@co0ontty/wand 4.57.0 → 4.58.0

package/dist/server.js

@@ -23,7 +23,6 @@ import { StructuredSessionManager } from "./structured-session-manager.js";
 import { recordRecentPath, registerFileRoutes } from "./server-file-routes.js";
 import { registerSettingsRoutes } from "./server-settings-routes.js";
 import { registerGithubRoutes } from "./server-github-routes.js";
-import { startTaskboardBridge } from "./taskboard-bridge.js";
 import { registerTaskRoutes } from "./server-task-routes.js";
 import { getGithubConnectorStatus } from "./github-connector.js";
 import { registerMissionRoutes } from "./server-mission-routes.js";
@@ -558,20 +557,6 @@ export async function startServer(config, configPath, options = {}) {
     const requireSessions = buildRequireScope("sessions");
     const requireFiles = buildRequireScope("files");
     const requirePasswordVault = buildRequireScope("password-vault");
-    const taskboardBridge = await startTaskboardBridge(configDir, storage, sessionRegistry, structuredSessions, config.defaultCwd);
-    app.use("/taskboard", (req, res, next) => {
-        // Taskboard's immutable Vite assets are safe to serve without the Wand
-        // session cookie. This matters behind HTTPS reverse proxies where iframe
-        // subresource requests may not carry the parent authentication cookie.
-        const staticAsset = req.path.startsWith("/assets/")
-            || /^\/[^/]+\.(?:css|js|map|svg|png|jpg|jpeg|webp|ico)$/.test(req.path);
-        if (staticAsset) {
-            taskboardBridge.handler(req, res, next);
-            return;
-        }
-        requireAuth(req, res, next);
-    });
-    app.use("/taskboard", taskboardBridge.handler);
     // Route-specific parsers must run before the global parser. Once body-parser
     // has consumed a request, a later express.json() cannot tighten or widen it.
     app.use("/api/optimize-prompt", express.json({ limit: "256kb" }));
@@ -984,7 +969,8 @@ export async function startServer(config, configPath, options = {}) {
         },
     });
     registerGithubRoutes(app, { storage, requireAdmin, sessions: sessionRegistry });
-    registerTaskRoutes(app, storage, sessionRegistry, requireAdmin);
+    // 任务管理与 Missions 一样只需登录：原生 connected-app 也要能列/建/派发。
+    registerTaskRoutes(app, { storage, sessions: sessionRegistry, structured: structuredSessions, config });
     registerAdminUpdateRoutes(app, {
         storage,
         config,
@@ -1586,10 +1572,6 @@ export async function startServer(config, configPath, options = {}) {
                 wss.close();
             }
             catch { /* ignore */ }
-            try {
-                await taskboardBridge.close();
-            }
-            catch { /* best-effort shutdown */ }
             try {
                 await serverClosed;
             }

package/dist/storage.d.ts

@@ -8,6 +8,11 @@ export interface ConnectorMeta {
     connectedAt: string | null;
     updatedAt: string;
 }
+/**
+ * `wand_tasks.agent_json` 的读侧校验。历史行 / 手工写坏的值都退化成 null，
+ * 前端据此显示「未指定 CLI 工具」，而不是渲染出半个派发配置。
+ */
+export declare function parseWandTaskAgent(raw: unknown): import("./task-types.js").WandTaskAgent | null;
 type AuthPrincipalKind = "browser-admin" | "connected-app";
 export type AuthScope = "admin" | "sessions" | "files" | "password-vault" | "session-preferences";
 export interface AuthPrincipal {
@@ -93,30 +98,41 @@ export declare class WandStorage {
         status?: WorkspaceTaskStatus;
         worktree?: WorkspaceTaskWorktree | null;
     }): void;
-    saveWorkspaceTaskLayout(id: string, layout: TaskWindowLayout | null): void;
