chore: auto-commit (23 archivos)

- app.md - backend/dist/assets/index-CFDWXN9Z.js - backend/dist/index.html - backend/handlers.go - backend/main.go - backend/users.go - e2e/smoke_live.sh - frontend/src/App.tsx - frontend/src/api.ts - frontend/src/components/CardChatPanel.tsx - ... Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-21 18:22:44 +02:00
parent 2524340759
commit c9e15513c7
22 changed files with 2380 additions and 179 deletions
@@ -2,7 +2,7 @@
 name: kanban
 lang: go
 domain: tools
-version: 0.2.0
+version: 0.3.0
 description: "Kanban board con persistencia SQLite, drag-and-drop entre columnas (dnd-kit) y tracking del tiempo que cada tarjeta pasa en cada columna. Frontend Vite + React + Mantine v9 embebido en el binario Go."
 tags: [service, kanban, web, dnd-kit, mantine, sqlite, time-tracking]
 uses_functions:
@@ -4,7 +4,7 @@
    <meta charset="UTF-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>Kanban</title>
-    <script type="module" crossorigin src="/assets/index-CFDWXN9Z.js"></script>
+    <script type="module" crossorigin src="/assets/index-UVzY_37O.js"></script>
    <link rel="stylesheet" crossorigin href="/assets/index-b0xjFtx2.css">
  </head>
  <body>
@@ -622,7 +622,7 @@ func handlePurgeCard(db *DB, hub *EventHub) http.HandlerFunc {
 	}
 }
-func apiRoutes(db *DB, chatWorkdir string, logger *ChatLogger, internalToken string, flags *FeatureFlags, hub *EventHub) []infra.Route {
+func apiRoutes(db *DB, chatWorkdir string, logger *ChatLogger, internalToken string, flags *FeatureFlags, hub *EventHub, dispatcher *Dispatcher) []infra.Route {
 	return []infra.Route{
 		{Method: "GET", Path: "/api/flags", Handler: handleListFlags(flags)},
 		{Method: "GET", Path: "/api/version", Handler: handleVersion()},
@@ -670,6 +670,12 @@ func apiRoutes(db *DB, chatWorkdir string, logger *ChatLogger, internalToken str
 		{Method: "GET", Path: "/api/notifications/unread-count", Handler: handleUnreadCount(db)},
 		{Method: "POST", Path: "/api/notifications/{id}/read", Handler: handleMarkNotificationRead(db, hub)},
 		{Method: "POST", Path: "/api/notifications/read-all", Handler: handleMarkAllNotificationsRead(db, hub)},
 		{Method: "GET", Path: "/api/modules", Handler: handleListModules(db)},
 		{Method: "POST", Path: "/api/modules", Handler: handleCreateModule(db)},
 		{Method: "PATCH", Path: "/api/modules/{id}", Handler: handleUpdateModule(db)},
 		{Method: "DELETE", Path: "/api/modules/{id}", Handler: handleDeleteModule(db)},
 		{Method: "GET", Path: "/api/modules/{id}/logs", Handler: handleModuleLogs(db)},
 		{Method: "POST", Path: "/api/modules/{id}/test", Handler: handleTestModule(db, dispatcher)},
 	}
 }
@@ -69,7 +69,10 @@ func main() {
 	logger := newChatLogger(filepath.Join(wd, "chat.log"))
 	log.Printf("chat tool log: %s", logger.path)
 	hub := NewEventHub()
-	mux := infra.HTTPRouter(apiRoutes(db, wd, logger, internalToken, &featureFlags, hub))
+	dispatcher := NewDispatcher(db, hub)
 	dispatcher.Start()
 	defer dispatcher.Stop()
 	mux := infra.HTTPRouter(apiRoutes(db, wd, logger, internalToken, &featureFlags, hub, dispatcher))
 	feHandler := frontendHandler()
 	if feHandler != nil {
@@ -169,5 +172,28 @@ func frontendHandler() http.Handler {
 	if len(entries) == 0 {
 		return nil
 	}
-	return infra.SPAHandler(sub, "index.html")
+	return cacheHeadersMiddleware(infra.SPAHandler(sub, "index.html"))
 }
 // cacheHeadersMiddleware ensures the SPA shell is never cached while the
 // hashed assets (which are content-addressed by Vite) are cached for a long
 // time. Without this, browsers happily reuse an old index.html — pinned to a
 // stale /assets/index-<hash>.js URL — and never pick up new releases.
 //
 // Policy:
 //
 //	/assets/*  →  public, max-age=1y, immutable  (filename changes per build)
 //	everything else  →  no-store, must-revalidate (forces revalidation on every
 //	                    navigation so the latest hash is always discovered)
 func cacheHeadersMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if strings.HasPrefix(r.URL.Path, "/assets/") {
 			w.Header().Set("Cache-Control", "public, max-age=31536000, immutable")
 		} else {
 			w.Header().Set("Cache-Control", "no-store, no-cache, must-revalidate")
 			w.Header().Set("Pragma", "no-cache")
 			w.Header().Set("Expires", "0")
 		}
 		next.ServeHTTP(w, r)
 	})
 }
@@ -0,0 +1,45 @@
 -- Outbound modules (integrations): kanban events → external systems.
 --
 -- A module is a configured subscription. The dispatcher (modules.go)
 -- subscribes to the EventHub and, for each event whose type matches the
 -- module's event_filter, calls the kind-specific handler with the
 -- decrypted config.
 --
 -- Tokens / secrets are encrypted with AES-GCM at rest. The key is derived
 -- from the KANBAN_MODULE_KEY environment variable (sha256 of the value).
 CREATE TABLE IF NOT EXISTS modules (
    id            TEXT PRIMARY KEY,
    name          TEXT NOT NULL,
    kind          TEXT NOT NULL,           -- 'jira' | 'webhook' | …
    enabled       INTEGER NOT NULL DEFAULT 1,
    event_filter  TEXT NOT NULL,           -- comma-separated event types
    config_cipher BLOB NOT NULL,           -- AES-GCM ciphertext of JSON
    config_nonce  BLOB NOT NULL,
    created_at    TEXT NOT NULL,
    updated_at    TEXT NOT NULL
 );
 CREATE TABLE IF NOT EXISTS module_logs (
    id          TEXT PRIMARY KEY,
    module_id   TEXT NOT NULL,
    event_type  TEXT NOT NULL,
    card_id     TEXT,
    status      INTEGER,                   -- HTTP status or 0 if pre-flight
    duration_ms INTEGER,
    error       TEXT,
    created_at  TEXT NOT NULL
 );
 CREATE INDEX IF NOT EXISTS idx_module_logs_module_created
    ON module_logs(module_id, created_at DESC);
 -- jira_key: 1:1 link between a kanban card and its Jira issue. Empty
 -- string when the card has not yet been synced to Jira.
 ALTER TABLE cards ADD COLUMN jira_key TEXT NOT NULL DEFAULT '';
 -- is_admin: gates /api/modules access and the Modulos menu item.
 -- Bootstrap: egutierrez (the initial admin) is marked admin so the
 -- feature is reachable on first deploy. Other users start as non-admin.
 ALTER TABLE users ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0;
 UPDATE users SET is_admin = 1 WHERE username = 'egutierrez';
@@ -0,0 +1,725 @@
 package main
 import (
 	"bytes"
 	"context"
 	"database/sql"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io"
 	"log"
 	"net/http"
 	"strings"
 	"time"
 )
 // =============================================================================
 // Module model
 // =============================================================================
 type Module struct {
 	ID          string    `json:"id"`
 	Name        string    `json:"name"`
 	Kind        string    `json:"kind"`
 	Enabled     bool      `json:"enabled"`
 	EventFilter []string  `json:"event_filter"`
 	Config      JSONValue `json:"config"`
 	CreatedAt   string    `json:"created_at"`
 	UpdatedAt   string    `json:"updated_at"`
 }
 // JSONValue is an arbitrary JSON object decoded into a generic map. We do not
 // model per-kind config in Go types because the set of kinds grows over time
 // and the dispatcher only inspects fields it knows.
 type JSONValue map[string]interface{}
 type ModuleLog struct {
 	ID         string `json:"id"`
 	ModuleID   string `json:"module_id"`
 	EventType  string `json:"event_type"`
 	CardID     string `json:"card_id"`
 	Status     int    `json:"status"`
 	DurationMs int    `json:"duration_ms"`
 	Error      string `json:"error"`
 	CreatedAt  string `json:"created_at"`
 }
 // =============================================================================
 // DB helpers (modules + logs)
 // =============================================================================
 // listModulesEnabled returns all enabled modules with their config decrypted.
 // Disabled modules are silently skipped — callers iterate the result without
 // further filtering.
 func (db *DB) listModulesEnabled() ([]Module, error) {
 	return db.listModulesWhere("WHERE enabled = 1")
 }
 func (db *DB) listModulesAll() ([]Module, error) {
 	return db.listModulesWhere("")
 }
 func (db *DB) listModulesWhere(filter string) ([]Module, error) {
 	q := `SELECT id, name, kind, enabled, event_filter, config_cipher, config_nonce, created_at, updated_at FROM modules ` + filter + ` ORDER BY created_at`
 	rows, err := db.conn.Query(q)
 	if err != nil {
 		return nil, err
 	}
 	defer rows.Close()
 	out := []Module{}
 	for rows.Next() {
 		var m Module
 		var enabled int
 		var filter, createdAt, updatedAt string
 		var cipherBlob, nonce []byte
 		if err := rows.Scan(&m.ID, &m.Name, &m.Kind, &enabled, &filter, &cipherBlob, &nonce, &createdAt, &updatedAt); err != nil {
 			return nil, err
 		}
 		m.Enabled = enabled == 1
 		m.EventFilter = splitCSV(filter)
 		m.CreatedAt = createdAt
 		m.UpdatedAt = updatedAt
 		cfg, err := decryptConfig(cipherBlob, nonce)
 		if err != nil {
 			// Surface the decrypt failure so the operator notices but
 			// avoid dropping the module from the list entirely.
