perf(board): load pages incrementally and patch live changes

.github/workflows/publish-mcp.yml

@@ -18,7 +18,8 @@ concurrency:
 
 jobs:
   publish:
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    # npm provenance and trusted publishing require a GitHub-hosted runner.
+    runs-on: ubuntu-24.04
     if: ${{ github.event_name == 'push' || startsWith(github.event.release.tag_name, 'mcp-v') }}
     permissions:
       # gh release create needs contents: write; npm publish --provenance needs id-token: write.
@@ -27,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: useblacksmith/checkout@25227e61ff9dafe400e22fa487b673eac4e4409a # v1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           fetch-depth: 0

.github/workflows/publish-planka-import.yml

@@ -18,12 +18,13 @@ concurrency:
 
 jobs:
   publish:
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    # npm provenance and trusted publishing require a GitHub-hosted runner.
+    runs-on: ubuntu-24.04
     if: ${{ github.event_name == 'push' || startsWith(github.event.release.tag_name, 'planka-import-v') }}
 
     steps:
       - name: Checkout repository
-        uses: useblacksmith/checkout@25227e61ff9dafe400e22fa487b673eac4e4409a # v1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           fetch-depth: 0

AGENTS.md

@@ -9,6 +9,7 @@ Treat this guide as a set of defaults. The developer's request takes precedence.
 ## What matters
 
 - Keep routine work simple. Solve the user's problem with the smallest model that makes the behavior clear. Read the relevant code first, but do not keep complexity just because it is already there.
+- Keep modules small. Across the whole repo, give each file one responsibility: one component per file, and pure helpers and types in their own modules next to the code that uses them, with tests beside them. When a file grows a second concern, split it into a folder. Do not extract one-line wrappers; inline those.
 - Keep boards fast. Task-heavy views and realtime updates should not move or render more data than they need.
 - Keep self-hosting easy. A single instance must work without Redis or another managed service. Support both bundled same-origin and separately hosted API and web deployments.
 - Respect workspace boundaries. The API enforces authentication and permissions; a hidden UI control is not an authorization check. Never leak secrets or private workspace data through responses, logs, events, WebSockets, or MCP.

CHANGELOG.md

@@ -1,5 +1,27 @@
 ### Features
 
+- clickable task PR list, task link matching, and reopen completed tasks for new work: #1864
+- **mcp:** get tasks by ticket ID: #1839
+
+### Bug Fixes
+
+- **ci:** publish npm provenance on GitHub-hosted runners: [50779a4](https://github.com/usekaneo/kaneo/commit/50779a4e21159ad322dc4dd18fa7f1689bee64fa)
+- **ci:** pass the GitHub token to AgentScan: #1862
+- **ci:** resolve nightly warnings and errors: #1858
+- **api:** make legacy MCP HTTP requests replica independent: #1850
+- **docker:** disable wget proxy for loopback health checks: #1841
+
+### Documentation
+
+- add AI Policy badge to README: [011c8ee](https://github.com/usekaneo/kaneo/commit/011c8ee731cc684644d8bf568f4a5f74e194878c)
+- update sponsors: [e45c8ac](https://github.com/usekaneo/kaneo/commit/e45c8aceed5da9bcc040a592be9677c79133aecd)
+
+### Credits
+
+Huge thanks to @andrejsshell, @tinsever, @randoneering, and @mazzz1y for helping!
+
+### Features
+
 - **web:** guide cloud users through invites and plan choice during onboarding: #1840
 - rank new issue priority with Jev: [594e016](https://github.com/usekaneo/kaneo/commit/594e0168dbf586b09d1b0a946e5da9148485b76c)
 

apps/api/src/column/controllers/create-column.ts

@@ -1,3 +1,4 @@
+import { publishEvent } from "../../events";
 import { eq, sql } from "drizzle-orm";
 import { HTTPException } from "hono/http-exception";
 import db from "../../database";
@@ -81,6 +82,8 @@ async function createColumn({
     throw new HTTPException(500, { message: "Failed to create column" });
   }
 
+  await publishEvent("project.updated", { projectId: created.projectId });
+
   return created;
 }
 

apps/api/src/column/controllers/delete-column.ts

@@ -1,3 +1,4 @@
+import { publishEvent } from "../../events";
 import { eq, sql } from "drizzle-orm";
 import { HTTPException } from "hono/http-exception";
 import db from "../../database";
@@ -26,6 +27,8 @@ async function deleteColumn(id: string) {
 
   await db.delete(columnTable).where(eq(columnTable.id, id));
 
+  await publishEvent("project.updated", { projectId: existing.projectId });
+
   return existing;
 }
 

apps/api/src/column/controllers/reorder-columns.ts

@@ -1,3 +1,4 @@
+import { publishEvent } from "../../events";
 import { and, eq } from "drizzle-orm";
 import { HTTPException } from "hono/http-exception";
 import db from "../../database";
@@ -7,27 +8,33 @@ async function reorderColumns(
   projectId: string,
   columns: Array<{ id: string; position: number }>,
 ) {
-  for (const col of columns) {
-    const [updated] = await db
-      .update(columnTable)
-      .set({ position: col.position })
-      .where(
-        and(eq(columnTable.id, col.id), eq(columnTable.projectId, projectId)),
-      )
-      .returning({ id: columnTable.id });
+  const updated = await db.transaction(async (tx) => {
+    for (const col of [...columns].sort((left, right) =>
+      left.id.localeCompare(right.id),
+    )) {
+      const [updated] = await tx
+        .update(columnTable)
+        .set({ position: col.position })
+        .where(
+          and(eq(columnTable.id, col.id), eq(columnTable.projectId, projectId)),
+        )
+        .returning({ id: columnTable.id });
 
-    if (!updated) {
-      throw new HTTPException(400, {
-        message: `Column ${col.id} does not belong to this project`,
-      });
+      if (!updated) {
+        throw new HTTPException(400, {
+          message: `Column ${col.id} does not belong to this project`,
+        });
+      }
     }
-  }
 
-  const updated = await db.query.columnTable.findMany({
-    where: eq(columnTable.projectId, projectId),
-    orderBy: (columns, { asc }) => [asc(columns.position)],
+    return tx.query.columnTable.findMany({
+      where: eq(columnTable.projectId, projectId),
+      orderBy: (columns, { asc }) => [asc(columns.position)],
+    });
   });
 
+  await publishEvent("project.updated", { projectId });
+
   return updated;
 }
 

apps/api/src/column/controllers/update-column.ts

@@ -50,6 +50,8 @@ async function updateColumn(
     });
   }
 
+  await publishEvent("project.updated", { projectId: updated.projectId });
+
   return updated;
 }