+    saveWorkspaceTaskLayout(id: string, layout: TaskWindowLayout | null, expectedRevision?: number): {
+        ok: true;
+        layoutRevision: number;
+    } | {
+        ok: false;
+        conflict: true;
+        layoutRevision: number;
+        layout: TaskWindowLayout | null;
+    };
     touchWorkspaceTask(id: string): void;
     deleteWorkspaceTask(id: string, options?: {
         cascade?: boolean;
     }): void;
+    tasksAggregateFingerprint(): string;
     listWandTasks(workspaceId?: string | null): import("./task-types.js").WandTask[];
+    private mapWandTaskRow;
     getWandTask(id: string): import("./task-types.js").WandTask | null;
+    getWandTaskByWorkspaceTaskId(workspaceTaskId: string): import("./task-types.js").WandTask | null;
+    findUnlinkedWandTask(workspaceId: string, title: string): import("./task-types.js").WandTask | null;
     createWandTask(input: {
         workspaceId?: string | null;
+        workspaceTaskId?: string | null;
         title: string;
         description?: string;
         status?: import("./task-types.js").WandTaskStatus;
         priority?: import("./task-types.js").WandTaskPriority;
         labels?: string[];
         dueDate?: string | null;
+        agent?: import("./task-types.js").WandTaskAgent | null;
     }): import("./task-types.js").WandTask;
-    updateWandTask(id: string, patch: Partial<Pick<import("./task-types.js").WandTask, "workspaceId" | "title" | "description" | "status" | "priority" | "labels" | "dueDate" | "sortOrder">>): import("./task-types.js").WandTask | null;
+    updateWandTask(id: string, patch: Partial<Pick<import("./task-types.js").WandTask, "workspaceId" | "workspaceTaskId" | "title" | "description" | "status" | "priority" | "labels" | "dueDate" | "sortOrder" | "agent">>): import("./task-types.js").WandTask | null;
     deleteWandTask(id: string): void;
     listWandTaskSessionIds(taskId: string): string[];
     bindWandTaskSession(taskId: string, sessionId: string): void;
     unbindWandTaskSession(taskId: string, sessionId: string): void;
-    bindTaskboardTaskSession(taskId: string, sessionId: string): void;
-    listTaskboardTaskSessions(taskId: string): string[];
-    unbindTaskboardTaskSession(taskId: string, sessionId: string): void;
     listGithubIssueBindings(owner: string, repo: string, issueNumber: number): Array<{
         sessionId: string;
         boundAt: string;
@@ -135,7 +151,8 @@ export declare class WandStorage {
     getAppSecret(): string | null;
     /** Persist appSecret in database (DB is the authoritative source after first migration) */
     setAppSecret(value: string): void;
-    private encryptStoredPassword;
+    /** Encrypt an at-rest secret with the vault key; plaintext when no key exists. */
+    private encryptStoredSecret;
     private decryptPasswordItem;
     ensureDefaultPasswordVault(): void;
     listPasswordVaults(): PasswordVault[];

package/dist/storage.js

@@ -15,6 +15,25 @@ function safeJsonParse(raw) {
         return undefined;
     }
 }
+/**
+ * `wand_tasks.agent_json` 的读侧校验。历史行 / 手工写坏的值都退化成 null，
+ * 前端据此显示「未指定 CLI 工具」，而不是渲染出半个派发配置。
+ */
+export function parseWandTaskAgent(raw) {
+    const value = typeof raw === "string" ? safeJsonParse(raw) : undefined;
+    if (!value || typeof value !== "object")
+        return null;
+    const provider = value.provider;
+    const model = value.model;
+    const thinkingEffort = value.thinkingEffort;
+    if (provider !== "claude" && provider !== "codex" && provider !== "opencode" && provider !== "grok" && provider !== "qoder" && provider !== "pi")
+        return null;
+    if (typeof model !== "string" || !model.trim() || model.trim().length > 128)
