kanbango 3.5.0 → 3.6.2

package/bin/kanban.js

@@ -6,8 +6,10 @@ const guiRegistry = require('../gui-registry.js');
 const http = require('http');
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 
 const BACKLOG = path.join(process.cwd(), 'backlog');
+const AGENT_MANIFEST = '.kanbango-agents.json';
 
 function shortId(taskId) {
   const match = taskId.match(/^(?:[A-Z]+-)?(\d+)/);
@@ -99,6 +101,8 @@ async function cliInit() {
         + '- `active/`  — w trakcie (max 1-2)\n'
         + '- `planned/` — zaplanowane\n'
         + '- `icebox/`  — zamrozone / nice-to-have\n'
+        + '- `testing/` — bramka QA (async agent)\n'
+        + '- `review/`  — bramka review / Temida (async agent)\n'
         + '- `done/`    — ukonczone\n'
         + '- `epics/`   — first-class epic containers (context for initiatives)\n',
       'utf-8'
@@ -108,6 +112,129 @@ async function cliInit() {
   console.log(`✓ Backlog w: ${BACKLOG}`);
 }
 
+function sha256Hex(content) {
+  return crypto.createHash('sha256').update(content).digest('hex');
+}
+
+async function readAgentManifest(destDir) {
+  const manifestPath = path.join(destDir, AGENT_MANIFEST);
+  try {
+    const raw = await fs.promises.readFile(manifestPath, 'utf-8');
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return {};
+    const agents = parsed.agents && typeof parsed.agents === 'object' && !Array.isArray(parsed.agents)
+      ? parsed.agents
+      : parsed;
+    const out = {};
+    for (const [name, value] of Object.entries(agents)) {
+      if (typeof value === 'string' && value) out[name] = value;
+      else if (value && typeof value.hash === 'string' && value.hash) out[name] = value.hash;
+    }
+    return out;
+  } catch (error) {
+    if (error.code === 'ENOENT') return {};
+    if (error instanceof SyntaxError) return {};
+    throw error;
+  }
+}
+
+async function writeAgentManifest(destDir, hashes) {
+  const manifestPath = path.join(destDir, AGENT_MANIFEST);
+  const payload = {
+    version: 1,
+    updated: new Date().toISOString(),
+    agents: hashes
+  };
+  await fs.promises.writeFile(manifestPath, JSON.stringify(payload, null, 2) + '\n', 'utf-8');
+}
+
+async function copyOpenCodeAgents(cwd, force) {
+  const srcDir = path.join(__dirname, '..', 'agents');
+  const destDir = path.join(cwd, '.opencode', 'agent');
+  let names;
+  try {
+    names = (await fs.promises.readdir(srcDir)).filter((f) => f.endsWith('.md'));
+  } catch (error) {
+    if (error.code === 'ENOENT') return { written: 0, updated: 0, unchanged: 0, skipped: 0, conflict: 0 };
+    throw error;
+  }
+  await fs.promises.mkdir(destDir, { recursive: true });
+  const prevHashes = await readAgentManifest(destDir);
+  const nextHashes = { ...prevHashes };
+  let written = 0;
+  let updated = 0;
+  let unchanged = 0;
+  let skipped = 0;
+  let conflict = 0;
+
+  for (const name of names) {
+    const srcPath = path.join(srcDir, name);
+    const destPath = path.join(destDir, name);
+    const srcContent = await fs.promises.readFile(srcPath, 'utf-8');
+    const srcHash = sha256Hex(srcContent);
+    const destExists = fs.existsSync(destPath);
+
+    if (!destExists) {
+      await fs.promises.writeFile(destPath, srcContent, 'utf-8');
+      nextHashes[name] = srcHash;
+      written += 1;
+      console.log(`✓ Skopiowano .opencode/agent/${name}`);
+      continue;
+    }
+
+    const destContent = await fs.promises.readFile(destPath, 'utf-8');
+    const destHash = sha256Hex(destContent);
+    const recorded = prevHashes[name] || null;
+
+    if (force) {
+      if (destHash === srcHash) {
+        nextHashes[name] = srcHash;
+        unchanged += 1;
+        console.log(`• Bez zmian .opencode/agent/${name}`);
+      } else {
+        await fs.promises.writeFile(destPath, srcContent, 'utf-8');
+        nextHashes[name] = srcHash;
+        updated += 1;
+        console.log(`✓ Zaktualizowano .opencode/agent/${name} (--force)`);
+      }
+      continue;
+    }
+
+    // Local copy already matches package source.
+    if (destHash === srcHash) {
+      nextHashes[name] = srcHash;
+      unchanged += 1;
+      console.log(`• Bez zmian .opencode/agent/${name}`);
+      continue;
+    }
+
+    // Clean packaged copy from an older version → safe auto-update.
+    if (recorded && destHash === recorded && recorded !== srcHash) {
+      await fs.promises.writeFile(destPath, srcContent, 'utf-8');
+      nextHashes[name] = srcHash;
+      updated += 1;
+      console.log(`✓ Zaktualizowano .opencode/agent/${name} (nowa wersja w paczce)`);
+      continue;
+    }
+
+    // Local edit (or legacy copy without matching manifest) → do not overwrite.
+    conflict += 1;
+    skipped += 1;
+    if (recorded && destHash !== recorded) {
+      console.log(
+        `• Konflikt .opencode/agent/${name} (lokalna edycja; użyj --force aby nadpisać)`
+      );
+    } else {
+      console.log(
+        `• Pominięto .opencode/agent/${name} (lokalna kopia różni się od paczki; użyj --force)`
+      );
+    }
+  }
+
+  await writeAgentManifest(destDir, nextHashes);
+  return { written, updated, unchanged, skipped, conflict };
+}
+
 async function cliMcpInit(options) {
   const useNpx = options.useNpx;
   const force = options.force;
@@ -140,6 +267,11 @@ async function cliMcpInit(options) {
     }
   }
 
