@co0ontty/wand 4.55.3-beta.g2c47e41 → 4.56.0-beta.ga71d7db

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
-  "commit": "2c47e41268f4636a7b0e0360effe84bf6d795631",
-  "builtAt": "2026-09-08T06:00:48.199Z",
-  "version": "4.55.3-beta.g2c47e41",
+  "commit": "a71d7db07de28e316d86d8a42c23c7a59a8dbace",
+  "builtAt": "2026-09-10T01:18:24.234Z",
+  "version": "4.56.0-beta.ga71d7db",
   "channel": "beta"
 }

package/dist/github-connector.d.ts

@@ -0,0 +1,22 @@
+import type { WandStorage } from "./storage.js";
+export declare const GITHUB_PROVIDER = "github";
+export declare const GITHUB_API_URL = "https://api.github.com";
+export interface GithubConnectorStatus {
+    provider: "github";
+    connected: boolean;
+    apiUrl: string | null;
+    username: string | null;
+    connectedAt: string | null;
+    updatedAt: string | null;
+    scopes: string[];
+}
+export interface GithubApiResponse<T> {
+    data: T;
+    headers: Headers;
+}
+export declare function getGithubApiUrl(storage: WandStorage): string;
+export declare function getGithubConnectorStatus(storage: WandStorage): GithubConnectorStatus;
+export declare function githubRequest<T = unknown>(storage: WandStorage, pathname: string, init?: RequestInit): Promise<GithubApiResponse<T>>;
+export declare function connectGithub(storage: WandStorage, token: string, apiUrl?: string): Promise<GithubConnectorStatus>;
+export declare function githubStatusWithScopes(storage: WandStorage, scopes?: string[]): GithubConnectorStatus;
+export declare function jsonBody(value: unknown): string;

package/dist/github-connector.js

@@ -0,0 +1,117 @@
+export const GITHUB_PROVIDER = "github";
+export const GITHUB_API_URL = "https://api.github.com";
+function normalizeApiUrl(value) {
+    const raw = typeof value === "string" && value.trim() ? value.trim() : GITHUB_API_URL;
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new Error("GitHub API 地址无效。");
+    }
+    const local = parsed.hostname === "localhost"
+        || parsed.hostname === "127.0.0.1"
+        || parsed.hostname === "[::1]";
+    if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && local)) {
+        throw new Error("GitHub API 地址必须使用 HTTPS（本地测试可使用 HTTP）。");
+    }
+    return parsed.toString().replace(/\/$/, "");
+}
+export function getGithubApiUrl(storage) {
+    return normalizeApiUrl(storage.getConnectorMeta(GITHUB_PROVIDER)?.apiUrl || GITHUB_API_URL);
+}
+export function getGithubConnectorStatus(storage) {
+    const meta = storage.getConnectorMeta(GITHUB_PROVIDER);
+    const token = storage.getConnectorToken(GITHUB_PROVIDER);
+    return {
+        provider: "github",
+        connected: Boolean(token && meta?.connectedAt),
+        apiUrl: meta?.apiUrl || null,
+        username: meta?.username || null,
+        connectedAt: meta?.connectedAt || null,
+        updatedAt: meta?.updatedAt || null,
+        scopes: [],
+    };
+}
+function connectorToken(storage) {
+    const token = storage.getConnectorToken(GITHUB_PROVIDER)?.trim();
+    if (!token)
+        throw new Error("GitHub 尚未连接，请先在设置中保存 Token。");
+    return token;
+}
+function apiPath(pathname) {