+        return null;
+    if (thinkingEffort !== "off" && thinkingEffort !== "standard" && thinkingEffort !== "deep" && thinkingEffort !== "max")
+        return null;
+    return { provider, model: model.trim(), thinkingEffort };
+}
 const SESSION_OPTIONS_SCHEMA_VERSION = 1;
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -315,6 +334,7 @@ function mapWorkspaceTaskRow(row) {
         status: (row.status === "done" ? "done" : "active"),
         createdAt: row.created_at,
         lastOpenedAt: row.last_opened_at,
+        layoutRevision: Number(row.layout_revision ?? 0) || 0,
     };
 }
 function sessionPersistFields() {
@@ -381,8 +401,8 @@ function sessionPersistValues(snapshot) {
         snapshot.output,
         snapshot.ptyOutputSeq ?? 0,
         snapshot.archived ? 1 : 0,
-        snapshot.archivedAt,
-        snapshot.claudeSessionId,
+        snapshot.archivedAt ?? null,
+        snapshot.claudeSessionId ?? null,
         snapshot.provider ?? null,
         snapshot.sessionKind ?? "pty",
         snapshot.runner ?? null,
@@ -415,8 +435,8 @@ function sessionRuntimeMetadataValues(snapshot) {
         snapshot.startedAt,
         snapshot.endedAt,
         snapshot.archived ? 1 : 0,
-        snapshot.archivedAt,
-        snapshot.claudeSessionId,
+        snapshot.archivedAt ?? null,
+        snapshot.claudeSessionId ?? null,
         snapshot.provider ?? null,
         snapshot.sessionKind ?? "pty",
         snapshot.runner ?? null,
@@ -668,6 +688,7 @@ const INIT_SQL = `
     cwd TEXT,
     created_at TEXT NOT NULL,
     last_opened_at TEXT,
+    layout_revision INTEGER NOT NULL DEFAULT 0,
     FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE
   );
 
@@ -696,6 +717,8 @@ const INIT_SQL = `
     labels_json TEXT NOT NULL DEFAULT '[]',
     due_date TEXT,
     sort_order INTEGER NOT NULL DEFAULT 0,
+    agent_json TEXT,
+    workspace_task_id TEXT,
     created_at TEXT NOT NULL,
     updated_at TEXT NOT NULL,
     FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE SET NULL
@@ -710,14 +733,6 @@ const INIT_SQL = `
     FOREIGN KEY (session_id) REFERENCES command_sessions(id) ON DELETE CASCADE
   );
   CREATE INDEX IF NOT EXISTS idx_wand_task_sessions_session ON wand_task_sessions(session_id);
-  CREATE TABLE IF NOT EXISTS taskboard_session_bindings (
-    task_id TEXT NOT NULL,
-    session_id TEXT NOT NULL,
-    bound_at TEXT NOT NULL,
-    PRIMARY KEY (task_id, session_id),
-    FOREIGN KEY (session_id) REFERENCES command_sessions(id) ON DELETE CASCADE
-  );
-  CREATE INDEX IF NOT EXISTS idx_taskboard_session_bindings_session ON taskboard_session_bindings(session_id);
 `;
 function ensureWandTaskSchema(db) {
     const columns = db.prepare("PRAGMA table_info(wand_tasks)").all();
@@ -726,7 +741,16 @@ function ensureWandTaskSchema(db) {
         db.exec("ALTER TABLE wand_tasks ADD COLUMN identifier TEXT");
     if (columns.length > 0 && !names.has("due_date"))
         db.exec("ALTER TABLE wand_tasks ADD COLUMN due_date TEXT");
+    // 任务的默认派发配置（CLI 工具 / 模型 / 思考深度）。只加列，历史行保持 NULL。
+    if (columns.length > 0 && !names.has("agent_json"))
+        db.exec("ALTER TABLE wand_tasks ADD COLUMN agent_json TEXT");
+    if (columns.length > 0 && !names.has("workspace_task_id"))
+        db.exec("ALTER TABLE wand_tasks ADD COLUMN workspace_task_id TEXT");
     if (columns.length > 0) {
+        // Index creation must wait until the column exists on legacy databases.
+        // INIT_SQL cannot create it: CREATE TABLE IF NOT EXISTS is a no-op on old
+        // wand_tasks, and CREATE INDEX would then fail with "no such column".