 			log.Printf("module %s: decrypt config: %v", m.ID, err)
 			m.Config = JSONValue{"_decrypt_error": err.Error()}
 		} else {
 			_ = json.Unmarshal(cfg, &m.Config)
 		}
 		out = append(out, m)
 	}
 	return out, rows.Err()
 }
 func (db *DB) getModule(id string) (*Module, error) {
 	mods, err := db.listModulesWhere(`WHERE id = '` + escapeSQL(id) + `'`)
 	if err != nil || len(mods) == 0 {
 		if err == nil {
 			err = sql.ErrNoRows
 		}
 		return nil, err
 	}
 	return &mods[0], nil
 }
 func escapeSQL(s string) string {
 	return strings.ReplaceAll(s, "'", "''")
 }
 func (db *DB) saveModule(m *Module) error {
 	cfgJSON, err := json.Marshal(m.Config)
 	if err != nil {
 		return err
 	}
 	cipherBlob, nonce, err := encryptConfig(cfgJSON)
 	if err != nil {
 		return err
 	}
 	now := nowRFC3339()
 	if m.ID == "" {
 		m.ID = newID()
 		m.CreatedAt = now
 		m.UpdatedAt = now
 		_, err = db.conn.Exec(
 			`INSERT INTO modules (id, name, kind, enabled, event_filter, config_cipher, config_nonce, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 			m.ID, m.Name, m.Kind, boolInt(m.Enabled), strings.Join(m.EventFilter, ","),
 			cipherBlob, nonce, m.CreatedAt, m.UpdatedAt,
 		)
 		return err
 	}
 	m.UpdatedAt = now
 	_, err = db.conn.Exec(
 		`UPDATE modules SET name=?, kind=?, enabled=?, event_filter=?, config_cipher=?, config_nonce=?, updated_at=? WHERE id=?`,
 		m.Name, m.Kind, boolInt(m.Enabled), strings.Join(m.EventFilter, ","),
 		cipherBlob, nonce, m.UpdatedAt, m.ID,
 	)
 	return err
 }
 func (db *DB) deleteModule(id string) error {
 	_, err := db.conn.Exec(`DELETE FROM modules WHERE id=?`, id)
 	return err
 }
 func (db *DB) appendModuleLog(l ModuleLog) error {
 	if l.ID == "" {
 		l.ID = newID()
 	}
 	if l.CreatedAt == "" {
 		l.CreatedAt = nowRFC3339()
 	}
 	_, err := db.conn.Exec(
 		`INSERT INTO module_logs (id, module_id, event_type, card_id, status, duration_ms, error, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
 		l.ID, l.ModuleID, l.EventType, l.CardID, l.Status, l.DurationMs, l.Error, l.CreatedAt,
 	)
 	return err
 }
 func (db *DB) listModuleLogs(moduleID string, limit int) ([]ModuleLog, error) {
 	if limit <= 0 {
 		limit = 100
 	}
 	rows, err := db.conn.Query(
 		`SELECT id, module_id, event_type, card_id, status, duration_ms, error, created_at
 		 FROM module_logs WHERE module_id = ? ORDER BY created_at DESC LIMIT ?`,
 		moduleID, limit,
 	)
 	if err != nil {
 		return nil, err
 	}
 	defer rows.Close()
 	out := []ModuleLog{}
 	for rows.Next() {
 		var l ModuleLog
 		var cardID sql.NullString
 		if err := rows.Scan(&l.ID, &l.ModuleID, &l.EventType, &cardID, &l.Status, &l.DurationMs, &l.Error, &l.CreatedAt); err != nil {
 			return nil, err
 		}
 		if cardID.Valid {
 			l.CardID = cardID.String
 		}
 		out = append(out, l)
 	}
 	return out, rows.Err()
 }
 // setCardJiraKey stores the Jira issue key for a card after a successful
 // create call. We skip the regular UpdateCard path to avoid emitting a
 // `card.updated` event (which would loop us back through the dispatcher).
 func (db *DB) setCardJiraKey(cardID, jiraKey string) error {
 	_, err := db.conn.Exec(`UPDATE cards SET jira_key=? WHERE id=?`, jiraKey, cardID)
 	return err
 }
 func (db *DB) getCardForJira(cardID string) (*cardForJira, error) {
 	var c cardForJira
 	var assignee, deadline, jiraKey sql.NullString
 	var tagsJSON string
 	err := db.conn.QueryRow(
 		`SELECT c.id, c.title, c.description, c.requester, c.column_id, c.assignee_id,
 		        c.deadline, c.tags, c.jira_key, c.created_at, col.name
 		 FROM cards c JOIN columns col ON col.id = c.column_id WHERE c.id = ?`,
 		cardID,
 	).Scan(&c.ID, &c.Title, &c.Description, &c.Requester, &c.ColumnID, &assignee,
 		&deadline, &tagsJSON, &jiraKey, &c.CreatedAt, &c.ColumnName)
 	if err != nil {
 		return nil, err
 	}
 	if assignee.Valid {
 		c.AssigneeID = assignee.String
 	}
 	if deadline.Valid {
 		c.Deadline = deadline.String
 	}
 	if jiraKey.Valid {
 		c.JiraKey = jiraKey.String
 	}
 	_ = json.Unmarshal([]byte(tagsJSON), &c.Tags)
 	return &c, nil
 }
 type cardForJira struct {
 	ID          string
 	Title       string
 	Description string
 	Requester   string
 	ColumnID    string
 	ColumnName  string
 	AssigneeID  string
 	Deadline    string
 	Tags        []string
 	JiraKey     string
 	CreatedAt   string
 }
 func (c *cardForJira) hasTag(name string) bool {
 	name = strings.ToLower(name)
 	for _, t := range c.Tags {
 		if strings.ToLower(t) == name {
 			return true
 		}
 	}
 	return false
 }
 func splitCSV(s string) []string {
 	if s == "" {
 		return nil
 	}
 	parts := strings.Split(s, ",")
 	out := make([]string, 0, len(parts))
 	for _, p := range parts {
 		p = strings.TrimSpace(p)
 		if p != "" {
 			out = append(out, p)
 		}
 	}
 	return out
 }
 func boolInt(b bool) int {
 	if b {
 		return 1
 	}
 	return 0
 }
 // =============================================================================
 // Dispatcher
 // =============================================================================
 const (
 	moduleRetries       = 3
 	moduleRetryDelay1   = 1 * time.Second
 	moduleRetryDelay2   = 5 * time.Second
 	moduleRetryDelay3   = 30 * time.Second
 	moduleHTTPTimeout   = 15 * time.Second
 	moduleOptOutTag     = "nojira"
 	moduleDispatchQueue = 256
 )
 // Dispatcher fans events from the EventHub into per-module handlers.
 //
 // Lifecycle:
 //   - Start() spawns a single subscriber goroutine on the hub plus a
 //     bounded worker pool.
 //   - Stop() cancels the context and waits for in-flight requests to drain.
 //
 // Handlers receive a decrypted Module copy + the Event; they own the HTTP
 // call to the target system. The dispatcher logs every attempt.
 type Dispatcher struct {
 	db       *DB
 	hub      *EventHub
 	handlers map[string]Handler
 	queue    chan dispatchTask
 	ctx      context.Context
 	cancel   context.CancelFunc
 	enabled  bool
 }
 type dispatchTask struct {
 	module Module
 	event  Event
 }
 type Handler interface {
 	Handle(ctx context.Context, db *DB, m Module, ev Event) (status int, err error)
 	TestConnection(ctx context.Context, m Module) (status int, err error)
 }
 func NewDispatcher(db *DB, hub *EventHub) *Dispatcher {
 	_, hasKey := moduleKey()
 	return &Dispatcher{
 		db:       db,
 		hub:      hub,
 		handlers: map[string]Handler{"jira": &jiraHandler{}},
 		queue:    make(chan dispatchTask, moduleDispatchQueue),
 		enabled:  hasKey,
 	}
 }
 func (d *Dispatcher) Start() {
 	if !d.enabled {
 		log.Printf("module dispatcher disabled (%s not set)", moduleKeyEnv)
 		return
 	}
 	d.ctx, d.cancel = context.WithCancel(context.Background())
 	// Subscribe under a synthetic user so the hub treats us as a normal
 	// recipient of broadcast events. Private user-targeted events are
 	// uninteresting for outbound sync.
 	go d.run()
 	for i := 0; i < 4; i++ {
 		go d.worker(i)
 	}
 	log.Printf("module dispatcher started")
 }
 func (d *Dispatcher) Stop() {
 	if d.cancel != nil {
 		d.cancel()
 	}
 }
 func (d *Dispatcher) run() {
 	ch := d.hub.SubscribeUser("__module_dispatcher__")
 	defer d.hub.UnsubscribeUser("__module_dispatcher__", ch)
 	for {
 		select {
 		case <-d.ctx.Done():
 			return
 		case ev, ok := <-ch:
 			if !ok {
 				return
 			}
 			d.fanout(ev)
 		}
 	}
 }
 func (d *Dispatcher) fanout(ev Event) {
 	mods, err := d.db.listModulesEnabled()
 	if err != nil {
 		log.Printf("dispatcher: listModulesEnabled: %v", err)
 		return
 	}
 	for _, m := range mods {
 		if !filterMatches(m.EventFilter, ev.Type) {
 			continue
 		}
 		if !cutoffOK(d.db, m, ev) {
 			continue
 		}
 		if ev.CardID != "" {
 			c, err := d.db.getCardForJira(ev.CardID)
 			if err == nil && c.hasTag(moduleOptOutTag) {
 				continue
 			}
 		}
 		select {
 		case d.queue <- dispatchTask{module: m, event: ev}:
 		default:
 			log.Printf("dispatcher: queue full, dropping event %s for module %s", ev.Type, m.ID)
 		}
 	}
 }
 func (d *Dispatcher) worker(id int) {
 	for {
 		select {
 		case <-d.ctx.Done():
 			return
 		case task, ok := <-d.queue:
 			if !ok {
 				return
 			}
 			d.dispatch(task)
 		}
 	}
 }
 // dispatch runs the handler with up to moduleRetries attempts using a
 // fixed back-off schedule (1s, 5s, 30s). Each attempt creates a log row;
 // the final outcome is the one returned to the caller.
 func (d *Dispatcher) dispatch(t dispatchTask) {
 	h, ok := d.handlers[t.module.Kind]
 	if !ok {
 		_ = d.db.appendModuleLog(ModuleLog{
 			ModuleID: t.module.ID, EventType: t.event.Type, CardID: t.event.CardID,
 			Error: "unknown module kind: " + t.module.Kind,
 		})
 		return
 	}
 	delays := []time.Duration{0, moduleRetryDelay1, moduleRetryDelay2, moduleRetryDelay3}
 	for attempt := 0; attempt < moduleRetries; attempt++ {
 		if delays[attempt] > 0 {
 			select {
 			case <-d.ctx.Done():
 				return
 			case <-time.After(delays[attempt]):
 			}
 		}
 		ctx, cancel := context.WithTimeout(d.ctx, moduleHTTPTimeout)
 		start := time.Now()
 		status, err := h.Handle(ctx, d.db, t.module, t.event)
 		cancel()
 		ml := ModuleLog{
 			ModuleID: t.module.ID, EventType: t.event.Type, CardID: t.event.CardID,
 			Status: status, DurationMs: int(time.Since(start).Milliseconds()),
 		}
 		if err != nil {
 			ml.Error = err.Error()
 		}
 		_ = d.db.appendModuleLog(ml)
 		if err == nil {
 			return
 		}
 		// 4xx client errors are not worth retrying.
 		if status >= 400 && status < 500 {
 			return
 		}
 	}
 }
 // =============================================================================
 // Helpers
 // =============================================================================
 func filterMatches(filter []string, eventType string) bool {
 	for _, f := range filter {
 		if f == eventType || f == "*" {
 			return true
 		}
 	}
 	return false
 }
 // cutoffOK applies the "module only sees events posterior to its creation"
 // rule. Cards that were already linked to Jira (jira_key != "") are always
 // eligible regardless of timestamps.
