local-kanban 1.6.3

package/src/server.js

@@ -0,0 +1,100 @@
+import Fastify from 'fastify';
+import fastifyStatic from '@fastify/static';
+import { mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { DATA_DIR, logError } from './db.js';
+import { PORT, ROOT, localRoot } from './config.js';
+import { makeOriginGuard } from './origin-guard.js';
+import { errorHandler } from './error-handler.js';
+import projectRoutes from './routes/projects.js';
+import taskRoutes from './routes/tasks.js';
+import dashboardRoutes from './routes/dashboard.js';
+import systemRoutes from './routes/system.js';
+import skillRoutes from './routes/skills.js';
+import eventRoutes from './routes/events.js';
+import horizonRoutes from './routes/horizons.js';
+import { startWorker } from './sync/worker.js';
+import { startBackups } from './backup.js';
+import { sweepStalePreviews } from './restore.js';
+
+const ATTACH_DIR = join(DATA_DIR, 'attachments');
+mkdirSync(ATTACH_DIR, { recursive: true });
+
+const app = Fastify({ logger: { level: 'warn' } });
+
+app.addHook('onRequest', makeOriginGuard(PORT));
+
+const CSP = [
+  "default-src 'self'",
+  "img-src 'self' data: blob:",
+  "style-src 'self' 'unsafe-inline'",
+  "script-src 'self'",
+  "connect-src 'self'",
+  "object-src 'none'",
+  "base-uri 'none'",
+  "frame-ancestors 'none'",
+].join('; ');
+
+app.register(fastifyStatic, {
+  root: join(ROOT, 'public'),
+  setHeaders: (res) => {
+    res.setHeader('Cache-Control', 'no-cache');
+    res.setHeader('Content-Security-Policy', CSP);
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.setHeader('Referrer-Policy', 'no-referrer');
+  },
+});
+app.register(fastifyStatic, {
+  root: ATTACH_DIR,
+  prefix: '/attachments/',
+  decorateReply: false,
+  setHeaders: (res) => { res.setHeader('X-Content-Type-Options', 'nosniff'); },
+});
+app.setErrorHandler(errorHandler);
+
+app.register(projectRoutes);
+app.register(taskRoutes);
+app.register(dashboardRoutes);
+app.register(systemRoutes);
+app.register(skillRoutes);
+app.register(eventRoutes);
+app.register(horizonRoutes);
+
+for (const ev of ['unhandledRejection', 'uncaughtException']) {
+  process.on(ev, (err) => {
+    logError('server', ev, err?.message || String(err), err?.stack);
+    console.error(err);
+    process.exit(1);
+  });
+}
+
+if (process.env.KB_PREVIEW_TTL_MS) {
+  const ttl = Number(process.env.KB_PREVIEW_TTL_MS);
+  if (Number.isFinite(ttl) && ttl > 0) setTimeout(() => process.exit(0), ttl).unref();
+  process.stdin.on('end', () => process.exit(0));
+  process.stdin.on('close', () => process.exit(0));
+  process.stdin.on('error', () => process.exit(0));
+  process.stdin.resume();
+}
+
+app.listen({ port: PORT, host: '127.0.0.1' }).then(() => {
+  console.log(`kanban: http://127.0.0.1:${PORT}`);
+  console.log(`kanban: data ${DATA_DIR} · project folders ${localRoot()}`);
+  startWorker();
+  startBackups();
+  if (!process.env.KB_PREVIEW_TTL_MS) {
+    const swept = sweepStalePreviews();
+    if (swept) console.log(`restore: swept ${swept} stale preview director${swept === 1 ? 'y' : 'ies'}`);
+  }
+}).catch((err) => {
+  if (err && err.code === 'EADDRINUSE') {
+    console.error(`\n  Port ${PORT} is already taken — the board did not start.\n`);
+    console.error('  What to do:');
+    console.error(`    · free the port (see who holds it:  lsof -i :${PORT} )`);