+  // OpenCode agents ship with the package; Claude path does not get them.
+  if (!onlyClaude) {
+    await copyOpenCodeAgents(cwd, force);
+  }
+
   if (!force) {
     console.log('  (użyj --force, aby nadpisać istniejące pliki)');
   }
@@ -453,7 +585,9 @@ async function serveWeb(port) {
             acceptance_criteria: body.acceptance_criteria,
             test_cases: body.test_cases,
             subtasks: body.subtasks,
-            notes: body.notes
+            notes: body.notes,
+            adr: body.adr,
+            evidence: body.evidence
           }
         );
         sendJson(res, 201, task);
@@ -474,7 +608,9 @@ async function serveWeb(port) {
             acceptance_criteria: body.acceptance_criteria,
             test_cases: body.test_cases,
             subtasks: body.subtasks,
-            notes: body.notes
+            notes: body.notes,
+            adr: body.adr,
+            evidence: body.evidence
           }
         );
         sendJson(res, 201, task);
@@ -568,6 +704,8 @@ async function serveWeb(port) {
           if (body.test_cases !== undefined) patch.test_cases = body.test_cases;
           if (body.subtasks !== undefined) patch.subtasks = body.subtasks;
           if (body.notes !== undefined) patch.notes = body.notes;
+          if (body.adr !== undefined) patch.adr = body.adr;
+          if (body.evidence !== undefined) patch.evidence = body.evidence;
           if (body.epic_id !== undefined) patch.epic_id = body.epic_id;
           else if (body.epic !== undefined) patch.epic = body.epic;
           else if (body.epic_group !== undefined) patch.epic_group = body.epic_group;