+    if (!pathname.startsWith("/") || pathname.includes("\\") || pathname.includes("..")) {
+        throw new Error("GitHub API 路径无效。");
+    }
+    return pathname;
+}
+export async function githubRequest(storage, pathname, init = {}) {
+    const headers = new Headers(init.headers);
+    headers.set("Accept", "application/vnd.github+json");
+    headers.set("X-GitHub-Api-Version", "2022-11-28");
+    headers.set("User-Agent", "wand-github-connector");
+    headers.set("Authorization", `Bearer ${connectorToken(storage)}`);
+    if (init.body !== undefined && !headers.has("Content-Type"))
+        headers.set("Content-Type", "application/json");
+    const response = await fetch(`${getGithubApiUrl(storage)}${apiPath(pathname)}`, { ...init, headers });
+    const raw = await response.text();
+    let data = null;
+    try {
+        data = raw ? JSON.parse(raw) : null;
+    }
+    catch {
+        data = raw.slice(0, 2000);
+    }
+    if (!response.ok) {
+        const message = data && typeof data === "object" && "message" in data && typeof data.message === "string"
+            ? data.message
+            : `GitHub API 请求失败（${response.status}）。`;
+        const error = new Error(message);
+        error.status = response.status;
+        throw error;
+    }
+    return { data: data, headers: response.headers };
+}
+export async function connectGithub(storage, token, apiUrl) {
+    const normalizedToken = token.trim();
+    if (!normalizedToken)
+        throw new Error("GitHub Token 不能为空。");
+    const targetApiUrl = normalizeApiUrl(apiUrl);
+    const previous = storage.getConnectorMeta(GITHUB_PROVIDER);
+    const previousToken = storage.getConnectorToken(GITHUB_PROVIDER);
+    storage.saveConnector(GITHUB_PROVIDER, { token: normalizedToken, apiUrl: targetApiUrl, markConnected: false });
+    try {
+        const profile = await githubRequest(storage, "/user");
+        const username = typeof profile.data.login === "string" ? profile.data.login : "";
+        if (!username)
+            throw new Error("GitHub 返回的账号信息无效。");
+        const scopes = (profile.headers.get("x-oauth-scopes") || "")
+            .split(",").map((scope) => scope.trim()).filter(Boolean);
+        const meta = storage.saveConnector(GITHUB_PROVIDER, {
+            apiUrl: targetApiUrl,
+            username,
+            markConnected: true,
+        });
+        return { ...getGithubConnectorStatus(storage), ...meta, provider: "github", connected: true, scopes };
+    }
+    catch (error) {
+        if (previous?.connectedAt && previousToken) {
+            storage.saveConnector(GITHUB_PROVIDER, {
+                token: previousToken,
+                apiUrl: previous.apiUrl,
+                username: previous.username,
+                markConnected: true,
+            });
+        }
+        else {
+            storage.deleteConnector(GITHUB_PROVIDER);
+        }
+        throw error;
+    }
+}
+export function githubStatusWithScopes(storage, scopes = []) {
+    return { ...getGithubConnectorStatus(storage), scopes };
+}
+export function jsonBody(value) {
+    return JSON.stringify(value);
+}