+    console.error(`    · or run on another one:  PORT=${PORT + 1} local-kanban start`);
+    console.error('    · or change the port in ecosystem.config.cjs when running under pm2\n');
+    process.exit(1);
+  }
+  app.log.error(err);
+  process.exit(1);
+});

package/src/skills.js

@@ -0,0 +1,119 @@
+
+import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, resolve, sep } from 'node:path';
+import { skillsExtra } from './config.js';
+import { snapshotDir, snapshotFile } from './file-snapshot.js';
+
+export const SKILL_NAME_RE = /^[A-Za-z0-9_-]{1,64}$/;
+export const SKILL_MAX_BYTES = 512 * 1024;
+
+export const BOARD_SKILL = 'kanban';
+export const GENERIC_DEPLOY_SKILL = 'deploy';
+
+export function skillRoots() {
+  const home = process.env.HOME || homedir();
+  return [join(home, '.claude', 'skills'), ...skillsExtra()].map((r) => resolve(r));
+}
+
+export function resolveSkillPath(name) {
+  if (!name || !SKILL_NAME_RE.test(name)) return null;
+  for (const root of skillRoots()) {
+    const p = resolve(root, name, 'SKILL.md');
+    if (!p.startsWith(root + sep)) continue;
+    if (existsSync(p)) return p;
+  }
+  return null;
+}
+
+export function skillTargetPath(name) {
+  if (!name || !SKILL_NAME_RE.test(name)) return null;
+  return resolveSkillPath(name) || join(skillRoots()[0], name, 'SKILL.md');
+}
+
+function realPathOf(path) {
+  try { return realpathSync(path); } catch {  }
+  try { return join(realpathSync(join(path, '..')), 'SKILL.md'); } catch { return path; }
+}
+
+export function skillInfo(name) {
+  if (!name || !SKILL_NAME_RE.test(name)) return null;
+  const path = skillTargetPath(name);
+  const real = realPathOf(path);
+  let size = null;
+  let mtime = null;
+  try {
+    const st = statSync(path);
+    size = st.size;
+    mtime = new Date(st.mtimeMs).toISOString();
+  } catch {  }
+  return {
+    name,
+    path,
+    real_path: real,
+    symlink: real !== path,
+    exists: existsSync(path),
+    size,
+    mtime,
+  };
+}
+
+export function listSkills() {
+  const seen = new Set();
+  const out = [];
+  for (const root of skillRoots()) {
+    let entries = [];
+    try { entries = readdirSync(root); } catch { continue; }
+    for (const name of entries.sort()) {
+      if (seen.has(name) || !SKILL_NAME_RE.test(name)) continue;
+      if (!existsSync(join(root, name, 'SKILL.md'))) continue;
+      seen.add(name);
+      out.push({ ...skillInfo(name), root });
+    }
+  }
+  return out;
+}
+
+export function readSkill(name) {
+  const info = skillInfo(name);
+  if (!info || !info.exists) return info ? { ...info, text: null, truncated: false } : null;
+  const buf = readFileSync(info.path);
+  const truncated = buf.length > SKILL_MAX_BYTES;
+  return { ...info, text: buf.subarray(0, SKILL_MAX_BYTES).toString('utf8'), truncated };
+}
+
+export const SKILL_BACKUP_DIR = () => snapshotDir('skills');
+
+export function writeSkill(name, text, confirmPath) {
+  if (!name || !SKILL_NAME_RE.test(name)) return { error: 'skill name: latin letters, digits, hyphen, underscore only', code: 400 };
+  if (typeof text !== 'string') return { error: 'text is required', code: 400 };
+  if (Buffer.byteLength(text) > SKILL_MAX_BYTES) return { error: `the skill is larger than ${Math.round(SKILL_MAX_BYTES / 1024)} KB`, code: 413 };
+  const info = skillInfo(name);
+  if (confirmPath !== info.real_path) {
+    return { error: 'the file on disk is not the one the page was editing', code: 409, real_path: info.real_path };