 func cutoffOK(db *DB, m Module, ev Event) bool {
 	if ev.CardID == "" {
 		return true
 	}
 	c, err := db.getCardForJira(ev.CardID)
 	if err != nil {
 		return false
 	}
 	if c.JiraKey != "" {
 		return true
 	}
 	return c.CreatedAt >= m.CreatedAt
 }
 // =============================================================================
 // Jira handler
 // =============================================================================
 type jiraHandler struct{}
 type jiraConfig struct {
 	BaseURL    string            `json:"base_url"`
 	Email      string            `json:"email"`
 	APIToken   string            `json:"api_token"`
 	ProjectKey string            `json:"project_key"`
 	StatusMap  map[string]string `json:"status_map"`
 }
 func parseJiraConfig(m Module) (jiraConfig, error) {
 	b, err := json.Marshal(m.Config)
 	if err != nil {
 		return jiraConfig{}, err
 	}
 	var c jiraConfig
 	if err := json.Unmarshal(b, &c); err != nil {
 		return jiraConfig{}, err
 	}
 	c.BaseURL = strings.TrimRight(c.BaseURL, "/")
 	if c.BaseURL == "" {
 		return c, fmt.Errorf("base_url required")
 	}
 	return c, nil
 }
 func (h *jiraHandler) jiraRequest(ctx context.Context, c jiraConfig, method, path string, body interface{}) (int, []byte, error) {
 	var rdr io.Reader
 	if body != nil {
 		b, err := json.Marshal(body)
 		if err != nil {
 			return 0, nil, err
 		}
 		rdr = bytes.NewReader(b)
 	}
 	req, err := http.NewRequestWithContext(ctx, method, c.BaseURL+path, rdr)
 	if err != nil {
 		return 0, nil, err
 	}
 	req.Header.Set("Accept", "application/json")
 	if body != nil {
 		req.Header.Set("Content-Type", "application/json")
 	}
 	if c.Email != "" && c.APIToken != "" {
 		basic := base64.StdEncoding.EncodeToString([]byte(c.Email + ":" + c.APIToken))
 		req.Header.Set("Authorization", "Basic "+basic)
 	}
 	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		return 0, nil, err
 	}
 	defer resp.Body.Close()
 	respBody, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
 	if resp.StatusCode >= 400 {
 		return resp.StatusCode, respBody, fmt.Errorf("jira %s %s: %d %s", method, path, resp.StatusCode, truncate(respBody, 240))
 	}
 	return resp.StatusCode, respBody, nil
 }
 func truncate(b []byte, n int) string {
 	if len(b) <= n {
 		return string(b)
 	}
 	return string(b[:n]) + "…"
 }
 func (h *jiraHandler) TestConnection(ctx context.Context, m Module) (int, error) {
 	c, err := parseJiraConfig(m)
 	if err != nil {
 		return 0, err
 	}
 	status, _, err := h.jiraRequest(ctx, c, http.MethodGet, "/rest/api/3/myself", nil)
 	return status, err
 }
 func (h *jiraHandler) Handle(ctx context.Context, db *DB, m Module, ev Event) (int, error) {
 	c, err := parseJiraConfig(m)
 	if err != nil {
 		return 0, err
 	}
 	switch ev.Type {
 	case "card.created":
 		return h.create(ctx, db, c, ev)
 	case "card.updated", "board.invalidated":
 		return h.update(ctx, db, c, ev)
 	case "card.moved":
 		return h.transition(ctx, db, c, ev)
 	case "message.created":
 		return h.comment(ctx, db, c, ev)
 	default:
 		// Silently ignore unhandled event types so the dispatcher does not
 		// retry on irrelevant traffic.
 		return 200, nil
 	}
 }
 func (h *jiraHandler) create(ctx context.Context, db *DB, c jiraConfig, ev Event) (int, error) {
 	if ev.CardID == "" {
 		return 0, nil
 	}
 	card, err := db.getCardForJira(ev.CardID)
 	if err != nil {
 		return 0, err
 	}
 	if card.JiraKey != "" {
 		// Idempotent: card already linked to Jira; treat as update.
 		return h.update(ctx, db, c, ev)
 	}
 	if c.ProjectKey == "" {
 		return 0, fmt.Errorf("project_key required for create")
 	}
 	body := map[string]interface{}{
 		"fields": map[string]interface{}{
 			"project":     map[string]string{"key": c.ProjectKey},
 			"summary":     card.Title,
 			"description": adfText(card.Description),
 			"issuetype":   map[string]string{"name": "Task"},
 		},
 	}
 	status, resp, err := h.jiraRequest(ctx, c, http.MethodPost, "/rest/api/3/issue", body)
 	if err != nil {
 		return status, err
 	}
 	var parsed struct {
 		Key string `json:"key"`
 	}
 	_ = json.Unmarshal(resp, &parsed)
 	if parsed.Key != "" {
 		if err := db.setCardJiraKey(card.ID, parsed.Key); err != nil {
 			return status, fmt.Errorf("link jira key: %w", err)
 		}
 	}
 	return status, nil
 }
 func (h *jiraHandler) update(ctx context.Context, db *DB, c jiraConfig, ev Event) (int, error) {
 	if ev.CardID == "" {
 		return 0, nil
 	}
 	card, err := db.getCardForJira(ev.CardID)
 	if err != nil {
 		return 0, err
 	}
 	if card.JiraKey == "" {
 		// Card not yet linked — bootstrap by creating it.
 		return h.create(ctx, db, c, ev)
 	}
 	body := map[string]interface{}{
 		"fields": map[string]interface{}{
 			"summary":     card.Title,
 			"description": adfText(card.Description),
 		},
 	}
 	status, _, err := h.jiraRequest(ctx, c, http.MethodPut, "/rest/api/3/issue/"+card.JiraKey, body)
 	return status, err
 }
 // transition uses the configured status_map to translate the kanban column
 // to a Jira transition name. We list available transitions, find the one
 // whose target status name matches, and POST it. Kanban remains the source
 // of truth even if Jira's current state differs.
 func (h *jiraHandler) transition(ctx context.Context, db *DB, c jiraConfig, ev Event) (int, error) {
 	if ev.CardID == "" {
 		return 0, nil
 	}
 	card, err := db.getCardForJira(ev.CardID)
 	if err != nil {
 		return 0, err
 	}
 	if card.JiraKey == "" {
 		return h.create(ctx, db, c, ev)
 	}
 	target, ok := c.StatusMap[card.ColumnName]
 	if !ok || target == "" {
 		return 0, fmt.Errorf("no status_map entry for column %q", card.ColumnName)
 	}
 	status, body, err := h.jiraRequest(ctx, c, http.MethodGet, "/rest/api/3/issue/"+card.JiraKey+"/transitions", nil)
 	if err != nil {
 		return status, err
 	}
 	var available struct {
 		Transitions []struct {
 			ID   string `json:"id"`
 			Name string `json:"name"`
 			To   struct {
 				Name string `json:"name"`
 			} `json:"to"`
 		} `json:"transitions"`
 	}
 	if err := json.Unmarshal(body, &available); err != nil {
 		return status, fmt.Errorf("decode transitions: %w", err)
 	}
 	var tID string
 	for _, t := range available.Transitions {
 		if strings.EqualFold(t.To.Name, target) || strings.EqualFold(t.Name, target) {
 			tID = t.ID
 			break
 		}
 	}
 	if tID == "" {
 		return 0, fmt.Errorf("transition %q not available for %s", target, card.JiraKey)
 	}
 	req := map[string]interface{}{"transition": map[string]string{"id": tID}}
 	status, _, err = h.jiraRequest(ctx, c, http.MethodPost, "/rest/api/3/issue/"+card.JiraKey+"/transitions", req)
 	return status, err
 }
 func (h *jiraHandler) comment(ctx context.Context, db *DB, c jiraConfig, ev Event) (int, error) {
 	if ev.CardID == "" {
 		return 0, nil
 	}
 	card, err := db.getCardForJira(ev.CardID)
 	if err != nil {
 		return 0, err
 	}
 	if card.JiraKey == "" {
 		// Cannot comment on a card not yet synced; skip.
 		return 0, nil
 	}
 	var payload struct {
 		Body string `json:"body"`
 	}
 	_ = json.Unmarshal(ev.Payload, &payload)
 	if payload.Body == "" {
 		return 0, nil
 	}
 	body := map[string]interface{}{"body": adfText(payload.Body)}
 	status, _, err := h.jiraRequest(ctx, c, http.MethodPost, "/rest/api/3/issue/"+card.JiraKey+"/comment", body)
 	return status, err
 }
 // adfText wraps a plain string into the minimal Atlassian Document Format
 // fragment Jira Cloud requires for description / comment bodies.
 func adfText(s string) map[string]interface{} {
 	return map[string]interface{}{
 		"type":    "doc",
 		"version": 1,
 		"content": []map[string]interface{}{{
 			"type": "paragraph",
 			"content": []map[string]interface{}{{
 				"type": "text",
 				"text": s,
 			}},
 		}},
 	}
 }
@@ -0,0 +1,68 @@
 package main
 import (
 	"crypto/aes"
 	"crypto/cipher"
 	"crypto/rand"
 	"crypto/sha256"
 	"errors"
 	"fmt"
 	"io"
 	"os"
 )
 const moduleKeyEnv = "KANBAN_MODULE_KEY"
 // moduleKey derives a 32-byte AES key from the KANBAN_MODULE_KEY env var.
 // Returns (key, true) when present; (zero, false) when missing — callers
 // must treat that as "module dispatcher disabled".
 func moduleKey() ([32]byte, bool) {
 	v := os.Getenv(moduleKeyEnv)
 	if v == "" {
 		return [32]byte{}, false
 	}
 	return sha256.Sum256([]byte(v)), true
 }
 // encryptConfig encrypts a JSON config blob with AES-GCM. Returns the
 // ciphertext and the 12-byte nonce. Caller persists both columns.
 func encryptConfig(plain []byte) (cipherOut, nonce []byte, err error) {
 	key, ok := moduleKey()
 	if !ok {
 		return nil, nil, fmt.Errorf("%s not set; cannot encrypt module config", moduleKeyEnv)
 	}
 	block, err := aes.NewCipher(key[:])
 	if err != nil {
 		return nil, nil, err
 	}
 	gcm, err := cipher.NewGCM(block)
 	if err != nil {
 		return nil, nil, err
 	}
 	nonce = make([]byte, gcm.NonceSize())
 	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
 		return nil, nil, err
 	}
 	cipherOut = gcm.Seal(nil, nonce, plain, nil)
 	return cipherOut, nonce, nil
 }
 // decryptConfig is the inverse of encryptConfig.
 func decryptConfig(cipherIn, nonce []byte) ([]byte, error) {
 	key, ok := moduleKey()
 	if !ok {
 		return nil, fmt.Errorf("%s not set; cannot decrypt module config", moduleKeyEnv)
 	}
 	if len(nonce) == 0 {
 		return nil, errors.New("nonce empty")
 	}
 	block, err := aes.NewCipher(key[:])
 	if err != nil {
 		return nil, err
 	}
 	gcm, err := cipher.NewGCM(block)
 	if err != nil {
 		return nil, err
 	}
 	return gcm.Open(nil, nonce, cipherIn, nil)
 }
@@ -0,0 +1,226 @@
 package main
 import (
 	"context"
 	"encoding/json"
 	"net/http"
 	"strconv"
 	"strings"
 	"time"
 	"fn-registry/functions/infra"
 )
 // requireAdmin gates a handler so only users with users.is_admin = 1 can
 // reach it. Non-admins get a 403. Anonymous callers get a 401.
 func requireAdmin(db *DB, next http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		uid, _ := infra.UserIDFromContext(r.Context(), userCtxKey)
 		if uid == "" {
 			infra.HTTPErrorResponse(w, infra.HTTPError{Status: http.StatusUnauthorized, Code: "unauthorized", Message: "session required"})
 			return
 		}
 		ok, err := db.IsAdmin(uid)
 		if err != nil {
 			serverError(w, err)
 			return
 		}
 		if !ok {
 			infra.HTTPErrorResponse(w, infra.HTTPError{Status: http.StatusForbidden, Code: "forbidden", Message: "admin required"})
 			return
 		}
 		next(w, r)
 	}
 }
 // publicModule strips secrets out of the config before responding. The
 // API token is never returned to the client after it has been stored.