package/dist/missions.js

@@ -21,11 +21,30 @@ function firstPromptLine(prompt) {
     const line = prompt.split("\n").map((part) => part.trim()).find(Boolean) || "新任务";
     return line.length > 72 ? `${line.slice(0, 69)}…` : line;
 }
+const ACTIVITY_NOISE = /(?:⏵⏵|⎿|bypasspermissions|shift\+tab|esc to interrupt|tip:|worked for|total messages:|ran playwright code)/i;
+function cleanActivityText(value, maxLength) {
+    const normalized = value.replace(/[\u0000-\u001f\u007f]/g, " ").replace(/\s+/g, " ").trim();
+    if (!normalized || ACTIVITY_NOISE.test(normalized))
+        return null;
+    return normalized.length > maxLength ? `${normalized.slice(0, maxLength - 1).trimEnd()}…` : normalized;
+}
+function cleanActivityTitle(value) {
+    const normalized = value.replace(/[\u0000-\u001f\u007f]/g, " ").replace(/\s+/g, " ").trim();
+    const match = normalized.match(/^(.*?)\s+(执行中|已完成|失败|等待答复|等待授权)\s*[·:]?\s*(.*)$/);
+    if (!match)
+        return { title: cleanActivityText(normalized, 72) || "Agent 会话", summary: null };
+    return {
+        title: cleanActivityText(match[1], 72) || "Agent 会话",
+        summary: cleanActivityText(match[3], 160),
+    };
+}
 function sessionSummary(snapshot) {
-    if (snapshot.description?.trim())
-        return snapshot.description.trim();
-    if (snapshot.currentTaskTitle?.trim())
-        return snapshot.currentTaskTitle.trim();
+    const direct = cleanActivityText(snapshot.description?.trim() || "", 160);
+    if (direct)
+        return direct;
+    const taskTitle = cleanActivityText(snapshot.currentTaskTitle?.trim() || "", 160);
+    if (taskTitle)
+        return taskTitle;
     const messages = snapshot.messages ?? [];
     for (let turnIndex = messages.length - 1; turnIndex >= 0; turnIndex--) {
         const text = messages[turnIndex].content
@@ -33,10 +52,11 @@ function sessionSummary(snapshot) {
             .map((block) => block.text.trim())
             .filter(Boolean)
             .join(" ");
-        if (text)
-            return text.length > 240 ? `${text.slice(0, 237)}…` : text;
+        const cleaned = cleanActivityText(text, 160);
+        if (cleaned)
+            return cleaned;
     }
-    return snapshot.summary?.trim() || null;
+    return cleanActivityText(snapshot.summary?.trim() || "", 160);
 }
 function hasUnansweredQuestion(messages) {
     if (!messages?.length || messages[messages.length - 1]?.role === "user")
@@ -166,12 +186,15 @@ export class Missions {
             error: state === "failed" ? snapshot.structuredState?.lastError ?? "任务执行失败" : null,
             updatedAt,
         });
+        const mission = this.storage.getMission(attempt.missionId);
         this.storage.upsertAgentActivity({
             sessionId: event.sessionId,
             missionId: attempt.missionId,
             attemptId: attempt.id,
             state,
-            title: snapshot.title?.trim() || snapshot.summary?.trim() || firstPromptLine(this.storage.getMission(attempt.missionId)?.prompt ?? ""),
+            // The session title can contain provider TUI status chrome. Inbox items
+            // belong to the mission, so keep their title stable and human-readable.
+            title: mission?.title || firstPromptLine(mission?.prompt ?? ""),
             summary: sessionSummary(snapshot),
             provider: snapshot.provider ?? attempt.provider,
             cwd: snapshot.cwd,
@@ -181,7 +204,17 @@ export class Missions {
         this.refreshMissionStatus(attempt.missionId);
     }
     inbox() {
-        return this.storage.listAgentActivity();
+        return this.storage.listAgentActivity().map((item) => {
+            const mission = item.missionId ? this.storage.getMission(item.missionId) : null;
+            const legacyTitle = cleanActivityTitle(item.title);
+            return {
+                ...item,
+                // Older rows may have been populated from a provider TUI title. Prefer
+                // the mission title at read time so existing inbox data is repaired too.
+                title: mission?.title || legacyTitle.title,
+                summary: cleanActivityText(item.summary ?? "", 160) || legacyTitle.summary,
+            };
+        });
     }
     markInboxRead(sessionId) {
         this.storage.markAgentActivityRead(sessionId);

package/dist/server-github-routes.d.ts

@@ -0,0 +1,10 @@
+import type { Express, RequestHandler } from "express";
+import type { WandStorage } from "./storage.js";
+import type { SessionRegistry } from "./session-registry.js";
+interface GithubRouteDependencies {
+    storage: WandStorage;
+    requireAdmin: RequestHandler;
+    sessions?: SessionRegistry;
+}
+export declare function registerGithubRoutes(app: Express, deps: GithubRouteDependencies): void;
+export {};

