · `" + SLACK_COMMAND + " ask`" }] });
+  return blocks;
+}
+
+function buildTaskListBlocks(tasks) {
+  const blocks = [{ type: "header", text: { type: "plain_text", text: PROJECT_NAME + " kanban" } }];
+  const groups = [
+    { key: "in_progress", label: "In Progress" },
+    { key: "pending", label: "Pending" },
+    { key: "completed", label: "Completed (recent)" },
+  ];
+  for (const g of groups) {
+    let items = tasks.filter((t) => t.status === g.key);
+    if (g.key === "completed") items = items.slice(-5);
+    if (items.length === 0) continue;
+    blocks.push({ type: "divider" }, { type: "section", text: { type: "mrkdwn", text: "*" + g.label + "* (" + items.length + ")" } });
+    for (const t of items) {
+      let desc = "*#" + t.id + "* " + t.subject;
+      if (t.owner) desc += "  " + t.owner;
+      if (t.activeForm) desc += "\n_" + t.activeForm + "_";
+      blocks.push({ type: "section", text: { type: "mrkdwn", text: desc } });
+      const buttons = [];
+      if (t.status === "pending") buttons.push({ type: "button", text: { type: "plain_text", text: "Start" }, action_id: "task_start_" + t.id, style: "primary" });
+      if (t.status === "in_progress") buttons.push({ type: "button", text: { type: "plain_text", text: "Complete" }, action_id: "task_complete_" + t.id, style: "primary" });
+      if (t.status !== "completed") buttons.push({ type: "button", text: { type: "plain_text", text: "Delete" }, action_id: "task_delete_" + t.id, style: "danger" });
+      if (buttons.length > 0) blocks.push({ type: "actions", elements: buttons });
+    }
+  }
+  if (blocks.length <= 1) blocks.push({ type: "section", text: { type: "mrkdwn", text: "_No tasks found._" } });
+  return blocks;
+}
+
+function buildAddTaskModal() {
+  return {
+    type: "modal", callback_id: "add_task_modal",
+    title: { type: "plain_text", text: "New Task" }, submit: { type: "plain_text", text: "Create" },
+    blocks: [
+      { type: "input", block_id: "subject_block", element: { type: "plain_text_input", action_id: "subject_input", placeholder: { type: "plain_text", text: "Task title" } }, label: { type: "plain_text", text: "Subject" } },
+      { type: "input", block_id: "desc_block", optional: true, element: { type: "plain_text_input", action_id: "desc_input", multiline: true, placeholder: { type: "plain_text", text: "Task description" } }, label: { type: "plain_text", text: "Description" } },
+      { type: "input", block_id: "priority_block", optional: true, element: { type: "static_select", action_id: "priority_select", initial_option: { text: { type: "plain_text", text: "Medium" }, value: "medium" }, options: [{ text: { type: "plain_text", text: "Low" }, value: "low" }, { text: { type: "plain_text", text: "Medium" }, value: "medium" }, { text: { type: "plain_text", text: "High" }, value: "high" }] }, label: { type: "plain_text", text: "Priority" } },
+    ],
+  };
+}
+
+function handleSlackAsk(question, channelId, client) {
+  slackAskActive = true;
+  let prompt = buildChatSystemPrompt(readAllTasks(), PROJECT_NAME);
+  prompt += "\n\n[User via Slack]: " + question;
+  appendOrchestratorHistory("user-slack", question);
+  const askEnv = Object.assign({}, process.env);
+  delete askEnv.ANTHROPIC_API_KEY;
+  const proc = spawn("claude", ["-p", "--output-format", "text", "--model", "sonnet", "--no-session-persistence"], { cwd: REPO_PATH, env: askEnv, stdio: ["pipe", "pipe", "pipe"] });
+  proc.stdin.write(prompt); proc.stdin.end();
+  let output = "";
+  proc.stdout.on("data", (data) => { output += data.toString(); });
+  proc.on("close", (code) => {
+    slackAskActive = false;
+    const targetChannel = channelId || SLACK_CHANNEL_ID;