+  }
+  const backup = snapshotFile('skills', name, info.path);
+  mkdirSync(join(info.path, '..'), { recursive: true });
+  writeFileSync(info.path, text);
+  return { ...skillInfo(name), backup, backup_name: backup ? backup.split(sep).pop() : null };
+}
+
+export function deleteSkill(name, confirmPath) {
+  if (!name || !SKILL_NAME_RE.test(name)) return { error: 'skill name: latin letters, digits, hyphen, underscore only', code: 400 };
+  const info = skillInfo(name);
+  if (!info.exists) return { error: 'there is no such skill', code: 404 };
+  if (confirmPath !== info.real_path) {
+    return { error: 'the file on disk is not the one the page was showing', code: 409, real_path: info.real_path };
+  }
+  const backup = snapshotFile('skills', name, info.path);
+  const dir = join(info.path, '..');
+  let unlinkedOnly = false;
+  try { unlinkedOnly = lstatSync(dir).isSymbolicLink(); } catch {  }
+  if (unlinkedOnly) {
+    unlinkSync(dir);
+  } else {
+    rmSync(info.path, { force: true });
+    try { if (!readdirSync(dir).length) rmSync(dir, { recursive: true, force: true }); } catch {  }
+  }
+  return { name, removed: true, link_only: unlinkedOnly, backup, backup_name: backup ? backup.split(sep).pop() : null };
+}

package/src/sync/github.js

@@ -0,0 +1,265 @@
+import { execFile } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { db, ghOwner, ghRepo, uiLang } from '../db.js';
+const GH_CANDIDATES = [
+  '/opt/homebrew/bin/gh', '/usr/local/bin/gh', '/usr/bin/gh',
+  '/home/linuxbrew/.linuxbrew/bin/gh', `${process.env.HOME}/.local/bin/gh`,
+];
+const GH = GH_CANDIDATES.find((p) => existsSync(p)) || 'gh';
+
+const PERMANENT = [
+  /validation failed/i,
+  /could not resolve to an? (repository|issue|user|organization)/i,
+  /label.{0,80}not found/i,
+  /^unprocessable entity/i,
+];
+export function isPermanent(stderr) {
+  return PERMANENT.some((re) => re.test(stderr));
+}
+
+export function gh(args, { timeout = 60000 } = {}) {
+  return new Promise((resolve, reject) => {
+    execFile(GH, args, { timeout, maxBuffer: 4 * 1024 * 1024 }, (err, stdout, stderr) => {
+      if (err) {
+        const e = new Error((stderr || err.message || '').trim().slice(0, 500));
+        e.permanent = isPermanent(String(stderr));
+        return reject(e);
+      }
+      resolve(stdout.trim());
+    });
+  });
+}
+
+export async function ghAvailable() {
+  try { await gh(['auth', 'status'], { timeout: 15000 }); return true; }
+  catch { return false; }
+}
+
+const GH_STATUS = [
+  ['backlog',   { ru: 'Бэклог',     en: 'Backlog' },   'PINK'],
+  ['todo',      { ru: 'Сделать',    en: 'To do' },     'GRAY'],
+  ['prep',      { ru: 'Подготовка', en: 'Prep' },      'PURPLE'],
+  ['doing',     { ru: 'Делаю',      en: 'Doing' },     'YELLOW'],
+  ['deploy',    { ru: 'Деплою',     en: 'Deploying' }, 'BLUE'],
+  ['review',    { ru: 'Проверяю',   en: 'Review' },    'ORANGE'],
+  ['done',      { ru: 'Готово',     en: 'Done' },      'GREEN'],
+  ['cancelled', { ru: 'Отменено',   en: 'Cancelled' }, 'RED'],
+];
+const statusName = (names) => names[uiLang()] || names.ru;
+export const ghStatusName = (key) => statusName(GH_STATUS.find(([k]) => k === key)?.[1] || { ru: key });
+export const NAME_TO_KEY = { Todo: 'todo', 'In Progress': 'doing', Done: 'done' };
+for (const [key, names] of GH_STATUS) for (const n of Object.values(names)) NAME_TO_KEY[n] = key;