package/dist/server-github-routes.js

@@ -0,0 +1,239 @@
+import { asyncRoute } from "./express-async.js";
+import { connectGithub, githubRequest, githubStatusWithScopes, jsonBody, } from "./github-connector.js";
+import { getErrorMessage } from "./error-utils.js";
+function stringQuery(value, fallback = "") {
+    return typeof value === "string" ? value.trim() : fallback;
+}
+function integerQuery(value, fallback, min, max) {
+    const parsed = Number(stringQuery(value));
+    return Number.isInteger(parsed) && parsed >= min && parsed <= max ? parsed : fallback;
+}
+function repoPath(req) {
+    const owner = req.params.owner?.trim();
+    const repo = req.params.repo?.trim();
+    if (!owner || !repo || !/^[A-Za-z0-9_.-]+$/.test(owner) || !/^[A-Za-z0-9_.-]+$/.test(repo)) {
+        throw new Error("仓库名称无效。");
+    }
+    return `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`;
+}
+function issueNumber(req) {
+    const number = Number(req.params.number);
+    if (!Number.isInteger(number) || number < 1)
+        throw new Error("Issue 或 PR 编号无效。");
+    return number;
+}
+function validateObjectBody(body) {
+    if (!body || typeof body !== "object" || Array.isArray(body))
+        throw new Error("请求体必须是对象。");
+    return body;
+}
+function requiredString(body, key) {
+    const value = typeof body[key] === "string" ? body[key].trim() : "";
+    if (!value)
+        throw new Error(`${key} 不能为空。`);
+    return value;
+}
+function publicError(error) {
+    const status = error instanceof Error && "status" in error && typeof error.status === "number"
+        ? error.status
+        : 400;
+    return { status: status >= 400 && status < 600 ? status : 500, message: getErrorMessage(error, "GitHub 操作失败。") };
+}
+export function registerGithubRoutes(app, deps) {
+    const { storage, requireAdmin, sessions } = deps;
+    app.get("/api/connectors/github", requireAdmin, (_req, res) => {
+        res.set("Cache-Control", "no-store");
+        res.json(githubStatusWithScopes(storage));
+    });
+    app.post("/api/connectors/github", requireAdmin, asyncRoute(async (req, res) => {
+        try {
+            const body = validateObjectBody(req.body);
+            const token = requiredString(body, "token");
+            const apiUrl = typeof body.apiUrl === "string" ? body.apiUrl : undefined;
+            res.set("Cache-Control", "no-store");
+            res.json(await connectGithub(storage, token, apiUrl));
+        }
+        catch (error) {
+            const result = publicError(error);
+            res.status(result.status === 401 || result.status === 403 ? 400 : result.status).json({ error: result.message });
+        }
+    }));
+    app.delete("/api/connectors/github", requireAdmin, (_req, res) => {
+        storage.deleteConnector("github");
+        res.json({ ok: true, connected: false });
+    });
+    app.get("/api/github/repos/:owner/:repo/issues/:number/bindings", requireAdmin, (req, res) => {
+        try {
+            const number = issueNumber(req);
+            const bindings = storage.listGithubIssueBindings(req.params.owner, req.params.repo, number);
+            res.json({ bindings });
+        }
+        catch (error) {
+            const result = publicError(error);
+            res.status(result.status).json({ error: result.message });
+        }
+    });
+    app.post("/api/github/repos/:owner/:repo/issues/:number/bindings", requireAdmin, (req, res) => {
+        try {
+            const number = issueNumber(req);
+            const body = validateObjectBody(req.body);
+            const sessionId = requiredString(body, "sessionId");
+            if (sessions && !sessions.get(sessionId))
+                throw new Error("未找到该会话。");
+            storage.bindGithubIssueSession(req.params.owner, req.params.repo, number, sessionId);
+            res.status(201).json({ ok: true, sessionId });
+        }
+        catch (error) {
+            const result = publicError(error);
+            res.status(result.status).json({ error: result.message });
+        }
+    });
+    app.delete("/api/github/repos/:owner/:repo/issues/:number/bindings/:sessionId", requireAdmin, (req, res) => {
+        try {
+            storage.unbindGithubIssueSession(req.params.owner, req.params.repo, issueNumber(req), req.params.sessionId);
+            res.json({ ok: true });
+        }
+        catch (error) {
+            const result = publicError(error);
+            res.status(result.status).json({ error: result.message });
+        }
+    });
+    app.get("/api/github/user", requireAdmin, asyncRoute(async (_req, res) => {
+        try {
+            res.json((await githubRequest(storage, "/user")).data);
+        }
+        catch (error) {
+            const result = publicError(error);
+            res.status(result.status).json({ error: result.message });
+        }
+    }));
+    app.get("/api/github/repos", requireAdmin, asyncRoute(async (req, res) => {
+        try {
+            const query = new URLSearchParams();
+            const visibility = stringQuery(req.query.visibility);
+            const affiliation = stringQuery(req.query.affiliation);
+            const type = stringQuery(req.query.type);
+            if (visibility)
+                query.set("visibility", visibility);
+            if (affiliation)
+                query.set("affiliation", affiliation);
+            if (type)
+                query.set("type", type);
+            query.set("sort", stringQuery(req.query.sort, "updated"));
+            query.set("direction", stringQuery(req.query.direction, "desc"));
+            query.set("per_page", String(integerQuery(req.query.per_page, 30, 1, 100)));
