chore: auto-commit (23 archivos)

- app.md - backend/dist/assets/index-CFDWXN9Z.js - backend/dist/index.html - backend/handlers.go - backend/main.go - backend/users.go - e2e/smoke_live.sh - frontend/src/App.tsx - frontend/src/api.ts - frontend/src/components/CardChatPanel.tsx - ... Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-21 18:22:44 +02:00
parent 2524340759
commit c9e15513c7
22 changed files with 2380 additions and 179 deletions
@@ -2,7 +2,7 @@
 name: kanban
 lang: go
 domain: tools
-version: 0.2.0
+version: 0.3.0
 description: "Kanban board con persistencia SQLite, drag-and-drop entre columnas (dnd-kit) y tracking del tiempo que cada tarjeta pasa en cada columna. Frontend Vite + React + Mantine v9 embebido en el binario Go."
 tags: [service, kanban, web, dnd-kit, mantine, sqlite, time-tracking]
 uses_functions:
@@ -4,7 +4,7 @@
    <meta charset="UTF-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>Kanban</title>
-    <script type="module" crossorigin src="/assets/index-CFDWXN9Z.js"></script>
+    <script type="module" crossorigin src="/assets/index-UVzY_37O.js"></script>
    <link rel="stylesheet" crossorigin href="/assets/index-b0xjFtx2.css">
  </head>
  <body>
@@ -622,7 +622,7 @@ func handlePurgeCard(db *DB, hub *EventHub) http.HandlerFunc {
 	}
 }

-func apiRoutes(db *DB, chatWorkdir string, logger *ChatLogger, internalToken string, flags *FeatureFlags, hub *EventHub) []infra.Route {
+func apiRoutes(db *DB, chatWorkdir string, logger *ChatLogger, internalToken string, flags *FeatureFlags, hub *EventHub, dispatcher *Dispatcher) []infra.Route {
 	return []infra.Route{
 		{Method: "GET", Path: "/api/flags", Handler: handleListFlags(flags)},
 		{Method: "GET", Path: "/api/version", Handler: handleVersion()},
@@ -670,6 +670,12 @@ func apiRoutes(db *DB, chatWorkdir string, logger *ChatLogger, internalToken str
 		{Method: "GET", Path: "/api/notifications/unread-count", Handler: handleUnreadCount(db)},
 		{Method: "POST", Path: "/api/notifications/{id}/read", Handler: handleMarkNotificationRead(db, hub)},
 		{Method: "POST", Path: "/api/notifications/read-all", Handler: handleMarkAllNotificationsRead(db, hub)},
+		{Method: "GET", Path: "/api/modules", Handler: handleListModules(db)},
+		{Method: "POST", Path: "/api/modules", Handler: handleCreateModule(db)},
+		{Method: "PATCH", Path: "/api/modules/{id}", Handler: handleUpdateModule(db)},
+		{Method: "DELETE", Path: "/api/modules/{id}", Handler: handleDeleteModule(db)},
+		{Method: "GET", Path: "/api/modules/{id}/logs", Handler: handleModuleLogs(db)},
+		{Method: "POST", Path: "/api/modules/{id}/test", Handler: handleTestModule(db, dispatcher)},
 	}
 }

@@ -69,7 +69,10 @@ func main() {
 	logger := newChatLogger(filepath.Join(wd, "chat.log"))
 	log.Printf("chat tool log: %s", logger.path)
 	hub := NewEventHub()
-	mux := infra.HTTPRouter(apiRoutes(db, wd, logger, internalToken, &featureFlags, hub))
+	dispatcher := NewDispatcher(db, hub)
+	dispatcher.Start()
+	defer dispatcher.Stop()
+	mux := infra.HTTPRouter(apiRoutes(db, wd, logger, internalToken, &featureFlags, hub, dispatcher))