+    if (!targetChannel || !client) return;
+    const text = code === 0 && output.trim() ? output.trim().slice(0, 3000) : "(Claude returned exit code " + code + ")";
+    appendOrchestratorHistory("orchestrator", text);
+    extractAndSaveLearnings(output);
+    client.chat.postMessage({ channel: targetChannel, text: "*Claude says:*\n" + text }).catch(() => {});
+  });
+}
+
+// ── File watch + activity diffing ────────────────────────────────────────────
+const taskSnapshot = new Map();
+function snapshotTasks(tasks) { for (const t of tasks) taskSnapshot.set(String(t.id), { status: t.status, subject: t.subject, owner: t.owner || "", reportSummary: t.reportSummary || "" }); }
+function detectAndNotifyChanges(tasks) {
+  for (const t of tasks) {
+    const id = String(t.id);
+    const prev = taskSnapshot.get(id);
+    if (!prev) {
+      logActivity({ type: "created", taskId: id, subject: t.subject, agent: t.agent || t.owner || "", detail: t.priority === "high" ? "Priority: high" : "", description: t.description, priority: t.priority, owner: t.owner, parentId: t.parentId });
+    } else if (prev.status !== t.status) {
+      if (t.status === "in_progress" && prev.status === "pending") logActivity({ type: "started", taskId: id, subject: t.subject, agent: t.agent || t.owner || "", detail: t.activeForm || "", owner: t.owner, activeForm: t.activeForm, description: t.description });
+      else if (t.status === "completed") logActivity({ type: "completed", taskId: id, subject: t.subject, agent: t.agent || t.owner || "", detail: t.reportSummary || "", reportSummary: t.reportSummary, reportPath: t.reportPath, parentId: t.parentId });
+      else logActivity({ type: "updated", taskId: id, subject: t.subject, agent: t.agent || t.owner || "", detail: prev.status + " → " + t.status });
+    }
+  }
+  const currentIds = new Set(tasks.map((t) => String(t.id)));
+  for (const [id, prev] of taskSnapshot) if (!currentIds.has(id)) logActivity({ type: "deleted", taskId: id, subject: prev.subject || "Unknown", agent: "", detail: "" });
+  snapshotTasks(tasks);
+}
+function watchTasks() {
+  if (!fs.existsSync(TASKS_DIR)) fs.mkdirSync(TASKS_DIR, { recursive: true });
+  const watched = new Set();
+  snapshotTasks(readAllTasks());
+  function onFileChange() { const tasks = readAllTasks(); detectAndNotifyChanges(tasks); broadcast({ type: "update", tasks }); }
+  function scanAndWatch() {
+    if (!fs.existsSync(TASKS_DIR)) return;
+    try {
+      for (const session of fs.readdirSync(TASKS_DIR, { withFileTypes: true })) {
+        if (!session.isDirectory()) continue;
+        const sp = path.join(TASKS_DIR, session.name);
+        if (!watched.has(sp)) { watched.add(sp); try { fs.watch(sp, { persistent: false }, () => onFileChange()); } catch {} }
+      }
+    } catch {}
+  }
+  try { fs.watch(TASKS_DIR, { persistent: false }, () => { scanAndWatch(); onFileChange(); }); } catch {}
+  scanAndWatch();
+  setInterval(() => broadcast({ type: "update", tasks: readAllTasks() }), 2000);
+}
+
+// ── Request body parser ──────────────────────────────────────────────────────
+function parseBody(req) {
+  return new Promise((resolve, reject) => {
+    let body = "";
+    req.on("data", (chunk) => (body += chunk));
+    req.on("end", () => { try { resolve(body ? JSON.parse(body) : {}); } catch { reject(new Error("Invalid JSON")); } });
+  });
+}
+
+// ── Static assets ────────────────────────────────────────────────────────────
+const HTML_PATH = path.join(HARNESS_ROOT, "ui", "kanban.html");
+function getHTML() { return fs.readFileSync(HTML_PATH, "utf-8").replace(/\{\{PORT\}\}/g, String(PORT)); }
+