+            query.set("page", String(integerQuery(req.query.page, 1, 1, 10_000)));
+            const suffix = query.toString();
+            res.json((await githubRequest(storage, `/user/repos?${suffix}`)).data);
+        }
+        catch (error) {
+            const result = publicError(error);
+            res.status(result.status).json({ error: result.message });
+        }
+    }));
+    app.get("/api/github/repos/:owner/:repo", requireAdmin, asyncRoute(async (req, res) => {
+        try {
+            res.json((await githubRequest(storage, repoPath(req))).data);
+        }
+        catch (error) {
+            const result = publicError(error);
+            res.status(result.status).json({ error: result.message });
+        }
+    }));
+    app.get("/api/github/repos/:owner/:repo/issues", requireAdmin, asyncRoute(async (req, res) => {
+        try {
+            const query = new URLSearchParams();
+            query.set("state", stringQuery(req.query.state, "open"));
+            if (stringQuery(req.query.labels))
+                query.set("labels", stringQuery(req.query.labels));
+            if (stringQuery(req.query.sort))
+                query.set("sort", stringQuery(req.query.sort));
+            if (stringQuery(req.query.direction))
+                query.set("direction", stringQuery(req.query.direction));
+            query.set("per_page", String(integerQuery(req.query.per_page, 30, 1, 100)));
+            query.set("page", String(integerQuery(req.query.page, 1, 1, 10_000)));
+            res.json((await githubRequest(storage, `${repoPath(req)}/issues?${query}`)).data);
+        }
+        catch (error) {
+            const result = publicError(error);
+            res.status(result.status).json({ error: result.message });
+        }
+    }));
+    app.post("/api/github/repos/:owner/:repo/issues", requireAdmin, asyncRoute(async (req, res) => {
+        try {
+            const body = validateObjectBody(req.body);
+            const payload = { title: requiredString(body, "title") };
+            for (const key of ["body", "labels", "assignees", "milestone"]) {
+                if (body[key] !== undefined)
+                    payload[key] = body[key];
+            }
+            res.status(201).json((await githubRequest(storage, `${repoPath(req)}/issues`, { method: "POST", body: jsonBody(payload) })).data);
+        }
+        catch (error) {
+            const result = publicError(error);
+            res.status(result.status).json({ error: result.message });
+        }
+    }));
+    app.patch("/api/github/repos/:owner/:repo/issues/:number", requireAdmin, asyncRoute(async (req, res) => {
+        try {
+            const body = validateObjectBody(req.body);
+            const payload = {};
+            for (const key of ["title", "body", "state", "state_reason", "labels", "assignees", "milestone"]) {
+                if (body[key] !== undefined)
+                    payload[key] = body[key];
+            }
+            if (!Object.keys(payload).length)
+                throw new Error("没有可更新的 Issue 字段。");
+            res.json((await githubRequest(storage, `${repoPath(req)}/issues/${issueNumber(req)}`, { method: "PATCH", body: jsonBody(payload) })).data);
+        }
+        catch (error) {
+            const result = publicError(error);
+            res.status(result.status).json({ error: result.message });
+        }
+    }));
+    app.post("/api/github/repos/:owner/:repo/issues/:number/comments", requireAdmin, asyncRoute(async (req, res) => {
+        try {
+            const body = validateObjectBody(req.body);
+            const payload = { body: requiredString(body, "body") };
+            res.status(201).json((await githubRequest(storage, `${repoPath(req)}/issues/${issueNumber(req)}/comments`, { method: "POST", body: jsonBody(payload) })).data);
+        }
+        catch (error) {
+            const result = publicError(error);
+            res.status(result.status).json({ error: result.message });
+        }
+    }));
+    app.get("/api/github/repos/:owner/:repo/pulls", requireAdmin, asyncRoute(async (req, res) => {
+        try {
+            const query = new URLSearchParams();
+            query.set("state", stringQuery(req.query.state, "open"));
+            query.set("sort", stringQuery(req.query.sort, "created"));
+            query.set("direction", stringQuery(req.query.direction, "desc"));
+            query.set("per_page", String(integerQuery(req.query.per_page, 30, 1, 100)));
+            query.set("page", String(integerQuery(req.query.page, 1, 1, 10_000)));
+            res.json((await githubRequest(storage, `${repoPath(req)}/pulls?${query}`)).data);
+        }
+        catch (error) {
+            const result = publicError(error);
+            res.status(result.status).json({ error: result.message });
+        }
+    }));
+    app.post("/api/github/repos/:owner/:repo/pulls", requireAdmin, asyncRoute(async (req, res) => {
+        try {
+            const body = validateObjectBody(req.body);
+            const payload = {
+                title: requiredString(body, "title"),
+                head: requiredString(body, "head"),
+                base: requiredString(body, "base"),
+            };
+            for (const key of ["body", "draft", "maintainer_can_modify"]) {
+                if (body[key] !== undefined)
+                    payload[key] = body[key];
+            }
+            res.status(201).json((await githubRequest(storage, `${repoPath(req)}/pulls`, { method: "POST", body: jsonBody(payload) })).data);
+        }
+        catch (error) {
+            const result = publicError(error);
+            res.status(result.status).json({ error: result.message });
+        }
+    }));
+}