 	feHandler := frontendHandler()
 	if feHandler != nil {
@@ -169,5 +172,28 @@ func frontendHandler() http.Handler {
 	if len(entries) == 0 {
 		return nil
 	}
-	return infra.SPAHandler(sub, "index.html")
+	return cacheHeadersMiddleware(infra.SPAHandler(sub, "index.html"))
+}
+
+// cacheHeadersMiddleware ensures the SPA shell is never cached while the
+// hashed assets (which are content-addressed by Vite) are cached for a long
+// time. Without this, browsers happily reuse an old index.html — pinned to a
+// stale /assets/index-<hash>.js URL — and never pick up new releases.
+//
+// Policy:
+//
+//	/assets/*  →  public, max-age=1y, immutable  (filename changes per build)
+//	everything else  →  no-store, must-revalidate (forces revalidation on every
+//	                    navigation so the latest hash is always discovered)
+func cacheHeadersMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasPrefix(r.URL.Path, "/assets/") {
+			w.Header().Set("Cache-Control", "public, max-age=31536000, immutable")
+		} else {
+			w.Header().Set("Cache-Control", "no-store, no-cache, must-revalidate")
+			w.Header().Set("Pragma", "no-cache")
+			w.Header().Set("Expires", "0")
+		}
+		next.ServeHTTP(w, r)
+	})
 }
@@ -0,0 +1,45 @@
+-- Outbound modules (integrations): kanban events → external systems.
+--
+-- A module is a configured subscription. The dispatcher (modules.go)
+-- subscribes to the EventHub and, for each event whose type matches the
+-- module's event_filter, calls the kind-specific handler with the
+-- decrypted config.
+--
+-- Tokens / secrets are encrypted with AES-GCM at rest. The key is derived
+-- from the KANBAN_MODULE_KEY environment variable (sha256 of the value).
+
+CREATE TABLE IF NOT EXISTS modules (
+    id            TEXT PRIMARY KEY,
+    name          TEXT NOT NULL,
+    kind          TEXT NOT NULL,           -- 'jira' | 'webhook' | …
+    enabled       INTEGER NOT NULL DEFAULT 1,
+    event_filter  TEXT NOT NULL,           -- comma-separated event types
+    config_cipher BLOB NOT NULL,           -- AES-GCM ciphertext of JSON
+    config_nonce  BLOB NOT NULL,
+    created_at    TEXT NOT NULL,
+    updated_at    TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS module_logs (
+    id          TEXT PRIMARY KEY,
+    module_id   TEXT NOT NULL,
+    event_type  TEXT NOT NULL,
+    card_id     TEXT,
+    status      INTEGER,                   -- HTTP status or 0 if pre-flight
+    duration_ms INTEGER,
+    error       TEXT,
+    created_at  TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_module_logs_module_created
+    ON module_logs(module_id, created_at DESC);
+
+-- jira_key: 1:1 link between a kanban card and its Jira issue. Empty
+-- string when the card has not yet been synced to Jira.
+ALTER TABLE cards ADD COLUMN jira_key TEXT NOT NULL DEFAULT '';
+
+-- is_admin: gates /api/modules access and the Modulos menu item.
+-- Bootstrap: egutierrez (the initial admin) is marked admin so the
+-- feature is reachable on first deploy. Other users start as non-admin.
+ALTER TABLE users ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0;
+UPDATE users SET is_admin = 1 WHERE username = 'egutierrez';
@@ -0,0 +1,725 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"database/sql"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+)
+
+// =============================================================================
+// Module model
+// =============================================================================
+
+type Module struct {
+	ID          string    `json:"id"`
+	Name        string    `json:"name"`
+	Kind        string    `json:"kind"`
+	Enabled     bool      `json:"enabled"`
+	EventFilter []string  `json:"event_filter"`
+	Config      JSONValue `json:"config"`
+	CreatedAt   string    `json:"created_at"`
+	UpdatedAt   string    `json:"updated_at"`
+}
+
+// JSONValue is an arbitrary JSON object decoded into a generic map. We do not
+// model per-kind config in Go types because the set of kinds grows over time
+// and the dispatcher only inspects fields it knows.
+type JSONValue map[string]interface{}
+
+type ModuleLog struct {
+	ID         string `json:"id"`
+	ModuleID   string `json:"module_id"`
+	EventType  string `json:"event_type"`
+	CardID     string `json:"card_id"`
+	Status     int    `json:"status"`
+	DurationMs int    `json:"duration_ms"`
+	Error      string `json:"error"`
+	CreatedAt  string `json:"created_at"`
+}
+
+// =============================================================================
+// DB helpers (modules + logs)
+// =============================================================================
+
+// listModulesEnabled returns all enabled modules with their config decrypted.
+// Disabled modules are silently skipped — callers iterate the result without
+// further filtering.
+func (db *DB) listModulesEnabled() ([]Module, error) {
+	return db.listModulesWhere("WHERE enabled = 1")
+}
+
+func (db *DB) listModulesAll() ([]Module, error) {
+	return db.listModulesWhere("")
+}
+
+func (db *DB) listModulesWhere(filter string) ([]Module, error) {
+	q := `SELECT id, name, kind, enabled, event_filter, config_cipher, config_nonce, created_at, updated_at FROM modules ` + filter + ` ORDER BY created_at`
+	rows, err := db.conn.Query(q)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := []Module{}
+	for rows.Next() {
+		var m Module
+		var enabled int
+		var filter, createdAt, updatedAt string
+		var cipherBlob, nonce []byte
+		if err := rows.Scan(&m.ID, &m.Name, &m.Kind, &enabled, &filter, &cipherBlob, &nonce, &createdAt, &updatedAt); err != nil {
+			return nil, err
+		}
+		m.Enabled = enabled == 1
+		m.EventFilter = splitCSV(filter)
+		m.CreatedAt = createdAt
+		m.UpdatedAt = updatedAt
+		cfg, err := decryptConfig(cipherBlob, nonce)
+		if err != nil {
+			// Surface the decrypt failure so the operator notices but
+			// avoid dropping the module from the list entirely.
+			log.Printf("module %s: decrypt config: %v", m.ID, err)
+			m.Config = JSONValue{"_decrypt_error": err.Error()}
+		} else {
+			_ = json.Unmarshal(cfg, &m.Config)
+		}
+		out = append(out, m)
+	}
+	return out, rows.Err()
+}
+
+func (db *DB) getModule(id string) (*Module, error) {
+	mods, err := db.listModulesWhere(`WHERE id = '` + escapeSQL(id) + `'`)
+	if err != nil || len(mods) == 0 {
+		if err == nil {
+			err = sql.ErrNoRows
+		}
+		return nil, err
+	}
+	return &mods[0], nil
+}
+
+func escapeSQL(s string) string {
+	return strings.ReplaceAll(s, "'", "''")
+}
+
+func (db *DB) saveModule(m *Module) error {
+	cfgJSON, err := json.Marshal(m.Config)
+	if err != nil {
+		return err
+	}
+	cipherBlob, nonce, err := encryptConfig(cfgJSON)
+	if err != nil {
+		return err
+	}
+	now := nowRFC3339()
+	if m.ID == "" {
+		m.ID = newID()
+		m.CreatedAt = now
+		m.UpdatedAt = now
+		_, err = db.conn.Exec(
+			`INSERT INTO modules (id, name, kind, enabled, event_filter, config_cipher, config_nonce, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+			m.ID, m.Name, m.Kind, boolInt(m.Enabled), strings.Join(m.EventFilter, ","),
+			cipherBlob, nonce, m.CreatedAt, m.UpdatedAt,
+		)
+		return err
+	}
+	m.UpdatedAt = now
+	_, err = db.conn.Exec(
+		`UPDATE modules SET name=?, kind=?, enabled=?, event_filter=?, config_cipher=?, config_nonce=?, updated_at=? WHERE id=?`,
+		m.Name, m.Kind, boolInt(m.Enabled), strings.Join(m.EventFilter, ","),
+		cipherBlob, nonce, m.UpdatedAt, m.ID,
+	)
+	return err
+}
+
+func (db *DB) deleteModule(id string) error {
+	_, err := db.conn.Exec(`DELETE FROM modules WHERE id=?`, id)
+	return err
+}
+
+func (db *DB) appendModuleLog(l ModuleLog) error {
+	if l.ID == "" {
+		l.ID = newID()
+	}
+	if l.CreatedAt == "" {
+		l.CreatedAt = nowRFC3339()
+	}
+	_, err := db.conn.Exec(
+		`INSERT INTO module_logs (id, module_id, event_type, card_id, status, duration_ms, error, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+		l.ID, l.ModuleID, l.EventType, l.CardID, l.Status, l.DurationMs, l.Error, l.CreatedAt,
+	)
+	return err
+}
+
+func (db *DB) listModuleLogs(moduleID string, limit int) ([]ModuleLog, error) {
+	if limit <= 0 {
+		limit = 100
+	}
+	rows, err := db.conn.Query(
+		`SELECT id, module_id, event_type, card_id, status, duration_ms, error, created_at
+		 FROM module_logs WHERE module_id = ? ORDER BY created_at DESC LIMIT ?`,
+		moduleID, limit,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := []ModuleLog{}
+	for rows.Next() {
+		var l ModuleLog
+		var cardID sql.NullString
+		if err := rows.Scan(&l.ID, &l.ModuleID, &l.EventType, &cardID, &l.Status, &l.DurationMs, &l.Error, &l.CreatedAt); err != nil {
+			return nil, err
+		}
+		if cardID.Valid {
+			l.CardID = cardID.String
+		}
+		out = append(out, l)
+	}
+	return out, rows.Err()
+}
+
+// setCardJiraKey stores the Jira issue key for a card after a successful
+// create call. We skip the regular UpdateCard path to avoid emitting a
+// `card.updated` event (which would loop us back through the dispatcher).
+func (db *DB) setCardJiraKey(cardID, jiraKey string) error {
+	_, err := db.conn.Exec(`UPDATE cards SET jira_key=? WHERE id=?`, jiraKey, cardID)
+	return err
+}
+
+func (db *DB) getCardForJira(cardID string) (*cardForJira, error) {
+	var c cardForJira
+	var assignee, deadline, jiraKey sql.NullString
+	var tagsJSON string
+	err := db.conn.QueryRow(
+		`SELECT c.id, c.title, c.description, c.requester, c.column_id, c.assignee_id,
+		        c.deadline, c.tags, c.jira_key, c.created_at, col.name
+		 FROM cards c JOIN columns col ON col.id = c.column_id WHERE c.id = ?`,
+		cardID,
+	).Scan(&c.ID, &c.Title, &c.Description, &c.Requester, &c.ColumnID, &assignee,
+		&deadline, &tagsJSON, &jiraKey, &c.CreatedAt, &c.ColumnName)
+	if err != nil {
+		return nil, err
+	}
+	if assignee.Valid {
+		c.AssigneeID = assignee.String
+	}
+	if deadline.Valid {
+		c.Deadline = deadline.String
+	}
+	if jiraKey.Valid {
+		c.JiraKey = jiraKey.String
+	}
+	_ = json.Unmarshal([]byte(tagsJSON), &c.Tags)
+	return &c, nil
+}
+
+type cardForJira struct {
+	ID          string
+	Title       string
+	Description string
+	Requester   string
+	ColumnID    string
+	ColumnName  string
+	AssigneeID  string
+	Deadline    string
+	Tags        []string
+	JiraKey     string
+	CreatedAt   string
+}
+
+func (c *cardForJira) hasTag(name string) bool {
+	name = strings.ToLower(name)
+	for _, t := range c.Tags {
+		if strings.ToLower(t) == name {
+			return true
+		}
+	}
+	return false
+}
+
+func splitCSV(s string) []string {
+	if s == "" {
+		return nil
+	}
+	parts := strings.Split(s, ",")
+	out := make([]string, 0, len(parts))
+	for _, p := range parts {
+		p = strings.TrimSpace(p)
+		if p != "" {
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+func boolInt(b bool) int {
+	if b {
+		return 1
+	}
+	return 0
+}
+
+// =============================================================================
+// Dispatcher
+// =============================================================================
+
+const (
+	moduleRetries       = 3
+	moduleRetryDelay1   = 1 * time.Second
+	moduleRetryDelay2   = 5 * time.Second
+	moduleRetryDelay3   = 30 * time.Second
+	moduleHTTPTimeout   = 15 * time.Second
+	moduleOptOutTag     = "nojira"
+	moduleDispatchQueue = 256
+)
+
+// Dispatcher fans events from the EventHub into per-module handlers.
+//
+// Lifecycle:
+//   - Start() spawns a single subscriber goroutine on the hub plus a
+//     bounded worker pool.
+//   - Stop() cancels the context and waits for in-flight requests to drain.
+//
+// Handlers receive a decrypted Module copy + the Event; they own the HTTP
+// call to the target system. The dispatcher logs every attempt.
+type Dispatcher struct {
+	db       *DB
+	hub      *EventHub
+	handlers map[string]Handler
+	queue    chan dispatchTask
+	ctx      context.Context
+	cancel   context.CancelFunc
+	enabled  bool
+}
+
+type dispatchTask struct {
+	module Module
+	event  Event
+}
+
+type Handler interface {
+	Handle(ctx context.Context, db *DB, m Module, ev Event) (status int, err error)
+	TestConnection(ctx context.Context, m Module) (status int, err error)
+}
+
+func NewDispatcher(db *DB, hub *EventHub) *Dispatcher {
+	_, hasKey := moduleKey()
+	return &Dispatcher{
+		db:       db,
+		hub:      hub,
+		handlers: map[string]Handler{"jira": &jiraHandler{}},
+		queue:    make(chan dispatchTask, moduleDispatchQueue),
+		enabled:  hasKey,
+	}
+}
+
+func (d *Dispatcher) Start() {
+	if !d.enabled {
+		log.Printf("module dispatcher disabled (%s not set)", moduleKeyEnv)
+		return
+	}
+	d.ctx, d.cancel = context.WithCancel(context.Background())
+	// Subscribe under a synthetic user so the hub treats us as a normal
+	// recipient of broadcast events. Private user-targeted events are
+	// uninteresting for outbound sync.
+	go d.run()
+	for i := 0; i < 4; i++ {
+		go d.worker(i)
+	}
+	log.Printf("module dispatcher started")
+}
+
+func (d *Dispatcher) Stop() {
+	if d.cancel != nil {