+const STATIC_ROOTS = [path.join(HARNESS_ROOT, "ui"), path.join(HARNESS_ROOT, "playbooks")];
+const MIME = { ".css": "text/css", ".js": "application/javascript", ".html": "text/html; charset=utf-8", ".svg": "image/svg+xml", ".json": "application/json", ".png": "image/png" };
+function serveStatic(req, res) {
+  // /styles/foo.css  → ui/styles/foo.css ; /playbooks/foo.html → playbooks/foo.html
+  let urlPath = decodeURIComponent((req.url.split("?")[0] || ""));
+  if (urlPath === "/" || urlPath === "") return false;
+  if (urlPath.includes("..")) return false;
+  const candidates = [
+    path.join(HARNESS_ROOT, "ui", urlPath.replace(/^\//, "")),
+    path.join(HARNESS_ROOT, urlPath.replace(/^\//, "")),
+  ];
+  for (const file of candidates) {
+    if (!STATIC_ROOTS.some((root) => file.startsWith(root))) continue;
+    if (fs.existsSync(file) && fs.statSync(file).isFile()) {
+      res.writeHead(200, { "Content-Type": MIME[path.extname(file)] || "application/octet-stream" });
+      res.end(fs.readFileSync(file));
+      return true;
+    }
+  }
+  return false;
+}
+
+// ── HTTP server ──────────────────────────────────────────────────────────────
+const server = http.createServer(async (req, res) => {
+  res.setHeader("Access-Control-Allow-Origin", "*");
+  res.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
+  res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+  if (req.method === "OPTIONS") { res.writeHead(204); res.end(); return; }
+
+  if (req.url === "/events") {
+    res.writeHead(200, { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", Connection: "keep-alive" });
+    sseClients.add(res);
+    res.write("data: " + JSON.stringify({ type: "update", tasks: readAllTasks() }) + "\n\n");
+    req.on("close", () => sseClients.delete(res));
+    return;
+  }
+
+  if (req.url === "/api/tasks" && req.method === "GET") {
+    res.writeHead(200, { "Content-Type": "application/json" }); res.end(JSON.stringify(readAllTasks())); return;
+  }
+  if (req.url === "/api/tasks" && req.method === "POST") {
+    try { const task = createTask(await parseBody(req)); res.writeHead(201, { "Content-Type": "application/json" }); res.end(JSON.stringify(task)); }
+    catch (e) { res.writeHead(400, { "Content-Type": "application/json" }); res.end(JSON.stringify({ error: e.message })); }
+    return;
+  }
+  const putMatch = req.url.match(/^\/api\/tasks\/([\w.-]+)$/);
+  if (putMatch && req.method === "PUT") {
+    try {
+      const task = updateTask(putMatch[1], await parseBody(req));
+      if (!task) { res.writeHead(404); res.end('{"error":"Not found"}'); return; }
+      res.writeHead(200, { "Content-Type": "application/json" }); res.end(JSON.stringify(task));
+    } catch (e) { res.writeHead(400, { "Content-Type": "application/json" }); res.end(JSON.stringify({ error: e.message })); }
+    return;
+  }
+  const delMatch = req.url.match(/^\/api\/tasks\/([\w.-]+)$/);
+  if (delMatch && req.method === "DELETE") { const ok = deleteTask(delMatch[1]); res.writeHead(ok ? 204 : 404); res.end(); return; }
+
+  // POST /api/tasks/:id/slack  — post a one-off note to Slack for this task
+  const slackMatch = req.url.match(/^\/api\/tasks\/([\w.-]+)\/slack$/);
+  if (slackMatch && req.method === "POST") {
+    try {
+      const body = await parseBody(req);
+      const t = readAllTasks().find((x) => String(x.id) === slackMatch[1]);
+      const prefix = t ? `[#${t.id}] ` : "";
+      slackNotify(prefix + (body.text || ""));
+      res.writeHead(200, { "Content-Type": "application/json" }); res.end('{"ok":true}');
+    } catch (e) { res.writeHead(400, { "Content-Type": "application/json" }); res.end(JSON.stringify({ error: e.message })); }