package/dist/server-settings-routes.d.ts

@@ -3,6 +3,7 @@ import type { ModelCatalogService } from "./models.js";
 import { type RuntimeConfigState } from "./runtime-config.js";
 import type { WandStorage } from "./storage.js";
 import type { WandConfig } from "./types.js";
+import type { GithubConnectorStatus } from "./github-connector.js";
 interface SettingsDistributionPayload {
     androidApk: Record<string, unknown>;
     macosDmg: Record<string, unknown>;
@@ -34,6 +35,7 @@ export interface ServerSettingsRoutesDependencies {
     } | null;
     getUpdateChannel(): "stable" | "beta";
     getDistributionSettings(): Promise<SettingsDistributionPayload>;
+    getGithubConnector(): GithubConnectorStatus;
     modelCatalog: ModelCatalogService;
     resolveAppConnectCode(req: Request): {
         code: string;

package/dist/server-settings-routes.js

@@ -91,6 +91,7 @@ export function registerSettingsRoutes(app, deps) {
             activeConfig: publicConfig(config),
             restartRequired: runtimeConfig.hasPendingRestart(),
             hasCert: existsSync(path.join(configDir, "server.key")) && existsSync(path.join(configDir, "server.crt")),
+            githubConnector: deps.getGithubConnector(),
             updateAvailable: cachedUpdate?.updateAvailable ?? false,
             latestVersion: cachedUpdate?.latest ?? null,
             updateChannel: deps.getUpdateChannel(),

package/dist/server-task-routes.d.ts

@@ -0,0 +1,4 @@
+import type { Express, RequestHandler } from "express";
+import type { WandStorage } from "./storage.js";
+import type { SessionRegistry } from "./session-registry.js";
+export declare function registerTaskRoutes(app: Express, storage: WandStorage, sessions?: SessionRegistry, requireAdmin?: RequestHandler): void;