+		d.cancel()
+	}
+}
+
+func (d *Dispatcher) run() {
+	ch := d.hub.SubscribeUser("__module_dispatcher__")
+	defer d.hub.UnsubscribeUser("__module_dispatcher__", ch)
+	for {
+		select {
+		case <-d.ctx.Done():
+			return
+		case ev, ok := <-ch:
+			if !ok {
+				return
+			}
+			d.fanout(ev)
+		}
+	}
+}
+
+func (d *Dispatcher) fanout(ev Event) {
+	mods, err := d.db.listModulesEnabled()
+	if err != nil {
+		log.Printf("dispatcher: listModulesEnabled: %v", err)
+		return
+	}
+	for _, m := range mods {
+		if !filterMatches(m.EventFilter, ev.Type) {
+			continue
+		}
+		if !cutoffOK(d.db, m, ev) {
+			continue
+		}
+		if ev.CardID != "" {
+			c, err := d.db.getCardForJira(ev.CardID)
+			if err == nil && c.hasTag(moduleOptOutTag) {
+				continue
+			}
+		}
+		select {
+		case d.queue <- dispatchTask{module: m, event: ev}:
+		default:
+			log.Printf("dispatcher: queue full, dropping event %s for module %s", ev.Type, m.ID)
+		}
+	}
+}
+
+func (d *Dispatcher) worker(id int) {
+	for {
+		select {
+		case <-d.ctx.Done():
+			return
+		case task, ok := <-d.queue:
+			if !ok {
+				return
+			}
+			d.dispatch(task)
+		}
+	}
+}
+
+// dispatch runs the handler with up to moduleRetries attempts using a
+// fixed back-off schedule (1s, 5s, 30s). Each attempt creates a log row;
+// the final outcome is the one returned to the caller.
+func (d *Dispatcher) dispatch(t dispatchTask) {
+	h, ok := d.handlers[t.module.Kind]
+	if !ok {
+		_ = d.db.appendModuleLog(ModuleLog{
+			ModuleID: t.module.ID, EventType: t.event.Type, CardID: t.event.CardID,
+			Error: "unknown module kind: " + t.module.Kind,
+		})
+		return
+	}
+	delays := []time.Duration{0, moduleRetryDelay1, moduleRetryDelay2, moduleRetryDelay3}
+	for attempt := 0; attempt < moduleRetries; attempt++ {
+		if delays[attempt] > 0 {
+			select {
+			case <-d.ctx.Done():
+				return
+			case <-time.After(delays[attempt]):
+			}
+		}
+		ctx, cancel := context.WithTimeout(d.ctx, moduleHTTPTimeout)
+		start := time.Now()
+		status, err := h.Handle(ctx, d.db, t.module, t.event)
+		cancel()
+		ml := ModuleLog{
+			ModuleID: t.module.ID, EventType: t.event.Type, CardID: t.event.CardID,
+			Status: status, DurationMs: int(time.Since(start).Milliseconds()),
+		}
+		if err != nil {
+			ml.Error = err.Error()
+		}
+		_ = d.db.appendModuleLog(ml)
+		if err == nil {
+			return
+		}
+		// 4xx client errors are not worth retrying.
+		if status >= 400 && status < 500 {
+			return
+		}
+	}
+}
+
+// =============================================================================
+// Helpers
+// =============================================================================
+
+func filterMatches(filter []string, eventType string) bool {
+	for _, f := range filter {
+		if f == eventType || f == "*" {
+			return true
+		}
+	}
+	return false
+}
+
+// cutoffOK applies the "module only sees events posterior to its creation"
+// rule. Cards that were already linked to Jira (jira_key != "") are always
+// eligible regardless of timestamps.
+func cutoffOK(db *DB, m Module, ev Event) bool {
+	if ev.CardID == "" {
+		return true
+	}
+	c, err := db.getCardForJira(ev.CardID)
+	if err != nil {
+		return false
+	}
+	if c.JiraKey != "" {
+		return true
+	}
+	return c.CreatedAt >= m.CreatedAt
+}
+
+// =============================================================================
+// Jira handler
+// =============================================================================
+
+type jiraHandler struct{}
+
+type jiraConfig struct {
+	BaseURL    string            `json:"base_url"`
+	Email      string            `json:"email"`
+	APIToken   string            `json:"api_token"`
+	ProjectKey string            `json:"project_key"`
+	StatusMap  map[string]string `json:"status_map"`
+}
+
+func parseJiraConfig(m Module) (jiraConfig, error) {
+	b, err := json.Marshal(m.Config)
+	if err != nil {
+		return jiraConfig{}, err
+	}
+	var c jiraConfig
+	if err := json.Unmarshal(b, &c); err != nil {
+		return jiraConfig{}, err
+	}
+	c.BaseURL = strings.TrimRight(c.BaseURL, "/")
+	if c.BaseURL == "" {
+		return c, fmt.Errorf("base_url required")
+	}
+	return c, nil
+}
+
+func (h *jiraHandler) jiraRequest(ctx context.Context, c jiraConfig, method, path string, body interface{}) (int, []byte, error) {
+	var rdr io.Reader
+	if body != nil {
+		b, err := json.Marshal(body)
+		if err != nil {
+			return 0, nil, err
+		}
+		rdr = bytes.NewReader(b)
+	}
+	req, err := http.NewRequestWithContext(ctx, method, c.BaseURL+path, rdr)
+	if err != nil {
+		return 0, nil, err
+	}
+	req.Header.Set("Accept", "application/json")
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	if c.Email != "" && c.APIToken != "" {
+		basic := base64.StdEncoding.EncodeToString([]byte(c.Email + ":" + c.APIToken))
+		req.Header.Set("Authorization", "Basic "+basic)
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return 0, nil, err
+	}
+	defer resp.Body.Close()
+	respBody, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+	if resp.StatusCode >= 400 {
+		return resp.StatusCode, respBody, fmt.Errorf("jira %s %s: %d %s", method, path, resp.StatusCode, truncate(respBody, 240))
+	}
+	return resp.StatusCode, respBody, nil
+}
+
+func truncate(b []byte, n int) string {
+	if len(b) <= n {
+		return string(b)
+	}
+	return string(b[:n]) + "…"
+}
+
+func (h *jiraHandler) TestConnection(ctx context.Context, m Module) (int, error) {
+	c, err := parseJiraConfig(m)
+	if err != nil {
+		return 0, err
+	}
+	status, _, err := h.jiraRequest(ctx, c, http.MethodGet, "/rest/api/3/myself", nil)
+	return status, err
+}
+
+func (h *jiraHandler) Handle(ctx context.Context, db *DB, m Module, ev Event) (int, error) {
+	c, err := parseJiraConfig(m)
+	if err != nil {
+		return 0, err
+	}
+	switch ev.Type {
+	case "card.created":
+		return h.create(ctx, db, c, ev)
+	case "card.updated", "board.invalidated":
+		return h.update(ctx, db, c, ev)
+	case "card.moved":
+		return h.transition(ctx, db, c, ev)
+	case "message.created":
+		return h.comment(ctx, db, c, ev)
+	default:
+		// Silently ignore unhandled event types so the dispatcher does not
+		// retry on irrelevant traffic.
+		return 200, nil
+	}
+}
+
+func (h *jiraHandler) create(ctx context.Context, db *DB, c jiraConfig, ev Event) (int, error) {
+	if ev.CardID == "" {
+		return 0, nil
+	}
+	card, err := db.getCardForJira(ev.CardID)
+	if err != nil {
+		return 0, err
+	}
+	if card.JiraKey != "" {
+		// Idempotent: card already linked to Jira; treat as update.
+		return h.update(ctx, db, c, ev)
+	}
+	if c.ProjectKey == "" {
+		return 0, fmt.Errorf("project_key required for create")
+	}
+	body := map[string]interface{}{
+		"fields": map[string]interface{}{
+			"project":     map[string]string{"key": c.ProjectKey},
+			"summary":     card.Title,
+			"description": adfText(card.Description),
+			"issuetype":   map[string]string{"name": "Task"},
+		},
+	}
+	status, resp, err := h.jiraRequest(ctx, c, http.MethodPost, "/rest/api/3/issue", body)
+	if err != nil {
+		return status, err
+	}
+	var parsed struct {
+		Key string `json:"key"`
+	}
+	_ = json.Unmarshal(resp, &parsed)
+	if parsed.Key != "" {
+		if err := db.setCardJiraKey(card.ID, parsed.Key); err != nil {
+			return status, fmt.Errorf("link jira key: %w", err)
+		}
+	}
+	return status, nil
+}
+
+func (h *jiraHandler) update(ctx context.Context, db *DB, c jiraConfig, ev Event) (int, error) {
+	if ev.CardID == "" {
+		return 0, nil
+	}
+	card, err := db.getCardForJira(ev.CardID)
+	if err != nil {
+		return 0, err
+	}
+	if card.JiraKey == "" {
+		// Card not yet linked — bootstrap by creating it.
+		return h.create(ctx, db, c, ev)
+	}
+	body := map[string]interface{}{
+		"fields": map[string]interface{}{
+			"summary":     card.Title,
+			"description": adfText(card.Description),
+		},
+	}
+	status, _, err := h.jiraRequest(ctx, c, http.MethodPut, "/rest/api/3/issue/"+card.JiraKey, body)
+	return status, err
+}
+
+// transition uses the configured status_map to translate the kanban column
+// to a Jira transition name. We list available transitions, find the one
+// whose target status name matches, and POST it. Kanban remains the source
+// of truth even if Jira's current state differs.
+func (h *jiraHandler) transition(ctx context.Context, db *DB, c jiraConfig, ev Event) (int, error) {
+	if ev.CardID == "" {
+		return 0, nil
+	}
+	card, err := db.getCardForJira(ev.CardID)
+	if err != nil {
+		return 0, err
+	}
+	if card.JiraKey == "" {
+		return h.create(ctx, db, c, ev)
+	}
+	target, ok := c.StatusMap[card.ColumnName]
+	if !ok || target == "" {
+		return 0, fmt.Errorf("no status_map entry for column %q", card.ColumnName)
+	}
+	status, body, err := h.jiraRequest(ctx, c, http.MethodGet, "/rest/api/3/issue/"+card.JiraKey+"/transitions", nil)
+	if err != nil {
+		return status, err
+	}
+	var available struct {
+		Transitions []struct {
+			ID   string `json:"id"`
+			Name string `json:"name"`
+			To   struct {
+				Name string `json:"name"`
+			} `json:"to"`
+		} `json:"transitions"`
+	}
+	if err := json.Unmarshal(body, &available); err != nil {
+		return status, fmt.Errorf("decode transitions: %w", err)
+	}
+	var tID string
+	for _, t := range available.Transitions {
+		if strings.EqualFold(t.To.Name, target) || strings.EqualFold(t.Name, target) {
+			tID = t.ID
+			break
+		}
+	}
+	if tID == "" {
+		return 0, fmt.Errorf("transition %q not available for %s", target, card.JiraKey)
+	}
+	req := map[string]interface{}{"transition": map[string]string{"id": tID}}
+	status, _, err = h.jiraRequest(ctx, c, http.MethodPost, "/rest/api/3/issue/"+card.JiraKey+"/transitions", req)
+	return status, err
+}
+
+func (h *jiraHandler) comment(ctx context.Context, db *DB, c jiraConfig, ev Event) (int, error) {
+	if ev.CardID == "" {
+		return 0, nil
+	}
+	card, err := db.getCardForJira(ev.CardID)
+	if err != nil {
+		return 0, err
+	}
+	if card.JiraKey == "" {
+		// Cannot comment on a card not yet synced; skip.
+		return 0, nil
+	}
+	var payload struct {
+		Body string `json:"body"`
+	}
+	_ = json.Unmarshal(ev.Payload, &payload)
+	if payload.Body == "" {
+		return 0, nil
+	}
+	body := map[string]interface{}{"body": adfText(payload.Body)}
+	status, _, err := h.jiraRequest(ctx, c, http.MethodPost, "/rest/api/3/issue/"+card.JiraKey+"/comment", body)
+	return status, err
+}
+
+// adfText wraps a plain string into the minimal Atlassian Document Format
+// fragment Jira Cloud requires for description / comment bodies.
+func adfText(s string) map[string]interface{} {
+	return map[string]interface{}{
+		"type":    "doc",
+		"version": 1,
+		"content": []map[string]interface{}{{
+			"type": "paragraph",
+			"content": []map[string]interface{}{{
+				"type": "text",
+				"text": s,
+			}},
+		}},
+	}
+}
@@ -0,0 +1,68 @@
+package main
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/sha256"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+)
+
+const moduleKeyEnv = "KANBAN_MODULE_KEY"
+
+// moduleKey derives a 32-byte AES key from the KANBAN_MODULE_KEY env var.
+// Returns (key, true) when present; (zero, false) when missing — callers
+// must treat that as "module dispatcher disabled".
+func moduleKey() ([32]byte, bool) {
+	v := os.Getenv(moduleKeyEnv)
+	if v == "" {
+		return [32]byte{}, false
+	}
+	return sha256.Sum256([]byte(v)), true
+}
+
+// encryptConfig encrypts a JSON config blob with AES-GCM. Returns the
+// ciphertext and the 12-byte nonce. Caller persists both columns.
+func encryptConfig(plain []byte) (cipherOut, nonce []byte, err error) {
+	key, ok := moduleKey()
+	if !ok {
+		return nil, nil, fmt.Errorf("%s not set; cannot encrypt module config", moduleKeyEnv)
+	}
+	block, err := aes.NewCipher(key[:])
+	if err != nil {
+		return nil, nil, err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, nil, err
+	}
+	nonce = make([]byte, gcm.NonceSize())
+	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+		return nil, nil, err
+	}
+	cipherOut = gcm.Seal(nil, nonce, plain, nil)
+	return cipherOut, nonce, nil
+}
+
+// decryptConfig is the inverse of encryptConfig.
+func decryptConfig(cipherIn, nonce []byte) ([]byte, error) {
+	key, ok := moduleKey()
+	if !ok {
+		return nil, fmt.Errorf("%s not set; cannot decrypt module config", moduleKeyEnv)
+	}
+	if len(nonce) == 0 {
+		return nil, errors.New("nonce empty")
+	}
+	block, err := aes.NewCipher(key[:])
+	if err != nil {
+		return nil, err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+	return gcm.Open(nil, nonce, cipherIn, nil)
+}
@@ -0,0 +1,226 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"fn-registry/functions/infra"
+)
+
+// requireAdmin gates a handler so only users with users.is_admin = 1 can
+// reach it. Non-admins get a 403. Anonymous callers get a 401.
+func requireAdmin(db *DB, next http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		uid, _ := infra.UserIDFromContext(r.Context(), userCtxKey)
+		if uid == "" {