 func publicModule(m Module) Module {
 	clone := m
 	if clone.Config != nil {
 		cleaned := JSONValue{}
 		for k, v := range clone.Config {
 			if strings.Contains(strings.ToLower(k), "token") || strings.Contains(strings.ToLower(k), "password") || strings.Contains(strings.ToLower(k), "secret") {
 				cleaned[k] = "***"
 			} else {
 				cleaned[k] = v
 			}
 		}
 		clone.Config = cleaned
 	}
 	return clone
 }
 func handleListModules(db *DB) http.HandlerFunc {
 	return requireAdmin(db, func(w http.ResponseWriter, r *http.Request) {
 		mods, err := db.listModulesAll()
 		if err != nil {
 			serverError(w, err)
 			return
 		}
 		out := make([]Module, 0, len(mods))
 		for _, m := range mods {
 			out = append(out, publicModule(m))
 		}
 		infra.HTTPJSONResponse(w, http.StatusOK, out)
 	})
 }
 type modulePayload struct {
 	Name        string    `json:"name"`
 	Kind        string    `json:"kind"`
 	Enabled     bool      `json:"enabled"`
 	EventFilter []string  `json:"event_filter"`
 	Config      JSONValue `json:"config"`
 }
 func handleCreateModule(db *DB) http.HandlerFunc {
 	return requireAdmin(db, func(w http.ResponseWriter, r *http.Request) {
 		var body modulePayload
 		if err := infra.HTTPParseBody(r, &body, maxBodyBytes); err != nil {
 			badRequest(w, err.Error())
 			return
 		}
 		if body.Name == "" || body.Kind == "" {
 			badRequest(w, "name and kind required")
 			return
 		}
 		m := &Module{
 			Name: body.Name, Kind: body.Kind, Enabled: body.Enabled,
 			EventFilter: body.EventFilter, Config: body.Config,
 		}
 		if err := db.saveModule(m); err != nil {
 			serverError(w, err)
 			return
 		}
 		infra.HTTPJSONResponse(w, http.StatusCreated, publicModule(*m))
 	})
 }
 func handleUpdateModule(db *DB) http.HandlerFunc {
 	return requireAdmin(db, func(w http.ResponseWriter, r *http.Request) {
 		id := r.PathValue("id")
 		existing, err := db.getModule(id)
 		if err != nil {
 			notFound(w, "module not found")
 			return
 		}
 		// Partial body: preserve fields the client did not include. We rely
 		// on a generic map to detect omitted vs explicit-null because PATCH
 		// callers do not always send the full record.
 		var raw map[string]json.RawMessage
 		if err := infra.HTTPParseBody(r, &raw, maxBodyBytes); err != nil {
 			badRequest(w, err.Error())
 			return
 		}
 		decode := func(key string, into interface{}) {
 			if v, ok := raw[key]; ok {
 				_ = json.Unmarshal(v, into)
 			}
 		}
 		decode("name", &existing.Name)
 		decode("kind", &existing.Kind)
 		decode("enabled", &existing.Enabled)
 		if v, ok := raw["event_filter"]; ok {
 			_ = json.Unmarshal(v, &existing.EventFilter)
 		}
 		if v, ok := raw["config"]; ok {
 			var cfg JSONValue
 			_ = json.Unmarshal(v, &cfg)
 			// Re-inject masked fields the UI left as "***" so a partial
 			// edit does not nuke stored secrets.
 			merged := JSONValue{}
 			for k, val := range existing.Config {
 				merged[k] = val
 			}
 			for k, val := range cfg {
 				if s, isStr := val.(string); isStr && s == "***" {
 					continue
 				}
 				merged[k] = val
 			}
 			existing.Config = merged
 		}
 		if err := db.saveModule(existing); err != nil {
 			serverError(w, err)
 			return
 		}
 		infra.HTTPJSONResponse(w, http.StatusOK, publicModule(*existing))
 	})
 }
 func handleDeleteModule(db *DB) http.HandlerFunc {
 	return requireAdmin(db, func(w http.ResponseWriter, r *http.Request) {
 		id := r.PathValue("id")
 		if err := db.deleteModule(id); err != nil {
 			serverError(w, err)
 			return
 		}
 		w.WriteHeader(http.StatusNoContent)
 	})
 }
 func handleModuleLogs(db *DB) http.HandlerFunc {
 	return requireAdmin(db, func(w http.ResponseWriter, r *http.Request) {
 		id := r.PathValue("id")
 		limit := 100
 		if v := r.URL.Query().Get("limit"); v != "" {
 			if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 1000 {
 				limit = n
 			}
 		}
 		out, err := db.listModuleLogs(id, limit)
 		if err != nil {
 			serverError(w, err)
 			return
 		}
 		infra.HTTPJSONResponse(w, http.StatusOK, out)
 	})
 }
 // handleTestModule executes the kind-specific test_connection probe with
 // the *current stored config* (or with an incoming config payload, for
 // pre-save validation). Returns {ok, status, error} regardless of outcome
 // so the UI can show a useful message.
 func handleTestModule(db *DB, dispatcher *Dispatcher) http.HandlerFunc {
 	return requireAdmin(db, func(w http.ResponseWriter, r *http.Request) {
 		id := r.PathValue("id")
 		var m *Module
 		if id == "draft" {
 			// Pre-save test path: caller supplies a full module payload.
 			var body modulePayload
 			if err := infra.HTTPParseBody(r, &body, maxBodyBytes); err != nil {
 				badRequest(w, err.Error())
 				return
 			}
 			m = &Module{Kind: body.Kind, Config: body.Config}
 		} else {
 			got, err := db.getModule(id)
 			if err != nil {
 				notFound(w, "module not found")
 				return
 			}
 			m = got
 		}
 		h, ok := dispatcher.handlers[m.Kind]
 		if !ok {
 			infra.HTTPJSONResponse(w, http.StatusOK, map[string]interface{}{
 				"ok": false, "status": 0, "error": "unknown kind: " + m.Kind,
 			})
 			return
 		}
 		ctx, cancel := context.WithTimeout(r.Context(), moduleHTTPTimeout)
 		defer cancel()
 		start := time.Now()
 		status, err := h.TestConnection(ctx, *m)
 		resp := map[string]interface{}{
 			"ok":          err == nil,
 			"status":      status,
 			"duration_ms": int(time.Since(start).Milliseconds()),
 		}
 		if err != nil {
 			resp["error"] = err.Error()
 		}
 		infra.HTTPJSONResponse(w, http.StatusOK, resp)
 	})
 }
@@ -0,0 +1,227 @@
 package main
 import (
 	"context"
 	"encoding/json"
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"strings"
 	"testing"
 	"time"
 )
 // withModuleKey sets KANBAN_MODULE_KEY for the duration of a test and
 // restores the previous value afterwards.
 func withModuleKey(t *testing.T, value string) {
 	t.Helper()
 	prev := os.Getenv(moduleKeyEnv)
 	t.Setenv(moduleKeyEnv, value)
 	t.Cleanup(func() { _ = os.Setenv(moduleKeyEnv, prev) })
 }
 func TestCryptoRoundTrip(t *testing.T) {
 	withModuleKey(t, "test-passphrase")
 	plain := []byte(`{"hello":"world"}`)
 	cipherBlob, nonce, err := encryptConfig(plain)
 	if err != nil {
 		t.Fatalf("encrypt: %v", err)
 	}
 	got, err := decryptConfig(cipherBlob, nonce)
 	if err != nil {
 		t.Fatalf("decrypt: %v", err)
 	}
 	if string(got) != string(plain) {
 		t.Fatalf("roundtrip mismatch: got %q want %q", got, plain)
 	}
 }
 func TestCryptoMissingKey(t *testing.T) {
 	t.Setenv(moduleKeyEnv, "")
 	if _, _, err := encryptConfig([]byte("x")); err == nil {
 		t.Fatal("expected error when KANBAN_MODULE_KEY unset")
 	}
 }
 func TestSaveAndLoadModule(t *testing.T) {
 	withModuleKey(t, "test-passphrase")
 	db := setupTestDB(t)
 	m := &Module{
 		Name: "jira-test", Kind: "jira", Enabled: true,
 		EventFilter: []string{"card.created", "card.moved"},
 		Config: JSONValue{
 			"base_url": "https://example.atlassian.net",
 			"email":    "x@y.z",
 			"api_token": "secret-123",
 		},
 	}
 	if err := db.saveModule(m); err != nil {
 		t.Fatalf("save: %v", err)
 	}
 	if m.ID == "" {
 		t.Fatal("ID not assigned on insert")
 	}
 	got, err := db.getModule(m.ID)
 	if err != nil {
 		t.Fatalf("get: %v", err)
 	}
 	if got.Config["api_token"] != "secret-123" {
 		t.Fatalf("token roundtrip failed: %v", got.Config["api_token"])
 	}
 }
 func TestFilterMatches(t *testing.T) {
 	if !filterMatches([]string{"card.created"}, "card.created") {
 		t.Fatal("exact match")
 	}
 	if !filterMatches([]string{"*"}, "anything") {
 		t.Fatal("wildcard")
 	}
 	if filterMatches([]string{"card.created"}, "card.moved") {
 		t.Fatal("non-match should be false")
 	}
 }
 func TestCardOptOutTag(t *testing.T) {
 	c := cardForJira{Tags: []string{"foo", "NoJira", "bar"}}
 	if !c.hasTag("nojira") {
 		t.Fatal("nojira (case-insensitive) not detected")
 	}
 	if c.hasTag("missing") {
 		t.Fatal("missing tag returned true")
 	}
 }
 func TestJiraHandler_TransitionMappingMissing(t *testing.T) {
 	withModuleKey(t, "k")
 	db := setupTestDB(t)
 	col, _ := db.CreateColumn("Backlog")
 	card, _ := db.CreateCard(col.ID, "req", "t", "d", "")
 	// Link the card so the create-fallback path is skipped.
 	_ = db.setCardJiraKey(card.ID, "KAN-1")
 	h := &jiraHandler{}
 	_, err := h.transition(context.Background(), db, jiraConfig{BaseURL: "http://x"}, Event{Type: "card.moved", CardID: card.ID})
 	if err == nil || !strings.Contains(err.Error(), "status_map") {
 		t.Fatalf("expected status_map error, got %v", err)
 	}
 }
 func TestJiraHandler_TestConnectionHitsMyself(t *testing.T) {
 	var path string
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		path = r.URL.Path
 		w.WriteHeader(http.StatusOK)
 		_, _ = io.WriteString(w, `{"accountId":"abc"}`)
 	}))
 	defer srv.Close()
 	h := &jiraHandler{}
 	m := Module{Kind: "jira", Config: JSONValue{
 		"base_url":  srv.URL,
 		"email":     "x@y.z",
 		"api_token": "tok",
 	}}
 	status, err := h.TestConnection(context.Background(), m)
 	if err != nil {
 		t.Fatalf("TestConnection: %v", err)
 	}
 	if status != 200 {
 		t.Fatalf("status = %d, want 200", status)
 	}
 	if path != "/rest/api/3/myself" {
 		t.Fatalf("path = %q, want /rest/api/3/myself", path)
 	}
 }
 func TestJiraHandler_CreateLinksCardKey(t *testing.T) {
 	withModuleKey(t, "test-passphrase")
 	db := setupTestDB(t)
 	user, _ := db.CreateUser("alice", "passw", "Alice")
 	col, _ := db.CreateColumn("Todo")
 	card, _ := db.CreateCard(col.ID, "req", "Buy bread", "desc", user.ID)
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method == http.MethodPost && r.URL.Path == "/rest/api/3/issue" {
 			b, _ := io.ReadAll(r.Body)
 			var p struct {
 				Fields struct {
 					Summary string `json:"summary"`
 				} `json:"fields"`
 			}
 			_ = json.Unmarshal(b, &p)
 			if p.Fields.Summary != "Buy bread" {
 				t.Errorf("summary = %q", p.Fields.Summary)
 			}
 			w.WriteHeader(http.StatusCreated)
 			_, _ = io.WriteString(w, `{"id":"10000","key":"KAN-1"}`)
 			return
 		}
 		w.WriteHeader(http.StatusNotFound)
 	}))
 	defer srv.Close()
 	h := &jiraHandler{}
 	mod := Module{Kind: "jira", Config: JSONValue{
 		"base_url":    srv.URL,
 		"email":       "x@y.z",
 		"api_token":   "tok",
 		"project_key": "KAN",
 		"status_map":  map[string]interface{}{"Todo": "To Do"},
 	}}
 	status, err := h.Handle(context.Background(), db, mod, Event{Type: "card.created", CardID: card.ID})
 	if err != nil {
 		t.Fatalf("Handle: %v", err)
 	}
 	if status != http.StatusCreated {
 		t.Fatalf("status = %d, want 201", status)
 	}
 	again, err := db.getCardForJira(card.ID)
 	if err != nil {
 		t.Fatalf("get card: %v", err)
 	}
 	if again.JiraKey != "KAN-1" {
 		t.Fatalf("jira_key = %q, want KAN-1", again.JiraKey)
 	}
 }
 func TestDispatcher_Cutoff(t *testing.T) {
 	withModuleKey(t, "k")
 	db := setupTestDB(t)
 	col, _ := db.CreateColumn("Todo")
 	// Create card BEFORE the module so cutoffOK rejects it.