+const PRIORITY_LABELS = { 1: 'p:low', 2: 'p:med', 3: 'p:high' };
+
+export const LABELS = {
+  bug: 'D73A4A', documentation: '0075CA', docs: '0075CA', duplicate: 'CFD3D7', enhancement: 'A2EEEF',
+  'good first issue': '7057FF', 'help wanted': '008672', invalid: 'E4E669',
+  question: 'D876E3', wontfix: 'FFFFFF', ui: '5319E7', feature: '0E8A16',
+  blocked: 'D93F0B', 'p:low': 'C2E0C6', 'p:med': 'FBCA04', 'p:high': 'B60205',
+  noclaude: '6E7681',
+  security: 'EE0701',
+  ask: '8250DF',
+};
+
+export const MANAGED_LABELS = new Set([...Object.values(PRIORITY_LABELS), 'blocked']);
+
+let labelsEnsuredFor = null;
+
+export function missingLabels(existingNames = []) {
+  const have = new Set(existingNames.map((n) => String(n).toLowerCase()));
+  return Object.entries(LABELS).filter(([name]) => !have.has(name.toLowerCase()));
+}
+
+export async function ensureLabels({ run = gh } = {}) {
+  const repo = ghRepo();
+  if (labelsEnsuredFor === repo) return;
+  let existing = [];
+  let listed = false;
+  try {
+    const out = await run(['label', 'list', '-R', repo, '--limit', '200', '--json', 'name']);
+    existing = JSON.parse(out || '[]').map((l) => l.name);
+    listed = true;
+  } catch {  }
+  for (const [name, color] of missingLabels(existing)) {
+    try {
+      await run(['label', 'create', name, '-R', repo, '--color', color]);
+    } catch (e) {
+      if (!/already exists/i.test(e.message)) throw e;
+    }
+  }
+  if (listed) labelsEnsuredFor = repo;
+}
+
+function statusOptions(project) {
+  return JSON.parse(project.gh_status_options || '{}');
+}
+
+function optionsComplete(project) {
+  const opts = statusOptions(project);
+  return GH_STATUS.every(([key]) => opts[key]);
+}
+
+export async function ensureProject(project) {
+  if (project.gh_project_id && project.gh_status_field_id && optionsComplete(project)) return project;
+
+  let { gh_project_number: number, gh_project_id: pid } = project;
+  if (!pid) {
+    const created = JSON.parse(await gh(['project', 'create', '--owner', ghOwner(), '--title', `kb: ${project.slug}`, '--format', 'json']));
+    number = created.number;
+    pid = created.id;
+  }
+
+  const fields = JSON.parse(await gh(['project', 'field-list', String(number), '--owner', ghOwner(), '--format', 'json'])).fields;
+  const statusField = fields.find((f) => f.name === 'Status');
+
+  const keep = {};
+  for (const o of statusField.options || []) {
+    const key = NAME_TO_KEY[o.name];
+    if (key && !keep[key]) keep[key] = o.id;
+  }
+
+  const optionsLiteral = '[' + GH_STATUS.map(([key, names, color]) => {
+    const idPart = keep[key] ? `id: ${JSON.stringify(keep[key])}, ` : '';
+    return `{${idPart}name: ${JSON.stringify(statusName(names))}, color: ${color}, description: ""}`;
+  }).join(', ') + ']';
+
+  const res = JSON.parse(await gh(['api', 'graphql', '-f',
+    `query=mutation { updateProjectV2Field(input: {fieldId: ${JSON.stringify(statusField.id)}, singleSelectOptions: ${optionsLiteral}}) {
+      projectV2Field { ... on ProjectV2SingleSelectField { id options { id name } } } } }`,
+  ]));
+  const out = res.data.updateProjectV2Field.projectV2Field;
+  const map = {};
+  for (const o of out.options) if (NAME_TO_KEY[o.name]) map[NAME_TO_KEY[o.name]] = o.id;
+
+  db.prepare('UPDATE projects SET gh_project_number=?, gh_project_id=?, gh_status_field_id=?, gh_status_options=? WHERE id=?')