+			infra.HTTPErrorResponse(w, infra.HTTPError{Status: http.StatusUnauthorized, Code: "unauthorized", Message: "session required"})
+			return
+		}
+		ok, err := db.IsAdmin(uid)
+		if err != nil {
+			serverError(w, err)
+			return
+		}
+		if !ok {
+			infra.HTTPErrorResponse(w, infra.HTTPError{Status: http.StatusForbidden, Code: "forbidden", Message: "admin required"})
+			return
+		}
+		next(w, r)
+	}
+}
+
+// publicModule strips secrets out of the config before responding. The
+// API token is never returned to the client after it has been stored.
+func publicModule(m Module) Module {
+	clone := m
+	if clone.Config != nil {
+		cleaned := JSONValue{}
+		for k, v := range clone.Config {
+			if strings.Contains(strings.ToLower(k), "token") || strings.Contains(strings.ToLower(k), "password") || strings.Contains(strings.ToLower(k), "secret") {
+				cleaned[k] = "***"
+			} else {
+				cleaned[k] = v
+			}
+		}
+		clone.Config = cleaned
+	}
+	return clone
+}
+
+func handleListModules(db *DB) http.HandlerFunc {
+	return requireAdmin(db, func(w http.ResponseWriter, r *http.Request) {
+		mods, err := db.listModulesAll()
+		if err != nil {
+			serverError(w, err)
+			return
+		}
+		out := make([]Module, 0, len(mods))
+		for _, m := range mods {
+			out = append(out, publicModule(m))
+		}
+		infra.HTTPJSONResponse(w, http.StatusOK, out)
+	})
+}
+
+type modulePayload struct {
+	Name        string    `json:"name"`
+	Kind        string    `json:"kind"`
+	Enabled     bool      `json:"enabled"`
+	EventFilter []string  `json:"event_filter"`
+	Config      JSONValue `json:"config"`
+}
+
+func handleCreateModule(db *DB) http.HandlerFunc {
+	return requireAdmin(db, func(w http.ResponseWriter, r *http.Request) {
+		var body modulePayload
+		if err := infra.HTTPParseBody(r, &body, maxBodyBytes); err != nil {
+			badRequest(w, err.Error())
+			return
+		}
+		if body.Name == "" || body.Kind == "" {
+			badRequest(w, "name and kind required")
+			return
+		}
+		m := &Module{
+			Name: body.Name, Kind: body.Kind, Enabled: body.Enabled,
+			EventFilter: body.EventFilter, Config: body.Config,
+		}
+		if err := db.saveModule(m); err != nil {
+			serverError(w, err)
+			return
+		}
+		infra.HTTPJSONResponse(w, http.StatusCreated, publicModule(*m))
+	})
+}
+
+func handleUpdateModule(db *DB) http.HandlerFunc {
+	return requireAdmin(db, func(w http.ResponseWriter, r *http.Request) {
+		id := r.PathValue("id")
+		existing, err := db.getModule(id)
+		if err != nil {
+			notFound(w, "module not found")
+			return
+		}
+		// Partial body: preserve fields the client did not include. We rely
+		// on a generic map to detect omitted vs explicit-null because PATCH
+		// callers do not always send the full record.
+		var raw map[string]json.RawMessage
+		if err := infra.HTTPParseBody(r, &raw, maxBodyBytes); err != nil {
+			badRequest(w, err.Error())
+			return
+		}
+		decode := func(key string, into interface{}) {
+			if v, ok := raw[key]; ok {
+				_ = json.Unmarshal(v, into)
+			}
+		}
+		decode("name", &existing.Name)
+		decode("kind", &existing.Kind)
+		decode("enabled", &existing.Enabled)
+		if v, ok := raw["event_filter"]; ok {
+			_ = json.Unmarshal(v, &existing.EventFilter)
+		}
+		if v, ok := raw["config"]; ok {
+			var cfg JSONValue
+			_ = json.Unmarshal(v, &cfg)
+			// Re-inject masked fields the UI left as "***" so a partial
+			// edit does not nuke stored secrets.
+			merged := JSONValue{}
+			for k, val := range existing.Config {
+				merged[k] = val
+			}
+			for k, val := range cfg {
+				if s, isStr := val.(string); isStr && s == "***" {
+					continue
+				}
+				merged[k] = val
+			}
+			existing.Config = merged
+		}
+		if err := db.saveModule(existing); err != nil {
+			serverError(w, err)
+			return
+		}
+		infra.HTTPJSONResponse(w, http.StatusOK, publicModule(*existing))
+	})
+}
+
+func handleDeleteModule(db *DB) http.HandlerFunc {
+	return requireAdmin(db, func(w http.ResponseWriter, r *http.Request) {
+		id := r.PathValue("id")
+		if err := db.deleteModule(id); err != nil {
+			serverError(w, err)
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	})
+}
+
+func handleModuleLogs(db *DB) http.HandlerFunc {
+	return requireAdmin(db, func(w http.ResponseWriter, r *http.Request) {
+		id := r.PathValue("id")
+		limit := 100
+		if v := r.URL.Query().Get("limit"); v != "" {
+			if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 1000 {
+				limit = n
+			}
+		}
+		out, err := db.listModuleLogs(id, limit)
+		if err != nil {
+			serverError(w, err)
+			return
+		}
+		infra.HTTPJSONResponse(w, http.StatusOK, out)
+	})
+}
+
+// handleTestModule executes the kind-specific test_connection probe with
+// the *current stored config* (or with an incoming config payload, for
+// pre-save validation). Returns {ok, status, error} regardless of outcome
+// so the UI can show a useful message.
+func handleTestModule(db *DB, dispatcher *Dispatcher) http.HandlerFunc {
+	return requireAdmin(db, func(w http.ResponseWriter, r *http.Request) {
+		id := r.PathValue("id")
+		var m *Module
+		if id == "draft" {
+			// Pre-save test path: caller supplies a full module payload.
+			var body modulePayload
+			if err := infra.HTTPParseBody(r, &body, maxBodyBytes); err != nil {
+				badRequest(w, err.Error())
+				return
+			}
+			m = &Module{Kind: body.Kind, Config: body.Config}
+		} else {
+			got, err := db.getModule(id)
+			if err != nil {
+				notFound(w, "module not found")
+				return
+			}
+			m = got
+		}
+		h, ok := dispatcher.handlers[m.Kind]
+		if !ok {
+			infra.HTTPJSONResponse(w, http.StatusOK, map[string]interface{}{
+				"ok": false, "status": 0, "error": "unknown kind: " + m.Kind,
+			})
+			return
+		}
+		ctx, cancel := context.WithTimeout(r.Context(), moduleHTTPTimeout)
+		defer cancel()
+		start := time.Now()
+		status, err := h.TestConnection(ctx, *m)
+		resp := map[string]interface{}{
+			"ok":          err == nil,
+			"status":      status,
+			"duration_ms": int(time.Since(start).Milliseconds()),
+		}
+		if err != nil {
+			resp["error"] = err.Error()
+		}
+		infra.HTTPJSONResponse(w, http.StatusOK, resp)
+	})
+}
@@ -0,0 +1,227 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+	"time"
+)
+
+// withModuleKey sets KANBAN_MODULE_KEY for the duration of a test and
+// restores the previous value afterwards.
+func withModuleKey(t *testing.T, value string) {
+	t.Helper()
+	prev := os.Getenv(moduleKeyEnv)
+	t.Setenv(moduleKeyEnv, value)
+	t.Cleanup(func() { _ = os.Setenv(moduleKeyEnv, prev) })
+}
+
+func TestCryptoRoundTrip(t *testing.T) {
+	withModuleKey(t, "test-passphrase")
+	plain := []byte(`{"hello":"world"}`)
+	cipherBlob, nonce, err := encryptConfig(plain)
+	if err != nil {
+		t.Fatalf("encrypt: %v", err)
+	}
+	got, err := decryptConfig(cipherBlob, nonce)
+	if err != nil {
+		t.Fatalf("decrypt: %v", err)
+	}
+	if string(got) != string(plain) {
+		t.Fatalf("roundtrip mismatch: got %q want %q", got, plain)
+	}
+}
+
+func TestCryptoMissingKey(t *testing.T) {
+	t.Setenv(moduleKeyEnv, "")
+	if _, _, err := encryptConfig([]byte("x")); err == nil {
+		t.Fatal("expected error when KANBAN_MODULE_KEY unset")
+	}
+}
+
+func TestSaveAndLoadModule(t *testing.T) {
+	withModuleKey(t, "test-passphrase")
+	db := setupTestDB(t)
+	m := &Module{
+		Name: "jira-test", Kind: "jira", Enabled: true,
+		EventFilter: []string{"card.created", "card.moved"},
+		Config: JSONValue{
+			"base_url": "https://example.atlassian.net",
+			"email":    "x@y.z",
+			"api_token": "secret-123",
+		},
+	}
+	if err := db.saveModule(m); err != nil {
+		t.Fatalf("save: %v", err)
+	}
+	if m.ID == "" {
+		t.Fatal("ID not assigned on insert")
+	}
+	got, err := db.getModule(m.ID)
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	if got.Config["api_token"] != "secret-123" {
+		t.Fatalf("token roundtrip failed: %v", got.Config["api_token"])
+	}
+}
+
+func TestFilterMatches(t *testing.T) {
+	if !filterMatches([]string{"card.created"}, "card.created") {
+		t.Fatal("exact match")
+	}
+	if !filterMatches([]string{"*"}, "anything") {
+		t.Fatal("wildcard")
+	}
+	if filterMatches([]string{"card.created"}, "card.moved") {
+		t.Fatal("non-match should be false")
+	}
+}
+
+func TestCardOptOutTag(t *testing.T) {
+	c := cardForJira{Tags: []string{"foo", "NoJira", "bar"}}
+	if !c.hasTag("nojira") {
+		t.Fatal("nojira (case-insensitive) not detected")
+	}
+	if c.hasTag("missing") {
+		t.Fatal("missing tag returned true")
+	}
+}
+
+func TestJiraHandler_TransitionMappingMissing(t *testing.T) {
+	withModuleKey(t, "k")
+	db := setupTestDB(t)
+	col, _ := db.CreateColumn("Backlog")
+	card, _ := db.CreateCard(col.ID, "req", "t", "d", "")
+	// Link the card so the create-fallback path is skipped.
+	_ = db.setCardJiraKey(card.ID, "KAN-1")
+	h := &jiraHandler{}
+	_, err := h.transition(context.Background(), db, jiraConfig{BaseURL: "http://x"}, Event{Type: "card.moved", CardID: card.ID})
+	if err == nil || !strings.Contains(err.Error(), "status_map") {
+		t.Fatalf("expected status_map error, got %v", err)
+	}
+}
+
+func TestJiraHandler_TestConnectionHitsMyself(t *testing.T) {
+	var path string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		path = r.URL.Path
+		w.WriteHeader(http.StatusOK)
+		_, _ = io.WriteString(w, `{"accountId":"abc"}`)
+	}))
+	defer srv.Close()
+	h := &jiraHandler{}
+	m := Module{Kind: "jira", Config: JSONValue{
+		"base_url":  srv.URL,
+		"email":     "x@y.z",
+		"api_token": "tok",
+	}}
+	status, err := h.TestConnection(context.Background(), m)
+	if err != nil {
+		t.Fatalf("TestConnection: %v", err)
+	}
+	if status != 200 {
+		t.Fatalf("status = %d, want 200", status)
+	}
+	if path != "/rest/api/3/myself" {
+		t.Fatalf("path = %q, want /rest/api/3/myself", path)
+	}
+}
+
+func TestJiraHandler_CreateLinksCardKey(t *testing.T) {
+	withModuleKey(t, "test-passphrase")
+	db := setupTestDB(t)
+	user, _ := db.CreateUser("alice", "passw", "Alice")
+	col, _ := db.CreateColumn("Todo")
+	card, _ := db.CreateCard(col.ID, "req", "Buy bread", "desc", user.ID)
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodPost && r.URL.Path == "/rest/api/3/issue" {
+			b, _ := io.ReadAll(r.Body)
+			var p struct {
+				Fields struct {
+					Summary string `json:"summary"`
+				} `json:"fields"`
+			}
+			_ = json.Unmarshal(b, &p)
+			if p.Fields.Summary != "Buy bread" {
+				t.Errorf("summary = %q", p.Fields.Summary)
+			}
+			w.WriteHeader(http.StatusCreated)
+			_, _ = io.WriteString(w, `{"id":"10000","key":"KAN-1"}`)
+			return
+		}
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer srv.Close()
+
+	h := &jiraHandler{}
+	mod := Module{Kind: "jira", Config: JSONValue{
+		"base_url":    srv.URL,
+		"email":       "x@y.z",
+		"api_token":   "tok",
+		"project_key": "KAN",
+		"status_map":  map[string]interface{}{"Todo": "To Do"},
+	}}
+	status, err := h.Handle(context.Background(), db, mod, Event{Type: "card.created", CardID: card.ID})
+	if err != nil {
+		t.Fatalf("Handle: %v", err)
+	}
+	if status != http.StatusCreated {
+		t.Fatalf("status = %d, want 201", status)
+	}
+	again, err := db.getCardForJira(card.ID)
+	if err != nil {
+		t.Fatalf("get card: %v", err)
+	}
+	if again.JiraKey != "KAN-1" {
+		t.Fatalf("jira_key = %q, want KAN-1", again.JiraKey)
+	}
+}
+
+func TestDispatcher_Cutoff(t *testing.T) {
+	withModuleKey(t, "k")
+	db := setupTestDB(t)
+	col, _ := db.CreateColumn("Todo")
+	// Create card BEFORE the module so cutoffOK rejects it.
+	card, _ := db.CreateCard(col.ID, "req", "t", "d", "")
+	time.Sleep(20 * time.Millisecond)
+	mod := Module{ID: "m", CreatedAt: nowRFC3339()}
+	if cutoffOK(db, mod, Event{CardID: card.ID}) {
+		t.Fatal("card pre-dating module should be filtered out")
+	}
+	// Once linked, cutoff should allow it.
+	_ = db.setCardJiraKey(card.ID, "KAN-9")
+	if !cutoffOK(db, mod, Event{CardID: card.ID}) {
+		t.Fatal("linked card must pass cutoff even if older")
+	}
+}
+
+func TestIsAdmin(t *testing.T) {
+	db := setupTestDB(t)
+	u, _ := db.CreateUser("egutierrez", "passw", "Egu")
+	// Migration 015 marks egutierrez admin via UPDATE WHERE username, but
+	// that only takes effect when the row already exists. In production
+	// the migration runs against an existing user list; in tests we create
+	// users after migration, so simulate the same outcome explicitly.
+	if _, err := db.conn.Exec(`UPDATE users SET is_admin = 1 WHERE username = ?`, "egutierrez"); err != nil {
+		t.Fatalf("seed admin: %v", err)
+	}
+	ok, err := db.IsAdmin(u.ID)
+	if err != nil {
+		t.Fatalf("IsAdmin: %v", err)
+	}
+	if !ok {
+		t.Fatal("egutierrez must be admin after seed")
+	}
+	other, _ := db.CreateUser("alice", "passw", "Alice")
+	ok, _ = db.IsAdmin(other.ID)
+	if ok {
+		t.Fatal("alice must not be admin by default")
+	}
+}
@@ -14,6 +14,7 @@ type User struct {
 	Username    string `json:"username"`
 	DisplayName string `json:"display_name"`
 	Color       string `json:"color"`
+	IsAdmin     bool   `json:"is_admin"`
 	CreatedAt   string `json:"created_at"`
 }