+        db.exec("CREATE INDEX IF NOT EXISTS idx_wand_tasks_workspace_task ON wand_tasks(workspace_task_id)");
         const rows = db.prepare("SELECT id FROM wand_tasks WHERE identifier IS NULL OR identifier = '' ORDER BY created_at, id").all();
         const update = db.prepare("UPDATE wand_tasks SET identifier = ? WHERE id = ?");
         rows.forEach((row, index) => update.run(`TASK-${index + 1}`, row.id));
@@ -743,6 +767,9 @@ function ensureWorkspaceSchema(db) {
     if (taskColumns.length > 0 && !taskNames.has("cwd")) {
         db.exec("ALTER TABLE workspace_tasks ADD COLUMN cwd TEXT");
     }
+    if (taskColumns.length > 0 && !taskNames.has("layout_revision")) {
+        db.exec("ALTER TABLE workspace_tasks ADD COLUMN layout_revision INTEGER NOT NULL DEFAULT 0");
+    }
 }
 function ensureConnectorSchema(db) {
     // The table is created by INIT_SQL for new databases; this repairs an
@@ -771,6 +798,7 @@ export function ensureDatabaseFile(dbPath) {
     ensureAuthSessionSchema(db);
     ensureCommandSessionSchema(db);
     ensureWorkspaceSchema(db);
+    ensureWandTaskSchema(db);
     ensureConnectorSchema(db);
     {
         const missionColumns = db.prepare("PRAGMA table_info(missions)").all();
@@ -902,7 +930,7 @@ export class WandStorage {
     // ============ Workspaces（多标签 / 分屏项目）============
     listWorkspaces() {
         const rows = this.db
-            .prepare("SELECT id, name, cwd, kind, default_provider, layout_json, created_at, last_opened_at FROM workspaces ORDER BY created_at ASC, id ASC")
+            .prepare("SELECT id, name, cwd, kind, default_provider, layout_json, created_at, last_opened_at FROM workspaces ORDER BY created_at DESC, id DESC")
             .all();
         return rows.map(mapWorkspaceRow);
     }
@@ -1026,15 +1054,15 @@ export class WandStorage {
     // ── Workspace tasks（任务 = 命名 + 独立 worktree + 一组标签）──
     listWorkspaceTasks(workspaceId) {
         const rows = this.db
-            .prepare(`SELECT id, workspace_id, name, worktree_json, layout_json, status, cwd, created_at, last_opened_at
+            .prepare(`SELECT id, workspace_id, name, worktree_json, layout_json, status, cwd, created_at, last_opened_at, layout_revision
          FROM workspace_tasks WHERE workspace_id = ?
-         ORDER BY COALESCE(last_opened_at, created_at) DESC`)
+         ORDER BY created_at DESC, id DESC`)
             .all(workspaceId);
         return rows.map(mapWorkspaceTaskRow);
     }
     getWorkspaceTask(id) {
         const row = this.db
-            .prepare(`SELECT id, workspace_id, name, worktree_json, layout_json, status, cwd, created_at, last_opened_at
+            .prepare(`SELECT id, workspace_id, name, worktree_json, layout_json, status, cwd, created_at, last_opened_at, layout_revision
          FROM workspace_tasks WHERE id = ?`)
             .get(id);
         return row ? mapWorkspaceTaskRow(row) : null;
@@ -1079,10 +1107,19 @@ export class WandStorage {
             return;
         this.db.prepare(`UPDATE workspace_tasks SET ${assignments.join(", ")} WHERE id = ?`).run(...values, id);
     }
-    saveWorkspaceTaskLayout(id, layout) {
+    saveWorkspaceTaskLayout(id, layout, expectedRevision) {
+        const current = this.getWorkspaceTask(id);
+        if (!current)
+            throw new Error("未找到该任务。");
+        const currentRevision = current.layoutRevision ?? 0;
+        if (expectedRevision !== undefined && expectedRevision !== currentRevision) {
+            return { ok: false, conflict: true, layoutRevision: currentRevision, layout: current.layout };
+        }
+        const nextRevision = currentRevision + 1;
         this.db
-            .prepare("UPDATE workspace_tasks SET layout_json = ? WHERE id = ?")
-            .run(layout ? JSON.stringify(layout) : null, id);
+            .prepare("UPDATE workspace_tasks SET layout_json = ?, layout_revision = ? WHERE id = ?")