 	card, _ := db.CreateCard(col.ID, "req", "t", "d", "")
 	time.Sleep(20 * time.Millisecond)
 	mod := Module{ID: "m", CreatedAt: nowRFC3339()}
 	if cutoffOK(db, mod, Event{CardID: card.ID}) {
 		t.Fatal("card pre-dating module should be filtered out")
 	}
 	// Once linked, cutoff should allow it.
 	_ = db.setCardJiraKey(card.ID, "KAN-9")
 	if !cutoffOK(db, mod, Event{CardID: card.ID}) {
 		t.Fatal("linked card must pass cutoff even if older")
 	}
 }
 func TestIsAdmin(t *testing.T) {
 	db := setupTestDB(t)
 	u, _ := db.CreateUser("egutierrez", "passw", "Egu")
 	// Migration 015 marks egutierrez admin via UPDATE WHERE username, but
 	// that only takes effect when the row already exists. In production
 	// the migration runs against an existing user list; in tests we create
 	// users after migration, so simulate the same outcome explicitly.
 	if _, err := db.conn.Exec(`UPDATE users SET is_admin = 1 WHERE username = ?`, "egutierrez"); err != nil {
 		t.Fatalf("seed admin: %v", err)
 	}
 	ok, err := db.IsAdmin(u.ID)
 	if err != nil {
 		t.Fatalf("IsAdmin: %v", err)
 	}
 	if !ok {
 		t.Fatal("egutierrez must be admin after seed")
 	}
 	other, _ := db.CreateUser("alice", "passw", "Alice")
 	ok, _ = db.IsAdmin(other.ID)
 	if ok {
 		t.Fatal("alice must not be admin by default")
 	}
 }
@@ -14,6 +14,7 @@ type User struct {
 	Username    string `json:"username"`
 	DisplayName string `json:"display_name"`
 	Color       string `json:"color"`
 	IsAdmin     bool   `json:"is_admin"`
 	CreatedAt   string `json:"created_at"`
 }
@@ -51,36 +52,52 @@ func (db *DB) CreateUser(username, password, displayName string) (*User, error)
 func (db *DB) GetUserByID(id string) (*User, error) {
 	var u User
 	var isAdmin int
 	err := db.conn.QueryRow(
-		`SELECT id, username, display_name, color, created_at FROM users WHERE id=?`, id,
+		`SELECT id, username, display_name, color, is_admin, created_at FROM users WHERE id=?`, id,
-	).Scan(&u.ID, &u.Username, &u.DisplayName, &u.Color, &u.CreatedAt)
+	).Scan(&u.ID, &u.Username, &u.DisplayName, &u.Color, &isAdmin, &u.CreatedAt)
 	if errors.Is(err, sql.ErrNoRows) {
 		return nil, errUserNotFound
 	}
 	if err != nil {
 		return nil, err
 	}
 	u.IsAdmin = isAdmin == 1
 	return &u, nil
 }
 func (db *DB) IsAdmin(userID string) (bool, error) {
 	if userID == "" {
 		return false, nil
 	}
 	var n int
 	err := db.conn.QueryRow(`SELECT COALESCE(is_admin, 0) FROM users WHERE id=?`, userID).Scan(&n)
 	if errors.Is(err, sql.ErrNoRows) {
 		return false, nil
 	}
 	return n == 1, err
 }
 func (db *DB) GetUserByUsername(username string) (*User, string, error) {
 	username = strings.TrimSpace(strings.ToLower(username))
 	var u User
 	var hash string
 	var isAdmin int
 	err := db.conn.QueryRow(
-		`SELECT id, username, display_name, color, created_at, password_hash FROM users WHERE username=?`, username,
+		`SELECT id, username, display_name, color, is_admin, created_at, password_hash FROM users WHERE username=?`, username,
-	).Scan(&u.ID, &u.Username, &u.DisplayName, &u.Color, &u.CreatedAt, &hash)
+	).Scan(&u.ID, &u.Username, &u.DisplayName, &u.Color, &isAdmin, &u.CreatedAt, &hash)
 	if errors.Is(err, sql.ErrNoRows) {
 		return nil, "", errUserNotFound
 	}
 	if err != nil {
 		return nil, "", err
 	}
 	u.IsAdmin = isAdmin == 1
 	return &u, hash, nil
 }
 func (db *DB) ListUsers() ([]User, error) {
-	rows, err := db.conn.Query(`SELECT id, username, display_name, color, created_at FROM users ORDER BY username`)
+	rows, err := db.conn.Query(`SELECT id, username, display_name, color, is_admin, created_at FROM users ORDER BY username`)
 	if err != nil {
 		return nil, err
 	}
@@ -88,9 +105,11 @@ func (db *DB) ListUsers() ([]User, error) {
 	out := []User{}
 	for rows.Next() {
 		var u User
-		if err := rows.Scan(&u.ID, &u.Username, &u.DisplayName, &u.Color, &u.CreatedAt); err != nil {
+		var isAdmin int
 		if err := rows.Scan(&u.ID, &u.Username, &u.DisplayName, &u.Color, &isAdmin, &u.CreatedAt); err != nil {
 			return nil, err
 		}
 		u.IsAdmin = isAdmin == 1
 		out = append(out, u)
 	}
 	return out, rows.Err()
@@ -0,0 +1,248 @@
 #!/usr/bin/env bash
 # Kanban control TUI — gestiona backend (WSL) + frontend Vite (Windows) desde WSL.
 # Lanzamientos fire-and-forget; status panel auto-refresca cada 2s.
 # Lanzar: ./control.sh
 set -u
 BACKEND_PORT=8095
 FRONTEND_PORT=5180
 APP_DIR="/home/egutierrez/fn_registry/apps/kanban"
 BACKEND_LOG="/tmp/kanban.log"
 BUILD_LOG="/tmp/kanban_build.log"
 MSG_FILE="/tmp/kanban_control.msg"
 WIN_FRONT_DIR='C:\Users\egutierrez\fn_apps\kanban\frontend'
 RED=$'\033[31m'; GRN=$'\033[32m'; YLW=$'\033[33m'; CYN=$'\033[36m'; BLD=$'\033[1m'; RST=$'\033[0m'
 msg() { printf '%s\n' "$*" > "$MSG_FILE"; }
 wsl_pid_on_port() {
    local port=$1
    ss -ltnp 2>/dev/null | awk -v p=":$port\$" '$4 ~ p {print $0}' \
        | grep -oP 'pid=\K[0-9]+' | head -1
 }
 win_pid_on_port() {
    local port=$1
    netstat.exe -ano 2>/dev/null | tr -d '\r' \
        | awk -v p=":$port\$" '$2 ~ p && $4 == "LISTENING" {print $5; exit}'
 }
 backend_building() {
    [[ -f /tmp/kanban_build.pid ]] && kill -0 "$(cat /tmp/kanban_build.pid 2>/dev/null)" 2>/dev/null
 }
 # Build + launch en background — retorna inmediatamente
 start_backend() {
    if [[ -n $(wsl_pid_on_port "$BACKEND_PORT") ]]; then
        msg "${YLW}backend ya corriendo${RST}"; return 0
    fi
    if backend_building; then
        msg "${YLW}backend ya esta compilando, espera${RST}"; return 0
    fi
    local version
    version=$(awk -F': ' '/^version:/ {print $2; exit}' "$APP_DIR/app.md" 2>/dev/null || echo dev)
    msg "${CYN}lanzando backend en background (version=$version)...${RST}"
    (
        cd "$APP_DIR/backend" || exit 1
        # Rebuild si: binario no existe, .go/.sql mas nuevos, app.md mas nuevo (bump de version)
        if [[ ! -x kanban ]] \
           || [[ -n $(find . -maxdepth 3 \( -name '*.go' -o -name '*.sql' \) -newer kanban 2>/dev/null) ]] \
           || [[ "$APP_DIR/app.md" -nt kanban ]]; then
            CGO_ENABLED=1 go build -tags fts5 \
                -ldflags="-X main.Version=$version" \
                -o kanban . > "$BUILD_LOG" 2>&1 || {
                printf 'build failed — ver %s\n' "$BUILD_LOG" > "$MSG_FILE"
                exit 1
            }
        fi
        cd "$APP_DIR" || exit 1
        KANBAN_CLAUDE_BIN=/home/egutierrez/.local/bin/claude \
            setsid nohup ./backend/kanban --port "$BACKEND_PORT" --db ./operations.db \
            > "$BACKEND_LOG" 2>&1 < /dev/null &
        disown
    ) &
    echo $! > /tmp/kanban_build.pid
    disown
 }
 stop_backend() {
    local pid
    pid=$(wsl_pid_on_port "$BACKEND_PORT")
    if [[ -z $pid ]]; then
        msg "${YLW}backend ya parado${RST}"; return 0
    fi
    kill "$pid" 2>/dev/null
    ( sleep 1; kill -0 "$pid" 2>/dev/null && kill -9 "$pid" 2>/dev/null ) &
    disown
    msg "${GRN}backend stopped (pid $pid)${RST}"
 }
 wsl_ip() { hostname -I | awk '{print $1}'; }
 # WSL frontend → Windows frontend (excluye node_modules, dist, .vite)
 sync_frontend() {
    local src="$APP_DIR/frontend/"
    local dst="/mnt/c/Users/egutierrez/fn_apps/kanban/frontend/"
    if [[ ! -d $dst ]]; then
        msg "${RED}no existe $dst${RST}"; return 1
    fi
    rsync -a --delete \
        --exclude node_modules --exclude dist --exclude .vite \
        --exclude .cache --exclude tsconfig.tsbuildinfo \
        "$src" "$dst" 2>&1 | tail -3
    # pnpm install si package.json cambio
    if ! cmp -s "$src/package.json" "$dst/package.json" 2>/dev/null \
       || [[ ! -d "$dst/node_modules" ]]; then
        msg "${CYN}deps cambiaron, lanza pnpm install en Windows...${RST}"
        cmd.exe /c start "" cmd /c "cd /d $WIN_FRONT_DIR && pnpm install" >/dev/null 2>&1 &
        disown
    fi
 }
 # Lanza ventana cmd Windows con pnpm dev — no bloquea
 # Inyecta VITE_API_TARGET con IP WSL real porque localhost forwarding Win→WSL no es fiable
 start_vite() {
    if [[ -n $(win_pid_on_port "$FRONTEND_PORT") ]]; then
        msg "${YLW}vite ya corriendo${RST}"; return 0
    fi
    sync_frontend
    local ip target
    ip=$(wsl_ip)
    target="http://${ip}:${BACKEND_PORT}"
    cmd.exe /c start "" cmd /c "cd /d $WIN_FRONT_DIR && set VITE_API_TARGET=$target && pnpm dev --port $FRONTEND_PORT --strictPort --host" >/dev/null 2>&1 &
    disown
    msg "${CYN}vite lanzado, proxy → $target${RST}"
 }
 stop_vite() {
    local pid
    pid=$(win_pid_on_port "$FRONTEND_PORT")
    if [[ -z $pid ]]; then
        msg "${YLW}vite ya parado${RST}"; return 0
    fi
    taskkill.exe /F /T /PID "$pid" >/dev/null 2>&1 &
    disown
    msg "${GRN}taskkill enviado a vite pid $pid${RST}"
 }
 kill_stale() {
    local found=0 out=""
    for pid in $(pgrep -f "backend/kanban --port" 2>/dev/null); do
        local cmdl
        cmdl=$(tr '\0' ' ' < /proc/$pid/cmdline 2>/dev/null)
        if ! grep -q -- "--port $BACKEND_PORT" <<<"$cmdl"; then
            kill -9 "$pid" 2>/dev/null
            out+="killed wsl pid $pid ($cmdl); "
            found=1
        fi
    done
    [[ $found -eq 0 ]] && msg "${GRN}sin huerfanos WSL${RST}" || msg "${GRN}${out}${RST}"
 }
 _prev_frame=""
 build_frame() {
    local bpid vpid hc others
    bpid=$(wsl_pid_on_port "$BACKEND_PORT")
    vpid=$(win_pid_on_port "$FRONTEND_PORT")
    local out=""
    out+=$(printf '%s=== Kanban control ===%s' "$BLD" "$RST")$'\n\n'
    if [[ -n $bpid ]]; then
        local rv av
        rv=$(curl -s -m 1 "http://127.0.0.1:$BACKEND_PORT/api/version" | grep -oP '"version":"\K[^"]+' || echo "?")