package/index.html

@@ -11,6 +11,8 @@
   --active:  #e85d04;
   --planned: #2563eb;
   --icebox:  #64748b;
+  --testing: #ca8a04;
+  --review:  #7c3aed;
   --done:    #16a34a;
   --bg:      #e8eaef;
   --card:    #ffffff;
@@ -285,6 +287,8 @@ header h1 { font-size: 14px; font-weight: 700; letter-spacing: -0.2px; }
 }
 .col-head.icebox  { color: var(--icebox); }
 .col-head.planned { color: var(--planned); }
+.col-head.testing { color: var(--testing); }
+.col-head.review  { color: var(--review); }
 .col-head.done    { color: var(--done); }
 .ch-count {
   background: rgba(0,0,0,0.07);
@@ -327,6 +331,8 @@ header h1 { font-size: 14px; font-weight: 700; letter-spacing: -0.2px; }
   box-shadow: 0 2px 6px rgba(232,93,4,0.10);
 }
 .card.col-active.selected { box-shadow: 0 0 0 2px var(--active); }
+.card.col-testing { border-left-color: var(--testing); }
+.card.col-review  { border-left-color: var(--review); }
 .card.col-done    { border-left-color: var(--done); opacity: 0.7; }
 .card.col-icebox {
   background: #edf0f7;
@@ -353,8 +359,24 @@ header h1 { font-size: 14px; font-weight: 700; letter-spacing: -0.2px; }
 .prog-fill { height: 100%; border-radius: 2px; }
 .prog-fill.planned { background: var(--planned); }
 .prog-fill.active  { background: var(--active);  }
+.prog-fill.testing { background: var(--testing); }
+.prog-fill.review  { background: var(--review);  }
 .prog-fill.done    { background: var(--done);    }
 .prog-fill.icebox  { background: var(--icebox);  }
+.wf-badge {
+  font-size: 9px;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.4px;
+  padding: 1px 5px;
+  border-radius: 4px;
+  margin-left: auto;
+}
+.wf-badge.running { background: #fef3c7; color: #92400e; }
+.wf-badge.pass    { background: #dcfce7; color: #166534; }
+.wf-badge.fail    { background: #fee2e2; color: #991b1b; }
+.wf-badge.blocked { background: #e2e8f0; color: #475569; }
+.wf-badge.idle    { background: #f1f5f9; color: #64748b; }
 .prog-txt { font-size: 10px; color: var(--muted); white-space: nowrap; font-variant-numeric: tabular-nums; }
 
 .card-actions {
@@ -783,6 +805,14 @@ header h1 { font-size: 14px; font-weight: 700; letter-spacing: -0.2px; }
         <div class="col-head planned">Planned <span class="ch-count" id="cnt-planned">0</span></div>
         <div class="col-body" id="col-planned"></div>
       </div>
+      <div class="col" data-col="testing">
+        <div class="col-head testing">Testing <span class="ch-count" id="cnt-testing">0</span></div>
+        <div class="col-body" id="col-testing"></div>
+      </div>
+      <div class="col" data-col="review">
+        <div class="col-head review">Review <span class="ch-count" id="cnt-review">0</span></div>
+        <div class="col-body" id="col-review"></div>
+      </div>
       <div class="col" data-col="done">
         <div class="col-head done">Done <span class="ch-count" id="cnt-done">0</span></div>
         <div class="col-body" id="col-done"></div>
@@ -804,10 +834,12 @@ header h1 { font-size: 14px; font-weight: 700; letter-spacing: -0.2px; }
 const BOARD_COLS = [
   { id: "icebox",  label: "Icebox" },
   { id: "planned", label: "Planned" },
+  { id: "testing", label: "Testing" },
+  { id: "review",  label: "Review" },
   { id: "done",    label: "Done" }
 ];
-// Move order: icebox ↔ planned ↔ active(NOW) ↔ done
-const MOVE_ORDER = ["icebox", "planned", "active", "done"];
+// Move order: icebox ↔ planned ↔ active(NOW) ↔ testing ↔ review ↔ done
+const MOVE_ORDER = ["icebox", "planned", "active", "testing", "review", "done"];
 
 let allTasks = [];
 let allEpicEntities = [];
@@ -1002,11 +1034,23 @@ function currentEpicRef() {
   return "";
 }
 