+            .run(layout ? JSON.stringify(layout) : null, nextRevision, id);
+        return { ok: true, layoutRevision: nextRevision };
     }
     touchWorkspaceTask(id) {
         this.db.prepare("UPDATE workspace_tasks SET last_opened_at = ? WHERE id = ?").run(nowIso(), id);
@@ -1096,14 +1133,36 @@ export class WandStorage {
         }
         this.db.prepare("DELETE FROM workspace_tasks WHERE id = ?").run(id);
     }
+    tasksAggregateFingerprint() {
+        const sessions = this.db.prepare(`SELECT COUNT(*) AS count,
+              COALESCE(MAX(started_at), '') AS started,
+              COALESCE(MAX(ended_at), '') AS ended,
+              COALESCE(MAX(title), '') AS title
+       FROM command_sessions`).get();
+        const tasks = this.db.prepare(`SELECT COUNT(*) AS count,
+              COALESCE(MAX(created_at), '') AS created,
+              COALESCE(MAX(last_opened_at), '') AS opened,
+              COALESCE(MAX(layout_revision), 0) AS revision
+       FROM workspace_tasks`).get();
+        const workspaces = this.db.prepare(`SELECT COUNT(*) AS count, COALESCE(MAX(last_opened_at), '') AS opened FROM workspaces`).get();
+        return JSON.stringify({
+            sessions,
+            tasks,
+            workspaces,
+        });
+    }
     listWandTasks(workspaceId) {
-        const rows = this.db.prepare(`SELECT id, identifier, workspace_id, title, description, status, priority, labels_json, due_date, sort_order, created_at, updated_at
+        const rows = this.db.prepare(`SELECT id, identifier, workspace_id, workspace_task_id, title, description, status, priority, labels_json, due_date, sort_order, agent_json, created_at, updated_at
        FROM wand_tasks ${workspaceId === undefined ? "" : "WHERE workspace_id IS ?"}
        ORDER BY status, sort_order, updated_at DESC`).all(...(workspaceId === undefined ? [] : [workspaceId]));
-        return rows.map((row) => ({
+        return rows.map((row) => this.mapWandTaskRow(row));
+    }
+    mapWandTaskRow(row) {
+        return {
             id: String(row.id),
             identifier: typeof row.identifier === "string" && row.identifier ? row.identifier : `TASK-${String(row.id).slice(0, 6)}`,
             workspaceId: typeof row.workspace_id === "string" ? row.workspace_id : null,
+            workspaceTaskId: typeof row.workspace_task_id === "string" && row.workspace_task_id ? row.workspace_task_id : null,
             title: String(row.title),
             description: String(row.description ?? ""),
             status: row.status === "doing" || row.status === "done" ? row.status : "todo",
@@ -1111,13 +1170,26 @@ export class WandStorage {
             labels: (() => { const parsed = safeJsonParse(String(row.labels_json ?? "[]")); return Array.isArray(parsed) ? parsed.filter((item) => typeof item === "string") : []; })(),
             dueDate: typeof row.due_date === "string" ? row.due_date : null,
             sortOrder: Number(row.sort_order) || 0,
+            agent: parseWandTaskAgent(row.agent_json),
             createdAt: String(row.created_at),
             updatedAt: String(row.updated_at),
-        }));
+        };
     }
     getWandTask(id) {
         return this.listWandTasks().find((task) => task.id === id) ?? null;
     }
+    getWandTaskByWorkspaceTaskId(workspaceTaskId) {
+        const row = this.db.prepare(`SELECT id, identifier, workspace_id, workspace_task_id, title, description, status, priority, labels_json, due_date, sort_order, agent_json, created_at, updated_at
+       FROM wand_tasks WHERE workspace_task_id = ? ORDER BY updated_at DESC LIMIT 1`).get(workspaceTaskId);
+        return row ? this.mapWandTaskRow(row) : null;
+    }
+    findUnlinkedWandTask(workspaceId, title) {
+        const row = this.db.prepare(`SELECT id, identifier, workspace_id, workspace_task_id, title, description, status, priority, labels_json, due_date, sort_order, agent_json, created_at, updated_at
+       FROM wand_tasks
+       WHERE workspace_id IS ? AND title = ? AND (workspace_task_id IS NULL OR workspace_task_id = '')