+    .run(number, pid, out.id, JSON.stringify(map), project.id);
+  return db.prepare('SELECT * FROM projects WHERE id = ?').get(project.id);
+}
+
+export async function setItemStatus(project, itemId, statusKey) {
+  const opt = statusOptions(project)[statusKey];
+  if (!itemId) throw new Error('the task has no card on the GitHub board yet — waiting for create_issue');
+  if (!opt) return;
+  await gh(['project', 'item-edit', '--id', itemId, '--project-id', project.gh_project_id,
+    '--field-id', project.gh_status_field_id, '--single-select-option-id', opt]);
+}
+
+function issueBody(project, payload) {
+  return `${payload.description || ''}\n\n_project: ${project.slug} · ${payload.key} · created by local-kanban_`;
+}
+
+function issueTitle(project, payload) {
+  const t = (payload.title || '').trim().split('\n')[0]
+    || (payload.description || '').trim().split('\n')[0].slice(0, 80)
+    || `task ${payload.key}`;
+  const full = `[${project.slug}] ${t}`;
+  return full.length > 200 ? `${full.slice(0, 199)}…` : full;
+}
+
+export async function createIssueOnly(project, payload) {
+  await ensureLabels();
+  const args = ['issue', 'create', '-R', ghRepo(),
+    '--title', issueTitle(project, payload),
+    '--body', issueBody(project, payload)];
+  const labels = [...(payload.labels || [])];
+  if (PRIORITY_LABELS[payload.priority]) labels.push(PRIORITY_LABELS[payload.priority]);
+  if (payload.blocked) labels.push('blocked');
+  for (const l of labels) args.push('--label', l);
+  const url = await gh(args);
+  return { number: parseIssueNumber(url), url };
+}
+
+export function parseIssueNumber(url) {
+  const number = Number(String(url).match(/\/issues\/(\d+)/)?.[1]);
+  if (!Number.isInteger(number) || number <= 0) {
+    throw new Error(`gh issue create answered without an issue link: ${String(url).slice(0, 200)}`);
+  }
+  return number;
+}
+
+export async function findIssueByKey(key) {
+  if (!key) return null;
+  const out = await gh(['issue', 'list', '-R', ghRepo(), '--search', `"${key}" in:body`,
+    '--state', 'all', '--limit', '20', '--json', 'number,url,body']);
+  const list = JSON.parse(out || '[]');
+  const hit = list.find((i) => typeof i.body === 'string' && i.body.includes(`· ${key} ·`));
+  return hit ? { number: hit.number, url: hit.url } : null;
+}
+
+export async function addToProject(project, url) {
+  const item = JSON.parse(await gh(['project', 'item-add', String(project.gh_project_number),
+    '--owner', ghOwner(), '--url', url, '--format', 'json']));
+  return item.id;
+}
+
+export async function updateIssue(payload, project) {
+  await gh(['issue', 'edit', String(payload.gh_issue_number), '-R', ghRepo(),
+    '--title', issueTitle(project, payload),
+    '--body', issueBody(project, payload)]);
+}
+
+export async function setPriority(payload) {
+  await ensureLabels();
+  const args = ['issue', 'edit', String(payload.gh_issue_number), '-R', ghRepo()];
+  for (const l of Object.values(PRIORITY_LABELS)) args.push('--remove-label', l);
+  if (PRIORITY_LABELS[payload.priority]) args.push('--add-label', PRIORITY_LABELS[payload.priority]);
+  await gh(args);
+}
+
+async function currentLabels(number) {
+  try {
+    const out = await gh(['issue', 'view', String(number), '-R', ghRepo(), '--json', 'labels']);
+    return new Set(JSON.parse(out).labels.map((l) => l.name));
+  } catch { return new Set(); }
+}
+
+export async function setLabels(payload) {
+  await ensureLabels();
+  const want = new Set(payload.labels || []);
+  const cur = await currentLabels(payload.gh_issue_number);
+  const args = ['issue', 'edit', String(payload.gh_issue_number), '-R', ghRepo()];
+  let changed = false;
+  for (const l of cur) if (!want.has(l) && !MANAGED_LABELS.has(l)) { args.push('--remove-label', l); changed = true; }
+  for (const l of want) if (!cur.has(l)) { args.push('--add-label', l); changed = true; }
+  if (changed) await gh(args);
+}
+
+export async function setBlocked(payload) {
+  await ensureLabels();
+  await gh(['issue', 'edit', String(payload.gh_issue_number), '-R', ghRepo(),
+    payload.blocked ? '--add-label' : '--remove-label', 'blocked']);
+}
+
+export async function addComment(payload) {
+  const prefix = payload.comment_author === 'claude' ? '🤖 ' : '';