+const COLUMN_TRANSITIONS = {
+  icebox: ["planned"],
+  planned: ["active", "icebox", "testing"],
+  active: ["planned", "testing", "icebox"],
+  testing: ["active", "review"],
+  review: ["active", "done"],
+  done: ["active"]
+};
+
 function getNeighborCols(colId) {
+  const allowed = COLUMN_TRANSITIONS[colId] || [];
   const idx = MOVE_ORDER.indexOf(colId);
+  const behind = idx > 0 ? MOVE_ORDER.slice(0, idx).reverse() : [];
+  const ahead = idx >= 0 ? MOVE_ORDER.slice(idx + 1) : [];
   return {
-    prev: idx > 0 ? MOVE_ORDER[idx - 1] : null,
-    next: idx >= 0 && idx < MOVE_ORDER.length - 1 ? MOVE_ORDER[idx + 1] : null
+    prev: behind.find((col) => allowed.includes(col)) || null,
+    next: ahead.find((col) => allowed.includes(col)) || null
   };
 }
 
@@ -1035,6 +1079,12 @@ function renderCard(task, colId) {
   const idBadge = el("span", "card-id");
   idBadge.textContent = shortId;
   top.appendChild(idBadge);
+  const wfStatus = task.workflow && task.workflow.status;
+  if (wfStatus && (colId === "testing" || colId === "review" || wfStatus === "running")) {
+    const badge = el("span", `wf-badge ${wfStatus}`);
+    badge.textContent = wfStatus;
+    top.appendChild(badge);
+  }
   card.appendChild(top);
 
   const titleEl = el("div", "card-title");
@@ -1267,8 +1317,19 @@ function renderTaskPaperView(paper, task) {
       cmd.textContent = ev.test_command || "(no command)";
       card.appendChild(cmd);
       const meta = el("div", "ev-meta");
-      meta.textContent = `exit ${ev.exit_code == null ? "?" : ev.exit_code}${ev.created ? " · " + ev.created : ""}`;
+      const bits = [];
+      if (ev.stage) bits.push(ev.stage);
+      if (ev.agent) bits.push(ev.agent);
+      if (ev.verdict) bits.push(ev.verdict);
+      bits.push(`exit ${ev.exit_code == null ? "?" : ev.exit_code}`);
+      if (ev.created) bits.push(ev.created);
+      meta.textContent = bits.join(" · ");
       card.appendChild(meta);
+      if (ev.summary) {
+        const sum = el("div", "ev-diff");
+        sum.textContent = ev.summary;
+        card.appendChild(sum);
+      }
       if (ev.diff) {
         const diff = el("div", "ev-diff");
         diff.textContent = ev.diff;

package/index.js

@@ -10,12 +10,14 @@
 
 const kanban = require('./kanban.js');
 const plan = require('./plan.js');
+const workflow = require('./workflow.js');
 const guiRegistry = require('./gui-registry.js');
 const playbook = require('./agent-playbook.js');
 
 module.exports = {
   kanban,
   plan,
+  workflow,
   guiRegistry,
   playbook,
 };

package/kanban.js

@@ -3,13 +3,27 @@ const path = require('path');
 
 const BACKLOG = path.join(process.cwd(), 'backlog');
 const EPICS_DIR = path.join(BACKLOG, 'epics');
-const COLS = ['active', 'planned', 'icebox', 'done'];
+const COLS = ['active', 'planned', 'icebox', 'testing', 'review', 'done'];
 const STATUS_MAP = {
   active: 'in_progress',
   planned: 'planned',
   icebox: 'icebox',
+  testing: 'testing',
+  review: 'review',
   done: 'done'
 };
+const WORKFLOW_STAGES = ['testing', 'review'];
+const WORKFLOW_STATUSES = ['idle', 'running', 'pass', 'fail', 'blocked'];
+const EVIDENCE_VERDICTS = ['pass', 'fail', 'blocked', ''];
+// Agent/human move contract. Same column is always a no-op.
+const COLUMN_TRANSITIONS = {
+  icebox: ['planned'],
+  planned: ['active', 'icebox', 'testing'],
+  active: ['planned', 'testing', 'icebox'],
+  testing: ['active', 'review'],
+  review: ['active', 'done'],
+  done: ['active']
+};
 const VIEW_FIELDS = {
   summary: ['task_number', 'title', 'column', 'epic_id', 'epic_group', 'created', 'progress'],
   planning: [
@@ -44,7 +58,10 @@ const VIEW_FIELDS = {
     'acceptance_criteria',
     'test_cases',
     'subtasks',
-    'adr'
+    'adr',
+    'evidence',
+    'plan',
+    'workflow'
   ],
   full: [
     'task_number',
@@ -63,7 +80,10 @@ const VIEW_FIELDS = {
     'test_cases',
     'subtasks',
     'adr',
-    'notes'
+    'notes',
+    'evidence',
+    'plan',
+    'workflow'
   ]
 };
 