+       ORDER BY updated_at DESC LIMIT 1`).get(workspaceId, title);
+        return row ? this.mapWandTaskRow(row) : null;
+    }
     createWandTask(input) {
         const id = crypto.randomUUID();
         const now = nowIso();
@@ -1126,7 +1198,7 @@ export class WandStorage {
         const max = this.db.prepare("SELECT COALESCE(MAX(sort_order), -1) AS value FROM wand_tasks WHERE workspace_id IS ? AND status = ?").get(input.workspaceId ?? null, status);
         const numberRow = this.db.prepare("SELECT COALESCE(MAX(CAST(substr(identifier, 6) AS INTEGER)), 0) AS value FROM wand_tasks WHERE identifier GLOB 'TASK-[0-9]*'").get();
         const identifier = `TASK-${(numberRow?.value ?? 0) + 1}`;
-        this.db.prepare(`INSERT INTO wand_tasks (id, identifier, workspace_id, title, description, status, priority, labels_json, due_date, sort_order, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(id, identifier, input.workspaceId ?? null, input.title, input.description ?? "", status, priority, JSON.stringify(input.labels ?? []), input.dueDate ?? null, (max?.value ?? -1) + 1, now, now);
+        this.db.prepare(`INSERT INTO wand_tasks (id, identifier, workspace_id, workspace_task_id, title, description, status, priority, labels_json, due_date, sort_order, agent_json, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(id, identifier, input.workspaceId ?? null, input.workspaceTaskId ?? null, input.title, input.description ?? "", status, priority, JSON.stringify(input.labels ?? []), input.dueDate ?? null, (max?.value ?? -1) + 1, input.agent ? JSON.stringify(input.agent) : null, now, now);
         return this.getWandTask(id);
     }
     updateWandTask(id, patch) {
@@ -1134,12 +1206,12 @@ export class WandStorage {
         if (!current)
             return null;
         const next = { ...current, ...patch, updatedAt: nowIso() };
-        this.db.prepare(`UPDATE wand_tasks SET workspace_id = ?, title = ?, description = ?, status = ?, priority = ?, labels_json = ?, due_date = ?, sort_order = ?, updated_at = ? WHERE id = ?`).run(next.workspaceId, next.title, next.description, next.status, next.priority, JSON.stringify(next.labels), next.dueDate, next.sortOrder, next.updatedAt, id);
+        this.db.prepare(`UPDATE wand_tasks SET workspace_id = ?, workspace_task_id = ?, title = ?, description = ?, status = ?, priority = ?, labels_json = ?, due_date = ?, sort_order = ?, agent_json = ?, updated_at = ? WHERE id = ?`).run(next.workspaceId, next.workspaceTaskId, next.title, next.description, next.status, next.priority, JSON.stringify(next.labels), next.dueDate, next.sortOrder, next.agent ? JSON.stringify(next.agent) : null, next.updatedAt, id);
         return next;
     }
     deleteWandTask(id) { this.db.prepare("DELETE FROM wand_tasks WHERE id = ?").run(id); }
     listWandTaskSessionIds(taskId) {
-        const rows = this.db.prepare("SELECT session_id FROM wand_task_sessions WHERE task_id = ? ORDER BY bound_at ASC").all(taskId);
+        const rows = this.db.prepare("SELECT session_id FROM wand_task_sessions WHERE task_id = ? ORDER BY rowid ASC, session_id ASC").all(taskId);
         return rows.map((row) => row.session_id);
     }
     bindWandTaskSession(taskId, sessionId) {
@@ -1150,18 +1222,6 @@ export class WandStorage {
         this.db.prepare("INSERT OR IGNORE INTO wand_task_sessions (task_id, session_id, bound_at) VALUES (?, ?, ?)").run(taskId, sessionId, nowIso());
     }
     unbindWandTaskSession(taskId, sessionId) { this.db.prepare("DELETE FROM wand_task_sessions WHERE task_id = ? AND session_id = ?").run(taskId, sessionId); }
-    bindTaskboardTaskSession(taskId, sessionId) {
-        if (!this.getSession(sessionId))
-            throw new Error("未找到该会话。");
-        this.db.prepare("INSERT OR IGNORE INTO taskboard_session_bindings (task_id, session_id, bound_at) VALUES (?, ?, ?)").run(taskId, sessionId, nowIso());
-    }
-    listTaskboardTaskSessions(taskId) {
-        const rows = this.db.prepare("SELECT session_id FROM taskboard_session_bindings WHERE task_id = ? ORDER BY rowid ASC").all(taskId);