        av=$(awk -F': ' '/^version:/ {print $2; exit}' "$APP_DIR/app.md" 2>/dev/null || echo "?")
        if [[ "$rv" == "$av" ]]; then
            hc="${GRN}v$rv${RST}"
        else
            hc="${YLW}running=v$rv app.md=v$av (rebuild)${RST}"
        fi
        out+=$(printf '  backend (WSL :%s)   %sUP%s   pid %s   %s' \
            "$BACKEND_PORT" "$GRN" "$RST" "$bpid" "$hc")$'\n'
    elif backend_building; then
        out+=$(printf '  backend (WSL :%s)   %sBUILDING/STARTING%s   tail %s' \
            "$BACKEND_PORT" "$YLW" "$RST" "$BUILD_LOG")$'\n'
    else
        out+=$(printf '  backend (WSL :%s)   %sDOWN%s' "$BACKEND_PORT" "$RED" "$RST")$'\n'
    fi
    # frontend version + drift WSL↔Win
    local fv drift
    fv=$(grep -oP '"version":\s*"\K[^"]+' "$APP_DIR/frontend/package.json" 2>/dev/null || echo "?")
    drift=$(diff -rq "$APP_DIR/frontend/src" "/mnt/c/Users/egutierrez/fn_apps/kanban/frontend/src" 2>/dev/null \
        | grep -c -E "^(Files|Only)" || true)
    local dlbl
    if [[ ${drift:-0} -eq 0 ]]; then
        dlbl="${GRN}sync${RST}"
    else
        dlbl="${YLW}drift=$drift (sync al start)${RST}"
    fi
    if [[ -n $vpid ]]; then
        out+=$(printf '  vite    (WIN :%s)  %sUP%s   pid %s   v%s   %s' "$FRONTEND_PORT" "$GRN" "$RST" "$vpid" "$fv" "$dlbl")$'\n'
    else
        out+=$(printf '  vite    (WIN :%s)  %sDOWN%s   v%s   %s' "$FRONTEND_PORT" "$RED" "$RST" "$fv" "$dlbl")$'\n'
    fi
    others=$(pgrep -af "backend/kanban --port" 2>/dev/null | grep -v -- "--port $BACKEND_PORT" || true)
    if [[ -n $others ]]; then
        out+=$(printf '  %sOTROS kanban backends WSL:%s' "$YLW" "$RST")$'\n'
        out+=$(echo "$others" | sed 's/^/    /')$'\n'
    fi
    out+=$'\n'
    out+=$(printf '%sUltimo evento:%s %s' "$CYN" "$RST" "$(tail -1 "$MSG_FILE" 2>/dev/null || echo '-')")$'\n\n'
    out+="${BLD}Acciones${RST} (auto-refresh 2s, tecla suelta):"$'\n'
    out+="  1) Start backend             5) Start TODO"$'\n'
    out+="  2) Stop backend              6) Stop TODO"$'\n'
    out+="  3) Start vite                7) Mata kanban huerfanos"$'\n'
    out+="  4) Stop vite                 8) Tail backend log"$'\n'
    out+="                               9) Refrescar     0) Salir"$'\n'
    out+="> "
    printf '%s' "$out"
 }
 draw_status() {
    local frame
    frame=$(build_frame)
    if [[ $frame == "$_prev_frame" ]]; then
        return 0
    fi
    _prev_frame=$frame
    # cursor home + frame + erase-to-end-of-display (limpia lineas residuales)
    printf '\033[H%s\033[J' "$frame"
 }
 tail_log() {
    clear
    printf '%stail -f %s (Ctrl-C vuelve al menu)%s\n' "$CYN" "$BACKEND_LOG" "$RST"
    trap 'trap - INT; return 0' INT
    tail -f "$BACKEND_LOG" 2>/dev/null
    trap - INT
 }
 menu() {
    : > "$MSG_FILE"
    # limpia pantalla una sola vez; redraw posterior usa cursor-home
    printf '\033[2J\033[H'
    trap 'printf "\033[?25h\n"; exit 0' EXIT INT TERM
    printf '\033[?25l'  # oculta cursor mientras dibujamos
    while true; do
        draw_status
        # read con timeout 2s — refresco automatico si no hay tecla
        local choice=""
        if read -rsn1 -t 2 choice; then
            case "$choice" in
                1) start_backend ;;
                2) stop_backend ;;
                3) start_vite ;;
                4) stop_vite ;;
                5) start_backend; start_vite ;;
                6) stop_vite; stop_backend ;;
                7) kill_stale ;;
                8) printf '\033[?25h'; tail_log; printf '\033[?25l'; _prev_frame=""; printf '\033[2J\033[H' ;;
                9) : ;;
                0|q|Q) printf '\033[?25h'; clear; exit 0 ;;
                $'\n'|"") : ;;
                *) msg "${RED}opcion invalida: $choice${RST}" ;;
            esac
        fi
    done
 }
 menu
@@ -17,7 +17,7 @@ set -uo pipefail
 BACKEND="${BACKEND:-http://127.0.0.1:8095}"
 PROXY="${PROXY:-http://127.0.0.1:5180}"
-EXPECTED_VERSION="${EXPECTED_VERSION:-0.2.0}"
+EXPECTED_VERSION="${EXPECTED_VERSION:-0.3.0}"
 fail() { echo "FAIL: $*" >&2; exit 1; }
 ok()   { echo "OK   $*"; }
@@ -72,5 +72,20 @@ code=$(curl -sS -o /dev/null -w '%{http_code}' -m 5 \
 [[ "$code" != "404" ]] || ok "card chat ws path resolved ($code)"
 ok "card chat WS route present (status $code)"
 # 7. /api/modules — admin gated (401 unauthenticated).
 code=$(curl -sS -o /dev/null -w '%{http_code}' -m 5 "$BACKEND/api/modules")
 [[ "$code" == "401" ]] || fail "/api/modules returned $code, want 401"
 ok "modules CRUD gated 401"
 # 8. /api/modules/__nope__/test — exists (401 anonymous).
 code=$(curl -sS -o /dev/null -w '%{http_code}' -m 5 -X POST "$BACKEND/api/modules/__nope__/test")
 [[ "$code" == "401" ]] || fail "module test returned $code, want 401"
 ok "modules test endpoint present"
 # 9. bundle ships modules UI.
 for needle in "/modules" "/modules/__draft__/test" "ModulesModal" "is_admin" "jira"; do
    grep -q "$needle" "$js_tmp" && ok "bundle has '$needle'" || true
 done
 echo
-echo "PASS — kanban $EXPECTED_VERSION serving notifications/streaming UI"
+echo "PASS — kanban $EXPECTED_VERSION serving notifications + streaming + modules UI"
@@ -55,6 +55,7 @@ import {
  IconChevronRight,
  IconLayoutKanban,
  IconLogout,
  IconPlug,
  IconMenu2,
  IconMessageChatbot,
  IconMoodSmile,
@@ -82,6 +83,7 @@ import { ColorPickerGrid, CustomColorModal } from "./components/ColorPickerGrid"
 import { AVATAR_COLORS } from "./components/colors";
 import { colorBg, colorBorder } from "./components/colors";
 import { NotificationsBell } from "./components/NotificationsBell";
 import { ModulesModal } from "./components/ModulesModal";
 import { useEventStream } from "./hooks/useEventStream";
 import type { Board, Card, CardColor, Column, ColumnLocation, Notification, User } from "./types";
@@ -341,6 +343,8 @@ export function App() {
      .catch(() => setAppVersion(""));
  }, []);
  const [modulesOpen, setModulesOpen] = useState(false);
  const reloadNotifs = useCallback(async () => {
    try {
      const [list, c] = await Promise.all([api.listNotifications(false), api.unreadNotificationCount()]);
@@ -719,7 +723,7 @@ export function App() {
    });
  }, [reload, users, auth.user, requesterOptions, tagOptions]);
-  const openEditCard = useCallback((card: Card) => {
+  const openEditCard = useCallback((card: Card, options?: { highlightMessageId?: string }) => {
    const id = modals.open({
      title: "Editar tarjeta",
      size: "85%",
@@ -730,6 +734,7 @@ export function App() {
          currentUserId={auth.user?.id}
          requesterOptions={requesterOptions}
          tagOptions={tagOptions}
          highlightMessageId={options?.highlightMessageId}
          onCancel={() => modals.close(id)}
          onSubmit={async (v) => {
            try {
@@ -1178,17 +1183,30 @@ export function App() {
                <NotificationsBell
                  unreadCount={notifUnread}
                  notifications={notifs}
-                  onOpenCard={async (cardId) => {
+                  onOpenCard={async (cardId, messageId) => {
-                    const card = board?.cards.find((c) => c.id === cardId);
+                    // Resolve the card across all possible buckets: live
-                    if (card) {
+                    // board, refreshed board, archive, trash. Notifications
-                      setActiveCard(card);
+                    // can point at any of them.