@@ -51,36 +52,52 @@ func (db *DB) CreateUser(username, password, displayName string) (*User, error)

 func (db *DB) GetUserByID(id string) (*User, error) {
 	var u User
+	var isAdmin int
 	err := db.conn.QueryRow(
-		`SELECT id, username, display_name, color, created_at FROM users WHERE id=?`, id,
-	).Scan(&u.ID, &u.Username, &u.DisplayName, &u.Color, &u.CreatedAt)
+		`SELECT id, username, display_name, color, is_admin, created_at FROM users WHERE id=?`, id,
+	).Scan(&u.ID, &u.Username, &u.DisplayName, &u.Color, &isAdmin, &u.CreatedAt)
 	if errors.Is(err, sql.ErrNoRows) {
 		return nil, errUserNotFound
 	}
 	if err != nil {
 		return nil, err
 	}
+	u.IsAdmin = isAdmin == 1
 	return &u, nil
 }

+func (db *DB) IsAdmin(userID string) (bool, error) {
+	if userID == "" {
+		return false, nil
+	}
+	var n int
+	err := db.conn.QueryRow(`SELECT COALESCE(is_admin, 0) FROM users WHERE id=?`, userID).Scan(&n)
+	if errors.Is(err, sql.ErrNoRows) {
+		return false, nil
+	}
+	return n == 1, err
+}
+
 func (db *DB) GetUserByUsername(username string) (*User, string, error) {
 	username = strings.TrimSpace(strings.ToLower(username))
 	var u User
 	var hash string
+	var isAdmin int
 	err := db.conn.QueryRow(
-		`SELECT id, username, display_name, color, created_at, password_hash FROM users WHERE username=?`, username,
-	).Scan(&u.ID, &u.Username, &u.DisplayName, &u.Color, &u.CreatedAt, &hash)
+		`SELECT id, username, display_name, color, is_admin, created_at, password_hash FROM users WHERE username=?`, username,
+	).Scan(&u.ID, &u.Username, &u.DisplayName, &u.Color, &isAdmin, &u.CreatedAt, &hash)
 	if errors.Is(err, sql.ErrNoRows) {
 		return nil, "", errUserNotFound
 	}
 	if err != nil {
 		return nil, "", err
 	}
+	u.IsAdmin = isAdmin == 1
 	return &u, hash, nil
 }

 func (db *DB) ListUsers() ([]User, error) {
-	rows, err := db.conn.Query(`SELECT id, username, display_name, color, created_at FROM users ORDER BY username`)
+	rows, err := db.conn.Query(`SELECT id, username, display_name, color, is_admin, created_at FROM users ORDER BY username`)
 	if err != nil {
 		return nil, err
 	}
@@ -88,9 +105,11 @@ func (db *DB) ListUsers() ([]User, error) {
 	out := []User{}
 	for rows.Next() {
 		var u User
-		if err := rows.Scan(&u.ID, &u.Username, &u.DisplayName, &u.Color, &u.CreatedAt); err != nil {
+		var isAdmin int
+		if err := rows.Scan(&u.ID, &u.Username, &u.DisplayName, &u.Color, &isAdmin, &u.CreatedAt); err != nil {
 			return nil, err
 		}
+		u.IsAdmin = isAdmin == 1
 		out = append(out, u)
 	}
 	return out, rows.Err()
@@ -0,0 +1,248 @@
+#!/usr/bin/env bash
+# Kanban control TUI — gestiona backend (WSL) + frontend Vite (Windows) desde WSL.
+# Lanzamientos fire-and-forget; status panel auto-refresca cada 2s.
+# Lanzar: ./control.sh
+set -u
+
+BACKEND_PORT=8095
+FRONTEND_PORT=5180
+APP_DIR="/home/egutierrez/fn_registry/apps/kanban"
+BACKEND_LOG="/tmp/kanban.log"
+BUILD_LOG="/tmp/kanban_build.log"
+MSG_FILE="/tmp/kanban_control.msg"
+WIN_FRONT_DIR='C:\Users\egutierrez\fn_apps\kanban\frontend'
+
+RED=$'\033[31m'; GRN=$'\033[32m'; YLW=$'\033[33m'; CYN=$'\033[36m'; BLD=$'\033[1m'; RST=$'\033[0m'
+
+msg() { printf '%s\n' "$*" > "$MSG_FILE"; }
+
+wsl_pid_on_port() {
+    local port=$1
+    ss -ltnp 2>/dev/null | awk -v p=":$port\$" '$4 ~ p {print $0}' \
+        | grep -oP 'pid=\K[0-9]+' | head -1
+}
+
+win_pid_on_port() {
+    local port=$1
+    netstat.exe -ano 2>/dev/null | tr -d '\r' \
+        | awk -v p=":$port\$" '$2 ~ p && $4 == "LISTENING" {print $5; exit}'
+}
+
+backend_building() {
+    [[ -f /tmp/kanban_build.pid ]] && kill -0 "$(cat /tmp/kanban_build.pid 2>/dev/null)" 2>/dev/null
+}
+
+# Build + launch en background — retorna inmediatamente
+start_backend() {
+    if [[ -n $(wsl_pid_on_port "$BACKEND_PORT") ]]; then
+        msg "${YLW}backend ya corriendo${RST}"; return 0
+    fi
+    if backend_building; then
+        msg "${YLW}backend ya esta compilando, espera${RST}"; return 0
+    fi
+    local version
+    version=$(awk -F': ' '/^version:/ {print $2; exit}' "$APP_DIR/app.md" 2>/dev/null || echo dev)
+    msg "${CYN}lanzando backend en background (version=$version)...${RST}"
+    (
+        cd "$APP_DIR/backend" || exit 1
+        # Rebuild si: binario no existe, .go/.sql mas nuevos, app.md mas nuevo (bump de version)
+        if [[ ! -x kanban ]] \
+           || [[ -n $(find . -maxdepth 3 \( -name '*.go' -o -name '*.sql' \) -newer kanban 2>/dev/null) ]] \
+           || [[ "$APP_DIR/app.md" -nt kanban ]]; then
+            CGO_ENABLED=1 go build -tags fts5 \
+                -ldflags="-X main.Version=$version" \
+                -o kanban . > "$BUILD_LOG" 2>&1 || {
+                printf 'build failed — ver %s\n' "$BUILD_LOG" > "$MSG_FILE"
+                exit 1
+            }
+        fi
+        cd "$APP_DIR" || exit 1
+        KANBAN_CLAUDE_BIN=/home/egutierrez/.local/bin/claude \
+            setsid nohup ./backend/kanban --port "$BACKEND_PORT" --db ./operations.db \
+            > "$BACKEND_LOG" 2>&1 < /dev/null &
+        disown
+    ) &
+    echo $! > /tmp/kanban_build.pid
+    disown
+}
+
+stop_backend() {
+    local pid
+    pid=$(wsl_pid_on_port "$BACKEND_PORT")
+    if [[ -z $pid ]]; then
+        msg "${YLW}backend ya parado${RST}"; return 0
+    fi
+    kill "$pid" 2>/dev/null
+    ( sleep 1; kill -0 "$pid" 2>/dev/null && kill -9 "$pid" 2>/dev/null ) &
+    disown
+    msg "${GRN}backend stopped (pid $pid)${RST}"
+}
+
+wsl_ip() { hostname -I | awk '{print $1}'; }
+
+# WSL frontend → Windows frontend (excluye node_modules, dist, .vite)
+sync_frontend() {
+    local src="$APP_DIR/frontend/"
+    local dst="/mnt/c/Users/egutierrez/fn_apps/kanban/frontend/"
+    if [[ ! -d $dst ]]; then
+        msg "${RED}no existe $dst${RST}"; return 1
+    fi
+    rsync -a --delete \
+        --exclude node_modules --exclude dist --exclude .vite \
+        --exclude .cache --exclude tsconfig.tsbuildinfo \
+        "$src" "$dst" 2>&1 | tail -3
+    # pnpm install si package.json cambio
+    if ! cmp -s "$src/package.json" "$dst/package.json" 2>/dev/null \
+       || [[ ! -d "$dst/node_modules" ]]; then
+        msg "${CYN}deps cambiaron, lanza pnpm install en Windows...${RST}"
+        cmd.exe /c start "" cmd /c "cd /d $WIN_FRONT_DIR && pnpm install" >/dev/null 2>&1 &
+        disown
+    fi
+}
+
+# Lanza ventana cmd Windows con pnpm dev — no bloquea
+# Inyecta VITE_API_TARGET con IP WSL real porque localhost forwarding Win→WSL no es fiable
+start_vite() {
+    if [[ -n $(win_pid_on_port "$FRONTEND_PORT") ]]; then
+        msg "${YLW}vite ya corriendo${RST}"; return 0
+    fi
+    sync_frontend
+    local ip target
+    ip=$(wsl_ip)
+    target="http://${ip}:${BACKEND_PORT}"
+    cmd.exe /c start "" cmd /c "cd /d $WIN_FRONT_DIR && set VITE_API_TARGET=$target && pnpm dev --port $FRONTEND_PORT --strictPort --host" >/dev/null 2>&1 &
+    disown
+    msg "${CYN}vite lanzado, proxy → $target${RST}"
+}
+
+stop_vite() {
+    local pid
+    pid=$(win_pid_on_port "$FRONTEND_PORT")
+    if [[ -z $pid ]]; then
+        msg "${YLW}vite ya parado${RST}"; return 0
+    fi
+    taskkill.exe /F /T /PID "$pid" >/dev/null 2>&1 &
+    disown
+    msg "${GRN}taskkill enviado a vite pid $pid${RST}"
+}
+
+kill_stale() {
+    local found=0 out=""
+    for pid in $(pgrep -f "backend/kanban --port" 2>/dev/null); do
+        local cmdl
+        cmdl=$(tr '\0' ' ' < /proc/$pid/cmdline 2>/dev/null)
+        if ! grep -q -- "--port $BACKEND_PORT" <<<"$cmdl"; then
+            kill -9 "$pid" 2>/dev/null
+            out+="killed wsl pid $pid ($cmdl); "
+            found=1
+        fi
+    done
+    [[ $found -eq 0 ]] && msg "${GRN}sin huerfanos WSL${RST}" || msg "${GRN}${out}${RST}"
+}
+
+_prev_frame=""
+build_frame() {
+    local bpid vpid hc others
+    bpid=$(wsl_pid_on_port "$BACKEND_PORT")
+    vpid=$(win_pid_on_port "$FRONTEND_PORT")
+    local out=""
+    out+=$(printf '%s=== Kanban control ===%s' "$BLD" "$RST")$'\n\n'
+    if [[ -n $bpid ]]; then
+        local rv av
+        rv=$(curl -s -m 1 "http://127.0.0.1:$BACKEND_PORT/api/version" | grep -oP '"version":"\K[^"]+' || echo "?")
+        av=$(awk -F': ' '/^version:/ {print $2; exit}' "$APP_DIR/app.md" 2>/dev/null || echo "?")
+        if [[ "$rv" == "$av" ]]; then
+            hc="${GRN}v$rv${RST}"
+        else
+            hc="${YLW}running=v$rv app.md=v$av (rebuild)${RST}"
+        fi
+        out+=$(printf '  backend (WSL :%s)   %sUP%s   pid %s   %s' \
+            "$BACKEND_PORT" "$GRN" "$RST" "$bpid" "$hc")$'\n'
+    elif backend_building; then
+        out+=$(printf '  backend (WSL :%s)   %sBUILDING/STARTING%s   tail %s' \
+            "$BACKEND_PORT" "$YLW" "$RST" "$BUILD_LOG")$'\n'
+    else
+        out+=$(printf '  backend (WSL :%s)   %sDOWN%s' "$BACKEND_PORT" "$RED" "$RST")$'\n'
+    fi
+    # frontend version + drift WSL↔Win
+    local fv drift
+    fv=$(grep -oP '"version":\s*"\K[^"]+' "$APP_DIR/frontend/package.json" 2>/dev/null || echo "?")
+    drift=$(diff -rq "$APP_DIR/frontend/src" "/mnt/c/Users/egutierrez/fn_apps/kanban/frontend/src" 2>/dev/null \
+        | grep -c -E "^(Files|Only)" || true)
+    local dlbl
+    if [[ ${drift:-0} -eq 0 ]]; then
+        dlbl="${GRN}sync${RST}"
+    else
+        dlbl="${YLW}drift=$drift (sync al start)${RST}"
+    fi
+    if [[ -n $vpid ]]; then
+        out+=$(printf '  vite    (WIN :%s)  %sUP%s   pid %s   v%s   %s' "$FRONTEND_PORT" "$GRN" "$RST" "$vpid" "$fv" "$dlbl")$'\n'
+    else
+        out+=$(printf '  vite    (WIN :%s)  %sDOWN%s   v%s   %s' "$FRONTEND_PORT" "$RED" "$RST" "$fv" "$dlbl")$'\n'
+    fi
+    others=$(pgrep -af "backend/kanban --port" 2>/dev/null | grep -v -- "--port $BACKEND_PORT" || true)
+    if [[ -n $others ]]; then
+        out+=$(printf '  %sOTROS kanban backends WSL:%s' "$YLW" "$RST")$'\n'
+        out+=$(echo "$others" | sed 's/^/    /')$'\n'
+    fi
+    out+=$'\n'
+    out+=$(printf '%sUltimo evento:%s %s' "$CYN" "$RST" "$(tail -1 "$MSG_FILE" 2>/dev/null || echo '-')")$'\n\n'
+    out+="${BLD}Acciones${RST} (auto-refresh 2s, tecla suelta):"$'\n'
+    out+="  1) Start backend             5) Start TODO"$'\n'
+    out+="  2) Stop backend              6) Stop TODO"$'\n'
+    out+="  3) Start vite                7) Mata kanban huerfanos"$'\n'
+    out+="  4) Stop vite                 8) Tail backend log"$'\n'
+    out+="                               9) Refrescar     0) Salir"$'\n'
+    out+="> "
+    printf '%s' "$out"
+}
+
+draw_status() {
+    local frame
+    frame=$(build_frame)
+    if [[ $frame == "$_prev_frame" ]]; then
+        return 0
+    fi
+    _prev_frame=$frame
+    # cursor home + frame + erase-to-end-of-display (limpia lineas residuales)
+    printf '\033[H%s\033[J' "$frame"
+}
+
+tail_log() {
+    clear
+    printf '%stail -f %s (Ctrl-C vuelve al menu)%s\n' "$CYN" "$BACKEND_LOG" "$RST"
+    trap 'trap - INT; return 0' INT
+    tail -f "$BACKEND_LOG" 2>/dev/null
+    trap - INT
+}
+
+menu() {
+    : > "$MSG_FILE"
+    # limpia pantalla una sola vez; redraw posterior usa cursor-home
+    printf '\033[2J\033[H'
+    trap 'printf "\033[?25h\n"; exit 0' EXIT INT TERM
+    printf '\033[?25l'  # oculta cursor mientras dibujamos
+    while true; do
+        draw_status
+        # read con timeout 2s — refresco automatico si no hay tecla
+        local choice=""
+        if read -rsn1 -t 2 choice; then
+            case "$choice" in
+                1) start_backend ;;
+                2) stop_backend ;;
+                3) start_vite ;;
+                4) stop_vite ;;
+                5) start_backend; start_vite ;;
+                6) stop_vite; stop_backend ;;
+                7) kill_stale ;;
+                8) printf '\033[?25h'; tail_log; printf '\033[?25l'; _prev_frame=""; printf '\033[2J\033[H' ;;
+                9) : ;;
+                0|q|Q) printf '\033[?25h'; clear; exit 0 ;;
+                $'\n'|"") : ;;
+                *) msg "${RED}opcion invalida: $choice${RST}" ;;
+            esac
+        fi
+    done
+}
+
+menu
@@ -17,7 +17,7 @@ set -uo pipefail