-        return rows.map((row) => row.session_id);
-    }
-    unbindTaskboardTaskSession(taskId, sessionId) {
-        this.db.prepare("DELETE FROM taskboard_session_bindings WHERE task_id = ? AND session_id = ?").run(taskId, sessionId);
-    }
     listGithubIssueBindings(owner, repo, issueNumber) {
         const rows = this.db.prepare(`SELECT session_id, bound_at FROM github_issue_bindings
        WHERE owner = ? AND repo = ? AND issue_number = ? ORDER BY bound_at ASC`).all(owner, repo, issueNumber);
@@ -1208,14 +1268,23 @@ export class WandStorage {
     setAppSecret(value) {
         this.setConfigValue("appSecret", value);
     }
-    encryptStoredPassword(password) {
-        if (!password)
+    /** Encrypt an at-rest secret with the vault key; plaintext when no key exists. */
+    encryptStoredSecret(value) {
+        if (!value)
             return null;
         const secret = this.getAppSecret();
-        return secret ? encryptVaultSecret(password, secret) : password;
+        return secret ? encryptVaultSecret(value, secret) : value;
     }
-    decryptPasswordItem(item) {
-        return { ...item, password: decryptVaultSecret(item.password, this.getAppSecret()) };
+    decryptPasswordItem(item, raw) {
+        const secret = this.getAppSecret();
+        const notes = decryptVaultSecret(raw.notes ?? undefined, secret);
+        const fieldsJson = decryptVaultSecret(raw.fields, secret) ?? raw.fields;
+        return {
+            ...item,
+            password: decryptVaultSecret(raw.password ?? undefined, secret),
+            notes,
+            fields: decodePasswordFields(fieldsJson),
+        };
     }
     // ============ Browser Extension Password Vault Methods ============
     ensureDefaultPasswordVault() {
@@ -1260,7 +1329,7 @@ export class WandStorage {
         const limit = typeof filter.limit === "number" && Number.isFinite(filter.limit)
             ? Math.max(1, Math.min(200, Math.floor(filter.limit)))
             : 100;
-        return rows.map((row) => this.decryptPasswordItem(mapPasswordItemRow(row)))
+        return rows.map((row) => this.decryptPasswordItem(mapPasswordItemRow(row), row))
             .filter((item) => itemMatchesFilter(item, filter)).slice(0, limit);
     }
     getPasswordItem(id) {
@@ -1270,7 +1339,7 @@ export class WandStorage {
          FROM password_items
          WHERE id = ? AND archived = 0`)
             .get(id);
-        return row ? this.decryptPasswordItem(mapPasswordItemRow(row)) : null;
+        return row ? this.decryptPasswordItem(mapPasswordItemRow(row), row) : null;
     }
     createPasswordItem(input) {
         this.ensureDefaultPasswordVault();
@@ -1286,7 +1355,7 @@ export class WandStorage {
            id, vault_id, type, title, username, password, urls, notes, fields, tags, favorite, archived,
            created_at, updated_at, last_used_at, password_updated_at
          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?, ?, NULL, ?)`)
-            .run(id, vaultId, normalized.type, normalized.title, normalized.username ?? null, this.encryptStoredPassword(normalized.password), JSON.stringify(normalized.urls), normalized.notes ?? null, JSON.stringify(normalized.fields), JSON.stringify(normalized.tags), normalized.favorite ? 1 : 0, now, now, passwordUpdatedAt ?? null);
+            .run(id, vaultId, normalized.type, normalized.title, normalized.username ?? null, this.encryptStoredSecret(normalized.password), JSON.stringify(normalized.urls), this.encryptStoredSecret(normalized.notes), this.encryptStoredSecret(JSON.stringify(normalized.fields)) ?? "{}", JSON.stringify(normalized.tags), normalized.favorite ? 1 : 0, now, now, passwordUpdatedAt ?? null);
         return this.getPasswordItem(id);
     }
     updatePasswordItem(id, input) {
@@ -1317,7 +1386,7 @@ export class WandStorage {
          SET vault_id = ?, type = ?, title = ?, username = ?, password = ?, urls = ?, notes = ?,
              fields = ?, tags = ?, favorite = ?, updated_at = ?, password_updated_at = ?