-                    } else {
+                    const find = (cs?: Card[]) => cs?.find((c) => c.id === cardId);
-                      // Card may be archived/trashed/missing locally — refetch and retry.
+                    let card = find(board?.cards);
                    if (!card) {
                      await reload();
-                      const b = await api.getBoard();
+                      const fresh = await api.getBoard();
-                      const c2 = b.cards.find((c) => c.id === cardId);
+                      card = find(fresh.cards);
                      if (c2) setActiveCard(c2);
                    }
                    if (!card) {
                      const archived = await api.listArchive();
                      card = find(archived);
                    }
                    if (!card) {
                      const trashed = await api.listTrash();
                      card = find(trashed);
                    }
                    if (!card) {
                      notifications.show({ color: "red", message: "Card no encontrada" });
                      return;
                    }
                    openEditCard(card, { highlightMessageId: messageId });
                  }}
                  onChanged={reloadNotifs}
                />
@@ -1240,6 +1258,14 @@ export function App() {
                      />
                    </Box>
                    <Menu.Divider />
                    {auth.user.is_admin && (
                      <Menu.Item
                        leftSection={<IconPlug size={14} />}
                        onClick={() => setModulesOpen(true)}
                      >
                        Modulos
                      </Menu.Item>
                    )}
                    <Menu.Item
                      leftSection={<IconLogout size={14} />}
                      color="red"
@@ -1250,6 +1276,9 @@ export function App() {
                  </Menu.Dropdown>
                </Menu>
              )}
              {auth.user?.is_admin && (
                <ModulesModal opened={modulesOpen} onClose={() => setModulesOpen(false)} />
              )}
            </Group>
          </Group>
        </AppShell.Header>
@@ -4,8 +4,11 @@ import type {
  CardHistoryResponse,
  CardMessage,
  Column,
  KanbanModule,
  Metrics,
  MetricsFilter,
  ModuleLog,
  ModuleTestResult,
  Notification,
  Sticker,
  User,
@@ -317,6 +320,40 @@ export function markAllNotificationsRead(): Promise<{ count: number }> {
  return fetchJSON("/notifications/read-all", { method: "POST" });
 }
 export function listModules(): Promise<KanbanModule[]> {
  return fetchJSON("/modules");
 }
 export interface ModuleInput {
  name: string;
  kind: string;
  enabled: boolean;
  event_filter: string[];
  config: Record<string, unknown>;
 }
 export function createModule(body: ModuleInput): Promise<KanbanModule> {
  return fetchJSON("/modules", { method: "POST", body: JSON.stringify(body) });
 }
 export function updateModule(id: string, patch: Partial<ModuleInput>): Promise<KanbanModule> {
  return fetchJSON(`/modules/${id}`, { method: "PATCH", body: JSON.stringify(patch) });
 }
 export function deleteModule(id: string): Promise<void> {
  return fetchJSON(`/modules/${id}`, { method: "DELETE" });
 }
 export function listModuleLogs(id: string, limit = 100): Promise<ModuleLog[]> {
  return fetchJSON(`/modules/${id}/logs?limit=${limit}`);
 }
 export function testModule(idOrDraft: string, body?: ModuleInput): Promise<ModuleTestResult> {
  const init: RequestInit = { method: "POST" };
  if (body) init.body = JSON.stringify(body);
  return fetchJSON(`/modules/${idOrDraft}/test`, init);
 }
 // streamChat opens a WebSocket, sends the message history, and streams events
 // to onEvent. Returns a Promise that resolves when the server closes the
 // connection (after a "done" event) and rejects on transport errors.
@@ -35,6 +35,9 @@ interface Props {
  users: User[];
  currentUserId?: string;
  onMessagesChange?: (messages: CardMessage[]) => void;
  // When set, the panel scrolls the matching message into view and flashes a
  // brief highlight (~2s). Used by notification click → open card.
  highlightMessageId?: string;
 }
 // Window for considering a peer "actively typing" after its last event.
@@ -98,7 +101,7 @@ function renderBody(body: string, knownUsers: Map<string, User>): ReactNode {
  return out;
 }
-export function CardChatPanel({ cardId, users, currentUserId, onMessagesChange }: Props) {
+export function CardChatPanel({ cardId, users, currentUserId, onMessagesChange, highlightMessageId }: Props) {
  const [messages, setMessages] = useState<CardMessage[]>([]);
  const [loading, setLoading] = useState(true);
  const [body, setBody] = useState("");
@@ -185,6 +188,22 @@ export function CardChatPanel({ cardId, users, currentUserId, onMessagesChange }
    }
  }, [messages.length]);
  // Scroll to + briefly pulse the message that triggered an incoming
  // notification. Runs whenever the highlight id changes AND the message
  // is present in the list (it may arrive asynchronously after WS sync).
  const [pulse, setPulse] = useState<string | null>(null);
  useEffect(() => {
    if (!highlightMessageId) return;
    if (!messages.some((m) => m.id === highlightMessageId)) return;
    const el = document.querySelector(`[data-msg-id="${highlightMessageId}"]`);
    if (el && el instanceof HTMLElement) {
      el.scrollIntoView({ behavior: "smooth", block: "center" });
    }
    setPulse(highlightMessageId);
    const t = setTimeout(() => setPulse(null), 2200);
    return () => clearTimeout(t);
  }, [highlightMessageId, messages]);
  const sendTypingPing = () => {
    const ws = wsRef.current;
    if (!ws || ws.readyState !== WebSocket.OPEN) return;
@@ -319,13 +338,25 @@ export function CardChatPanel({ cardId, users, currentUserId, onMessagesChange }
              const author = m.author_id ? usersById.get(m.author_id) : null;
              const isMe = m.author_id && m.author_id === currentUserId;
              const label = author ? author.display_name || author.username : "Anonimo";
              const highlighted = pulse === m.id;
              return (
                <Paper
                  key={m.id}
                  withBorder
                  p="xs"
                  radius="sm"
-                  bg={isMe ? "var(--mantine-color-blue-light)" : undefined}
+                  data-msg-id={m.id}
                  bg={
                    highlighted
                      ? "var(--mantine-color-yellow-light)"
                      : isMe
                      ? "var(--mantine-color-blue-light)"
                      : undefined
                  }
                  style={{
                    transition: "background-color 600ms ease",
                    boxShadow: highlighted ? "0 0 0 2px var(--mantine-color-yellow-5)" : undefined,
                  }}
                >
                  <Group gap={6} wrap="nowrap" align="flex-start">
                    <Avatar size={22} radius="xl" color={author?.color || tagColor(label)}>
@@ -14,6 +14,9 @@ interface Props {
  tagOptions: string[];
  onSubmit: (v: CardFormValues) => Promise<void> | void;
  onCancel: () => void;
  // When set, the chat panel auto-scrolls to this message id and pulses
  // it briefly. Used when opening a card from a notification click.
  highlightMessageId?: string;
 }
 export function CardEditPanel({
@@ -24,6 +27,7 @@ export function CardEditPanel({
  tagOptions,
  onSubmit,
  onCancel,
  highlightMessageId,
 }: Props) {
  const [messages, setMessages] = useState<CardMessage[]>([]);
  const [liveCard, setLiveCard] = useState(card);
@@ -68,6 +72,7 @@ export function CardEditPanel({
                  users={users}
                  currentUserId={currentUserId}
                  onMessagesChange={setMessages}
                  highlightMessageId={highlightMessageId}
                />
              </Box>
            </Tabs.Panel>
@@ -0,0 +1,441 @@
 import {
  ActionIcon,
  Alert,
  Badge,
  Box,
  Button,
  Checkbox,
  Code,
  Divider,
  Group,
  JsonInput,
  Loader,
  Modal,
  ScrollArea,
  Select,
  Stack,
  Table,
  Tabs,
  Text,
  TextInput,
  Tooltip,
 } from "@mantine/core";
 import { notifications } from "@mantine/notifications";
 import { IconPlug, IconPlugConnected, IconRefresh, IconTestPipe, IconTrash } from "@tabler/icons-react";
 import { useCallback, useEffect, useMemo, useState } from "react";
 import * as api from "../api";
 import type { KanbanModule, ModuleLog } from "../types";
 import { formatDateTimeShort } from "./format";
 interface Props {
  opened: boolean;
  onClose: () => void;
 }
 const KANBAN_EVENTS = [
  "card.created",
  "card.updated",
  "card.moved",
  "card.deleted",
  "message.created",
  "board.invalidated",
 ];
 const DEFAULT_JIRA_CONFIG = {
  base_url: "",
  email: "",
  api_token: "",
  project_key: "",
  status_map: {
    "Por hacer": "To Do",
    "Doing": "In Progress",
    "Done": "Done",
  },
 };
 export function ModulesModal({ opened, onClose }: Props) {
  const [modules, setModules] = useState<KanbanModule[]>([]);
  const [loading, setLoading] = useState(false);
  const [selectedId, setSelectedId] = useState<string | null>(null);
  const [editing, setEditing] = useState<KanbanModule | null>(null);
  const [logs, setLogs] = useState<ModuleLog[]>([]);
  const [logsLoading, setLogsLoading] = useState(false);
  const [activeTab, setActiveTab] = useState<string | null>("form");
  const reload = useCallback(async () => {
    setLoading(true);
    try {
      const list = await api.listModules();
      setModules(list);
    } catch (e) {
      notifications.show({ color: "red", message: (e as Error).message });
    } finally {
      setLoading(false);
    }
  }, []);
  useEffect(() => {
    if (opened) reload();
  }, [opened, reload]);
  const reloadLogs = useCallback(async (id: string) => {
    setLogsLoading(true);
    try {
      const out = await api.listModuleLogs(id);
      setLogs(out);
    } catch (e) {
      notifications.show({ color: "red", message: (e as Error).message });
    } finally {
      setLogsLoading(false);
    }
  }, []);
  const select = (m: KanbanModule | null) => {
    setEditing(m ? { ...m, config: { ...m.config } } : null);
    setSelectedId(m?.id ?? null);
    setActiveTab("form");
    setLogs([]);
    if (m) reloadLogs(m.id);
  };
  const startNew = () => {
    const blank: KanbanModule = {
      id: "",
      name: "Nuevo modulo",
      kind: "jira",
      enabled: false,
      event_filter: ["card.created", "card.updated", "card.moved", "message.created"],
      config: { ...DEFAULT_JIRA_CONFIG, status_map: { ...DEFAULT_JIRA_CONFIG.status_map } },
      created_at: "",
      updated_at: "",
    };
    setEditing(blank);
    setSelectedId(null);
    setActiveTab("form");
    setLogs([]);
  };
  const save = async () => {
    if (!editing) return;
    try {
      const payload = {
        name: editing.name,
        kind: editing.kind,
        enabled: editing.enabled,
        event_filter: editing.event_filter,
        config: editing.config,
      };
      const saved = editing.id
        ? await api.updateModule(editing.id, payload)
        : await api.createModule(payload);
      notifications.show({ color: "green", message: "Modulo guardado" });
      await reload();
      select(saved);
    } catch (e) {
      notifications.show({ color: "red", message: (e as Error).message });
    }
  };
  const remove = async () => {
    if (!selectedId) return;
    if (!confirm("Borrar modulo?")) return;
    try {
      await api.deleteModule(selectedId);
      notifications.show({ color: "green", message: "Modulo borrado" });
      setEditing(null);
      setSelectedId(null);
      reload();
    } catch (e) {
      notifications.show({ color: "red", message: (e as Error).message });
    }
  };
  const test = async () => {
    if (!editing) return;
    try {
      const result = editing.id
        ? await api.testModule(editing.id)
        : await api.testModule("draft", {
            name: editing.name,
            kind: editing.kind,
            enabled: editing.enabled,
            event_filter: editing.event_filter,
            config: editing.config,
          });
      if (result.ok) {
        notifications.show({
          color: "green",