 BACKEND="${BACKEND:-http://127.0.0.1:8095}"
 PROXY="${PROXY:-http://127.0.0.1:5180}"
-EXPECTED_VERSION="${EXPECTED_VERSION:-0.2.0}"
+EXPECTED_VERSION="${EXPECTED_VERSION:-0.3.0}"

 fail() { echo "FAIL: $*" >&2; exit 1; }
 ok()   { echo "OK   $*"; }
@@ -72,5 +72,20 @@ code=$(curl -sS -o /dev/null -w '%{http_code}' -m 5 \
 [[ "$code" != "404" ]] || ok "card chat ws path resolved ($code)"
 ok "card chat WS route present (status $code)"

+# 7. /api/modules — admin gated (401 unauthenticated).
+code=$(curl -sS -o /dev/null -w '%{http_code}' -m 5 "$BACKEND/api/modules")
+[[ "$code" == "401" ]] || fail "/api/modules returned $code, want 401"
+ok "modules CRUD gated 401"
+
+# 8. /api/modules/__nope__/test — exists (401 anonymous).
+code=$(curl -sS -o /dev/null -w '%{http_code}' -m 5 -X POST "$BACKEND/api/modules/__nope__/test")
+[[ "$code" == "401" ]] || fail "module test returned $code, want 401"
+ok "modules test endpoint present"
+
+# 9. bundle ships modules UI.
+for needle in "/modules" "/modules/__draft__/test" "ModulesModal" "is_admin" "jira"; do
+    grep -q "$needle" "$js_tmp" && ok "bundle has '$needle'" || true
+done
+
 echo
-echo "PASS — kanban $EXPECTED_VERSION serving notifications/streaming UI"
+echo "PASS — kanban $EXPECTED_VERSION serving notifications + streaming + modules UI"
@@ -55,6 +55,7 @@ import {
  IconChevronRight,
  IconLayoutKanban,
  IconLogout,
+  IconPlug,
  IconMenu2,
  IconMessageChatbot,
  IconMoodSmile,
@@ -82,6 +83,7 @@ import { ColorPickerGrid, CustomColorModal } from "./components/ColorPickerGrid"
 import { AVATAR_COLORS } from "./components/colors";
 import { colorBg, colorBorder } from "./components/colors";
 import { NotificationsBell } from "./components/NotificationsBell";
+import { ModulesModal } from "./components/ModulesModal";
 import { useEventStream } from "./hooks/useEventStream";
 import type { Board, Card, CardColor, Column, ColumnLocation, Notification, User } from "./types";

@@ -341,6 +343,8 @@ export function App() {
      .catch(() => setAppVersion(""));
  }, []);

+  const [modulesOpen, setModulesOpen] = useState(false);
+
  const reloadNotifs = useCallback(async () => {
    try {
      const [list, c] = await Promise.all([api.listNotifications(false), api.unreadNotificationCount()]);
@@ -719,7 +723,7 @@ export function App() {
    });
  }, [reload, users, auth.user, requesterOptions, tagOptions]);

-  const openEditCard = useCallback((card: Card) => {
+  const openEditCard = useCallback((card: Card, options?: { highlightMessageId?: string }) => {
    const id = modals.open({
      title: "Editar tarjeta",
      size: "85%",
@@ -730,6 +734,7 @@ export function App() {
          currentUserId={auth.user?.id}
          requesterOptions={requesterOptions}
          tagOptions={tagOptions}
+          highlightMessageId={options?.highlightMessageId}
          onCancel={() => modals.close(id)}
          onSubmit={async (v) => {
            try {
@@ -1178,17 +1183,30 @@ export function App() {
                <NotificationsBell
                  unreadCount={notifUnread}
                  notifications={notifs}
-                  onOpenCard={async (cardId) => {
-                    const card = board?.cards.find((c) => c.id === cardId);
-                    if (card) {
-                      setActiveCard(card);
-                    } else {
-                      // Card may be archived/trashed/missing locally — refetch and retry.
+                  onOpenCard={async (cardId, messageId) => {
+                    // Resolve the card across all possible buckets: live
+                    // board, refreshed board, archive, trash. Notifications
+                    // can point at any of them.
+                    const find = (cs?: Card[]) => cs?.find((c) => c.id === cardId);
+                    let card = find(board?.cards);
+                    if (!card) {
                      await reload();
-                      const b = await api.getBoard();
-                      const c2 = b.cards.find((c) => c.id === cardId);
-                      if (c2) setActiveCard(c2);
+                      const fresh = await api.getBoard();
+                      card = find(fresh.cards);
                    }
+                    if (!card) {
+                      const archived = await api.listArchive();
+                      card = find(archived);
+                    }
+                    if (!card) {
+                      const trashed = await api.listTrash();
+                      card = find(trashed);
+                    }
+                    if (!card) {
+                      notifications.show({ color: "red", message: "Card no encontrada" });
+                      return;
+                    }
+                    openEditCard(card, { highlightMessageId: messageId });
                  }}
                  onChanged={reloadNotifs}
                />
@@ -1240,6 +1258,14 @@ export function App() {
                      />
                    </Box>
                    <Menu.Divider />
+                    {auth.user.is_admin && (
+                      <Menu.Item
+                        leftSection={<IconPlug size={14} />}
+                        onClick={() => setModulesOpen(true)}
+                      >
+                        Modulos
+                      </Menu.Item>
+                    )}
                    <Menu.Item
                      leftSection={<IconLogout size={14} />}
                      color="red"
@@ -1250,6 +1276,9 @@ export function App() {
                  </Menu.Dropdown>
                </Menu>
              )}
+              {auth.user?.is_admin && (
+                <ModulesModal opened={modulesOpen} onClose={() => setModulesOpen(false)} />
+              )}
            </Group>
          </Group>
        </AppShell.Header>
@@ -4,8 +4,11 @@ import type {
  CardHistoryResponse,
  CardMessage,
  Column,
+  KanbanModule,
  Metrics,
  MetricsFilter,
+  ModuleLog,
+  ModuleTestResult,
  Notification,
  Sticker,
  User,
@@ -317,6 +320,40 @@ export function markAllNotificationsRead(): Promise<{ count: number }> {
  return fetchJSON("/notifications/read-all", { method: "POST" });
 }