package/dist/server-task-routes.js

@@ -0,0 +1,99 @@
+import { asyncRoute } from "./express-async.js";
+import { getErrorMessage } from "./error-utils.js";
+const STATUSES = new Set(["todo", "doing", "done"]);
+const PRIORITIES = new Set(["none", "low", "medium", "high", "urgent"]);
+function dateValue(value) { if (value === undefined)
+    return undefined; if (value === null || value === "")
+    return null; if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(value.trim()))
+    throw new Error("截止日期必须使用 YYYY-MM-DD 格式。"); return value.trim(); }
+function bodyObject(value) { if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("请求体必须是对象。"); return value; }
+function text(value) { return typeof value === "string" ? value.trim() : ""; }
+function taskDto(storage, task) { if (!task)
+    return null; return { ...task, sessionIds: storage.listWandTaskSessionIds(task.id) }; }
+export function registerTaskRoutes(app, storage, sessions, requireAdmin) {
+    const guard = requireAdmin ?? ((_req, _res, next) => next());
+    app.get("/api/wand-tasks", guard, (req, res) => res.json(storage.listWandTasks(typeof req.query.workspaceId === "string" ? req.query.workspaceId : undefined).map((task) => taskDto(storage, task))));
+    app.post("/api/wand-tasks", guard, (req, res) => { try {
+        const body = bodyObject(req.body);
+        const title = text(body.title);
+        if (!title)
+            throw new Error("任务标题不能为空。");
+        const workspaceId = body.workspaceId === null ? null : text(body.workspaceId) || null;
+        if (workspaceId && !storage.getWorkspace(workspaceId))
+            throw new Error("项目不存在。");
+        const status = STATUSES.has(body.status) ? body.status : "todo";
+        const priority = PRIORITIES.has(body.priority) ? body.priority : "none";
+        const labels = Array.isArray(body.labels) ? body.labels.filter((item) => typeof item === "string").map((item) => item.trim()).filter(Boolean).slice(0, 20) : [];
+        const task = storage.createWandTask({ workspaceId, title, description: text(body.description), status, priority, labels, dueDate: dateValue(body.dueDate) ?? null });
+        res.status(201).json(taskDto(storage, task));
+    }
+    catch (error) {
+        res.status(400).json({ error: getErrorMessage(error, "无法创建任务。") });
+    } });
+    app.patch("/api/wand-tasks/:id", guard, (req, res) => { try {
+        const body = bodyObject(req.body);
+        const patch = {};
+        if (body.title !== undefined) {
+            const value = text(body.title);
+            if (!value)
+                throw new Error("任务标题不能为空。");
+            patch.title = value;
+        }
+        if (body.description !== undefined)
+            patch.description = text(body.description);
+        if (body.status !== undefined) {
+            if (!STATUSES.has(body.status))
+                throw new Error("任务状态无效。");
+            patch.status = body.status;
+        }
+        if (body.priority !== undefined) {
+            if (!PRIORITIES.has(body.priority))
+                throw new Error("任务优先级无效。");
+            patch.priority = body.priority;
+        }
+        if (body.labels !== undefined)
+            patch.labels = Array.isArray(body.labels) ? body.labels.filter((item) => typeof item === "string").map((item) => item.trim()).filter(Boolean).slice(0, 20) : [];
+        if (body.dueDate !== undefined)
+            patch.dueDate = dateValue(body.dueDate) ?? null;
+        if (body.workspaceId !== undefined) {
+            const workspaceId = body.workspaceId === null ? null : text(body.workspaceId);
+            if (workspaceId && !storage.getWorkspace(workspaceId))
+                throw new Error("项目不存在。");
+            patch.workspaceId = workspaceId || null;
+        }
+        if (body.sortOrder !== undefined && Number.isFinite(Number(body.sortOrder)))
+            patch.sortOrder = Math.floor(Number(body.sortOrder));
+        const task = storage.updateWandTask(req.params.id, patch);
+        if (!task) {
+            res.status(404).json({ error: "未找到该任务。" });
+            return;
+        }
+        res.json(taskDto(storage, task));
+    }
+    catch (error) {
+        res.status(400).json({ error: getErrorMessage(error, "无法更新任务。") });
+    } });
+    app.delete("/api/wand-tasks/:id", guard, (req, res) => { if (!storage.getWandTask(req.params.id)) {
+        res.status(404).json({ error: "未找到该任务。" });
+        return;
+    } storage.deleteWandTask(req.params.id); res.json({ ok: true }); });
+    app.post("/api/wand-tasks/:id/sessions", guard, (req, res) => { try {
+        const body = bodyObject(req.body);
+        const sessionId = text(body.sessionId);
+        if (!sessionId)
+            throw new Error("缺少 sessionId。");
+        if (sessions && !sessions.get(sessionId))
+            throw new Error("未找到该会话。");
+        storage.bindWandTaskSession(req.params.id, sessionId);
+        res.status(201).json(taskDto(storage, storage.getWandTask(req.params.id)));
+    }
+    catch (error) {
+        res.status(400).json({ error: getErrorMessage(error, "无法绑定会话。") });
+    } });
+    app.delete("/api/wand-tasks/:id/sessions/:sessionId", guard, (req, res) => { storage.unbindWandTaskSession(req.params.id, req.params.sessionId); res.json({ ok: true }); });
+    app.get("/api/wand-tasks/:id", guard, asyncRoute(async (req, res) => { const task = taskDto(storage, storage.getWandTask(req.params.id)); if (!task) {
+        res.status(404).json({ error: "未找到该任务。" });
+        return;
+    } res.json(task); }));
+}