          title: `Test OK (${result.status})`,
          message: `Conexion verificada en ${result.duration_ms}ms`,
        });
      } else {
        notifications.show({
          color: "red",
          title: `Test fallo (${result.status})`,
          message: result.error || "sin detalle",
        });
      }
    } catch (e) {
      notifications.show({ color: "red", message: (e as Error).message });
    }
  };
  return (
    <Modal
      opened={opened}
      onClose={onClose}
      title={
        <Group gap={8}>
          <IconPlug size={18} />
          <Text fw={600}>Modulos / Integraciones</Text>
        </Group>
      }
      size="xl"
      centered
    >
      <Group align="flex-start" gap="md" wrap="nowrap">
        <Box style={{ width: 220, minWidth: 220 }}>
          <Group justify="space-between" mb={6}>
            <Text size="xs" c="dimmed">Configurados</Text>
            <Tooltip label="Refrescar" withArrow>
              <ActionIcon size="sm" variant="subtle" onClick={reload}>
                <IconRefresh size={14} />
              </ActionIcon>
            </Tooltip>
          </Group>
          <ScrollArea h={400} type="auto">
            <Stack gap={4}>
              {loading && <Loader size="xs" />}
              {modules.map((m) => (
                <Box
                  key={m.id}
                  p="xs"
                  style={{
                    cursor: "pointer",
                    border: "1px solid var(--mantine-color-gray-3)",
                    borderRadius: 4,
                    background:
                      selectedId === m.id ? "var(--mantine-color-blue-light)" : undefined,
                  }}
                  onClick={() => select(m)}
                >
                  <Group justify="space-between" gap={4} wrap="nowrap">
                    <Text size="sm" fw={600} truncate>
                      {m.name}
                    </Text>
                    <Badge size="xs" color={m.enabled ? "green" : "gray"}>
                      {m.enabled ? "on" : "off"}
                    </Badge>
                  </Group>
                  <Text size="xs" c="dimmed">{m.kind}</Text>
                </Box>
              ))}
              <Button size="xs" variant="light" onClick={startNew} mt="xs">
                + Nuevo
              </Button>
            </Stack>
          </ScrollArea>
        </Box>
        <Divider orientation="vertical" />
        <Box style={{ flex: 1, minWidth: 0 }}>
          {!editing ? (
            <Alert color="gray">Selecciona un modulo o pulsa "Nuevo".</Alert>
          ) : (
            <Tabs value={activeTab} onChange={setActiveTab}>
              <Tabs.List>
                <Tabs.Tab value="form">Configuracion</Tabs.Tab>
                <Tabs.Tab value="logs">Logs</Tabs.Tab>
              </Tabs.List>
              <Tabs.Panel value="form" pt="xs">
                <Stack gap="xs">
                  <Group gap="xs">
                    <TextInput
                      label="Nombre"
                      value={editing.name}
                      onChange={(e) => setEditing({ ...editing, name: e.currentTarget.value })}
                      style={{ flex: 1 }}
                    />
                    <Select
                      label="Kind"
                      value={editing.kind}
                      onChange={(v) => setEditing({ ...editing, kind: v || "jira" })}
                      data={[{ value: "jira", label: "Jira" }]}
                      w={140}
                    />
                  </Group>
                  <Checkbox
                    label="Activo"
                    checked={editing.enabled}
                    onChange={(e) => setEditing({ ...editing, enabled: e.currentTarget.checked })}
                  />
                  <Box>
                    <Text size="xs" fw={600} mb={4}>Eventos</Text>
                    <Group gap="xs">
                      {KANBAN_EVENTS.map((ev) => (
                        <Checkbox
                          key={ev}
                          label={<Code>{ev}</Code>}
                          checked={editing.event_filter.includes(ev)}
                          onChange={(e) => {
                            const next = e.currentTarget.checked
                              ? [...editing.event_filter, ev]
                              : editing.event_filter.filter((x) => x !== ev);
                            setEditing({ ...editing, event_filter: next });
                          }}
                        />
                      ))}
                    </Group>
                  </Box>
                  <JiraConfigEditor editing={editing} setEditing={setEditing} />
                  <Group gap="xs">
                    <Button onClick={save} leftSection={<IconPlugConnected size={14} />}>
                      Guardar
                    </Button>
                    <Button variant="default" onClick={test} leftSection={<IconTestPipe size={14} />}>
                      Probar conexion
                    </Button>
                    {selectedId && (
                      <Button
                        color="red"
                        variant="subtle"
                        onClick={remove}
                        leftSection={<IconTrash size={14} />}
                        ml="auto"
                      >
                        Borrar
                      </Button>
                    )}
                  </Group>
                </Stack>
              </Tabs.Panel>
              <Tabs.Panel value="logs" pt="xs">
                <Group justify="space-between" mb={6}>
                  <Text size="xs" c="dimmed">Ultimas 100 entradas</Text>
                  <ActionIcon
                    size="sm"
                    variant="subtle"
                    onClick={() => selectedId && reloadLogs(selectedId)}
                  >
                    <IconRefresh size={14} />
                  </ActionIcon>
                </Group>
                {logsLoading ? (
                  <Loader size="sm" />
                ) : logs.length === 0 ? (
                  <Text size="sm" c="dimmed">Sin entradas.</Text>
                ) : (
                  <ScrollArea h={400}>
                    <Table withTableBorder striped highlightOnHover stickyHeader>
                      <Table.Thead>
                        <Table.Tr>
                          <Table.Th>Hora</Table.Th>
                          <Table.Th>Evento</Table.Th>
                          <Table.Th>HTTP</Table.Th>
                          <Table.Th>ms</Table.Th>
                          <Table.Th>Error</Table.Th>
                        </Table.Tr>
                      </Table.Thead>
                      <Table.Tbody>
                        {logs.map((l) => (
                          <Table.Tr key={l.id}>
                            <Table.Td>{formatDateTimeShort(l.created_at)}</Table.Td>
                            <Table.Td><Code>{l.event_type}</Code></Table.Td>
                            <Table.Td>
                              <Badge color={l.status >= 400 || l.error ? "red" : "green"} size="sm">
                                {l.status || "-"}
                              </Badge>
                            </Table.Td>
                            <Table.Td>{l.duration_ms}</Table.Td>
                            <Table.Td>
                              <Text size="xs" c="red" lineClamp={2}>{l.error}</Text>
                            </Table.Td>
                          </Table.Tr>
                        ))}
                      </Table.Tbody>
                    </Table>
                  </ScrollArea>
                )}
              </Tabs.Panel>
            </Tabs>
          )}
        </Box>
      </Group>
    </Modal>
  );
 }
 interface JiraConfigEditorProps {
  editing: KanbanModule;
  setEditing: (m: KanbanModule) => void;
 }
 function JiraConfigEditor({ editing, setEditing }: JiraConfigEditorProps) {
  const cfg = editing.config as Record<string, unknown>;
  const set = (key: string, value: unknown) =>
    setEditing({ ...editing, config: { ...cfg, [key]: value } });
  const statusMapText = useMemo(() => {
    return JSON.stringify(cfg.status_map ?? {}, null, 2);
  }, [cfg.status_map]);
  if (editing.kind !== "jira") {
    return (
      <Alert color="yellow" mt="xs">
        Editor especifico para esta kind aun no implementado.
      </Alert>
    );
  }
  return (
    <Stack gap="xs">
      <TextInput
        label="Base URL"
        placeholder="https://acme.atlassian.net"
        value={(cfg.base_url as string) || ""}
        onChange={(e) => set("base_url", e.currentTarget.value)}
      />
      <Group gap="xs">
        <TextInput
          label="Email"
          value={(cfg.email as string) || ""}
          onChange={(e) => set("email", e.currentTarget.value)}
          style={{ flex: 1 }}
        />
        <TextInput
          label="API token"
          placeholder={editing.id ? "*** (deja vacio para conservar)" : ""}
          value={(cfg.api_token as string) || ""}
          onChange={(e) => set("api_token", e.currentTarget.value)}
          style={{ flex: 1 }}
        />
      </Group>
      <TextInput
        label="Project key"
        placeholder="KAN"
        value={(cfg.project_key as string) || ""}
        onChange={(e) => set("project_key", e.currentTarget.value)}
      />
      <JsonInput
        label="Status map (columna kanban → transicion Jira)"
        description='{"Doing":"In Progress","Done":"Done"}'
        value={statusMapText}
        autosize
        minRows={3}
        validationError="JSON invalido"
        onChange={(v) => {
          try {
            const parsed = JSON.parse(v);
            set("status_map", parsed);
          } catch {
            // Hold invalid input in textarea via raw state; final save will
            // reuse last valid parse.
          }
        }}
      />
    </Stack>
  );
 }
@@ -25,7 +25,9 @@ interface Props {
  unreadCount?: number;
  notifications?: Notification[];
  // Called when the user clicks a notification → open the relevant card.
-  onOpenCard?: (cardId: string) => void;
+  // messageId points to the chat message that triggered the notification so
  // the parent can scroll to it.
  onOpenCard?: (cardId: string, messageId: string) => void;
  // Called whenever the bell mutates state (mark read / mark all) so the
  // parent can refresh its cached lists.
  onChanged?: () => void;
@@ -101,7 +103,7 @@ export function NotificationsBell({ unreadCount: extCount, notifications: extLis
      }
    }
    setOpened(false);
-    onOpenCard?.(n.card_id);
+    onOpenCard?.(n.card_id, n.message_id);
  };
  const handleMarkAll = async () => {
@@ -51,9 +51,41 @@ export interface User {
  username: string;
  display_name: string;
  color: string;
  is_admin?: boolean;
  created_at: string;
 }
 export type ModuleKind = "jira" | "webhook";
 export interface KanbanModule {
  id: string;
  name: string;
  kind: ModuleKind | string;
  enabled: boolean;
  event_filter: string[];
  config: Record<string, unknown>;
  created_at: string;
  updated_at: string;
 }
 export interface ModuleLog {
  id: string;
  module_id: string;
  event_type: string;
  card_id: string;
  status: number;
  duration_ms: number;
  error: string;
  created_at: string;
 }
 export interface ModuleTestResult {
  ok: boolean;
  status: number;
  duration_ms: number;
  error?: string;
 }
 export interface MetricsRange {
  from: string;
  to: string;
@@ -13,7 +13,7 @@ export default defineConfig({
    port: 5180,
    proxy: {
      "/api": {
-        target: "http://localhost:8095",
+        target: process.env.VITE_API_TARGET || "http://127.0.0.1:8095",
        ws: true,
        changeOrigin: true,
      },
@@ -42,6 +42,10 @@ if [[ ! -d "$FRONT_DIR/node_modules" ]]; then
 fi
 # 3. Lanzar backend
 # KANBAN_MODULE_KEY: passphrase used to AES-GCM encrypt module config_json.
 # A stable default keeps the dev loop ergonomic; in production set this via
 # the host's secret store. Changing it invalidates previously stored modules.
 export KANBAN_MODULE_KEY="${KANBAN_MODULE_KEY:-local-dev-secret-rotate-in-prod}"
 echo ">>> Backend  http://localhost:$PORT_BACK  (db=$DB_PATH)"
 (cd "$BACK_DIR" && ./kanban --port "$PORT_BACK" --db "$DB_PATH") &
 BACK_PID=$!