Feature/enhancements

[m-hesse]

v2.0.0 — Backend Refactor, Multi-Project Support & Agent Hardening

A note upfront

I owe you an apology — this PR is far bigger than it should be. What started as "make the base URL configurable for Docker" turned into a full backend refactor when I realized the 2600-line app.py monolith wasn't going to cut it anymore. One thing led to another: multi-project support, filter bar, agent hardening... and I didn't split it into separate branches. Lesson learned.

That said: everything works, it's internally consistent, and the docs are fully updated. I've tried to make the scope as transparent as possible below.

---

What's in here

Backend Refactor — Monolithic app.py -> modular app/ package (15 modules). Write-safe DB layer (WAL + write lock), request logging middleware, IP restriction middleware. Dockerfile updated to uvicorn app.main:app.

Multi-Project Support — Projects CRUD, project switcher in header with colored badges, project manager modal. Tasks have a project_id FK (default project for backwards compat).

Filtering & UI — Combined filter bar (priority + agent + keyword search), new "Todo" column (6 columns total), Markdown export for tasks, responsive design (tablet + mobile breakpoints).

Auto-Save & UX Polish — Task fields (status, priority, agent, project, due date, description) auto-save on change. Inline action item creation with type picker. Larger task modal (720x700px), improved form layout, better save feedback animation, green resolved checkmarks. Project switcher moved to filter bar.

Agent Management — Three-tier agent detection (ENV -> OpenClaw API -> fallback). AUTO_STOP_ON_DONE config to permanently delete sessions on Done (default: false) — alternative: OpenClaw's archiveAfterMinutes. Session liveness checks, toggle start/stop button, double-spawn guard, follow-up & @mention spawning. Session deletion now via WS-RPC (removed legacy filesystem manipulation and deleted_sessions table).

Validation & Security — Pydantic field validators (HTTP 422 on invalid status/priority), configurable CORS via TASKBOARD_BASE_URL, IP restriction, agent guardrails.

Breaking Changes

• app.py no longer exists — entry point is now app.main:app
• New "Todo" column appears automatically (existing tasks unaffected)
• deleted_sessions table is dropped (sessions now deleted cleanly via WS-RPC)

New Environment Variables

AGENT_AUTO_DETECT, AGENTS, AUTO_STOP_ON_DONE, TASKBOARD_BASE_URL, ALLOWED_IPS, PROJECT_NAME, COMPANY_NAME, COMPANY_CONTEXT, ALLOWED_PATHS, COMPLIANCE_FRAMEWORKS

See CHANGELOG.md for the full diff-level breakdown.

Test Plan

• docker-compose up -d — board loads, 6 columns visible
• Create/switch/delete projects
• Filter bar: priority, agent, keyword (combined)
• Agent auto-detect on startup (check logs)
• Task -> "In Progress" -> session spawns
• Task -> "Done" -> session stops (if AUTO_STOP_ON_DONE=true)
• Auto-save: change status/priority/agent -> board updates without manual save
• Inline action item creation via "+ Add" button
• Markdown export from task modal
• @Mention in comment -> agent spawns
• Responsive: tablet and mobile