+    return;
+  }
+
+  // GET /api/agents  — registry from agents/*.md frontmatter
+  if (req.url.split("?")[0] === "/api/agents" && req.method === "GET") {
+    res.writeHead(200, { "Content-Type": "application/json" }); res.end(JSON.stringify({ agents: listAgents() })); return;
+  }
+  const agentFullMatch = req.url.match(/^\/api\/agents\/([^/]+)\/full$/);
+  if (agentFullMatch && req.method === "GET") {
+    const a = getAgentFull(decodeURIComponent(agentFullMatch[1]));
+    if (!a) { res.writeHead(404); res.end('{"error":"Not found"}'); return; }
+    res.writeHead(200, { "Content-Type": "application/json" }); res.end(JSON.stringify(a)); return;
+  }
+
+  // ── Ops Thread (Telegram mirror) ──
+  if (req.url.split("?")[0] === "/api/ops-thread" && req.method === "GET") {
+    const since = new URL(req.url, "http://localhost").searchParams.get("since") || null;
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(readOpsThread(since)));
+    return;
+  }
+  if (req.url === "/api/ops-thread/append" && req.method === "POST") {
+    try {
+      const body = await parseBody(req);
+      const msg = opsAppend(body.role || "system", body.text || "", body.taskId != null ? body.taskId : null, { source: body.source });
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify(msg));
+    } catch (e) { res.writeHead(400, { "Content-Type": "application/json" }); res.end(JSON.stringify({ error: e.message })); }
+    return;
+  }
+  if (req.url === "/api/ops-thread/send" && req.method === "POST") {
+    try {
+      const body = await parseBody(req);
+      const text = String(body.text == null ? "" : body.text);
+      const msg = opsAppend("you", text, null, { source: "kanban" });
+      telegramSend(text); // best-effort
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify(msg));
+    } catch (e) { res.writeHead(400, { "Content-Type": "application/json" }); res.end(JSON.stringify({ error: e.message })); }
+    return;
+  }
+  if (req.url === "/api/telegram/status" && req.method === "GET") {
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({
+      configured: !!(TELEGRAM.botToken && TELEGRAM.chatId),
+      botToken: TELEGRAM.botToken ? "(set)" : "",
+      chatId: TELEGRAM.chatId || "",
+      polling: !!telegramPollerHandle,
+      offset: telegramOffset,
+    }));
+    return;
+  }
+  // Convenience: send any DM to your bot, then GET this to see your chat id.
+  if (req.url === "/api/telegram/whoami" && req.method === "GET") {
+    if (!TELEGRAM.botToken) { res.writeHead(400, { "Content-Type": "application/json" }); res.end('{"error":"TELEGRAM_BOT_TOKEN not set"}'); return; }
+    const r = await telegramHttp("getUpdates", { limit: 5 });
+    res.writeHead(200, { "Content-Type": "application/json" });
+    const chats = (r && r.result || []).map((u) => u.message && u.message.chat).filter(Boolean);
+    res.end(JSON.stringify({ ok: r && r.ok, chats }));
+    return;
+  }
+
+  if (req.url.startsWith("/api/activity") && req.method === "GET") {
+    const params = new URL(req.url, "http://localhost").searchParams;
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(readActivity(params.get("since") || null, parseInt(params.get("limit")) || 200)));
+    return;
+  }
+
+  // GET /api/report?path=<filepath>  — read a report file (sandboxed)
+  if (req.url.startsWith("/api/report?") && req.method === "GET") {
+    const params = new URL(req.url, "http://localhost").searchParams;
+    const filePath = params.get("path");
+    if (!filePath) { res.writeHead(404, { "Content-Type": "application/json" }); res.end('{"error":"File not found"}'); return; }