+  await gh(['issue', 'comment', String(payload.gh_issue_number), '-R', ghRepo(), '--body', prefix + payload.comment_body]);
+}
+
+// done → closed completed; cancelled → closed not planned
+export async function closeIssue(payload, project) {
+  await setItemStatus(project, payload.gh_item_id, payload.status);
+  const reason = payload.status === 'cancelled' ? 'not planned' : 'completed';
+  try {
+    await gh(['issue', 'close', String(payload.gh_issue_number), '-R', ghRepo(), '--reason', reason]);
+  } catch (err) {
+    if (!/already closed/i.test(err.message)) throw err;
+  }
+}
+
+export async function reopenIssue(payload, project) {
+  try {
+    await gh(['issue', 'reopen', String(payload.gh_issue_number), '-R', ghRepo()]);
+  } catch (err) {
+    if (!/already open/i.test(err.message)) throw err;
+  }
+  await setItemStatus(project, payload.gh_item_id, payload.status);
+}
+
+export async function deleteIssue(payload) {
+  if (!payload.gh_issue_number) return;
+  try {
+    await gh(['issue', 'close', String(payload.gh_issue_number), '-R', ghRepo(), '--reason', 'not planned']);
+  } catch (err) {
+    if (!/already closed/i.test(err.message)) throw err;
+  }
+}

package/src/sync/worker.js

@@ -0,0 +1,136 @@
+import { db, kvGet, kvSet, syncConfigured, logError, resolveErrors, enqueue, SYNC_MAX_ATTEMPTS } from '../db.js';
+import { emit } from '../bus.js';
+import { taskEvent } from '../task-shape.js';
+import * as github from './github.js';
+
+export function syncPaused() {
+  return kvGet('sync.paused') === '1';
+}
+
+export const ghState = { available: null, lastCheck: 0 };
+
+let draining = false;
+
+async function checkGh() {
+  const ttl = ghState.available ? 600000 : 60000;
+  if (Date.now() - ghState.lastCheck < ttl) return ghState.available;
+  ghState.available = await github.ghAvailable();
+  ghState.lastCheck = Date.now();
+  return ghState.available;
+}
+
+function backoff(attempts) {
+  return Math.min(30 * 2 ** attempts, 3600);
+}
+
+export async function processOp(row, api = github) {
+  const payload = JSON.parse(row.payload);
+  const task = row.task_id
+    ? db.prepare('SELECT t.*, p.slug AS project FROM tasks t JOIN projects p ON p.id = t.project_id WHERE t.id = ?').get(row.task_id)
+    : null;
+  const slug = task?.project || payload.project;
+  let project = db.prepare('SELECT * FROM projects WHERE slug = ?').get(slug);
+  if (!project) return;
+
+  const data = { ...payload, ...(task ? {
+    title: task.title, description: task.description, status: task.status,
+    priority: task.priority, blocked: task.blocked, labels: JSON.parse(task.labels || '[]'),
+    gh_issue_number: task.gh_issue_number, gh_item_id: task.gh_item_id,
+  } : {}) };
+  if (payload.comment_author) { data.comment_author = payload.comment_author; data.comment_body = payload.comment_body; }
+  if (payload.key) data.key = payload.key;
+
+  if (row.op !== 'delete_issue' && !data.gh_issue_number && row.op !== 'create_issue') {
+    if (task && !db.prepare("SELECT 1 FROM sync_queue WHERE task_id = ? AND op = 'create_issue'").get(row.task_id)) {
+      enqueue('create_issue', row.task_id, { ...data, task_id: row.task_id });
+    }
+    throw new Error('the issue does not exist yet — waiting for create_issue');
+  }
+
+  switch (row.op) {
+    case 'create_issue': {
+      if (!task) return;
+      project = await api.ensureProject(project);
+      let { gh_issue_number: number, gh_issue_url: url, gh_item_id: itemId } = task;
+      if (!number) {
+        if (row.started_at) {
+          const found = await api.findIssueByKey(data.key);
+          if (found) ({ number, url } = found);
+        }
+        if (!number) {
+          db.prepare("UPDATE sync_queue SET started_at = datetime('now') WHERE id = ?").run(row.id);
+          ({ number, url } = await api.createIssueOnly(project, data));
+        }
+        if (db.prepare('UPDATE tasks SET gh_issue_number=?, gh_issue_url=? WHERE id=?').run(number, url, task.id).changes === 0) {
+          await api.deleteIssue({ gh_issue_number: number }); return;
+        }
+      }
+      if (!itemId) {
+        itemId = await api.addToProject(project, url);
+        if (db.prepare('UPDATE tasks SET gh_item_id=? WHERE id=?').run(itemId, task.id).changes === 0) {