          WHERE id = ? AND archived = 0`)
-            .run(vaultId, normalized.type, normalized.title, normalized.username ?? null, this.encryptStoredPassword(normalized.password), JSON.stringify(normalized.urls), normalized.notes ?? null, JSON.stringify(normalized.fields), JSON.stringify(normalized.tags), normalized.favorite ? 1 : 0, now, passwordUpdatedAt, id);
+            .run(vaultId, normalized.type, normalized.title, normalized.username ?? null, this.encryptStoredSecret(normalized.password), JSON.stringify(normalized.urls), this.encryptStoredSecret(normalized.notes), this.encryptStoredSecret(JSON.stringify(normalized.fields)) ?? "{}", JSON.stringify(normalized.tags), normalized.favorite ? 1 : 0, now, passwordUpdatedAt, id);
         return this.getPasswordItem(id);
     }
     touchPasswordItem(id) {
@@ -1382,10 +1451,7 @@ export class WandStorage {
         return this.db.prepare("DELETE FROM connectors WHERE provider = ?").run(provider).changes > 0;
     }
     encryptConnectorToken(token) {
-        if (!token)
-            return "";
-        const secret = this.getAppSecret();
-        return secret ? encryptVaultSecret(token, secret) : token;
+        return this.encryptStoredSecret(token) ?? "";
     }
     // ============ Auth Session Methods ============
     saveAuthSession(token, expiresAt, principal = { kind: "browser-admin", scopes: ["admin"] }) {
@@ -1670,6 +1736,20 @@ function mapPasswordVaultRow(row) {
         updatedAt: row.updated_at,
     };
 }
+/** Parse the (possibly encrypted) `fields` JSON column into a string map. */
+function decodePasswordFields(json) {
+    if (!json)
+        return {};
+    try {
+        const parsed = JSON.parse(json);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return {};
+        return Object.fromEntries(Object.entries(parsed).filter((entry) => typeof entry[1] === "string"));
+    }
+    catch {
+        return {};
+    }
+}
 function mapPasswordItemRow(row) {
     return {
         id: row.id,
@@ -1677,10 +1757,7 @@ function mapPasswordItemRow(row) {
         type: row.type,
         title: row.title,
         username: row.username ?? undefined,
-        password: row.password ?? undefined,
         urls: safeJsonParse(row.urls)?.filter((item) => typeof item === "string") ?? [],
-        notes: row.notes ?? undefined,
-        fields: safeJsonParse(row.fields) ?? {},
         tags: safeJsonParse(row.tags)?.filter((item) => typeof item === "string") ?? [],
         favorite: Boolean(row.favorite),
         createdAt: row.created_at,

package/dist/structured-exec-host.d.ts

@@ -60,6 +60,17 @@ export interface StructuredExecHost {
     listRuns(): Promise<StructuredRunState[]>;
     forgetRun(runId: string): void;
 }
+/**
+ * Stateful UTF-8 decoder for structured CLI stdout/stderr.
+ * Incomplete sequences are held across chunks. end() discards a trailing
+ * incomplete sequence instead of emitting U+FFFD replacement characters.
+ * Call this at the byte-stream seam, before line splitting or log append.
+ */
+export interface Utf8TextDecoder {
+    write(chunk: Buffer | string): string;
+    end(): string;
+}
+export declare function createUtf8TextDecoder(): Utf8TextDecoder;
 /** Resolve a stable daemon-side key for a session's active structured run. */
 export declare function structuredRunId(sessionId: string): string;
 /** Legacy/local adapter and deterministic test adapter for the structured seam. */
@@ -67,8 +78,8 @@ export declare class InProcessStructuredExecHost implements StructuredExecHost {
     readonly persistent = false;
     private readonly processes;
     spawnStructured(request: StructuredSpawnRequest): Promise<StructuredExecProcess>;
-    attachRun(): Promise<StructuredRunState | null>;
-    adoptRun(): Promise<StructuredExecProcess | null>;
+    attachRun(_runId: string): Promise<StructuredRunState | null>;
+    adoptRun(_runId: string): Promise<StructuredExecProcess | null>;
     listRuns(): Promise<StructuredRunState[]>;
     forgetRun(runId: string): void;
 }