+    const resolved = path.resolve(filePath.startsWith("/") ? filePath : path.join(REPO_PATH, filePath));
+    const allowed = [path.join(os.homedir(), ".claude"), HARNESS_ROOT, REPO_PATH];
+    if (!allowed.some((a) => resolved.startsWith(a)) || !fs.existsSync(resolved)) { res.writeHead(403, { "Content-Type": "application/json" }); res.end('{"error":"Access denied"}'); return; }
+    try { res.writeHead(200, { "Content-Type": "application/json" }); res.end(JSON.stringify({ path: resolved, content: fs.readFileSync(resolved, "utf-8") })); }
+    catch (e) { res.writeHead(500, { "Content-Type": "application/json" }); res.end(JSON.stringify({ error: e.message })); }
+    return;
+  }
+
+  if (req.url === "/api/cli-status" && req.method === "GET") {
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ available: cliAvailable, executing: activeExec ? activeExec.taskId : null, nested: !!process.env.CLAUDECODE }));
+    return;
+  }
+
+  // ── Orchestrator chat (optional) ──
+  const CHAT_FILE = path.join(KANBAN_DIR, "chat-history.json");
+  if (req.url === "/api/chat/history" && req.method === "GET") {
+    try { res.writeHead(200, { "Content-Type": "application/json" }); res.end(JSON.stringify(fs.existsSync(CHAT_FILE) ? JSON.parse(fs.readFileSync(CHAT_FILE, "utf-8")) : [])); }
+    catch { res.writeHead(200, { "Content-Type": "application/json" }); res.end("[]"); }
+    return;
+  }
+  if (req.url === "/api/chat/history" && req.method === "PUT") {
+    try { const body = await parseBody(req); fs.writeFileSync(CHAT_FILE, JSON.stringify(body.messages || [], null, 2)); res.writeHead(200, { "Content-Type": "application/json" }); res.end('{"ok":true}'); }
+    catch (e) { res.writeHead(400, { "Content-Type": "application/json" }); res.end(JSON.stringify({ error: e.message })); }
+    return;
+  }
+  if (req.url === "/api/chat/history" && req.method === "DELETE") { try { fs.unlinkSync(CHAT_FILE); } catch {} res.writeHead(200, { "Content-Type": "application/json" }); res.end('{"ok":true}'); return; }
+  if (req.url === "/api/orchestrator" && req.method === "GET") {
+    res.writeHead(200, { "Content-Type": "application/json" }); res.end(JSON.stringify({ prompt: readOrchestratorPrompt(), history: readOrchestratorHistory(20), path: ORCHESTRATOR_FILE })); return;
+  }
+  if (req.url === "/api/orchestrator" && req.method === "PUT") {
+    try { const body = await parseBody(req); if (body.prompt) fs.writeFileSync(ORCHESTRATOR_FILE, body.prompt); res.writeHead(200, { "Content-Type": "application/json" }); res.end('{"ok":true}'); }
+    catch (e) { res.writeHead(400, { "Content-Type": "application/json" }); res.end(JSON.stringify({ error: e.message })); }
+    return;
+  }
+  if (req.url === "/api/chat" && req.method === "POST") {
+    if (!cliAvailable) { res.writeHead(503, { "Content-Type": "application/json" }); res.end(JSON.stringify({ error: "Claude CLI not available" })); return; }
+    try {
+      const chatBody = await parseBody(req);
+      const chatMessage = chatBody.message || "";
+      const chatHistory = chatBody.history || [];
+      const chatModel = chatBody.model || "sonnet";
+      let chatPrompt = buildChatSystemPrompt(readAllTasks(), PROJECT_NAME);
+      if (chatHistory.length > 0) {
+        chatPrompt += "## Conversation so far:\n";
+        for (let ci = Math.max(0, chatHistory.length - 10); ci < chatHistory.length; ci++) {
+          const ch = chatHistory[ci];
+          chatPrompt += (ch.role === "user" ? "[User]" : "[Assistant]") + ": " + ch.content + "\n\n";
+        }
+      }
+      chatPrompt += "[User]: " + chatMessage;
+      res.writeHead(200, { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", Connection: "keep-alive" });