+          await api.deleteIssue({ gh_issue_number: number }); return;
+        }
+      }
+      await api.setItemStatus(project, itemId, data.status || 'backlog');
+      emit('task.updated', taskEvent(task.id));
+      break;
+    }
+    case 'set_status': project = await api.ensureProject(project); await api.setItemStatus(project, data.gh_item_id, data.status); break;
+    case 'set_priority': await api.setPriority(data); break;
+    case 'set_blocked': await api.setBlocked(data); break;
+    case 'set_labels': await api.setLabels(data); break;
+    case 'add_comment': await api.addComment(data); break;
+    case 'update_issue': await api.updateIssue(data, project); break;
+    case 'close_issue': project = await api.ensureProject(project); await api.closeIssue(data, project); break;
+    case 'reopen_issue': project = await api.ensureProject(project); await api.reopenIssue(data, project); break;
+    case 'delete_issue': await api.deleteIssue(payload); break;
+    default: break;
+  }
+}
+
+export async function drain({ handler = processOp } = {}) {
+  if (draining) return;
+  if (!syncConfigured()) return;
+  if (syncPaused()) return;
+  draining = true;
+  try {
+    const rows = db.prepare(`
+      SELECT * FROM sync_queue
+      WHERE attempts < ${SYNC_MAX_ATTEMPTS} AND next_attempt_at <= datetime('now')
+      ORDER BY id LIMIT 20
+    `).all();
+    if (!rows.length) return;
+    if (!(await checkGh())) return;
+
+    const awaitingCreate = new Set();
+    for (const row of rows) {
+      if (row.task_id && awaitingCreate.has(row.task_id)) continue;
+      try {
+        await handler(row);
+        db.prepare('DELETE FROM sync_queue WHERE id = ?').run(row.id);
+        resolveErrors(row.id);
+        kvSet('sync.last_ok', new Date().toISOString().slice(0, 19).replace('T', ' '));
+      } catch (err) {
+        const attempts = row.attempts + 1;
+        const delay = err.permanent ? null : backoff(attempts);
+        db.prepare(`UPDATE sync_queue SET attempts = ?, last_error = ?, next_attempt_at = datetime('now', ?) WHERE id = ?`)
+          .run(err.permanent ? SYNC_MAX_ATTEMPTS : attempts, String(err.message).slice(0, 500), `+${delay ?? 0} seconds`, row.id);
+        emit('sync.status', { error: String(err.message).slice(0, 200), op: row.op });
+        logError('sync', row.op, err.message, `attempt ${attempts}, op #${row.id}${row.task_id ? `, task #${row.task_id}` : ''}`, row.id);
+        if (row.op === 'create_issue' && row.task_id) awaitingCreate.add(row.task_id);
+      }
+    }
+    const pending = db.prepare(`SELECT COUNT(*) AS n FROM sync_queue WHERE attempts < ${SYNC_MAX_ATTEMPTS}`).get().n;
+    emit('sync.status', { pending });
+  } finally {
+    draining = false;
+  }
+}
+
+export function kick() {
+  setImmediate(() => drain().catch((e) => logError('sync', 'kick', e?.message || String(e), e?.stack)));
+}
+
+export function startWorker() {
+  setInterval(() => drain().catch((e) => logError('sync', 'drain', e?.message || String(e), e?.stack)), 5000);
+}

package/src/task-shape.js

@@ -0,0 +1,29 @@
+import { db } from './db.js';
+
+export function listShape(t) {
+  return {
+    id: t.id, key: t.key, project: t.project, title: t.title, status: t.status,
+    priority: t.priority, blocked: t.blocked, blocked_reason: t.blocked_reason || null, position: t.position,
+    pinned: t.pinned || 0,
+    labels: JSON.parse(t.labels || '[]'),
+    preview: (t.description || '').slice(0, 180),
+    comments_n: t.comments_n || 0,
+    attachments_n: t.attachments_n || 0,
+    gh_issue_number: t.gh_issue_number,
+    gh_issue_url: t.gh_issue_url || null,
+    work_seconds: t.work_seconds || 0,
+    work_started_at: t.work_started_at || null,
+    work_truncated: t.work_truncated || 0,
+    updated_at: t.updated_at,
+  };
+}
+
+export function taskEvent(id) {
+  const row = db.prepare(`
+    SELECT t.*, p.slug AS project, (p.prefix || '-' || t.task_no) AS key,
+      (SELECT COUNT(*) FROM task_comments c WHERE c.task_id = t.id) AS comments_n,
+      (SELECT COUNT(*) FROM task_attachments a WHERE a.task_id = t.id AND a.file != '') AS attachments_n
+    FROM tasks t JOIN projects p ON p.id = t.project_id WHERE t.id = ?
+  `).get(id);
+  return row ? listShape(row) : null;
+}