@@ -261,14 +281,39 @@ function normalizeSubtasks(value) {
 
 function normalizeEvidence(value) {
   if (!Array.isArray(value)) return [];
-  return value.map((item) => ({
-    diff: normalizeString(item && item.diff),
-    test_command: normalizeString(item && item.test_command),
-    stdout: normalizeString(item && item.stdout),
-    stderr: normalizeString(item && item.stderr),
-    exit_code: Number.isInteger(item && item.exit_code) ? item.exit_code : null,
-    created: normalizeString(item && item.created) || todayIso()
-  }));
+  return value.map((item) => {
+    const stage = normalizeString(item && item.stage);
+    const verdict = normalizeString(item && item.verdict);
+    return {
+      diff: normalizeString(item && item.diff),
+      test_command: normalizeString(item && item.test_command),
+      stdout: normalizeString(item && item.stdout),
+      stderr: normalizeString(item && item.stderr),
+      exit_code: Number.isInteger(item && item.exit_code) ? item.exit_code : null,
+      created: normalizeString(item && item.created) || todayIso(),
+      stage: WORKFLOW_STAGES.includes(stage) || stage === 'plan' ? stage : '',
+      agent: normalizeString(item && item.agent),
+      verdict: EVIDENCE_VERDICTS.includes(verdict) ? verdict : '',
+      summary: normalizeString(item && item.summary)
+    };
+  });
+}
+
+function normalizeWorkflow(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const stage = normalizeString(value.stage);
+  const status = normalizeString(value.status);
+  const agent = normalizeString(value.agent);
+  const runId = normalizeString(value.run_id);
+  if (!stage && !status && !agent && !runId) return null;
+  return {
+    stage: WORKFLOW_STAGES.includes(stage) ? stage : null,
+    status: WORKFLOW_STATUSES.includes(status) ? status : 'idle',
+    agent,
+    run_id: runId,
+    started_at: normalizeString(value.started_at) || undefined,
+    finished_at: normalizeString(value.finished_at) || undefined
+  };
 }
 
 function normalizeAdr(value) {
@@ -355,6 +400,7 @@ function normalizeTask(task) {
     notes: normalizeString(task.notes),
     plan: normalizePlan(task.plan),
     evidence: normalizeEvidence(task.evidence),
+    workflow: normalizeWorkflow(task.workflow),
     task_number: extractTaskNumber(id)
   };
 