+export function listModules(): Promise<KanbanModule[]> {
+  return fetchJSON("/modules");
+}
+
+export interface ModuleInput {
+  name: string;
+  kind: string;
+  enabled: boolean;
+  event_filter: string[];
+  config: Record<string, unknown>;
+}
+
+export function createModule(body: ModuleInput): Promise<KanbanModule> {
+  return fetchJSON("/modules", { method: "POST", body: JSON.stringify(body) });
+}
+
+export function updateModule(id: string, patch: Partial<ModuleInput>): Promise<KanbanModule> {
+  return fetchJSON(`/modules/${id}`, { method: "PATCH", body: JSON.stringify(patch) });
+}
+
+export function deleteModule(id: string): Promise<void> {
+  return fetchJSON(`/modules/${id}`, { method: "DELETE" });
+}
+
+export function listModuleLogs(id: string, limit = 100): Promise<ModuleLog[]> {
+  return fetchJSON(`/modules/${id}/logs?limit=${limit}`);
+}
+
+export function testModule(idOrDraft: string, body?: ModuleInput): Promise<ModuleTestResult> {
+  const init: RequestInit = { method: "POST" };
+  if (body) init.body = JSON.stringify(body);
+  return fetchJSON(`/modules/${idOrDraft}/test`, init);
+}
+
 // streamChat opens a WebSocket, sends the message history, and streams events
 // to onEvent. Returns a Promise that resolves when the server closes the
 // connection (after a "done" event) and rejects on transport errors.
@@ -35,6 +35,9 @@ interface Props {
  users: User[];
  currentUserId?: string;
  onMessagesChange?: (messages: CardMessage[]) => void;
+  // When set, the panel scrolls the matching message into view and flashes a
+  // brief highlight (~2s). Used by notification click → open card.
+  highlightMessageId?: string;
 }

 // Window for considering a peer "actively typing" after its last event.
@@ -98,7 +101,7 @@ function renderBody(body: string, knownUsers: Map<string, User>): ReactNode {
  return out;
 }

-export function CardChatPanel({ cardId, users, currentUserId, onMessagesChange }: Props) {
+export function CardChatPanel({ cardId, users, currentUserId, onMessagesChange, highlightMessageId }: Props) {
  const [messages, setMessages] = useState<CardMessage[]>([]);
  const [loading, setLoading] = useState(true);
  const [body, setBody] = useState("");
@@ -185,6 +188,22 @@ export function CardChatPanel({ cardId, users, currentUserId, onMessagesChange }
    }
  }, [messages.length]);

+  // Scroll to + briefly pulse the message that triggered an incoming
+  // notification. Runs whenever the highlight id changes AND the message
+  // is present in the list (it may arrive asynchronously after WS sync).
+  const [pulse, setPulse] = useState<string | null>(null);
+  useEffect(() => {
+    if (!highlightMessageId) return;
+    if (!messages.some((m) => m.id === highlightMessageId)) return;
+    const el = document.querySelector(`[data-msg-id="${highlightMessageId}"]`);
+    if (el && el instanceof HTMLElement) {
+      el.scrollIntoView({ behavior: "smooth", block: "center" });
+    }
+    setPulse(highlightMessageId);
+    const t = setTimeout(() => setPulse(null), 2200);
+    return () => clearTimeout(t);
+  }, [highlightMessageId, messages]);
+
  const sendTypingPing = () => {
    const ws = wsRef.current;
    if (!ws || ws.readyState !== WebSocket.OPEN) return;
@@ -319,13 +338,25 @@ export function CardChatPanel({ cardId, users, currentUserId, onMessagesChange }
              const author = m.author_id ? usersById.get(m.author_id) : null;
              const isMe = m.author_id && m.author_id === currentUserId;
              const label = author ? author.display_name || author.username : "Anonimo";
+              const highlighted = pulse === m.id;
              return (
                <Paper
                  key={m.id}
                  withBorder
                  p="xs"
                  radius="sm"
-                  bg={isMe ? "var(--mantine-color-blue-light)" : undefined}
+                  data-msg-id={m.id}
+                  bg={
+                    highlighted
+                      ? "var(--mantine-color-yellow-light)"
+                      : isMe
+                      ? "var(--mantine-color-blue-light)"
+                      : undefined
+                  }
+                  style={{
+                    transition: "background-color 600ms ease",
+                    boxShadow: highlighted ? "0 0 0 2px var(--mantine-color-yellow-5)" : undefined,
+                  }}
                >
                  <Group gap={6} wrap="nowrap" align="flex-start">
                    <Avatar size={22} radius="xl" color={author?.color || tagColor(label)}>
@@ -14,6 +14,9 @@ interface Props {
  tagOptions: string[];
  onSubmit: (v: CardFormValues) => Promise<void> | void;
  onCancel: () => void;
+  // When set, the chat panel auto-scrolls to this message id and pulses
+  // it briefly. Used when opening a card from a notification click.
+  highlightMessageId?: string;
 }