+      const chatEnv = Object.assign({}, process.env);
+      delete chatEnv.ANTHROPIC_API_KEY;
+      const chatProc = spawn("claude", ["-p", "--verbose", "--output-format", "stream-json", "--model", chatModel, "--no-session-persistence"], { cwd: REPO_PATH, env: chatEnv, stdio: ["pipe", "pipe", "pipe"] });
+      chatProc.stdin.write(chatPrompt); chatProc.stdin.end();
+      let chatBuf = "", rawOut = "", fullResponse = "";
+      appendOrchestratorHistory("user", chatMessage);
+      chatProc.stdout.on("data", (data) => {
+        const chunk = data.toString(); rawOut += chunk; chatBuf += chunk;
+        const lines = chatBuf.split("\n"); chatBuf = lines.pop();
+        for (const ln of lines) {
+          if (!ln.trim()) continue;
+          try {
+            const json = JSON.parse(ln);
+            let text = "";
+            if (json.type === "assistant" && json.subtype === "text") text = json.text || "";
+            else if (json.type === "assistant" && json.message && json.message.content) json.message.content.forEach((c) => { if (c.type === "text") text += c.text; });
+            else if (json.type === "content_block_delta" && json.delta) text = json.delta.text || "";
+            if (text) { fullResponse += text; res.write("data: " + JSON.stringify({ type: "chat", chunk: text }) + "\n\n"); }
+          } catch {}
+        }
+      });
+      let chatErr = "";
+      chatProc.stderr.on("data", (data) => { chatErr += data.toString(); });
+      chatProc.on("close", (code) => {
+        try {
+          if (!rawOut.trim() || code !== 0) res.write("data: " + JSON.stringify({ type: "chat_debug", rawOut: rawOut.slice(0, 2000), stderr: chatErr.slice(0, 2000), exitCode: code }) + "\n\n");
+          if (chatErr) res.write("data: " + JSON.stringify({ type: "chat_error", error: chatErr.trim(), exitCode: code }) + "\n\n");
+          res.write("data: " + JSON.stringify({ type: "chat_done" }) + "\n\n"); res.end();
+          if (fullResponse) { appendOrchestratorHistory("orchestrator", fullResponse); extractAndSaveLearnings(fullResponse); }
+        } catch {}
+      });
+      req.on("close", () => { try { chatProc.kill(); } catch {} });
+    } catch (e) { if (!res.headersSent) { res.writeHead(400, { "Content-Type": "application/json" }); res.end(JSON.stringify({ error: e.message })); } }
+    return;
+  }
+  if (req.url === "/api/exec/stop" && req.method === "POST") {
+    const stoppedId = stopExec();
+    res.writeHead(200, { "Content-Type": "application/json" }); res.end(JSON.stringify({ stopped: !!stoppedId, taskId: stoppedId }));
+    return;
+  }
+
+  // Static (CSS / playbooks / etc.)
+  if (req.method === "GET" && serveStatic(req, res)) return;
+
+  // HTML dashboard
+  res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+  res.end(getHTML());
+});
+
+checkClaudeCLI();
+watchTasks();
+server.listen(PORT, () => {
+  console.log("");
+  console.log("  " + PROJECT_NAME + " · kanban-system");
+  console.log("  ─────────────────────────");
+  console.log("  http://localhost:" + PORT);
+  console.log("  Tasks:   " + TASKS_DIR);
+  console.log("  Manual:  " + KANBAN_DIR);
+  console.log("  App repo:" + REPO_PATH);
+  console.log("  Config:  " + (config.configSource || "(none — using defaults)"));
+  console.log("  CLI:     " + (cliAvailable ? "ready" : process.env.CLAUDECODE ? "unavailable (nested session)" : "not found"));
+  if (TELEGRAM.botToken && TELEGRAM.chatId) console.log("  Telegram: configured (chat=" + TELEGRAM.chatId + ")");
+  else console.log("  Telegram: not configured (set TELEGRAM_BOT_TOKEN + TELEGRAM_CHAT_ID)");
+  console.log("");
+  initSlackBot();
+  startTelegramPoller();
+});