@@ -381,6 +427,7 @@ function serializeTask(task) {
     notes: normalized.notes,
     plan: normalized.plan,
     evidence: normalized.evidence,
+    workflow: normalized.workflow,
     task_number: normalized.task_number
   };
 }
@@ -418,7 +465,9 @@ function serializeEpic(epic) {
 function deriveEpicStatus(tasks, epic) {
   if (epic && epic.archived) return 'archived';
   if (!tasks || tasks.length === 0) return 'empty';
-  if (tasks.some((task) => task.column === 'active')) return 'active';
+  if (tasks.some((task) => WORKFLOW_STAGES.includes(task.column) || task.column === 'active')) {
+    return 'active';
+  }
   if (tasks.every((task) => task.column === 'done')) return 'done';
   return 'planned';
 }
@@ -436,13 +485,21 @@ function getEpicProgress(tasks) {
     tasks_done: 0,
     tasks_active: 0,
     tasks_planned: 0,
-    tasks_icebox: 0
+    tasks_icebox: 0,
+    tasks_testing: 0,
+    tasks_review: 0
+  };
+  const keyByCol = {
+    done: 'tasks_done',
+    active: 'tasks_active',
+    planned: 'tasks_planned',
+    icebox: 'tasks_icebox',
+    testing: 'tasks_testing',
+    review: 'tasks_review'
   };
   for (const task of tasks) {
-    if (task.column === 'done') progress.tasks_done += 1;
-    else if (task.column === 'active') progress.tasks_active += 1;
-    else if (task.column === 'planned') progress.tasks_planned += 1;
-    else if (task.column === 'icebox') progress.tasks_icebox += 1;
+    const key = keyByCol[task.column];
+    if (key) progress[key] += 1;
   }
   return progress;
 }
@@ -1360,6 +1417,32 @@ function validateColumn(column, fieldName = 'column') {
   }
 }
 
+function allowedColumnsFrom(fromColumn) {
+  return COLUMN_TRANSITIONS[fromColumn] ? COLUMN_TRANSITIONS[fromColumn].slice() : [];
+}
+
+function validateTransition(fromColumn, toColumn, taskId) {
+  if (fromColumn === toColumn) return;
+  validateColumn(toColumn);
+  const allowed = allowedColumnsFrom(fromColumn);
+  if (allowed.includes(toColumn)) return;
+  throw createKanbanError(
+    'INVALID_TRANSITION',
+    taskId
+      ? `Cannot move task ${taskId} from ${fromColumn} to ${toColumn}`
+      : `Cannot move from ${fromColumn} to ${toColumn}`,
+    `From ${fromColumn} you can move only to: ${allowed.join(', ') || '(none)'}`,
+    {
+      task_id: taskId || undefined,
+      from: fromColumn,
+      to: toColumn,
+      allowed_columns: allowed
+    },
+    false,
+    400
+  );
+}
+
 function validatePatch(patch) {
   if (!patch || typeof patch !== 'object' || Array.isArray(patch)) {
     throw createKanbanError(
@@ -1413,6 +1496,7 @@ async function doCreate(title, column = 'planned', epicRef = '—', extra = {})
         subtasks: extra.subtasks,
         notes: extra.notes,
         plan: extra.plan,
+        adr: extra.adr,
         evidence: extra.evidence
       });
       try {
@@ -1451,6 +1535,9 @@ async function updateTaskRecord(taskId, patch) {
 
   if (patch.column !== undefined) {
     validateColumn(patch.column);
+    if (patch.column !== current.column) {
+      validateTransition(current.column, patch.column, current.id);
+    }
     next.column = patch.column;
   }
   if (patch.title !== undefined) {
@@ -1566,6 +1653,22 @@ async function updateTaskRecord(taskId, patch) {
   }
   if (patch.notes !== undefined) next.notes = normalizeString(patch.notes);
   if (patch.plan !== undefined) next.plan = patch.plan;
+  if (patch.workflow !== undefined) {
+    next.workflow = patch.workflow === null ? null : normalizeWorkflow(patch.workflow);
+  }
+  if (patch.appendEvidence !== undefined) {
+    if (!patch.appendEvidence || typeof patch.appendEvidence !== 'object' || Array.isArray(patch.appendEvidence)) {
+      throw createKanbanError(
+        'VALIDATION_ERROR',
+        'appendEvidence must be an evidence object',
+        'Send a single evidence entry to append',
+        { field: 'appendEvidence' },
+        false,
+        400
+      );
+    }
+    next.evidence = [...normalizeEvidence(next.evidence), ...normalizeEvidence([patch.appendEvidence])];
+  }
   if (patch.evidence !== undefined) {
     if (!Array.isArray(patch.evidence)) {
       throw createKanbanError(
@@ -1583,9 +1686,36 @@ async function updateTaskRecord(taskId, patch) {
   return writeTask(next, previousFilePath);
 }
 