 export function CardEditPanel({
@@ -24,6 +27,7 @@ export function CardEditPanel({
  tagOptions,
  onSubmit,
  onCancel,
+  highlightMessageId,
 }: Props) {
  const [messages, setMessages] = useState<CardMessage[]>([]);
  const [liveCard, setLiveCard] = useState(card);
@@ -68,6 +72,7 @@ export function CardEditPanel({
                  users={users}
                  currentUserId={currentUserId}
                  onMessagesChange={setMessages}
+                  highlightMessageId={highlightMessageId}
                />
              </Box>
            </Tabs.Panel>
@@ -0,0 +1,441 @@
+import {
+  ActionIcon,
+  Alert,
+  Badge,
+  Box,
+  Button,
+  Checkbox,
+  Code,
+  Divider,
+  Group,
+  JsonInput,
+  Loader,
+  Modal,
+  ScrollArea,
+  Select,
+  Stack,
+  Table,
+  Tabs,
+  Text,
+  TextInput,
+  Tooltip,
+} from "@mantine/core";
+import { notifications } from "@mantine/notifications";
+import { IconPlug, IconPlugConnected, IconRefresh, IconTestPipe, IconTrash } from "@tabler/icons-react";
+import { useCallback, useEffect, useMemo, useState } from "react";
+import * as api from "../api";
+import type { KanbanModule, ModuleLog } from "../types";
+import { formatDateTimeShort } from "./format";
+
+interface Props {
+  opened: boolean;
+  onClose: () => void;
+}
+
+const KANBAN_EVENTS = [
+  "card.created",
+  "card.updated",
+  "card.moved",
+  "card.deleted",
+  "message.created",
+  "board.invalidated",
+];
+
+const DEFAULT_JIRA_CONFIG = {
+  base_url: "",
+  email: "",
+  api_token: "",
+  project_key: "",
+  status_map: {
+    "Por hacer": "To Do",
+    "Doing": "In Progress",
+    "Done": "Done",
+  },
+};
+
+export function ModulesModal({ opened, onClose }: Props) {
+  const [modules, setModules] = useState<KanbanModule[]>([]);
+  const [loading, setLoading] = useState(false);
+  const [selectedId, setSelectedId] = useState<string | null>(null);
+  const [editing, setEditing] = useState<KanbanModule | null>(null);
+  const [logs, setLogs] = useState<ModuleLog[]>([]);
+  const [logsLoading, setLogsLoading] = useState(false);
+  const [activeTab, setActiveTab] = useState<string | null>("form");
+
+  const reload = useCallback(async () => {
+    setLoading(true);
+    try {
+      const list = await api.listModules();
+      setModules(list);
+    } catch (e) {
+      notifications.show({ color: "red", message: (e as Error).message });
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    if (opened) reload();
+  }, [opened, reload]);
+
+  const reloadLogs = useCallback(async (id: string) => {
+    setLogsLoading(true);
+    try {
+      const out = await api.listModuleLogs(id);
+      setLogs(out);
+    } catch (e) {
+      notifications.show({ color: "red", message: (e as Error).message });
+    } finally {
+      setLogsLoading(false);
+    }
+  }, []);
+
+  const select = (m: KanbanModule | null) => {
+    setEditing(m ? { ...m, config: { ...m.config } } : null);
+    setSelectedId(m?.id ?? null);
+    setActiveTab("form");
+    setLogs([]);
+    if (m) reloadLogs(m.id);
+  };
+
+  const startNew = () => {
+    const blank: KanbanModule = {
+      id: "",
+      name: "Nuevo modulo",
+      kind: "jira",
+      enabled: false,
+      event_filter: ["card.created", "card.updated", "card.moved", "message.created"],
+      config: { ...DEFAULT_JIRA_CONFIG, status_map: { ...DEFAULT_JIRA_CONFIG.status_map } },
+      created_at: "",
+      updated_at: "",
+    };
+    setEditing(blank);
+    setSelectedId(null);
+    setActiveTab("form");
+    setLogs([]);
+  };
+
+  const save = async () => {
+    if (!editing) return;
+    try {
+      const payload = {
+        name: editing.name,
+        kind: editing.kind,
+        enabled: editing.enabled,
+        event_filter: editing.event_filter,
+        config: editing.config,
+      };
+      const saved = editing.id
+        ? await api.updateModule(editing.id, payload)
+        : await api.createModule(payload);
+      notifications.show({ color: "green", message: "Modulo guardado" });
+      await reload();
+      select(saved);
+    } catch (e) {
+      notifications.show({ color: "red", message: (e as Error).message });
+    }
+  };
+
+  const remove = async () => {
+    if (!selectedId) return;
+    if (!confirm("Borrar modulo?")) return;
+    try {
+      await api.deleteModule(selectedId);
+      notifications.show({ color: "green", message: "Modulo borrado" });
+      setEditing(null);
+      setSelectedId(null);
+      reload();
+    } catch (e) {
+      notifications.show({ color: "red", message: (e as Error).message });
+    }
+  };
+
+  const test = async () => {
+    if (!editing) return;
+    try {
+      const result = editing.id
+        ? await api.testModule(editing.id)
+        : await api.testModule("draft", {
+            name: editing.name,
+            kind: editing.kind,
+            enabled: editing.enabled,
+            event_filter: editing.event_filter,
+            config: editing.config,
+          });
+      if (result.ok) {
+        notifications.show({
+          color: "green",
+          title: `Test OK (${result.status})`,
+          message: `Conexion verificada en ${result.duration_ms}ms`,
+        });
+      } else {
+        notifications.show({
+          color: "red",
+          title: `Test fallo (${result.status})`,
+          message: result.error || "sin detalle",
+        });
+      }
+    } catch (e) {
+      notifications.show({ color: "red", message: (e as Error).message });
+    }
+  };
+
+  return (
+    <Modal
+      opened={opened}
+      onClose={onClose}
+      title={
+        <Group gap={8}>
+          <IconPlug size={18} />
+          <Text fw={600}>Modulos / Integraciones</Text>
+        </Group>
+      }
+      size="xl"
+      centered
+    >
+      <Group align="flex-start" gap="md" wrap="nowrap">
+        <Box style={{ width: 220, minWidth: 220 }}>
+          <Group justify="space-between" mb={6}>
+            <Text size="xs" c="dimmed">Configurados</Text>
+            <Tooltip label="Refrescar" withArrow>
+              <ActionIcon size="sm" variant="subtle" onClick={reload}>
+                <IconRefresh size={14} />
+              </ActionIcon>
+            </Tooltip>
+          </Group>
+          <ScrollArea h={400} type="auto">
+            <Stack gap={4}>
+              {loading && <Loader size="xs" />}
+              {modules.map((m) => (
+                <Box
+                  key={m.id}
+                  p="xs"
+                  style={{
+                    cursor: "pointer",
+                    border: "1px solid var(--mantine-color-gray-3)",
+                    borderRadius: 4,
+                    background:
+                      selectedId === m.id ? "var(--mantine-color-blue-light)" : undefined,
+                  }}
+                  onClick={() => select(m)}
+                >
+                  <Group justify="space-between" gap={4} wrap="nowrap">
+                    <Text size="sm" fw={600} truncate>
+                      {m.name}
+                    </Text>
+                    <Badge size="xs" color={m.enabled ? "green" : "gray"}>
+                      {m.enabled ? "on" : "off"}
+                    </Badge>
+                  </Group>
+                  <Text size="xs" c="dimmed">{m.kind}</Text>
+                </Box>
+              ))}
+              <Button size="xs" variant="light" onClick={startNew} mt="xs">
+                + Nuevo
+              </Button>
+            </Stack>
+          </ScrollArea>
+        </Box>
+
+        <Divider orientation="vertical" />
+
+        <Box style={{ flex: 1, minWidth: 0 }}>
+          {!editing ? (
+            <Alert color="gray">Selecciona un modulo o pulsa "Nuevo".</Alert>
+          ) : (
+            <Tabs value={activeTab} onChange={setActiveTab}>
+              <Tabs.List>
+                <Tabs.Tab value="form">Configuracion</Tabs.Tab>
+                <Tabs.Tab value="logs">Logs</Tabs.Tab>
+              </Tabs.List>
+
+              <Tabs.Panel value="form" pt="xs">
+                <Stack gap="xs">
+                  <Group gap="xs">
+                    <TextInput
+                      label="Nombre"
+                      value={editing.name}
+                      onChange={(e) => setEditing({ ...editing, name: e.currentTarget.value })}
+                      style={{ flex: 1 }}
+                    />
+                    <Select
+                      label="Kind"
+                      value={editing.kind}
+                      onChange={(v) => setEditing({ ...editing, kind: v || "jira" })}
+                      data={[{ value: "jira", label: "Jira" }]}
+                      w={140}
+                    />
+                  </Group>
+                  <Checkbox
+                    label="Activo"
+                    checked={editing.enabled}
+                    onChange={(e) => setEditing({ ...editing, enabled: e.currentTarget.checked })}
+                  />
+                  <Box>
+                    <Text size="xs" fw={600} mb={4}>Eventos</Text>
+                    <Group gap="xs">
+                      {KANBAN_EVENTS.map((ev) => (
+                        <Checkbox
+                          key={ev}
+                          label={<Code>{ev}</Code>}
+                          checked={editing.event_filter.includes(ev)}
+                          onChange={(e) => {
+                            const next = e.currentTarget.checked
+                              ? [...editing.event_filter, ev]
+                              : editing.event_filter.filter((x) => x !== ev);
+                            setEditing({ ...editing, event_filter: next });
+                          }}
+                        />
+                      ))}
+                    </Group>
+                  </Box>
+                  <JiraConfigEditor editing={editing} setEditing={setEditing} />
+                  <Group gap="xs">
+                    <Button onClick={save} leftSection={<IconPlugConnected size={14} />}>
+                      Guardar
+                    </Button>
+                    <Button variant="default" onClick={test} leftSection={<IconTestPipe size={14} />}>
+                      Probar conexion
+                    </Button>
+                    {selectedId && (
+                      <Button
+                        color="red"
+                        variant="subtle"
+                        onClick={remove}
+                        leftSection={<IconTrash size={14} />}
+                        ml="auto"
+                      >
+                        Borrar
+                      </Button>
+                    )}
+                  </Group>
+                </Stack>
+              </Tabs.Panel>
+
+              <Tabs.Panel value="logs" pt="xs">
+                <Group justify="space-between" mb={6}>
+                  <Text size="xs" c="dimmed">Ultimas 100 entradas</Text>
+                  <ActionIcon
+                    size="sm"
+                    variant="subtle"
+                    onClick={() => selectedId && reloadLogs(selectedId)}
+                  >
+                    <IconRefresh size={14} />
+                  </ActionIcon>
+                </Group>
+                {logsLoading ? (
+                  <Loader size="sm" />
+                ) : logs.length === 0 ? (
+                  <Text size="sm" c="dimmed">Sin entradas.</Text>
+                ) : (
+                  <ScrollArea h={400}>
+                    <Table withTableBorder striped highlightOnHover stickyHeader>
+                      <Table.Thead>
+                        <Table.Tr>
+                          <Table.Th>Hora</Table.Th>
+                          <Table.Th>Evento</Table.Th>
+                          <Table.Th>HTTP</Table.Th>
+                          <Table.Th>ms</Table.Th>
+                          <Table.Th>Error</Table.Th>
+                        </Table.Tr>
+                      </Table.Thead>
+                      <Table.Tbody>
+                        {logs.map((l) => (
+                          <Table.Tr key={l.id}>
+                            <Table.Td>{formatDateTimeShort(l.created_at)}</Table.Td>
+                            <Table.Td><Code>{l.event_type}</Code></Table.Td>
+                            <Table.Td>
+                              <Badge color={l.status >= 400 || l.error ? "red" : "green"} size="sm">
+                                {l.status || "-"}
+                              </Badge>
+                            </Table.Td>
+                            <Table.Td>{l.duration_ms}</Table.Td>
+                            <Table.Td>
+                              <Text size="xs" c="red" lineClamp={2}>{l.error}</Text>
+                            </Table.Td>
+                          </Table.Tr>
+                        ))}
+                      </Table.Tbody>
+                    </Table>
+                  </ScrollArea>
+                )}
+              </Tabs.Panel>
+            </Tabs>
+          )}
+        </Box>
+      </Group>
+    </Modal>
+  );
+}
+
+interface JiraConfigEditorProps {
+  editing: KanbanModule;
+  setEditing: (m: KanbanModule) => void;
+}
+
+function JiraConfigEditor({ editing, setEditing }: JiraConfigEditorProps) {
+  const cfg = editing.config as Record<string, unknown>;
+  const set = (key: string, value: unknown) =>
+    setEditing({ ...editing, config: { ...cfg, [key]: value } });
+
+  const statusMapText = useMemo(() => {
+    return JSON.stringify(cfg.status_map ?? {}, null, 2);
+  }, [cfg.status_map]);
+
+  if (editing.kind !== "jira") {
+    return (
+      <Alert color="yellow" mt="xs">
+        Editor especifico para esta kind aun no implementado.
+      </Alert>
+    );
+  }
+
+  return (
+    <Stack gap="xs">
+      <TextInput
+        label="Base URL"
+        placeholder="https://acme.atlassian.net"
+        value={(cfg.base_url as string) || ""}
+        onChange={(e) => set("base_url", e.currentTarget.value)}
+      />
+      <Group gap="xs">
+        <TextInput
+          label="Email"
+          value={(cfg.email as string) || ""}
+          onChange={(e) => set("email", e.currentTarget.value)}
+          style={{ flex: 1 }}
+        />
+        <TextInput
+          label="API token"
+          placeholder={editing.id ? "*** (deja vacio para conservar)" : ""}
+          value={(cfg.api_token as string) || ""}
+          onChange={(e) => set("api_token", e.currentTarget.value)}
+          style={{ flex: 1 }}
+        />
+      </Group>
+      <TextInput
+        label="Project key"
+        placeholder="KAN"
+        value={(cfg.project_key as string) || ""}
+        onChange={(e) => set("project_key", e.currentTarget.value)}
+      />
+      <JsonInput
+        label="Status map (columna kanban → transicion Jira)"
+        description='{"Doing":"In Progress","Done":"Done"}'
+        value={statusMapText}
+        autosize
+        minRows={3}
+        validationError="JSON invalido"
+        onChange={(v) => {
+          try {
+            const parsed = JSON.parse(v);
+            set("status_map", parsed);
+          } catch {
+            // Hold invalid input in textarea via raw state; final save will
+            // reuse last valid parse.
+          }
+        }}
+      />
+    </Stack>
+  );
+}
@@ -25,7 +25,9 @@ interface Props {
  unreadCount?: number;
  notifications?: Notification[];
  // Called when the user clicks a notification → open the relevant card.
-  onOpenCard?: (cardId: string) => void;
+  // messageId points to the chat message that triggered the notification so
+  // the parent can scroll to it.
+  onOpenCard?: (cardId: string, messageId: string) => void;
  // Called whenever the bell mutates state (mark read / mark all) so the
  // parent can refresh its cached lists.
  onChanged?: () => void;
@@ -101,7 +103,7 @@ export function NotificationsBell({ unreadCount: extCount, notifications: extLis
      }
    }
    setOpened(false);
-    onOpenCard?.(n.card_id);
+    onOpenCard?.(n.card_id, n.message_id);
  };

  const handleMarkAll = async () => {
@@ -51,9 +51,41 @@ export interface User {
  username: string;
  display_name: string;
  color: string;
+  is_admin?: boolean;
  created_at: string;
 }

+export type ModuleKind = "jira" | "webhook";
+
+export interface KanbanModule {
+  id: string;
+  name: string;
+  kind: ModuleKind | string;
+  enabled: boolean;
+  event_filter: string[];
+  config: Record<string, unknown>;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface ModuleLog {
+  id: string;
+  module_id: string;
+  event_type: string;
+  card_id: string;
+  status: number;
+  duration_ms: number;
+  error: string;
+  created_at: string;
+}
+
+export interface ModuleTestResult {
+  ok: boolean;
+  status: number;
+  duration_ms: number;
+  error?: string;
+}
+
 export interface MetricsRange {
  from: string;
  to: string;
@@ -13,7 +13,7 @@ export default defineConfig({
    port: 5180,
    proxy: {
      "/api": {
-        target: "http://localhost:8095",
+        target: process.env.VITE_API_TARGET || "http://127.0.0.1:8095",
        ws: true,
        changeOrigin: true,
      },
@@ -42,6 +42,10 @@ if [[ ! -d "$FRONT_DIR/node_modules" ]]; then
 fi

 # 3. Lanzar backend
+# KANBAN_MODULE_KEY: passphrase used to AES-GCM encrypt module config_json.
+# A stable default keeps the dev loop ergonomic; in production set this via
+# the host's secret store. Changing it invalidates previously stored modules.
+export KANBAN_MODULE_KEY="${KANBAN_MODULE_KEY:-local-dev-secret-rotate-in-prod}"
 echo ">>> Backend  http://localhost:$PORT_BACK  (db=$DB_PATH)"
 (cd "$BACK_DIR" && ./kanban --port "$PORT_BACK" --db "$DB_PATH") &
 BACK_PID=$!