+function scheduleWorkflowEnqueue(previousColumn, updated) {
+  if (!updated || !WORKFLOW_STAGES.includes(updated.column)) return;
+  if (previousColumn === updated.column) return;
+  // Lazy require avoids circular load: workflow.js requires kanban.js.
+  setImmediate(() => {
+    try {
+      const workflow = require('./workflow.js');
+      Promise.resolve(workflow.maybeEnqueueOnColumnEnter(updated, previousColumn)).catch((err) => {
+        console.error('workflow enqueue failed:', err && err.message ? err.message : err);
+      });
+    } catch (err) {
+      console.error('workflow load failed:', err && err.message ? err.message : err);
+    }
+  });
+}
+
 async function updateTask(taskId, patch) {
   validatePatch(patch);
-  return withBoardLock(() => updateTaskRecord(taskId, patch));
+  let previousColumn = null;
+  const updated = await withBoardLock(async () => {
+    const resolvedId = await resolveTaskId(taskId);
+    const previousFilePath = await findFile(resolvedId);
+    if (previousFilePath) {
+      const current = await parseEpic(previousFilePath, path.basename(path.dirname(previousFilePath)));
+      previousColumn = current.column;
+    }
+    return updateTaskRecord(taskId, patch);
+  });
+  scheduleWorkflowEnqueue(previousColumn, updated);
+  return updated;
 }
 
 async function doMove(epicId, target) {
@@ -1593,7 +1723,7 @@ async function doMove(epicId, target) {
     await updateTask(epicId, { column: target });
     return true;
   } catch (error) {
-    if (error.code === 'TASK_NOT_FOUND' || error.code === 'INVALID_COLUMN') {
+    if (error.code === 'TASK_NOT_FOUND' || error.code === 'INVALID_COLUMN' || error.code === 'INVALID_TRANSITION') {
       return false;
     }
     throw error;
@@ -1683,8 +1813,14 @@ module.exports = {
   resolveTaskId,
   COLS,
   STATUS_MAP,
+  WORKFLOW_STAGES,
+  COLUMN_TRANSITIONS,
+  allowedColumnsFrom,
+  validateTransition,
   VIEW_FIELDS,
   EPIC_VIEW_FIELDS,
+  normalizeEvidence,
+  normalizeWorkflow,
   LIVE_EPIC_STATUSES,
   RECOMMENDED_CREATE_FIELDS,
   RECOMMENDED_EPIC_CREATE_FIELDS,

package/mcp-server.js

@@ -502,7 +502,10 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             column: {
               type: 'string',
               enum: COLS,
-              description: 'Target column for move (not col)'
+              description:
+                'Target column for move (not col). Must be a legal transition from the current column. '
+                + 'icebox→planned; planned→active|icebox|testing; active→planned|testing|icebox; '
+                + 'testing→active|review; review→active|done; done→active. Illegal → INVALID_TRANSITION + allowed_columns.'
             },
             patch: {
               type: 'object',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kanbango",
-  "version": "3.5.0",
+  "version": "3.6.2",
   "description": "JSON-first local Kanban board with web GUI, CLI, and MCP server",
   "main": "index.js",
   "bin": {

package/plan.js

@@ -147,8 +147,11 @@ async function done(payload = {}) {
     throw planError('PLAN_INCOMPLETE', 'Plan has incomplete subtasks',
       'Advance every plan step before marking the workflow done', { incomplete });
   }
-  const updated = await kanban.updateTask(task.id, { column: 'done', plan: { ...task.plan, status: 'done' } });
-  return result(updated, { status: 'done' });
+  const updated = await kanban.updateTask(task.id, {
+    column: 'testing',
+    plan: { ...(task.plan || {}), status: 'done' }
+  });
+  return result(updated, { status: 'done', column: updated.column });
 }
 
 async function status(taskId) {